From e90e41788029c6f6447d0d7a02fdf3205d3b27ee Mon Sep 17 00:00:00 2001 From: bai <173792339@qq.com> Date: Thu, 8 Aug 2024 16:56:05 +0800 Subject: [PATCH] =?UTF-8?q?=E5=88=9D=E5=A7=8B=E5=8C=96?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .idea/.gitignore | 8 + .idea/compiler.xml | 13 ++ .idea/encodings.xml | 7 + .idea/inspectionProfiles/Project_Default.xml | 65 ++++++++ .idea/jarRepositories.xml | 45 ++++++ .idea/misc.xml | 12 ++ .idea/vcs.xml | 6 + pom.xml | 27 ++++ .../common/datascope/MyMetaObjectHandler.java | 35 ++++ .../datascope/annotation/DataScope.java | 28 ++++ .../datascope/aspect/DataScopeAspect.java | 149 ++++++++++++++++++ ...ot.autoconfigure.AutoConfiguration.imports | 2 + ...ot.autoconfigure.AutoConfiguration.imports | 2 + .../datascope/MyMetaObjectHandler.class | Bin 0 -> 1847 bytes .../datascope/annotation/DataScope.class | Bin 0 -> 582 bytes .../datascope/aspect/DataScopeAspect.class | Bin 0 -> 5858 bytes target/cloud-common-datascope-3.6.3.jar | Bin 0 -> 7176 bytes target/maven-archiver/pom.properties | 3 + .../compile/default-compile/createdFiles.lst | 3 + .../compile/default-compile/inputFiles.lst | 3 + 20 files changed, 408 insertions(+) create mode 100644 .idea/.gitignore create mode 100644 .idea/compiler.xml create mode 100644 .idea/encodings.xml create mode 100644 .idea/inspectionProfiles/Project_Default.xml create mode 100644 .idea/jarRepositories.xml create mode 100644 .idea/misc.xml create mode 100644 .idea/vcs.xml create mode 100644 pom.xml create mode 100644 src/main/java/com/muyu/common/datascope/MyMetaObjectHandler.java create mode 100644 src/main/java/com/muyu/common/datascope/annotation/DataScope.java create mode 100644 src/main/java/com/muyu/common/datascope/aspect/DataScopeAspect.java create mode 100644 src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports create mode 100644 target/classes/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports create mode 100644 target/classes/com/muyu/common/datascope/MyMetaObjectHandler.class create mode 100644 target/classes/com/muyu/common/datascope/annotation/DataScope.class create mode 100644 target/classes/com/muyu/common/datascope/aspect/DataScopeAspect.class create mode 100644 target/cloud-common-datascope-3.6.3.jar create mode 100644 target/maven-archiver/pom.properties create mode 100644 target/maven-status/maven-compiler-plugin/compile/default-compile/createdFiles.lst create mode 100644 target/maven-status/maven-compiler-plugin/compile/default-compile/inputFiles.lst diff --git a/.idea/.gitignore b/.idea/.gitignore new file mode 100644 index 0000000..13566b8 --- /dev/null +++ b/.idea/.gitignore @@ -0,0 +1,8 @@ +# Default ignored files +/shelf/ +/workspace.xml +# Editor-based HTTP Client requests +/httpRequests/ +# Datasource local storage ignored files +/dataSources/ +/dataSources.local.xml diff --git a/.idea/compiler.xml b/.idea/compiler.xml new file mode 100644 index 0000000..b1fadf7 --- /dev/null +++ b/.idea/compiler.xml @@ -0,0 +1,13 @@ + + + + + + + + + + + + + \ No newline at end of file diff --git a/.idea/encodings.xml b/.idea/encodings.xml new file mode 100644 index 0000000..aa00ffa --- /dev/null +++ b/.idea/encodings.xml @@ -0,0 +1,7 @@ + + + + + + + \ No newline at end of file diff --git a/.idea/inspectionProfiles/Project_Default.xml b/.idea/inspectionProfiles/Project_Default.xml new file mode 100644 index 0000000..187f5ad --- /dev/null +++ b/.idea/inspectionProfiles/Project_Default.xml @@ -0,0 +1,65 @@ + + + + \ No newline at end of file diff --git a/.idea/jarRepositories.xml b/.idea/jarRepositories.xml new file mode 100644 index 0000000..b870255 --- /dev/null +++ b/.idea/jarRepositories.xml @@ -0,0 +1,45 @@ + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/.idea/misc.xml b/.idea/misc.xml new file mode 100644 index 0000000..67e1e61 --- /dev/null +++ b/.idea/misc.xml @@ -0,0 +1,12 @@ + + + + + + + + \ No newline at end of file diff --git a/.idea/vcs.xml b/.idea/vcs.xml new file mode 100644 index 0000000..94a25f7 --- /dev/null +++ b/.idea/vcs.xml @@ -0,0 +1,6 @@ + + + + + + \ No newline at end of file diff --git a/pom.xml b/pom.xml new file mode 100644 index 0000000..26f55b2 --- /dev/null +++ b/pom.xml @@ -0,0 +1,27 @@ + + + + com.muyu + cloud-common + 3.6.3 + + 4.0.0 + 3.6.3 + cloud-common-datascope + + + cloud-common-datascope权限范围 + + + + + + + com.muyu + cloud-common-security + + + + diff --git a/src/main/java/com/muyu/common/datascope/MyMetaObjectHandler.java b/src/main/java/com/muyu/common/datascope/MyMetaObjectHandler.java new file mode 100644 index 0000000..e58fe97 --- /dev/null +++ b/src/main/java/com/muyu/common/datascope/MyMetaObjectHandler.java @@ -0,0 +1,35 @@ +package com.muyu.common.datascope; + +import com.baomidou.mybatisplus.core.handlers.MetaObjectHandler; +import com.muyu.common.core.text.Convert; +import com.muyu.common.security.utils.SecurityUtils; +import lombok.extern.log4j.Log4j2; +import org.apache.ibatis.reflection.MetaObject; + +import java.util.Date; + +/** + * 实体类字段填充 + */ +@Log4j2 +public class MyMetaObjectHandler implements MetaObjectHandler { + public MyMetaObjectHandler () { + log.info("元对象字段填充控制器 ------- 加载完成"); + } + + @Override + public void insertFill(MetaObject metaObject) { + this.setFieldValByName("createBy", Convert.utf8Str(SecurityUtils.getUserId()), metaObject); + this.setFieldValByName("createTime", new Date(), metaObject); + log.info("添加对象元数据字段填充-[createBy:[{}],createTime:[{}]", + SecurityUtils.getUserId(), new Date()); + } + + @Override + public void updateFill(MetaObject metaObject) { + this.setFieldValByName("updateBy", Convert.utf8Str(SecurityUtils.getUserId()), metaObject); + this.setFieldValByName("updateTime", new Date(),metaObject); + log.info("修改对象元数据字段填充-[updateBy:[{}],updateTime:[{}]", + SecurityUtils.getUserId(), new Date()); + } +} diff --git a/src/main/java/com/muyu/common/datascope/annotation/DataScope.java b/src/main/java/com/muyu/common/datascope/annotation/DataScope.java new file mode 100644 index 0000000..498f06b --- /dev/null +++ b/src/main/java/com/muyu/common/datascope/annotation/DataScope.java @@ -0,0 +1,28 @@ +package com.muyu.common.datascope.annotation; + +import java.lang.annotation.*; + +/** + * 数据权限过滤注解 + * + * @author muyu + */ +@Target(ElementType.METHOD) +@Retention(RetentionPolicy.RUNTIME) +@Documented +public @interface DataScope { + /** + * 部门表的别名 + */ + public String deptAlias () default ""; + + /** + * 用户表的别名 + */ + public String userAlias () default ""; + + /** + * 权限字符（用于多个角色匹配符合要求的权限）默认根据权限注解@RequiresPermissions获取，多个权限用逗号分隔开来 + */ + public String permission () default ""; +} diff --git a/src/main/java/com/muyu/common/datascope/aspect/DataScopeAspect.java b/src/main/java/com/muyu/common/datascope/aspect/DataScopeAspect.java new file mode 100644 index 0000000..3d66b0d --- /dev/null +++ b/src/main/java/com/muyu/common/datascope/aspect/DataScopeAspect.java @@ -0,0 +1,149 @@ +package com.muyu.common.datascope.aspect; + +import com.muyu.common.core.context.SecurityContextHolder; +import com.muyu.common.core.text.Convert; +import com.muyu.common.core.utils.StringUtils; +import com.muyu.common.core.web.domain.BaseEntity; +import com.muyu.common.datascope.annotation.DataScope; +import com.muyu.common.security.utils.SecurityUtils; +import com.muyu.common.system.domain.SysRole; +import com.muyu.common.system.domain.SysUser; +import com.muyu.common.system.domain.LoginUser; +import org.aspectj.lang.JoinPoint; +import org.aspectj.lang.annotation.Aspect; +import org.aspectj.lang.annotation.Before; +import org.springframework.stereotype.Component; + +import java.util.ArrayList; +import java.util.List; + +/** + * 数据过滤处理 + * + * @author muyu + */ +@Aspect +@Component +public class DataScopeAspect { + /** + * 全部数据权限 + */ + public static final String DATA_SCOPE_ALL = "1"; + + /** + * 自定数据权限 + */ + public static final String DATA_SCOPE_CUSTOM = "2"; + + /** + * 部门数据权限 + */ + public static final String DATA_SCOPE_DEPT = "3"; + + /** + * 部门及以下数据权限 + */ + public static final String DATA_SCOPE_DEPT_AND_CHILD = "4"; + + /** + * 仅本人数据权限 + */ + public static final String DATA_SCOPE_SELF = "5"; + + /** + * 数据权限过滤关键字 + */ + public static final String DATA_SCOPE = "dataScope"; + + /** + * 数据范围过滤 + * + * @param joinPoint 切点 + * @param user 用户 + * @param deptAlias 部门别名 + * @param userAlias 用户别名 + * @param permission 权限字符 + */ + public static void dataScopeFilter (JoinPoint joinPoint, SysUser user, String deptAlias, String userAlias, String permission) { + StringBuilder sqlString = new StringBuilder(); + List conditions = new ArrayList(); + + for (SysRole role : user.getRoles()) { + String dataScope = role.getDataScope(); + if (!DATA_SCOPE_CUSTOM.equals(dataScope) && conditions.contains(dataScope)) { + continue; + } + if (StringUtils.isNotEmpty(permission) && StringUtils.isNotEmpty(role.getPermissions()) + && !StringUtils.containsAny(role.getPermissions(), Convert.toStrArray(permission))) { + continue; + } + if (DATA_SCOPE_ALL.equals(dataScope)) { + sqlString = new StringBuilder(); + conditions.add(dataScope); + break; + } else if (DATA_SCOPE_CUSTOM.equals(dataScope)) { + sqlString.append(StringUtils.format( + " OR {}.dept_id IN ( SELECT dept_id FROM sys_role_dept WHERE role_id = {} ) ", deptAlias, + role.getRoleId())); + } else if (DATA_SCOPE_DEPT.equals(dataScope)) { + sqlString.append(StringUtils.format(" OR {}.dept_id = {} ", deptAlias, user.getDeptId())); + } else if (DATA_SCOPE_DEPT_AND_CHILD.equals(dataScope)) { + sqlString.append(StringUtils.format( + " OR {}.dept_id IN ( SELECT dept_id FROM sys_dept WHERE dept_id = {} or find_in_set( {} , ancestors ) )", + deptAlias, user.getDeptId(), user.getDeptId())); + } else if (DATA_SCOPE_SELF.equals(dataScope)) { + if (StringUtils.isNotBlank(userAlias)) { + sqlString.append(StringUtils.format(" OR {}.user_id = {} ", userAlias, user.getUserId())); + } else { + // 数据权限为仅本人且没有userAlias别名不查询任何数据 + sqlString.append(StringUtils.format(" OR {}.dept_id = 0 ", deptAlias)); + } + } + conditions.add(dataScope); + } + + // 多角色情况下，所有角色都不包含传递过来的权限字符，这个时候sqlString也会为空，所以要限制一下,不查询任何数据 + if (StringUtils.isEmpty(conditions)) { + sqlString.append(StringUtils.format(" OR {}.dept_id = 0 ", deptAlias)); + } + + if (StringUtils.isNotBlank(sqlString.toString())) { + Object params = joinPoint.getArgs()[0]; + if (StringUtils.isNotNull(params) && params instanceof BaseEntity) { + BaseEntity baseEntity = (BaseEntity) params; + baseEntity.getParams().put(DATA_SCOPE, " AND (" + sqlString.substring(4) + ")"); + } + } + } + + @Before("@annotation(controllerDataScope)") + public void doBefore (JoinPoint point, DataScope controllerDataScope) throws Throwable { + clearDataScope(point); + handleDataScope(point, controllerDataScope); + } + + protected void handleDataScope (final JoinPoint joinPoint, DataScope controllerDataScope) { + // 获取当前的用户 + LoginUser loginUser = SecurityUtils.getLoginUser(); + if (StringUtils.isNotNull(loginUser)) { + SysUser currentUser = loginUser.getSysUser(); + // 如果是超级管理员，则不过滤数据 + if (StringUtils.isNotNull(currentUser) && !currentUser.isAdmin()) { + String permission = StringUtils.defaultIfEmpty(controllerDataScope.permission(), SecurityContextHolder.getPermission()); + dataScopeFilter(joinPoint, currentUser, controllerDataScope.deptAlias(), + controllerDataScope.userAlias(), permission); + } + } + } + + /** + * 拼接权限sql前先清空params.dataScope参数防止注入 + */ + private void clearDataScope (final JoinPoint joinPoint) { + Object params = joinPoint.getArgs()[0]; + if (StringUtils.isNotNull(params) && params instanceof BaseEntity) { + BaseEntity baseEntity = (BaseEntity) params; + baseEntity.getParams().put(DATA_SCOPE, ""); + } + } +} diff --git a/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports b/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports new file mode 100644 index 0000000..8d69087 --- /dev/null +++ b/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports @@ -0,0 +1,2 @@ +com.muyu.common.datascope.aspect.DataScopeAspect +com.muyu.common.datascope.MyMetaObjectHandler diff --git a/target/classes/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports b/target/classes/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports new file mode 100644 index 0000000..8d69087 --- /dev/null +++ b/target/classes/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports @@ -0,0 +1,2 @@ +com.muyu.common.datascope.aspect.DataScopeAspect +com.muyu.common.datascope.MyMetaObjectHandler diff --git a/target/classes/com/muyu/common/datascope/MyMetaObjectHandler.class b/target/classes/com/muyu/common/datascope/MyMetaObjectHandler.class new file mode 100644 index 0000000000000000000000000000000000000000..5047ded9a3d938175185a4d3679856bcd1178b95 GIT binary patch literal 1847 zcmbVM-*4Mg6#i}+W;YA{5m>hswx%77v}`EUD!@VV6@=46+^B{b6FWYsaS;L zKD}ZTXel?Zqfg*ebM1Qb=dJs>{(0-hS9>vlK@FKSp2E`tBaZ+QNLsZeM_^yB(20D}cgZL}Ueqxppqs9ezM5;K zZ~zB245#r7o)wtf9lNK@x@-9jqwZU_XDmkMmB13{ttkJBr`(HWflO{Z23K$hmcn6- zXvn59iZP~Ww{z2RmEo%oePiCKT~jU#qt*ST8FCdk8fPD-JRe7h0!p!X&!zD^jtUHV z%0F)@yIhp^T;r0gDuGYqZlXIeo{{5t@vM^cEzfY(l1;5x6hNowWDo>Vl1|ksJ9VSl zX#c!w*FCC*(JY6m@M3o&p|JirfmE3I%T`rsm=Ne|S13rXagGH^VH`a=rUcHmHttdc zkyh5Ox4!wM^~HKzG*ef%i+JYh$De#K+40=A1JxLTWL^|F{dh^}sAW6fRLe=KrM}7@ zpjvcHGlb9zLeTLtnf~+Fdh6@0u1vQbgiJdQ+I9*vIIZDK8hOkL9OvF>;F!`bO4kbP z=rHLoTWlDkEuY68E_r6#s7iy7rt2@(5;DL;Ey}DE45LBNv?Pyx2 z7M;3lDxNdW0}q*o#{&tm+jUN0!BH$Q91K;Cy7qzpnqZm;#X*yC%4d_ zz-@j?;4IfZ^l%;EwL!jTcmZ@Hxb|ZX^V|i_;mye1M|7Rw*~y8_zD?}k#Gzw%aOAy- z%nNrh{{9Azwaox$lAoiqEgVnA5Qj+)7$Vw!9O6_Q!$C}PKfw?J^q~+TLMIl^<1OL~ zTzD9d6A$n>wVTIFkKl2bJVwYPOCF=-ktL6@t~_*H+)3{!Sp`pTM&HCMzd;KU%TDDQ OR3J#Nz}wstc;`RD^bkJ) literal 0 HcmV?d00001 diff --git a/target/classes/com/muyu/common/datascope/annotation/DataScope.class b/target/classes/com/muyu/common/datascope/annotation/DataScope.class new file mode 100644 index 0000000000000000000000000000000000000000..ff3a9fec38445384d49f029922b46e4146c74fbd GIT binary patch literal 582 zcmaix%}xR_6opSg7)3=;{972*1!mGLP0emRq zoy0I`NL)1SJ^9Y*N&ETr{sG_yCl(30$US`Ojj$J2sEy)A9BOU#44C}1nN2O z(3?!P5db^WgyJ7(C8F3@Ny5DZDx)xsJ-Stz1gguL?JQd0beIN4`ShX^HP)18bAhv! z>sR`^GM zEL&p5G&@5B#-_-$x%(iR1;mOFmLaBKxr#HfVw&Ca)MHDqtSY zQn5;62NRa*&|r25XX6|N=c;HytH9!!%q6U>9+Pfi$MV-~lWT#HVfR>0XFB7I&bZH$ zwPB~!&KebK@fuo~+S#gS(}ryumP!2M3aWQqF0MPRl9M*c#yWwBCxH91-AbjX7UH!^ zq8;c|uwKOmY!o=PEWZw|8*8`By?U0$4>=Zja=lt$iC;AZRxk9a%R7_YY*KMPx&>+r z%4#zyZ1c7bI6u0jH+uP%%aVG=88DL3uAXRp zG~U_W+1?i|oUQNOvN_5S8_3e#2IOh9e`9BFXVl#jX$>hv8=_Lz+f-~vzd(%_dR<9h z?76PcZJ9%^o_DC&i3{m5gH|@JQAg*NQHx)od}?X+0@)=tr6>g#skj&eB&TIEy2)#o zmLXS)>m{MqAT%mzWe^F*%?zcu^2r>es~9Xu*FimWQHjGuJ1dCY0)sQqj;c$a8Vh=M zud%YxLBmWA80LVjJM~ht%~8!v=r%KvO)WPBk>ZuBq;r@mEMy9Su#PGj5jfc|cl)rG zjWZ;5QlRGs!E9C#FUKS)Z9XNQqas%jPi9al-ae+~8FH+ekRwYUmbE4W6*8*r__d@DQTrI_9Mg0aam%&q*<0Ten-TXx7z9t~wI zFE71b#T%su*SN9YlS`!(yh)(3Yz*$xcNL1lI?dKQO~-IXL%0DqsdzJP&b#SWEvuzV zvcYC8L!Y>nATl+&302B>yNWw-Cr|C%F59hQGV^qm`c-R~m2$s|x8g3AzO*)?GZ!Q@ zr{8dfxw0M2ba?4vzp)CbpfnTI;%O03z%L^7CsWRc? z9fi<%!4xt*m@$DrI8Ee!rOWUL)OP`YsfJ3{XrA+ ze+hwUt;7^CGuB7(F$Eu2@dGymI9_k0*ue>0@&EZID`07p+3Mrp3*Tco zY1kgbQv#r>I@?_?X~?`sh0e_b zx*e!Hvv3rduK&?Y!3Jl{fL&d3N$XnjF)Qw9i4j%}&ve10wN7UTMiW$J@@4pV8TYhG zO83`+>l@Bm`|=(Y>CLe&r}gcIZP2CKrf5+C zXOvn&n|dG1GfttZ_U6MPdS3BueHkelWFMW&W_8oaSAd#Su^JqEEuds^E0;~^%p}y? zypBR<$B@a>1V|E6z0!u_{=`&;ZWnbn#Az}ElNb0L_}ar zoF`Wc1#9%_Ex|}|9E)0N!cCEyaV$N6aHKj?Gl`WI7(?~Jm!66QCh+PpoGRf~PvE>U z)VWJ}-adh@0}|?Bc(aQ>hR75Pc{*Dv(0>q5d*mgZs&H@BL#WtM*&N>ykfi$J6S!a; zuOr-8_!5s!lyJL>a16dHy^l0$3?BjPHU;wD&PKS#@Zut(g>q463Au zV5L}wAK-`lx_2*5!jJG{uJ+TVe}bQKR-#|xXZSg>8>B9pK5|@OQ3ix%vlx|FrQh9&;q(Mqd4l8}Pt}34EZ3zDT!N zyL24)wghA}ako4Y7{`4FP~SX>PYbs9lM{IO5iDz|YKjDS_BnPsllVMahpGvDQF2}B zy2@f20i3V{xSF?L!_TAFGLv106}TR&IViXDxgIyV(yXQGR`45;RCN_0SK;3@Nr3np zrX<|p8ca&K!ILmR8qeWByick<2=M~eE1ZQYD+gjUPf>nI{kymuVX?hY;9A^!7O4xF7GklwG#twY3M zCFuEk0*muA^VopH2#x}+Iu$4mCIVB0-LDw`S>kXhhZ1)8-R_?uMtV{VBX5VWKOucO zKeYcKZD!(R;%JIMnxCP^a;Bb%y*#$II@a*{t~(`TC&^gSTA)B<3EbM5z|!R0(;yhB{eQ4}ZFPo){*2CR1k*x+cBv~-y24b>pczJ^$-`>a%b+vXz0xU)2FqcZwQp#?YN z6DUCMqkC?Ego1=Xpy8n*7k#4hA--ooKkecZpe-FdqjK?yc!HaKa zP_-))7wEj+czg{J@TVy#*$bXy+KebQOBVE~a#{Ok=(XkHf6LwUbc z{s%MR%JM`XhqTYL&f2#_JlH^6elBC&N)KU?oVM;_OS}e#Z4Gs{2CNGXI3C#lxl=$w zzgpH{9?BU?06^&M!W?z&@1jWmx<4vSgr1u*XprV-wVCjnkpS##DgJtt6z?FUX@fXf zOt?6*Nh4A?uN>YdT$OdUjEvFeWzcywbgx<^H`&ET1@3M=7V?)tZb?bW=;-&FwaV>6 zoq}3nu~z%%EKhGX)a-P+Oa^BJi+^E%yw!wn5}u?jEhSHCj_v4T<6itN++uqeF;Way zFT*ysA?`;G$WhL#sG()HZnw^Fp%`g?4tCjmQtY z4eZ3Tavd7Hx=rG8IFYP5PM$Z!!gCjy>|(xlh0K0j{+1RoMD#{da?aM#34VDXztRw< z?1FP8LWkaM^|^y7aADRANT?m}tp!wz-;WtUzZ#3R3GMZU41AW1r=y$^0Qzgk2kB}w zJAtswr5ta3Z8z*D6JwEAZ6c3nBIT7>-*=b*uG(lLhip5-n|&NuBeV2^l(8btms;gf zs_W5sa<0Vpw^kS!&ub4sG)13h-*My{NP6fE4Raw$hDqfRm;ygimFZg@-}+~g^6Y{|5LT*Romrnxtw>{42`l`!kFFy!2x#5eui#e{n8R0+yl*W zs`+6w{-w@ELM|=MCU%B!p_XX(YN7sIT^Un}OYlkq(}@JU#W2|%PFBxqXp{37yzuYo z!--s(66(1Z+DmPH{SwNeY5FZktOF%)ud_W8UdAdK0N(NlkO9;kM$sM1a9%`6urfv!sX z_11#<$W^wO#q4)Macp9l0tm*jO#zpj0LZc|XI_X;3U!d~6FvgntTF@Vl#r;kF9={> zeKA3v)`r4up4UBv-w!C?h-FN(w)2*52ID8)vJV?y6AaG25*j6g(B5E;sh>}5O&HNu zu8#v|`wvY?dJemm-p&_&@M@V>voj9q?^ilC6rTZux%zf?R66h#(KpO+>AgaiO^!2 zxebSDqXRFdMN{8FM0EK<5}NFVTeI5benrN{777oUCbkWZl6C#Q0wE5^yUbZPUdk~R zYYfdk;gsa2BBa#Q;`iw6Sg4a0|{hV|{5vO)~x3+gC^YiheGqfh20~ z9f#0r)4~VOR2DJTH^@Hmh^9SJir{GnRt?Ry{z8t@>TbraxS-LnpwU-B+tN3t@hQ}m zi`&gr?kUs6GAA2pZ-nDU1a>}Y`>7wk4xx#O&jv2xPy+XxFs zbA(L1?24RN2>eXX9abQkIvP#yh8NXuaSbBsc!Nl5t>dN3vU6$4wRDxQIZq=;^G48B z-|HTW8NaTAb!vCZ4=cw~hQM(MKfeDF`5gzpp_0`=^irKbVXE-MzDV^$4g-|mSI2)M-f!0@L(1aEK3~X$9Uiw+XtG*-{{GGV z@`F^U3NqAe{sa8|bI-SQ{ecstE}6B0(VZP1x>?EEY`MH22GCDf_U5E(I!KmZlJyqy zx%)|{K)L>}tj{mA#yUAV9h?-&<~^vpl^x`@@v81wXgfcp<9jiu!#>>xL$fC~4Zn}6 z?SkVAZT+}iUya^DfIjfd9>f869!}KiAQ|Tl#(+Cxq;sN5qS%v6X^FLTICwBdZ`V56 zy}S%GP9l13!${Eg@!BlzK6lhCm*VY;Xjc=pP&N|T5eK|^;`&Cstt6rF!GNi!*W<7D zB*{fwmjj}kfSW~nNQD<8q<(0H*G0+VnishlrN^=4Qp|fdujhd4dD|}3Y^nFO}WT9w`KnSDgV;L;>n zNKVCUYMB*IKHCIxj*pQ?p~}!rJT|l=btLp5qn&7PKw+zun0HtK{K^waXW4P~KG6wx zRMiSfPL07G>*gx)E}f^97l$H4P-NiD=JbqfJ=yK$XL@i6v@nv%h-F;T?-E*rUWcIt z+9<-DEsl;uJ**W)!38n{rh?|Vg6B<^nyJOm``qmnzCh&X$s+Qwq~ z=JmK?Q@*=oGH*pGZZ@mCj&_It;CR?vO1?#YvxP^AMZNZIz8S;Tm#fw)RsCAx5f3sn z60zB-d^c?N(d7(eBr~N0RYbKr*DmAkonv}*)r@0+S;WvQ#kj`XhsQL~o1Y>_uflb& zu%hA};Vr6~zbu{~;O}TW%_#!^h*Y*1B-*dcwz;RcUgJ@pu;h6uW$BvLOhjTq0bPxe z>*g2BSmvsJqjg=)ADx7;b(0$;iJY$A*na+)pPIzkg3M9vIo_#1cS&KRzUu}L_t0SA z)DQII9M%b#!Z~KwDFCNU%Q}rTA|P<4x8-#Tlio#Q(rq{U8>YM1zUD}f(Q|{S2L?Q* zq;*uzfMLyV_oG{$>Um#!O(1-io3X8P->$JUQE(-*fwN=hHvQEF+I?Rpe5GPmt`Ac{ zRo9GoAFNGRte@%P%iE-HRjjmjDLF&CIhj0*tp zpLrsNxS_42g5t&jh)o>)0)xP!h@`b2^j+v$Z={9A z7}%~Kwm3cE-j(3qwHCi6w)n#G(GTF1AxN+&Nk^J9Fsi4yN08Z`z@DJ8EkDvSZI!<$ zkhWyHwxuVwJ!&*L#n3CV8JtFgc50b{-69mB=W1D?m?l(rv0!ssP5XysI3g z8m$(QoWE421Geyy58U;JhzvY$8F3)uEKWPH~W3ur@LlOS4L z_&7OEg1AZW$RmVaxyE+)tGfCNas0*FtjU@;goaD75XdY=Ra;MGATv7LL|v4q(y^)d z9h+y=L#{a$&TZbzifcYRE%#`*O=`Up1@1Ji5ItEj-AQ98LmSO{A)*;x*#0%l{4BYe z^I#>>iAR^3uiPW7GDWsafKD#o+m_aIDFc)%oF|qySF_)-I2+`tRiRDIvYw%Ucdaqh z;tQmWa4!(cTDwZPPb7euXgu)?4{cvg_)}3>;=d0&LI z$grOpUdrXRhJpaUi^x}$KgDg%-y!dGY9I(kTqYR2*^{gUbeOE-+$V2t271DeacJSS3WwJ{+%wnlonXLQ6?o7Kn?l4yi>MbpU#sU=GFQ(Ga z>~RsUMh^ELQU0XV#Oo8H6v|A2xY+mTXJY=O;RN}zpBK(@te4&puXjH|SDHp0dt-9$ zt^|`UnWK2h1i_?lT;nBSpGA#?5*tO}zz^o1rLhBMvuZxOgZcutZY;0c`l?ymSgrZw z6{##BWeQh?!#N&}CZVUBehSCQ7jC0t@osH*`QEdO86Pw4 zgT0iWFwkUeq92A))Fdxd%Fxvbb2`7iIo@T z&7De&y|lSS6m4(~tUsq%jyrYroC}HB#c$?S6Ke!kP4e!D#@Htx%t=}7kZ*&h>k1S_ zzHCS>ESb*T)PGx`7qCy%cVD(NU^a_2SOVw5d)bNY8345D;is0%pV^icJUlMCTe$|S zQEg!DS(X*i1YP8r5-DbAfsajzD2Y74SByk{Aq(P~UYaEL^=p5%{Mnx$SY$cCQne)( z?jvFnx>vHB{bY#5G>TCI_xM>?EkCa>qwg*%gL%e{FxMe3I}KeBC`<4Wf3ZNB*qOT^ zP&VMZ2!s>Z6)8VJ}-|-${pWh_s4@?G$Aw8~kwt-rmYUh}!tJbupCcJV5 zn+2TQd9Po$PK69Eg#t>V!M2Y-mn`0qa20GWU5^m>Mrl9t!alGVWf~oW*pV)(~af=($kdh9(yij6aTDCO~N1IVqOFGIq zxoh5V+)K`bi)H>n8c|aZ;6p8+0atr(ci3}!cPp<`QhsvzKz0H3G1L48#n^QfGO9?L zn2KhL>W5K}s`6?QUq~|QuJIrS=}QKRO*lb33=yD`2JwdgCTepR8j-Ih#$0+9X>e>j zIJeC}JMr%1^8N@8JYwuR=Lay|{^Nb9pI5|-D;H|8j{EG8rKPc0B*7nJZ&r#0*lvXX(SAzuW9c?HKEw=FEq}ha=644fFlC z+6n4>((ylW;$P~&9A{yshnVmzjYDpHG!8>;$4q~N#k157`RdU)RNKT%f2(08M^yRG z`8njuN8?cYGUjnSt$j>0PeySXsvdIYV>^0h+Brc*&oasMx5Zx>j62)p-xT_IrT@gC zk0Tt#nEPGQ-&Fco`}Fz_x%9C%9)|q>*8ZDP|5^EvQy(h}{d{&8w1?9`_Sl04=Km;XcsK*kp7wG2 zhykmOS?U^Q8Cx)jRW~kAK?H jkA0L