zenstack 1.0.0 → 1.0.1

package/plugins/access-policy/expression-writer.js

@@ -0,0 +1,580 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExpressionWriter = exports.FALSE = exports.TRUE = void 0;
+const ast_1 = require("@zenstackhq/language/ast");
+const sdk_1 = require("@zenstackhq/sdk");
+const lower_case_first_1 = require("lower-case-first");
+const _1 = require(".");
+const ast_utils_1 = require("../../utils/ast-utils");
+const typescript_expression_transformer_1 = require("../../utils/typescript-expression-transformer");
+// { OR: [] } filters to nothing, { AND: [] } includes everything
+// https://www.prisma.io/docs/concepts/components/prisma-client/null-and-undefined#the-effect-of-null-and-undefined-on-conditionals
+exports.TRUE = '{ AND: [] }';
+exports.FALSE = '{ OR: [] }';
+/**
+ * Utility for writing ZModel expression as Prisma query argument objects into a ts-morph writer
+ */
+class ExpressionWriter {
+    /**
+     * Constructs a new ExpressionWriter
+     *
+     * @param isPostGuard indicates if we're writing for post-update conditions
+     */
+    constructor(writer, isPostGuard = false) {
+        this.writer = writer;
+        this.isPostGuard = isPostGuard;
+        this.plainExprBuilder = new typescript_expression_transformer_1.TypeScriptExpressionTransformer({
+            context: sdk_1.ExpressionContext.AccessPolicy,
+            isPostGuard: this.isPostGuard,
+        });
+    }
+    /**
+     * Writes the given ZModel expression.
+     */
+    write(expr) {
+        switch (expr.$type) {
+            case ast_1.StringLiteral:
+            case ast_1.NumberLiteral:
+            case ast_1.BooleanLiteral:
+                this.writeLiteral(expr);
+                break;
+            case ast_1.UnaryExpr:
+                this.writeUnary(expr);
+                break;
+            case ast_1.BinaryExpr:
+                this.writeBinary(expr);
+                break;
+            case ast_1.ReferenceExpr:
+                this.writeReference(expr);
+                break;
+            case ast_1.MemberAccessExpr:
+                this.writeMemberAccess(expr);
+                break;
+            case ast_1.InvocationExpr:
+                this.writeInvocation(expr);
+                break;
+            default:
+                throw new Error(`Not implemented: ${expr.$type}`);
+        }
+    }
+    writeReference(expr) {
+        if ((0, ast_1.isEnumField)(expr.target.ref)) {
+            throw new Error('We should never get here');
+        }
+        else {
+            this.block(() => {
+                var _a;
+                this.writer.write(`${(_a = expr.target.ref) === null || _a === void 0 ? void 0 : _a.name}: true`);
+            });
+        }
+    }
+    writeMemberAccess(expr) {
+        if (this.isAuthOrAuthMemberAccess(expr)) {
+            // member access of `auth()`, generate plain expression
+            this.guard(() => this.plain(expr), true);
+        }
+        else {
+            this.block(() => {
+                // must be a boolean member
+                this.writeFieldCondition(expr.operand, () => {
+                    this.block(() => {
+                        var _a;
+                        this.writer.write(`${(_a = expr.member.ref) === null || _a === void 0 ? void 0 : _a.name}: true`);
+                    });
+                });
+            });
+        }
+    }
+    writeExprList(exprs) {
+        this.writer.write('[');
+        for (let i = 0; i < exprs.length; i++) {
+            this.write(exprs[i]);
+            if (i !== exprs.length - 1) {
+                this.writer.write(',');
+            }
+        }
+        this.writer.write(']');
+    }
+    writeBinary(expr) {
+        switch (expr.operator) {
+            case '&&':
+            case '||':
+                this.writeLogical(expr, expr.operator);
+                break;
+            case '==':
+            case '!=':
+            case '>':
+            case '>=':
+            case '<':
+            case '<=':
+                this.writeComparison(expr, expr.operator);
+                break;
+            case 'in':
+                this.writeIn(expr);
+                break;
+            case '?':
+            case '!':
+            case '^':
+                this.writeCollectionPredicate(expr, expr.operator);
+                break;
+        }
+    }
+    writeIn(expr) {
+        const leftIsFieldAccess = this.isFieldAccess(expr.left);
+        const rightIsFieldAccess = this.isFieldAccess(expr.right);
+        if (!leftIsFieldAccess && !rightIsFieldAccess) {
+            // 'in' without referencing fields
+            this.guard(() => this.plain(expr));
+        }
+        else {
+            this.block(() => {
+                var _a, _b;
+                if (leftIsFieldAccess && !rightIsFieldAccess) {
+                    // 'in' with left referencing a field, right is an array literal
+                    this.writeFieldCondition(expr.left, () => {
+                        this.plain(expr.right);
+                    }, 'in');
+                }
+                else if (!leftIsFieldAccess && rightIsFieldAccess) {
+                    // 'in' with right referencing an array field, left is a literal
+                    // transform it into a 'has' filter
+                    this.writeFieldCondition(expr.right, () => {
+                        this.plain(expr.left);
+                    }, 'has');
+                }
+                else if ((0, sdk_1.isDataModelFieldReference)(expr.left) &&
+                    (0, sdk_1.isDataModelFieldReference)(expr.right) &&
+                    ((_a = expr.left.target.ref) === null || _a === void 0 ? void 0 : _a.$container) === ((_b = expr.right.target.ref) === null || _b === void 0 ? void 0 : _b.$container)) {
+                    // comparing two fields of the same model
+                    this.writeFieldCondition(expr.left, () => {
+                        this.writeFieldReference(expr.right);
+                    }, 'in');
+                }
+                else {
+                    throw new sdk_1.PluginError(_1.name, '"in" operator cannot be used with field references on both sides');
+                }
+            });
+        }
+    }
+    writeCollectionPredicate(expr, operator) {
+        this.block(() => {
+            this.writeFieldCondition(expr.left, () => {
+                this.write(expr.right);
+            }, operator === '?' ? 'some' : operator === '!' ? 'every' : 'none');
+        });
+    }
+    isFieldAccess(expr) {
+        if ((0, ast_1.isThisExpr)(expr)) {
+            return true;
+        }
+        if ((0, ast_1.isMemberAccessExpr)(expr)) {
+            if ((0, sdk_1.isFutureExpr)(expr.operand) && this.isPostGuard) {
+                // when writing for post-update, future().field.x is a field access
+                return true;
+            }
+            else {
+                return this.isFieldAccess(expr.operand);
+            }
+        }
+        if ((0, sdk_1.isDataModelFieldReference)(expr) && !this.isPostGuard) {
+            return true;
+        }
+        return false;
+    }
+    guard(condition, cast = false) {
+        if (cast) {
+            this.writer.write('!!');
+            condition();
+        }
+        else {
+            condition();
+        }
+        this.writer.write(` ? ${exports.TRUE} : ${exports.FALSE}`);
+    }
+    plain(expr) {
+        try {
+            this.writer.write(this.plainExprBuilder.transform(expr));
+        }
+        catch (err) {
+            if (err instanceof typescript_expression_transformer_1.TypeScriptExpressionTransformerError) {
+                throw new sdk_1.PluginError(_1.name, err.message);
+            }
+            else {
+                throw err;
+            }
+        }
+    }
+    writeComparison(expr, operator) {
+        var _a;
+        const leftIsFieldAccess = this.isFieldAccess(expr.left);
+        const rightIsFieldAccess = this.isFieldAccess(expr.right);
+        if (!leftIsFieldAccess && !rightIsFieldAccess) {
+            // compile down to a plain expression
+            this.guard(() => {
+                this.plain(expr);
+            });
+            return;
+        }
+        let fieldAccess;
+        let operand;
+        if (leftIsFieldAccess) {
+            fieldAccess = expr.left;
+            operand = expr.right;
+        }
+        else {
+            fieldAccess = expr.right;
+            operand = expr.left;
+            operator = this.negateOperator(operator);
+        }
+        if ((0, ast_1.isMemberAccessExpr)(fieldAccess) && (0, sdk_1.isFutureExpr)(fieldAccess.operand)) {
+            // future().field should be treated as the "field" directly, so we
+            // strip 'future().' and synthesize a reference expr
+            fieldAccess = {
+                $type: ast_1.ReferenceExpr,
+                $container: fieldAccess.$container,
+                target: fieldAccess.member,
+                $resolvedType: fieldAccess.$resolvedType,
+                $future: true,
+            };
+        }
+        // guard member access of `auth()` with null check
+        if (this.isAuthOrAuthMemberAccess(operand) && !((_a = fieldAccess.$resolvedType) === null || _a === void 0 ? void 0 : _a.nullable)) {
+            try {
+                this.writer.write(`(${this.plainExprBuilder.transform(operand)} == null) ? ${
+                // auth().x != user.x is true when auth().x is null and user is not nullable
+                // other expressions are evaluated to false when null is involved
+                operator === '!=' ? exports.TRUE : exports.FALSE} : `);
+            }
+            catch (err) {
+                if (err instanceof typescript_expression_transformer_1.TypeScriptExpressionTransformerError) {
+                    throw new sdk_1.PluginError(_1.name, err.message);
+                }
+                else {
+                    throw err;
+                }
+            }
+        }
+        this.block(() => {
+            this.writeFieldCondition(fieldAccess, () => {
+                this.block(() => {
+                    var _a;
+                    const dataModel = this.isModelTyped(fieldAccess);
+                    if (dataModel && (0, ast_utils_1.isAuthInvocation)(operand)) {
+                        // right now this branch only serves comparison with `auth`, like
+                        //     @@allow('all', owner == auth())
+                        const idFields = this.requireIdFields(dataModel);
+                        if (operator !== '==' && operator !== '!=') {
+                            throw new sdk_1.PluginError(_1.name, 'Only == and != operators are allowed');
+                        }
+                        if (!(0, ast_1.isThisExpr)(fieldAccess)) {
+                            this.writer.writeLine(operator === '==' ? 'is:' : 'isNot:');
+                            const fieldIsNullable = !!((_a = fieldAccess.$resolvedType) === null || _a === void 0 ? void 0 : _a.nullable);
+                            if (fieldIsNullable) {
+                                // if field is nullable, we can generate "null" check condition
+                                this.writer.write(`(user == null) ? null : `);
+                            }
+                        }
+                        this.block(() => {
+                            idFields.forEach((idField, idx) => {
+                                const writeIdsCheck = () => {
+                                    // id: user.id
+                                    this.writer.write(`${idField.name}:`);
+                                    this.plain(operand);
+                                    this.writer.write(`.${idField.name}`);
+                                    if (idx !== idFields.length - 1) {
+                                        this.writer.write(',');
+                                    }
+                                };
+                                if ((0, ast_1.isThisExpr)(fieldAccess) && operator === '!=') {
+                                    // wrap a not
+                                    this.writer.writeLine('NOT:');
+                                    this.block(() => writeIdsCheck());
+                                }
+                                else {
+                                    writeIdsCheck();
+                                }
+                            });
+                        });
+                    }
+                    else {
+                        if (this.equivalentRefs(fieldAccess, operand)) {
+                            // f == f or f != f
+                            // this == this or this != this
+                            this.writer.write(operator === '!=' ? exports.TRUE : exports.FALSE);
+                        }
+                        else {
+                            this.writeOperator(operator, fieldAccess, () => {
+                                if ((0, sdk_1.isDataModelFieldReference)(operand) && !this.isPostGuard) {
+                                    // if operand is a field reference and we're not generating for post-update guard,
+                                    // we should generate a field reference (comparing fields in the same model)
+                                    this.writeFieldReference(operand);
+                                }
+                                else {
+                                    this.plain(operand);
+                                }
+                            });
+                        }
+                    }
+                }, !(0, ast_1.isThisExpr)(fieldAccess));
+            });
+        }, 
+        // "this" expression is compiled away (to .id access), so we should
+        // avoid generating a new layer
+        !(0, ast_1.isThisExpr)(fieldAccess));
+    }
+    requireIdFields(dataModel) {
+        const idFields = (0, ast_utils_1.getIdFields)(dataModel);
+        if (!idFields || idFields.length === 0) {
+            throw new sdk_1.PluginError(_1.name, `Data model ${dataModel.name} does not have an id field`);
+        }
+        return idFields;
+    }
+    equivalentRefs(expr1, expr2) {
+        if ((0, ast_1.isThisExpr)(expr1) && (0, ast_1.isThisExpr)(expr2)) {
+            return true;
+        }
+        if ((0, ast_1.isReferenceExpr)(expr1) &&
+            (0, ast_1.isReferenceExpr)(expr2) &&
+            expr1.target.ref === expr2.target.ref &&
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            expr1.$future === expr2.$future // either both future or both not
+        ) {
+            return true;
+        }
+        return false;
+    }
+    // https://www.prisma.io/docs/reference/api-reference/prisma-client-reference#compare-columns-in-the-same-table
+    writeFieldReference(expr) {
+        if (!expr.target.ref) {
+            throw new sdk_1.PluginError(_1.name, `Unresolved reference "${expr.target.$refText}"`);
+        }
+        const containingModel = expr.target.ref.$container;
+        this.writer.write(`db.${(0, lower_case_first_1.lowerCaseFirst)(containingModel.name)}.fields.${expr.target.ref.name}`);
+    }
+    isAuthOrAuthMemberAccess(expr) {
+        return (0, ast_utils_1.isAuthInvocation)(expr) || ((0, ast_1.isMemberAccessExpr)(expr) && (0, ast_utils_1.isAuthInvocation)(expr.operand));
+    }
+    writeOperator(operator, fieldAccess, writeOperand) {
+        var _a;
+        if ((0, ast_1.isDataModel)((_a = fieldAccess.$resolvedType) === null || _a === void 0 ? void 0 : _a.decl)) {
+            if (operator === '==') {
+                this.writer.write('is: ');
+            }
+            else if (operator === '!=') {
+                this.writer.write('isNot: ');
+            }
+            else {
+                throw new sdk_1.PluginError(_1.name, 'Only == and != operators are allowed for data model comparison');
+            }
+            writeOperand();
+        }
+        else {
+            if (operator === '!=') {
+                // wrap a 'not'
+                this.writer.write('not: ');
+                this.block(() => {
+                    this.writer.write(`${this.mapOperator('==')}: `);
+                    writeOperand();
+                });
+            }
+            else {
+                this.writer.write(`${this.mapOperator(operator)}: `);
+                writeOperand();
+            }
+        }
+    }
+    writeFieldCondition(fieldAccess, writeCondition, filterOp, extraArgs) {
+        var _a, _b, _c;
+        let selector;
+        let operand;
+        if ((0, ast_1.isThisExpr)(fieldAccess)) {
+            // pass on
+            writeCondition();
+            return;
+        }
+        else if ((0, ast_1.isReferenceExpr)(fieldAccess)) {
+            selector = (_a = fieldAccess.target.ref) === null || _a === void 0 ? void 0 : _a.name;
+        }
+        else if ((0, ast_1.isMemberAccessExpr)(fieldAccess)) {
+            if ((0, sdk_1.isFutureExpr)(fieldAccess.operand)) {
+                // future().field should be treated as the "field"
+                selector = (_b = fieldAccess.member.ref) === null || _b === void 0 ? void 0 : _b.name;
+            }
+            else {
+                selector = (_c = fieldAccess.member.ref) === null || _c === void 0 ? void 0 : _c.name;
+                operand = fieldAccess.operand;
+            }
+        }
+        else {
+            throw new sdk_1.PluginError(_1.name, `Unsupported expression type: ${fieldAccess.$type}`);
+        }
+        if (!selector) {
+            throw new sdk_1.PluginError(_1.name, `Failed to write FieldAccess expression`);
+        }
+        const writerFilterOutput = () => {
+            this.writer.write(selector + ': ');
+            if (filterOp) {
+                this.block(() => {
+                    this.writer.write(`${filterOp}: `);
+                    writeCondition();
+                    if (extraArgs) {
+                        for (const [k, v] of Object.entries(extraArgs)) {
+                            this.writer.write(`,\n${k}: `);
+                            this.plain(v);
+                        }
+                    }
+                });
+            }
+            else {
+                writeCondition();
+            }
+        };
+        if (operand) {
+            // member access expression
+            this.writeFieldCondition(operand, () => {
+                this.block(writerFilterOutput, 
+                // if operand is "this", it doesn't really generate a new layer of query,
+                // so we should avoid generating a new block
+                !(0, ast_1.isThisExpr)(operand));
+            });
+        }
+        else {
+            writerFilterOutput();
+        }
+    }
+    block(write, condition = true) {
+        if (condition) {
+            this.writer.inlineBlock(write);
+        }
+        else {
+            write();
+        }
+    }
+    isModelTyped(expr) {
+        var _a, _b;
+        return (0, ast_1.isDataModel)((_a = expr.$resolvedType) === null || _a === void 0 ? void 0 : _a.decl) ? (_b = expr.$resolvedType) === null || _b === void 0 ? void 0 : _b.decl : undefined;
+    }
+    mapOperator(operator) {
+        switch (operator) {
+            case '==':
+                return 'equals';
+            case '!=':
+                throw new Error('Operation != should have been compiled away');
+            case '>':
+                return 'gt';
+            case '>=':
+                return 'gte';
+            case '<':
+                return 'lt';
+            case '<=':
+                return 'lte';
+        }
+    }
+    negateOperator(operator) {
+        switch (operator) {
+            case '>':
+                return '<=';
+            case '<':
+                return '>=';
+            case '>=':
+                return '<';
+            case '<=':
+                return '>';
+            default:
+                return operator;
+        }
+    }
+    writeLogical(expr, operator) {
+        // TODO: do we need short-circuit for logical operators?
+        if (operator === '&&') {
+            // // && short-circuit: left && right -> left ? right : FALSE
+            // if (!this.hasFieldAccess(expr.left)) {
+            //     this.plain(expr.left);
+            //     this.writer.write(' ? ');
+            //     this.write(expr.right);
+            //     this.writer.write(' : ');
+            //     this.block(() => this.guard(() => this.writer.write('false')));
+            // } else {
+            this.block(() => {
+                this.writer.write('AND:');
+                this.writeExprList([expr.left, expr.right]);
+            });
+            // }
+        }
+        else {
+            // // || short-circuit: left || right -> left ? TRUE : right
+            // if (!this.hasFieldAccess(expr.left)) {
+            //     this.plain(expr.left);
+            //     this.writer.write(' ? ');
+            //     this.block(() => this.guard(() => this.writer.write('true')));
+            //     this.writer.write(' : ');
+            //     this.write(expr.right);
+            // } else {
+            this.block(() => {
+                this.writer.write('OR:');
+                this.writeExprList([expr.left, expr.right]);
+            });
+            // }
+        }
+    }
+    writeUnary(expr) {
+        if (expr.operator !== '!') {
+            throw new sdk_1.PluginError(_1.name, `Unary operator "${expr.operator}" is not supported`);
+        }
+        this.block(() => {
+            this.writer.write('NOT: ');
+            this.write(expr.operand);
+        });
+    }
+    writeLiteral(expr) {
+        if (expr.value === true) {
+            this.writer.write(exports.TRUE);
+        }
+        else if (expr.value === false) {
+            this.writer.write(exports.FALSE);
+        }
+        else {
+            this.guard(() => {
+                this.plain(expr);
+            });
+        }
+    }
+    writeInvocation(expr) {
+        var _a, _b;
+        const funcDecl = expr.function.ref;
+        if (!funcDecl) {
+            throw new sdk_1.PluginError(_1.name, `Failed to resolve function declaration`);
+        }
+        const functionAllowedContext = (0, sdk_1.getFunctionExpressionContext)(funcDecl);
+        if (functionAllowedContext.includes(sdk_1.ExpressionContext.AccessPolicy) ||
+            functionAllowedContext.includes(sdk_1.ExpressionContext.ValidationRule)) {
+            if (!expr.args.some((arg) => this.isFieldAccess(arg.value))) {
+                // filter functions without referencing fields
+                this.guard(() => this.plain(expr));
+                return;
+            }
+            let valueArg = (_a = expr.args[1]) === null || _a === void 0 ? void 0 : _a.value;
+            // isEmpty function is zero arity, it's mapped to a boolean literal
+            if (funcDecl.name === 'isEmpty') {
+                valueArg = { $type: ast_1.BooleanLiteral, value: true };
+            }
+            // contains function has a 3rd argument that indicates whether the comparison should be case-insensitive
+            let extraArgs = undefined;
+            if (funcDecl.name === 'contains') {
+                if ((0, sdk_1.getLiteral)((_b = expr.args[2]) === null || _b === void 0 ? void 0 : _b.value) === true) {
+                    extraArgs = { mode: { $type: ast_1.StringLiteral, value: 'insensitive' } };
+                }
+            }
+            this.block(() => {
+                this.writeFieldCondition(expr.args[0].value, () => {
+                    this.plain(valueArg);
+                }, funcDecl.name, extraArgs);
+            });
+        }
+        else {
+            throw new sdk_1.PluginError(_1.name, `Unsupported function ${funcDecl.name}`);
+        }
+    }
+}
+exports.ExpressionWriter = ExpressionWriter;
+//# sourceMappingURL=expression-writer.js.map

package/plugins/access-policy/expression-writer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"expression-writer.js","sourceRoot":"","sources":["../../../src/plugins/access-policy/expression-writer.ts"],"names":[],"mappings":";;;AAAA,kDAiBkC;AAClC,yCAOyB;AACzB,uDAAkD;AAElD,wBAAyB;AACzB,qDAAsE;AACtE,qGAGuD;AAmBvD,iEAAiE;AACjE,mIAAmI;AACtH,QAAA,IAAI,GAAG,aAAa,CAAC;AACrB,QAAA,KAAK,GAAG,YAAY,CAAC;AAElC;;GAEG;AACH,MAAa,gBAAgB;IAGzB;;;;OAIG;IACH,YAA6B,MAAuB,EAAmB,cAAc,KAAK;QAA7D,WAAM,GAAN,MAAM,CAAiB;QAAmB,gBAAW,GAAX,WAAW,CAAQ;QACtF,IAAI,CAAC,gBAAgB,GAAG,IAAI,mEAA+B,CAAC;YACxD,OAAO,EAAE,uBAAiB,CAAC,YAAY;YACvC,WAAW,EAAE,IAAI,CAAC,WAAW;SAChC,CAAC,CAAC;IACP,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAgB;QAClB,QAAQ,IAAI,CAAC,KAAK,EAAE;YAChB,KAAK,mBAAa,CAAC;YACnB,KAAK,mBAAa,CAAC;YACnB,KAAK,oBAAc;gBACf,IAAI,CAAC,YAAY,CAAC,IAAmB,CAAC,CAAC;gBACvC,MAAM;YAEV,KAAK,eAAS;gBACV,IAAI,CAAC,UAAU,CAAC,IAAiB,CAAC,CAAC;gBACnC,MAAM;YAEV,KAAK,gBAAU;gBACX,IAAI,CAAC,WAAW,CAAC,IAAkB,CAAC,CAAC;gBACrC,MAAM;YAEV,KAAK,mBAAa;gBACd,IAAI,CAAC,cAAc,CAAC,IAAqB,CAAC,CAAC;gBAC3C,MAAM;YAEV,KAAK,sBAAgB;gBACjB,IAAI,CAAC,iBAAiB,CAAC,IAAwB,CAAC,CAAC;gBACjD,MAAM;YAEV,KAAK,oBAAc;gBACf,IAAI,CAAC,eAAe,CAAC,IAAsB,CAAC,CAAC;gBAC7C,MAAM;YAEV;gBACI,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;SACzD;IACL,CAAC;IAEO,cAAc,CAAC,IAAmB;QACtC,IAAI,IAAA,iBAAW,EAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YAC9B,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;SAC/C;aAAM;YACH,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;;gBACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAA,IAAI,CAAC,MAAM,CAAC,GAAG,0CAAE,IAAI,QAAQ,CAAC,CAAC;YACxD,CAAC,CAAC,CAAC;SACN;IACL,CAAC;IAEO,iBAAiB,CAAC,IAAsB;QAC5C,IAAI,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE;YACrC,uDAAuD;YACvD,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;SAC5C;aAAM;YACH,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;gBACZ,2BAA2B;gBAC3B,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;oBACxC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;;wBACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAA,IAAI,CAAC,MAAM,CAAC,GAAG,0CAAE,IAAI,QAAQ,CAAC,CAAC;oBACxD,CAAC,CAAC,CAAC;gBACP,CAAC,CAAC,CAAC;YACP,CAAC,CAAC,CAAC;SACN;IACL,CAAC;IAEO,aAAa,CAAC,KAAmB;QACrC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;YACnC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;gBACxB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;aAC1B;SACJ;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAEO,WAAW,CAAC,IAAgB;QAChC,QAAQ,IAAI,CAAC,QAAQ,EAAE;YACnB,KAAK,IAAI,CAAC;YACV,KAAK,IAAI;gBACL,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACvC,MAAM;YAEV,KAAK,IAAI,CAAC;YACV,KAAK,IAAI,CAAC;YACV,KAAK,GAAG,CAAC;YACT,KAAK,IAAI,CAAC;YACV,KAAK,GAAG,CAAC;YACT,KAAK,IAAI;gBACL,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC1C,MAAM;YAEV,KAAK,IAAI;gBACL,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACnB,MAAM;YAEV,KAAK,GAAG,CAAC;YACT,KAAK,GAAG,CAAC;YACT,KAAK,GAAG;gBACJ,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACnD,MAAM;SACb;IACL,CAAC;IAEO,OAAO,CAAC,IAAgB;QAC5B,MAAM,iBAAiB,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,kBAAkB,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE1D,IAAI,CAAC,iBAAiB,IAAI,CAAC,kBAAkB,EAAE;YAC3C,kCAAkC;YAClC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;SACtC;aAAM;YACH,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;;gBACZ,IAAI,iBAAiB,IAAI,CAAC,kBAAkB,EAAE;oBAC1C,gEAAgE;oBAChE,IAAI,CAAC,mBAAmB,CACpB,IAAI,CAAC,IAAI,EACT,GAAG,EAAE;wBACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBAC3B,CAAC,EACD,IAAI,CACP,CAAC;iBACL;qBAAM,IAAI,CAAC,iBAAiB,IAAI,kBAAkB,EAAE;oBACjD,gEAAgE;oBAChE,mCAAmC;oBACnC,IAAI,CAAC,mBAAmB,CACpB,IAAI,CAAC,KAAK,EACV,GAAG,EAAE;wBACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC1B,CAAC,EACD,KAAK,CACR,CAAC;iBACL;qBAAM,IACH,IAAA,+BAAyB,EAAC,IAAI,CAAC,IAAI,CAAC;oBACpC,IAAA,+BAAyB,EAAC,IAAI,CAAC,KAAK,CAAC;oBACrC,CAAA,MAAA,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,0CAAE,UAAU,OAAK,MAAA,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,0CAAE,UAAU,CAAA,EACxE;oBACE,yCAAyC;oBACzC,IAAI,CAAC,mBAAmB,CACpB,IAAI,CAAC,IAAI,EACT,GAAG,EAAE;wBACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAsB,CAAC,CAAC;oBAC1D,CAAC,EACD,IAAI,CACP,CAAC;iBACL;qBAAM;oBACH,MAAM,IAAI,iBAAW,CAAC,OAAI,EAAE,kEAAkE,CAAC,CAAC;iBACnG;YACL,CAAC,CAAC,CAAC;SACN;IACL,CAAC;IAEO,wBAAwB,CAAC,IAAgB,EAAE,QAAgB;QAC/D,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,mBAAmB,CACpB,IAAI,CAAC,IAAI,EACT,GAAG,EAAE;gBACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC,EACD,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAClE,CAAC;QACN,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,aAAa,CAAC,IAAgB;QAClC,IAAI,IAAA,gBAAU,EAAC,IAAI,CAAC,EAAE;YAClB,OAAO,IAAI,CAAC;SACf;QAED,IAAI,IAAA,wBAAkB,EAAC,IAAI,CAAC,EAAE;YAC1B,IAAI,IAAA,kBAAY,EAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE;gBAChD,mEAAmE;gBACnE,OAAO,IAAI,CAAC;aACf;iBAAM;gBACH,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;aAC3C;SACJ;QACD,IAAI,IAAA,+BAAyB,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YACtD,OAAO,IAAI,CAAC;SACf;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,SAAqB,EAAE,IAAI,GAAG,KAAK;QAC7C,IAAI,IAAI,EAAE;YACN,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACxB,SAAS,EAAE,CAAC;SACf;aAAM;YACH,SAAS,EAAE,CAAC;SACf;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,YAAI,MAAM,aAAK,EAAE,CAAC,CAAC;IAC/C,CAAC;IAEO,KAAK,CAAC,IAAgB;QAC1B,IAAI;YACA,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;SAC5D;QAAC,OAAO,GAAG,EAAE;YACV,IAAI,GAAG,YAAY,wEAAoC,EAAE;gBACrD,MAAM,IAAI,iBAAW,CAAC,OAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;aAC5C;iBAAM;gBACH,MAAM,GAAG,CAAC;aACb;SACJ;IACL,CAAC;IAEO,eAAe,CAAC,IAAgB,EAAE,QAA4B;;QAClE,MAAM,iBAAiB,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,kBAAkB,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE1D,IAAI,CAAC,iBAAiB,IAAI,CAAC,kBAAkB,EAAE;YAC3C,qCAAqC;YACrC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;gBACZ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,OAAO;SACV;QAED,IAAI,WAAuB,CAAC;QAC5B,IAAI,OAAmB,CAAC;QACxB,IAAI,iBAAiB,EAAE;YACnB,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC;YACxB,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;SACxB;aAAM;YACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC;YACzB,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC;YACpB,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;SAC5C;QAED,IAAI,IAAA,wBAAkB,EAAC,WAAW,CAAC,IAAI,IAAA,kBAAY,EAAC,WAAW,CAAC,OAAO,CAAC,EAAE;YACtE,kEAAkE;YAClE,oDAAoD;YACpD,WAAW,GAAG;gBACV,KAAK,EAAE,mBAAa;gBACpB,UAAU,EAAE,WAAW,CAAC,UAAU;gBAClC,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,aAAa,EAAE,WAAW,CAAC,aAAa;gBACxC,OAAO,EAAE,IAAI;aACY,CAAC;SACjC;QAED,kDAAkD;QAClD,IAAI,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA,MAAA,WAAW,CAAC,aAAa,0CAAE,QAAQ,CAAA,EAAE;YAChF,IAAI;gBACA,IAAI,CAAC,MAAM,CAAC,KAAK,CACb,IAAI,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,eAAe;gBACvD,4EAA4E;gBAC5E,iEAAiE;gBACjE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,YAAI,CAAC,CAAC,CAAC,aAC/B,KAAK,CACR,CAAC;aACL;YAAC,OAAO,GAAG,EAAE;gBACV,IAAI,GAAG,YAAY,wEAAoC,EAAE;oBACrD,MAAM,IAAI,iBAAW,CAAC,OAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;iBAC5C;qBAAM;oBACH,MAAM,GAAG,CAAC;iBACb;aACJ;SACJ;QAED,IAAI,CAAC,KAAK,CACN,GAAG,EAAE;YACD,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,GAAG,EAAE;gBACvC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;;oBACZ,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;oBACjD,IAAI,SAAS,IAAI,IAAA,4BAAgB,EAAC,OAAO,CAAC,EAAE;wBACxC,iEAAiE;wBACjE,sCAAsC;wBAEtC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;wBAEjD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI,EAAE;4BACxC,MAAM,IAAI,iBAAW,CAAC,OAAI,EAAE,sCAAsC,CAAC,CAAC;yBACvE;wBAED,IAAI,CAAC,IAAA,gBAAU,EAAC,WAAW,CAAC,EAAE;4BAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;4BAC5D,MAAM,eAAe,GAAG,CAAC,CAAC,CAAA,MAAA,WAAW,CAAC,aAAa,0CAAE,QAAQ,CAAA,CAAC;4BAC9D,IAAI,eAAe,EAAE;gCACjB,+DAA+D;gCAC/D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;6BACjD;yBACJ;wBAED,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;4BACZ,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;gCAC9B,MAAM,aAAa,GAAG,GAAG,EAAE;oCACvB,cAAc;oCACd,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;oCACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oCACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;oCACtC,IAAI,GAAG,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;wCAC7B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;qCAC1B;gCACL,CAAC,CAAC;gCAEF,IAAI,IAAA,gBAAU,EAAC,WAAW,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE;oCAC9C,aAAa;oCACb,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;oCAC9B,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;iCACrC;qCAAM;oCACH,aAAa,EAAE,CAAC;iCACnB;4BACL,CAAC,CAAC,CAAC;wBACP,CAAC,CAAC,CAAC;qBACN;yBAAM;wBACH,IAAI,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE;4BAC3C,mBAAmB;4BACnB,+BAA+B;4BAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,YAAI,CAAC,CAAC,CAAC,aAAK,CAAC,CAAC;yBACvD;6BAAM;4BACH,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE;gCAC3C,IAAI,IAAA,+BAAyB,EAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;oCACzD,kFAAkF;oCAClF,4EAA4E;oCAC5E,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;iCACrC;qCAAM;oCACH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;iCACvB;4BACL,CAAC,CAAC,CAAC;yBACN;qBACJ;gBACL,CAAC,EAAE,CAAC,IAAA,gBAAU,EAAC,WAAW,CAAC,CAAC,CAAC;YACjC,CAAC,CAAC,CAAC;QACP,CAAC;QACD,mEAAmE;QACnE,+BAA+B;QAC/B,CAAC,IAAA,gBAAU,EAAC,WAAW,CAAC,CAC3B,CAAC;IACN,CAAC;IAEO,eAAe,CAAC,SAAoB;QACxC,MAAM,QAAQ,GAAG,IAAA,uBAAW,EAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE;YACpC,MAAM,IAAI,iBAAW,CAAC,OAAI,EAAE,cAAc,SAAS,CAAC,IAAI,4BAA4B,CAAC,CAAC;SACzF;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;IAEO,cAAc,CAAC,KAAiB,EAAE,KAAiB;QACvD,IAAI,IAAA,gBAAU,EAAC,KAAK,CAAC,IAAI,IAAA,gBAAU,EAAC,KAAK,CAAC,EAAE;YACxC,OAAO,IAAI,CAAC;SACf;QAED,IACI,IAAA,qBAAe,EAAC,KAAK,CAAC;YACtB,IAAA,qBAAe,EAAC,KAAK,CAAC;YACtB,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,MAAM,CAAC,GAAG;YACrC,8DAA8D;YAC7D,KAAa,CAAC,OAAO,KAAM,KAAa,CAAC,OAAO,CAAC,iCAAiC;UACrF;YACE,OAAO,IAAI,CAAC;SACf;QAED,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,+GAA+G;IACvG,mBAAmB,CAAC,IAAmB;QAC3C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YAClB,MAAM,IAAI,iBAAW,CAAC,OAAI,EAAE,yBAAyB,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;SACjF;QACD,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,IAAA,iCAAc,EAAC,eAAe,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACnG,CAAC;IAEO,wBAAwB,CAAC,IAAgB;QAC7C,OAAO,IAAA,4BAAgB,EAAC,IAAI,CAAC,IAAI,CAAC,IAAA,wBAAkB,EAAC,IAAI,CAAC,IAAI,IAAA,4BAAgB,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAClG,CAAC;IAEO,aAAa,CAAC,QAA4B,EAAE,WAAuB,EAAE,YAAwB;;QACjG,IAAI,IAAA,iBAAW,EAAC,MAAA,WAAW,CAAC,aAAa,0CAAE,IAAI,CAAC,EAAE;YAC9C,IAAI,QAAQ,KAAK,IAAI,EAAE;gBACnB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;aAC7B;iBAAM,IAAI,QAAQ,KAAK,IAAI,EAAE;gBAC1B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;aAChC;iBAAM;gBACH,MAAM,IAAI,iBAAW,CAAC,OAAI,EAAE,gEAAgE,CAAC,CAAC;aACjG;YACD,YAAY,EAAE,CAAC;SAClB;aAAM;YACH,IAAI,QAAQ,KAAK,IAAI,EAAE;gBACnB,eAAe;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC3B,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;oBACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACjD,YAAY,EAAE,CAAC;gBACnB,CAAC,CAAC,CAAC;aACN;iBAAM;gBACH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACrD,YAAY,EAAE,CAAC;aAClB;SACJ;IACL,CAAC;IAEO,mBAAmB,CACvB,WAAuB,EACvB,cAA0B,EAC1B,QAA0B,EAC1B,SAAsC;;QAEtC,IAAI,QAA4B,CAAC;QACjC,IAAI,OAA+B,CAAC;QAEpC,IAAI,IAAA,gBAAU,EAAC,WAAW,CAAC,EAAE;YACzB,UAAU;YACV,cAAc,EAAE,CAAC;YACjB,OAAO;SACV;aAAM,IAAI,IAAA,qBAAe,EAAC,WAAW,CAAC,EAAE;YACrC,QAAQ,GAAG,MAAA,WAAW,CAAC,MAAM,CAAC,GAAG,0CAAE,IAAI,CAAC;SAC3C;aAAM,IAAI,IAAA,wBAAkB,EAAC,WAAW,CAAC,EAAE;YACxC,IAAI,IAAA,kBAAY,EAAC,WAAW,CAAC,OAAO,CAAC,EAAE;gBACnC,kDAAkD;gBAClD,QAAQ,GAAG,MAAA,WAAW,CAAC,MAAM,CAAC,GAAG,0CAAE,IAAI,CAAC;aAC3C;iBAAM;gBACH,QAAQ,GAAG,MAAA,WAAW,CAAC,MAAM,CAAC,GAAG,0CAAE,IAAI,CAAC;gBACxC,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC;aACjC;SACJ;aAAM;YACH,MAAM,IAAI,iBAAW,CAAC,OAAI,EAAE,gCAAgC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;SACpF;QAED,IAAI,CAAC,QAAQ,EAAE;YACX,MAAM,IAAI,iBAAW,CAAC,OAAI,EAAE,wCAAwC,CAAC,CAAC;SACzE;QAED,MAAM,kBAAkB,GAAG,GAAG,EAAE;YAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;YACnC,IAAI,QAAQ,EAAE;gBACV,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;oBACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,IAAI,CAAC,CAAC;oBACnC,cAAc,EAAE,CAAC;oBAEjB,IAAI,SAAS,EAAE;wBACX,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE;4BAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;4BAC/B,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;yBACjB;qBACJ;gBACL,CAAC,CAAC,CAAC;aACN;iBAAM;gBACH,cAAc,EAAE,CAAC;aACpB;QACL,CAAC,CAAC;QAEF,IAAI,OAAO,EAAE;YACT,2BAA2B;YAC3B,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnC,IAAI,CAAC,KAAK,CACN,kBAAkB;gBAClB,yEAAyE;gBACzE,4CAA4C;gBAC5C,CAAC,IAAA,gBAAU,EAAC,OAAO,CAAC,CACvB,CAAC;YACN,CAAC,CAAC,CAAC;SACN;aAAM;YACH,kBAAkB,EAAE,CAAC;SACxB;IACL,CAAC;IAEO,KAAK,CAAC,KAAiB,EAAE,SAAS,GAAG,IAAI;QAC7C,IAAI,SAAS,EAAE;YACX,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;SAClC;aAAM;YACH,KAAK,EAAE,CAAC;SACX;IACL,CAAC;IAEO,YAAY,CAAC,IAAgB;;QACjC,OAAO,IAAA,iBAAW,EAAC,MAAA,IAAI,CAAC,aAAa,0CAAE,IAAI,CAAC,CAAC,CAAC,CAAE,MAAA,IAAI,CAAC,aAAa,0CAAE,IAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,CAAC;IAEO,WAAW,CAAC,QAA+C;QAC/D,QAAQ,QAAQ,EAAE;YACd,KAAK,IAAI;gBACL,OAAO,QAAQ,CAAC;YACpB,KAAK,IAAI;gBACL,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACnE,KAAK,GAAG;gBACJ,OAAO,IAAI,CAAC;YAChB,KAAK,IAAI;gBACL,OAAO,KAAK,CAAC;YACjB,KAAK,GAAG;gBACJ,OAAO,IAAI,CAAC;YAChB,KAAK,IAAI;gBACL,OAAO,KAAK,CAAC;SACpB;IACL,CAAC;IAEO,cAAc,CAAC,QAA+C;QAClE,QAAQ,QAAQ,EAAE;YACd,KAAK,GAAG;gBACJ,OAAO,IAAI,CAAC;YAChB,KAAK,GAAG;gBACJ,OAAO,IAAI,CAAC;YAChB,KAAK,IAAI;gBACL,OAAO,GAAG,CAAC;YACf,KAAK,IAAI;gBACL,OAAO,GAAG,CAAC;YACf;gBACI,OAAO,QAAQ,CAAC;SACvB;IACL,CAAC;IAEO,YAAY,CAAC,IAAgB,EAAE,QAAqB;QACxD,wDAAwD;QAExD,IAAI,QAAQ,KAAK,IAAI,EAAE;YACnB,6DAA6D;YAC7D,yCAAyC;YACzC,6BAA6B;YAC7B,gCAAgC;YAChC,8BAA8B;YAC9B,gCAAgC;YAChC,sEAAsE;YACtE,WAAW;YACX,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;gBACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC1B,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAChD,CAAC,CAAC,CAAC;YACH,IAAI;SACP;aAAM;YACH,4DAA4D;YAC5D,yCAAyC;YACzC,6BAA6B;YAC7B,gCAAgC;YAChC,qEAAqE;YACrE,gCAAgC;YAChC,8BAA8B;YAC9B,WAAW;YACX,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;gBACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACzB,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAChD,CAAC,CAAC,CAAC;YACH,IAAI;SACP;IACL,CAAC;IAEO,UAAU,CAAC,IAAe;QAC9B,IAAI,IAAI,CAAC,QAAQ,KAAK,GAAG,EAAE;YACvB,MAAM,IAAI,iBAAW,CAAC,OAAI,EAAE,mBAAmB,IAAI,CAAC,QAAQ,oBAAoB,CAAC,CAAC;SACrF;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC3B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,YAAY,CAAC,IAAiB;QAClC,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE;YACrB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAI,CAAC,CAAC;SAC3B;aAAM,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,EAAE;YAC7B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAK,CAAC,CAAC;SAC5B;aAAM;YACH,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;gBACZ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;SACN;IACL,CAAC;IAEO,eAAe,CAAC,IAAoB;;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,QAAQ,EAAE;YACX,MAAM,IAAI,iBAAW,CAAC,OAAI,EAAE,wCAAwC,CAAC,CAAC;SACzE;QAED,MAAM,sBAAsB,GAAG,IAAA,kCAA4B,EAAC,QAAQ,CAAC,CAAC;QACtE,IACI,sBAAsB,CAAC,QAAQ,CAAC,uBAAiB,CAAC,YAAY,CAAC;YAC/D,sBAAsB,CAAC,QAAQ,CAAC,uBAAiB,CAAC,cAAc,CAAC,EACnE;YACE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE;gBACzD,8CAA8C;gBAC9C,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBACnC,OAAO;aACV;YAED,IAAI,QAAQ,GAAG,MAAA,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,0CAAE,KAAK,CAAC;YAEnC,mEAAmE;YACnE,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE;gBAC7B,QAAQ,GAAG,EAAE,KAAK,EAAE,oBAAc,EAAE,KAAK,EAAE,IAAI,EAAiB,CAAC;aACpE;YAED,wGAAwG;YACxG,IAAI,SAAS,GAA2C,SAAS,CAAC;YAClE,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE;gBAC9B,IAAI,IAAA,gBAAU,EAAU,MAAA,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,0CAAE,KAAK,CAAC,KAAK,IAAI,EAAE;oBACnD,SAAS,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,mBAAa,EAAE,KAAK,EAAE,aAAa,EAAiB,EAAE,CAAC;iBACvF;aACJ;YAED,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;gBACZ,IAAI,CAAC,mBAAmB,CACpB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAClB,GAAG,EAAE;oBACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACzB,CAAC,EACD,QAAQ,CAAC,IAAuB,EAChC,SAAS,CACZ,CAAC;YACN,CAAC,CAAC,CAAC;SACN;aAAM;YACH,MAAM,IAAI,iBAAW,CAAC,OAAI,EAAE,wBAAwB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;SACxE;IACL,CAAC;CACJ;AA1mBD,4CA0mBC"}

package/plugins/access-policy/index.d.ts

@@ -0,0 +1,4 @@
+import { PluginFunction } from '@zenstackhq/sdk';
+export declare const name = "Access Policy";
+declare const run: PluginFunction;
+export default run;

package/plugins/access-policy/index.js

@@ -0,0 +1,22 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.name = void 0;
+const policy_guard_generator_1 = __importDefault(require("./policy-guard-generator"));
+exports.name = 'Access Policy';
+const run = (model, options, _dmmf, globalOptions) => __awaiter(void 0, void 0, void 0, function* () {
+    return new policy_guard_generator_1.default().generate(model, options, globalOptions);
+});
+exports.default = run;
+//# sourceMappingURL=index.js.map

package/plugins/access-policy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/plugins/access-policy/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AACA,sFAAuD;AAE1C,QAAA,IAAI,GAAG,eAAe,CAAC;AAEpC,MAAM,GAAG,GAAmB,CAAO,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE;IACvE,OAAO,IAAI,gCAAe,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;AACzE,CAAC,CAAA,CAAC;AAEF,kBAAe,GAAG,CAAC"}

package/plugins/access-policy/policy-guard-generator.d.ts

@@ -0,0 +1,22 @@
+import { Model } from '@zenstackhq/language/ast';
+import { PluginGlobalOptions, PluginOptions } from '@zenstackhq/sdk';
+/**
+ * Generates source file that contains Prisma query guard objects used for injecting database queries
+ */
+export default class PolicyGenerator {
+    generate(model: Model, options: PluginOptions, globalOptions?: PluginGlobalOptions): Promise<void>;
+    private isEnumReferenced;
+    private getPolicyExpressions;
+    private processUpdatePolicies;
+    private visitPolicyExpression;
+    private hasFutureReference;
+    private generateQueryGuardForModel;
+    private generateReadFieldsGuards;
+    private generateReadFieldGuardFunction;
+    private generateUpdateFieldsGuards;
+    private canCheckCreateBasedOnInput;
+    private generateSelectForRules;
+    private generateQueryGuardFunction;
+    private generateInputCheckFunction;
+    private generateNormalizedAuthRef;
+}