feat!: affine cloud support (#3813)

Co-authored-by: Hongtao Lye <codert.sn@gmail.com>
Co-authored-by: liuyi <forehalo@gmail.com>
Co-authored-by: LongYinan <lynweklm@gmail.com>
Co-authored-by: X1a0t <405028157@qq.com>
Co-authored-by: JimmFly <yangjinfei001@gmail.com>
Co-authored-by: Peng Xiao <pengxiao@outlook.com>
Co-authored-by: xiaodong zuo <53252747+zuoxiaodong0815@users.noreply.github.com>
Co-authored-by: DarkSky <25152247+darkskygit@users.noreply.github.com>
Co-authored-by: Qi <474021214@qq.com>
Co-authored-by: danielchim <kahungchim@gmail.com>

apps/server/src/modules/workspaces/controller.ts

@@ -1,6 +1,7 @@
 import type { Storage } from '@affine/storage';
 import {
   Controller,
+  ForbiddenException,
   Get,
   Inject,
   NotFoundException,
@@ -8,20 +9,33 @@ import {
   Res,
 } from '@nestjs/common';
 import type { Response } from 'express';
+import format from 'pretty-time';
 
 import { StorageProvide } from '../../storage';
+import { trimGuid } from '../../utils/doc';
+import { Auth, CurrentUser, Publicable } from '../auth';
+import { DocManager } from '../doc';
+import { UserType } from '../users';
+import { PermissionService } from './permission';
 
 @Controller('/api/workspaces')
 export class WorkspacesController {
-  constructor(@Inject(StorageProvide) private readonly storage: Storage) {}
+  constructor(
+    @Inject(StorageProvide) private readonly storage: Storage,
+    private readonly permission: PermissionService,
+    private readonly docManager: DocManager
+  ) {}
 
+  // get workspace blob
+  //
+  // NOTE: because graphql can't represent a File, so we have to use REST API to get blob
   @Get('/:id/blobs/:name')
   async blob(
     @Param('id') workspaceId: string,
     @Param('name') name: string,
     @Res() res: Response
   ) {
-    const blob = await this.storage.blob(workspaceId, name);
+    const blob = await this.storage.getBlob(workspaceId, name);
 
     if (!blob) {
       throw new NotFoundException('Blob not found');
@@ -33,4 +47,34 @@ export class WorkspacesController {
 
     res.send(blob.data);
   }
+
+  // get doc binary
+  @Get('/:id/docs/:guid')
+  @Auth()
+  @Publicable()
+  async doc(
+    @CurrentUser() user: UserType | undefined,
+    @Param('id') ws: string,
+    @Param('guid') guid: string,
+    @Res() res: Response
+  ) {
+    const start = process.hrtime();
+    const id = trimGuid(ws, guid);
+    if (
+      // if a user has the permission
+      !(await this.permission.isAccessible(ws, id, user?.id))
+    ) {
+      throw new ForbiddenException('Permission denied');
+    }
+
+    const update = await this.docManager.getLatestUpdate(ws, id);
+
+    if (!update) {
+      throw new NotFoundException('Doc not found');
+    }
+
+    res.setHeader('content-type', 'application/octet-stream');
+    res.send(update);
+    console.info('workspaces doc api: ', format(process.hrtime(start)));
+  }
 }

apps/server/src/modules/workspaces/index.ts

@@ -1,12 +1,15 @@
 import { Module } from '@nestjs/common';
 
+import { DocModule } from '../doc';
 import { WorkspacesController } from './controller';
 import { PermissionService } from './permission';
 import { WorkspaceResolver } from './resolver';
 
 @Module({
-  providers: [WorkspaceResolver, PermissionService, WorkspacesController],
+  imports: [DocModule.forFeature()],
+  controllers: [WorkspacesController],
+  providers: [WorkspaceResolver, PermissionService],
   exports: [PermissionService],
 })
 export class WorkspaceModule {}
-export { WorkspaceType } from './resolver';
+export { InvitationType, WorkspaceType } from './resolver';

apps/server/src/modules/workspaces/permission.ts

@@ -12,6 +12,7 @@ export class PermissionService {
     const data = await this.prisma.userWorkspacePermission.findFirst({
       where: {
         workspaceId: ws,
+        subPageId: null,
         userId: user,
         accepted: true,
       },
@@ -20,6 +21,38 @@ export class PermissionService {
     return data?.type as Permission;
   }
 
+  async isAccessible(ws: string, id: string, user?: string): Promise<boolean> {
+    if (user) {
+      return await this.tryCheck(ws, user);
+    } else {
+      // check if this is a public workspace
+      const count = await this.prisma.workspace.count({
+        where: { id: ws, public: true },
+      });
+      if (count > 0) {
+        return true;
+      }
+
+      // check whether this is a public subpage
+      const workspace = await this.prisma.userWorkspacePermission.findMany({
+        where: {
+          workspaceId: ws,
+          userId: null,
+        },
+      });
+      const subpages = workspace
+        .map(ws => ws.subPageId)
+        .filter((v): v is string => !!v);
+      if (subpages.length > 0 && ws === id) {
+        // rootDoc is always accessible when there is a public subpage
+        return true;
+      } else {
+        // check if this is a public subpage
+        return subpages.map(page => `space:${page}`).includes(id);
+      }
+    }
+  }
+
   async check(
     ws: string,
     user: string,
@@ -35,9 +68,21 @@ export class PermissionService {
     user: string,
     permission: Permission = Permission.Read
   ) {
+    // If the permission is read, we should check if the workspace is public
+    if (permission === Permission.Read) {
+      const data = await this.prisma.workspace.count({
+        where: { id: ws, public: true },
+      });
+
+      if (data > 0) {
+        return true;
+      }
+    }
+
     const data = await this.prisma.userWorkspacePermission.count({
       where: {
         workspaceId: ws,
+        subPageId: null,
         userId: user,
         accepted: true,
         type: {
@@ -46,30 +91,18 @@ export class PermissionService {
       },
     });
 
-    if (data > 0) {
-      return true;
-    }
-
-    // If the permission is read, we should check if the workspace is public
-    if (permission === Permission.Read) {
-      const data = await this.prisma.workspace.count({
-        where: { id: ws, public: true },
-      });
-
-      return data > 0;
-    }
-
-    return false;
+    return data > 0;
   }
 
   async grant(
     ws: string,
     user: string,
     permission: Permission = Permission.Read
-  ) {
+  ): Promise<string> {
     const data = await this.prisma.userWorkspacePermission.findFirst({
       where: {
         workspaceId: ws,
+        subPageId: null,
         userId: user,
         accepted: true,
       },
@@ -105,22 +138,40 @@ export class PermissionService {
         ].filter(Boolean) as Prisma.PrismaPromise<any>[]
       );
 
-      return p;
+      return p.id;
     }
 
-    return this.prisma.userWorkspacePermission.create({
-      data: {
+    return this.prisma.userWorkspacePermission
+      .create({
+        data: {
+          workspaceId: ws,
+          subPageId: null,
+          userId: user,
+          type: permission,
+        },
+      })
+      .then(p => p.id);
+  }
+
+  async acceptById(ws: string, id: string) {
+    const result = await this.prisma.userWorkspacePermission.updateMany({
+      where: {
+        id,
         workspaceId: ws,
-        userId: user,
-        type: permission,
+      },
+      data: {
+        accepted: true,
       },
     });
+
+    return result.count > 0;
   }
 
   async accept(ws: string, user: string) {
     const result = await this.prisma.userWorkspacePermission.updateMany({
       where: {
         workspaceId: ws,
+        subPageId: null,
         userId: user,
         accepted: false,
       },
@@ -136,6 +187,67 @@ export class PermissionService {
     const result = await this.prisma.userWorkspacePermission.deleteMany({
       where: {
         workspaceId: ws,
+        subPageId: null,
+        userId: user,
+        type: {
+          // We shouldn't revoke owner permission, should auto deleted by workspace/user delete cascading
+          not: Permission.Owner,
+        },
+      },
+    });
+
+    return result.count > 0;
+  }
+
+  async isPageAccessible(ws: string, page: string, user?: string) {
+    const data = await this.prisma.userWorkspacePermission.findFirst({
+      where: {
+        workspaceId: ws,
+        subPageId: page,
+        userId: user,
+      },
+    });
+
+    return data?.accepted || false;
+  }
+
+  async grantPage(
+    ws: string,
+    page: string,
+    user?: string,
+    permission: Permission = Permission.Read
+  ) {
+    const data = await this.prisma.userWorkspacePermission.findFirst({
+      where: {
+        workspaceId: ws,
+        subPageId: page,
+        userId: user,
+      },
+    });
+
+    if (data) {
+      return data.accepted;
+    }
+
+    return this.prisma.userWorkspacePermission
+      .create({
+        data: {
+          workspaceId: ws,
+          subPageId: page,
+          userId: user,
+          // if provide user id, user need to accept the invitation
+          accepted: user ? false : true,
+          type: permission,
+        },
+      })
+      .then(ret => ret.accepted);
+  }
+
+  async revokePage(ws: string, page: string, user?: string) {
+    const result = await this.prisma.userWorkspacePermission.deleteMany({
+      where: {
+        workspaceId: ws,
+        subPageId: page,
         userId: user,
         type: {
           // We shouldn't revoke owner permission, should auto deleted by workspace/user delete cascading

apps/server/src/modules/workspaces/resolver.ts

@@ -8,6 +8,7 @@ import {
   Int,
   Mutation,
   ObjectType,
+  OmitType,
   Parent,
   PartialType,
   PickType,
@@ -19,20 +20,43 @@ import {
 import type { User, Workspace } from '@prisma/client';
 // @ts-expect-error graphql-upload is not typed
 import GraphQLUpload from 'graphql-upload/GraphQLUpload.mjs';
+import { applyUpdate, Doc } from 'yjs';
 
 import { PrismaService } from '../../prisma';
 import { StorageProvide } from '../../storage';
 import type { FileUpload } from '../../types';
-import { Auth, CurrentUser } from '../auth';
+import { Auth, CurrentUser, Public } from '../auth';
+import { MailService } from '../auth/mailer';
+import { AuthService } from '../auth/service';
 import { UserType } from '../users/resolver';
 import { PermissionService } from './permission';
 import { Permission } from './types';
+import { defaultWorkspaceAvatar } from './utils';
 
 registerEnumType(Permission, {
   name: 'Permission',
   description: 'User permission in workspace',
 });
 
+@ObjectType()
+export class InviteUserType extends OmitType(
+  PartialType(UserType),
+  ['id'],
+  ObjectType
+) {
+  @Field(() => ID)
+  id!: string;
+
+  @Field(() => Permission, { description: 'User permission in workspace' })
+  permission!: Permission;
+
+  @Field({ description: 'Invite id' })
+  inviteId!: string;
+
+  @Field({ description: 'User accepted' })
+  accepted!: boolean;
+}
+
 @ObjectType()
 export class WorkspaceType implements Partial<Workspace> {
   @Field(() => ID)
@@ -43,6 +67,34 @@ export class WorkspaceType implements Partial<Workspace> {
 
   @Field({ description: 'Workspace created date' })
   createdAt!: Date;
+
+  @Field(() => [InviteUserType], {
+    description: 'Members of workspace',
+  })
+  members!: InviteUserType[];
+}
+
+@ObjectType()
+export class InvitationWorkspaceType {
+  @Field(() => ID)
+  id!: string;
+
+  @Field({ description: 'Workspace name' })
+  name!: string;
+
+  @Field(() => String, {
+    // nullable: true,
+    description: 'Base64 encoded avatar',
+  })
+  avatar!: string;
+}
+
+@ObjectType()
+export class InvitationType {
+  @Field({ description: 'Workspace information' })
+  workspace!: InvitationWorkspaceType;
+  @Field({ description: 'User information' })
+  user!: UserType;
 }
 
 @InputType()
@@ -59,6 +111,8 @@ export class UpdateWorkspaceInput extends PickType(
 @Resolver(() => WorkspaceType)
 export class WorkspaceResolver {
   constructor(
+    private readonly auth: AuthService,
+    private readonly mailer: MailService,
     private readonly prisma: PrismaService,
     private readonly permissionProvider: PermissionService,
     @Inject(StorageProvide) private readonly storage: Storage
@@ -69,7 +123,7 @@ export class WorkspaceResolver {
     complexity: 2,
   })
   async permission(
-    @CurrentUser() user: User,
+    @CurrentUser() user: UserType,
     @Parent() workspace: WorkspaceType
   ) {
     // may applied in workspaces query
@@ -99,6 +153,20 @@ export class WorkspaceResolver {
     });
   }
 
+  @ResolveField(() => [String], {
+    description: 'Shared pages of workspace',
+    complexity: 2,
+  })
+  async sharedPages(@Parent() workspace: WorkspaceType) {
+    const data = await this.prisma.userWorkspacePermission.findMany({
+      where: {
+        workspaceId: workspace.id,
+      },
+    });
+
+    return data.map(item => item.subPageId).filter(Boolean);
+  }
+
   @ResolveField(() => UserType, {
     description: 'Owner of workspace',
     complexity: 2,
@@ -117,27 +185,46 @@ export class WorkspaceResolver {
     return data.user;
   }
 
-  @ResolveField(() => [UserType], {
+  @ResolveField(() => [InviteUserType], {
     description: 'Members of workspace',
     complexity: 2,
   })
-  async members(
-    @CurrentUser() user: UserType,
-    @Parent() workspace: WorkspaceType
-  ) {
+  async members(@Parent() workspace: WorkspaceType) {
     const data = await this.prisma.userWorkspacePermission.findMany({
       where: {
         workspaceId: workspace.id,
-        accepted: true,
-        userId: {
-          not: user.id,
-        },
       },
       include: {
         user: true,
       },
     });
-    return data.map(({ user }) => user);
+    return data.map(({ id, accepted, type, user }) => ({
+      ...user,
+      permission: type,
+      inviteId: id,
+      accepted,
+    }));
+  }
+
+  @Query(() => Boolean, {
+    description: 'Get is owner of workspace',
+    complexity: 2,
+  })
+  async isOwner(
+    @CurrentUser() user: UserType,
+    @Args('workspaceId') workspaceId: string
+  ) {
+    const data = await this.prisma.userWorkspacePermission.findFirst({
+      where: {
+        workspaceId,
+        type: Permission.Owner,
+      },
+      include: {
+        user: true,
+      },
+    });
+
+    return data?.user?.id === user.id;
   }
 
   @Query(() => [WorkspaceType], {
@@ -163,6 +250,22 @@ export class WorkspaceResolver {
     });
   }
 
+  @Query(() => WorkspaceType, {
+    description: 'Get public workspace by id',
+  })
+  @Public()
+  async publicWorkspace(@Args('id') id: string) {
+    const workspace = await this.prisma.workspace.findUnique({
+      where: { id },
+    });
+
+    if (workspace?.public) {
+      return workspace;
+    }
+
+    throw new NotFoundException("Workspace doesn't exist");
+  }
+
   @Query(() => WorkspaceType, {
     description: 'Get workspace by id',
   })
@@ -181,7 +284,7 @@ export class WorkspaceResolver {
     description: 'Create a new workspace',
   })
   async createWorkspace(
-    @CurrentUser() user: User,
+    @CurrentUser() user: UserType,
     @Args({ name: 'init', type: () => GraphQLUpload })
     update: FileUpload
   ) {
@@ -215,7 +318,13 @@ export class WorkspaceResolver {
       },
     });
 
-    await this.storage.createWorkspace(workspace.id, buffer);
+    await this.prisma.snapshot.create({
+      data: {
+        id: workspace.id,
+        workspaceId: workspace.id,
+        blob: buffer,
+      },
+    });
 
     return workspace;
   }
@@ -224,11 +333,11 @@ export class WorkspaceResolver {
     description: 'Update workspace',
   })
   async updateWorkspace(
-    @CurrentUser() user: User,
+    @CurrentUser() user: UserType,
     @Args({ name: 'input', type: () => UpdateWorkspaceInput })
     { id, ...updates }: UpdateWorkspaceInput
   ) {
-    await this.permissionProvider.check('id', user.id, Permission.Admin);
+    await this.permissionProvider.check(id, user.id, Permission.Admin);
 
     return this.prisma.workspace.update({
       where: {
@@ -239,7 +348,7 @@ export class WorkspaceResolver {
   }
 
   @Mutation(() => Boolean)
-  async deleteWorkspace(@CurrentUser() user: User, @Args('id') id: string) {
+  async deleteWorkspace(@CurrentUser() user: UserType, @Args('id') id: string) {
     await this.permissionProvider.check(id, user.id, Permission.Owner);
 
     await this.prisma.workspace.delete({
@@ -248,25 +357,30 @@ export class WorkspaceResolver {
       },
     });
 
-    await this.prisma.userWorkspacePermission.deleteMany({
-      where: {
-        workspaceId: id,
-      },
-    });
-
-    // TODO:
-    // delete all related data, like websocket connections, blobs, etc.
-    await this.storage.deleteWorkspace(id);
+    await this.prisma.$transaction([
+      this.prisma.update.deleteMany({
+        where: {
+          workspaceId: id,
+        },
+      }),
+      this.prisma.snapshot.deleteMany({
+        where: {
+          workspaceId: id,
+        },
+      }),
+    ]);
 
     return true;
   }
 
-  @Mutation(() => Boolean)
+  @Mutation(() => String)
   async invite(
-    @CurrentUser() user: User,
+    @CurrentUser() user: UserType,
     @Args('workspaceId') workspaceId: string,
     @Args('email') email: string,
-    @Args('permission', { type: () => Permission }) permission: Permission
+    @Args('permission', { type: () => Permission }) permission: Permission,
+    // TODO: add rate limit
+    @Args('sendInviteMail', { nullable: true }) sendInviteMail: boolean
   ) {
     await this.permissionProvider.check(workspaceId, user.id, Permission.Admin);
 
@@ -280,18 +394,122 @@ export class WorkspaceResolver {
       },
     });
 
-    if (!target) {
-      throw new NotFoundException("User doesn't exist");
+    if (target) {
+      const originRecord = await this.prisma.userWorkspacePermission.findFirst({
+        where: {
+          workspaceId,
+          userId: target.id,
+        },
+      });
+
+      if (originRecord) {
+        return originRecord.id;
+      }
+
+      const inviteId = await this.permissionProvider.grant(
+        workspaceId,
+        target.id,
+        permission
+      );
+      if (sendInviteMail) {
+        const inviteInfo = await this.getInviteInfo(inviteId);
+
+        await this.mailer.sendInviteEmail(email, inviteId, {
+          workspace: {
+            id: inviteInfo.workspace.id,
+            name: inviteInfo.workspace.name,
+            avatar: inviteInfo.workspace.avatar,
+          },
+          user: {
+            avatar: inviteInfo.user?.avatarUrl || '',
+            name: inviteInfo.user?.name || '',
+          },
+        });
+      }
+      return inviteId;
+    } else {
+      const user = await this.auth.createAnonymousUser(email);
+      const inviteId = await this.permissionProvider.grant(
+        workspaceId,
+        user.id,
+        permission
+      );
+      if (sendInviteMail) {
+        const inviteInfo = await this.getInviteInfo(inviteId);
+
+        await this.mailer.sendInviteEmail(email, inviteId, {
+          workspace: {
+            id: inviteInfo.workspace.id,
+            name: inviteInfo.workspace.name,
+            avatar: inviteInfo.workspace.avatar,
+          },
+          user: {
+            avatar: inviteInfo.user?.avatarUrl || '',
+            name: inviteInfo.user?.name || '',
+          },
+        });
+      }
+      return inviteId;
+    }
+  }
+
+  @Public()
+  @Query(() => InvitationType, {
+    description: 'Update workspace',
+  })
+  async getInviteInfo(@Args('inviteId') inviteId: string) {
+    const permission =
+      await this.prisma.userWorkspacePermission.findUniqueOrThrow({
+        where: {
+          id: inviteId,
+        },
+      });
+
+    const snapshot = await this.prisma.snapshot.findFirstOrThrow({
+      where: {
+        id: permission.workspaceId,
+        workspaceId: permission.workspaceId,
+      },
+    });
+
+    const doc = new Doc();
+
+    applyUpdate(doc, new Uint8Array(snapshot.blob));
+    const metaJSON = doc.getMap('meta').toJSON();
+
+    const owner = await this.prisma.userWorkspacePermission.findFirstOrThrow({
+      where: {
+        workspaceId: permission.workspaceId,
+        type: Permission.Owner,
+      },
+      include: {
+        user: true,
+      },
+    });
+
+    let avatar = '';
+
+    if (metaJSON.avatar) {
+      const avatarBlob = await this.storage.getBlob(
+        permission.workspaceId,
+        metaJSON.avatar
+      );
+      avatar = avatarBlob?.data.toString('base64') || '';
     }
 
-    await this.permissionProvider.grant(workspaceId, target.id, permission);
-
-    return true;
+    return {
+      workspace: {
+        name: metaJSON.name || '',
+        avatar: avatar || defaultWorkspaceAvatar,
+        id: permission.workspaceId,
+      },
+      user: owner.user,
+    };
   }
 
   @Mutation(() => Boolean)
   async revoke(
-    @CurrentUser() user: User,
+    @CurrentUser() user: UserType,
     @Args('workspaceId') workspaceId: string,
     @Args('userId') userId: string
   ) {
@@ -300,9 +518,18 @@ export class WorkspaceResolver {
     return this.permissionProvider.revoke(workspaceId, userId);
   }
 
+  @Mutation(() => Boolean)
+  @Public()
+  async acceptInviteById(
+    @Args('workspaceId') workspaceId: string,
+    @Args('inviteId') inviteId: string
+  ) {
+    return this.permissionProvider.acceptById(workspaceId, inviteId);
+  }
+
   @Mutation(() => Boolean)
   async acceptInvite(
-    @CurrentUser() user: User,
+    @CurrentUser() user: UserType,
     @Args('workspaceId') workspaceId: string
   ) {
     return this.permissionProvider.accept(workspaceId, user.id);
@@ -310,7 +537,7 @@ export class WorkspaceResolver {
 
   @Mutation(() => Boolean)
   async leaveWorkspace(
-    @CurrentUser() user: User,
+    @CurrentUser() user: UserType,
     @Args('workspaceId') workspaceId: string
   ) {
     await this.permissionProvider.check(workspaceId, user.id);
@@ -318,14 +545,48 @@ export class WorkspaceResolver {
     return this.permissionProvider.revoke(workspaceId, user.id);
   }
 
+  @Mutation(() => Boolean)
+  async sharePage(
+    @CurrentUser() user: UserType,
+    @Args('workspaceId') workspaceId: string,
+    @Args('pageId') pageId: string
+  ) {
+    await this.permissionProvider.check(workspaceId, user.id, Permission.Admin);
+
+    return this.permissionProvider.grantPage(workspaceId, pageId);
+  }
+
+  @Mutation(() => Boolean)
+  async revokePage(
+    @CurrentUser() user: UserType,
+    @Args('workspaceId') workspaceId: string,
+    @Args('pageId') pageId: string
+  ) {
+    await this.permissionProvider.check(workspaceId, user.id, Permission.Admin);
+
+    return this.permissionProvider.revokePage(workspaceId, pageId);
+  }
+
+  @Query(() => [String], {
+    description: 'List blobs of workspace',
+  })
+  async listBlobs(
+    @CurrentUser() user: UserType,
+    @Args('workspaceId') workspaceId: string
+  ) {
+    await this.permissionProvider.check(workspaceId, user.id);
+
+    return this.storage.listBlobs(workspaceId);
+  }
+
   @Mutation(() => String)
-  async uploadBlob(
-    @CurrentUser() user: User,
+  async setBlob(
+    @CurrentUser() user: UserType,
     @Args('workspaceId') workspaceId: string,
     @Args({ name: 'blob', type: () => GraphQLUpload })
     blob: FileUpload
   ) {
-    await this.permissionProvider.check(workspaceId, user.id);
+    await this.permissionProvider.check(workspaceId, user.id, Permission.Write);
 
     const buffer = await new Promise<Buffer>((resolve, reject) => {
       const stream = blob.createReadStream();
@@ -341,4 +602,15 @@ export class WorkspaceResolver {
 
     return this.storage.uploadBlob(workspaceId, buffer);
   }
+
+  @Mutation(() => Boolean)
+  async deleteBlob(
+    @CurrentUser() user: UserType,
+    @Args('workspaceId') workspaceId: string,
+    @Args('hash') hash: string
+  ) {
+    await this.permissionProvider.check(workspaceId, user.id);
+
+    return this.storage.deleteBlob(workspaceId, hash);
+  }
 }

apps/server/src/modules/workspaces/utils.ts

@@ -0,0 +1,2 @@
+export const defaultWorkspaceAvatar =
+  'iVBORw0KGgoAAAANSUhEUgAAABgAAAAYCAYAAADgdz34AAAACXBIWXMAAAsTAAALEwEAmpwYAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAQtSURBVHgBfVa9jhxFEK6q7rkf+4T2AgdIIC0ZoXkBuNQJtngBuIzs1hIRye1FhL438D0CRgKRGUeE6wwkhHYlkE2AtGdkbN/MdJe/qu7Z27PWnnG5Znq7v/rqd47pHddkNh/918tR1/FBamXc9zxOPVFKfJ4yP86qD1LD3/986/3F2zB40+LXv83HrHq/6+gAoNS1kF4odUz2nhJRTkI5E6mD6Bk1crLJkLy5cHc+P4ohzxLng8RKLqKUq6hkUtBSe8Zvdmfir7TT2a0fnkzeaeCbv/44ztSfZskjP2ygVRM0mbYTpgHMMMS8CsIIj/c+//Hp8UYD3z758whQUwdeEwPjAZQLqJhI0VxB2MVco+kXP/0zuZKD6dP5uM397ELzqEtMba/UJ4t7iXeq8U94z52Q+js09qjlIXMxAEsRDJpI59dVPzlDTooHko7BdlR2FcYmAtbGMmAt2mFI4yDQkIjtEQkxUAMKAPD9SiOK4b578N0S7Nt+fqFKbTbmRD1YGXurEmdtnjjz4kFuIV0gtWewV62hMHBY2gpEOw3Rnmztx9jnO72xzTV/YkzgNmgkiypeYJdCLjonqyAAg7VCshVpjTbD08HbxrySdhKxcDvoJTA5gLvpeXVQ+K340WKea9UkNeZVqGSba/IbF6athj+LUeRmRCyiAVnlAKhJJQfmugGZ28ZWna24RGzwNUNUqpWGf6HkajvAgNA4NsSjHgcb9obx+k5c3DUttcwd3NcHxpVurXQ2d4MZACGw9TwEHsdtbEwytL1xywAGcxavjoH1quLVywuGi+aBhFWexRilFSwK0QzgdUdkkVMeKw4wijrgxjzz2CefCRZn+21ViOWW4Ym9nNnyFLMbMS8ivNhGP8RdlgUojBkuBLDpEPi+5LpWiDURgFkKOIIckJTgN/sZ84KtKkKpDnsOZiTQ47jD4ZGwHghbw6AXIL3lo5Zg6Tp2AwIAyYJ8BRzGfmfPl6kI7HOLUdN2LIg+4IfL5SiFdvkK4blI6h50qda7jQI0CUMLdEhFIkqtQciMvXsgpaZ1pWtVUfrIa+TX5/8+RBcftAhTa91r8ycXA5ZxBqhAh2zgVagUAddxMkxfF/JxfvbpB+8d2jhBtsPhtuqsE0HJlhxYeHKdkCU8xUCos8dmkDdnGaOlJ1yy9dM52J2spqldvz9fTgB4z+aQd2kqjUY2KU2s4dTT7ezD0AqDAbvZiKF/VO9+fGPv9IoBu+b/P5ti6djDY+JlSg4ug1jc6fJbMAx9/3b4CNGTD/evT698D9avv188m4gKvko8MiMeJC3jmOvU9MSuHXZohAVpOrmxd+10HW/jR3/58uU45TRFt35ZR2XpY61DzW+tH3z/7xdM8sP93d3Fm1gbDawbEtU7CMtt/JVxEw01Kh7RAmoBE4+u7eycYv38bRivAZbdHBtPrwOHAAAAAElFTkSuQmCC';