From a3430f011f1adceaef8484f38a57018712a18ad2 Mon Sep 17 00:00:00 2001
From: Markus Koller <markus-koller@gmx.ch>
Date: Tue, 24 Jan 2017 22:09:58 +0100
Subject: [PATCH] Support 2FA requirement per-group

---
 app/controllers/admin/groups_controller.rb    |   4 +-
 app/controllers/application_controller.rb     |  12 +-
 app/controllers/groups_controller.rb          |   4 +-
 app/models/group.rb                           |  11 +
 app/models/members/group_member.rb            |   5 +
 app/models/user.rb                            |   9 +
 app/views/admin/groups/_form.html.haml        |   2 +-
 .../groups/_group_admin_settings.html.haml    |  28 +++
 .../groups/_group_lfs_settings.html.haml      |  11 -
 app/views/groups/edit.html.haml               |   2 +-
 .../feature-enforce-2fa-per-group.yml         |   4 +
 ...47_add_two_factor_columns_to_namespaces.rb |  21 ++
 ...4193205_add_two_factor_columns_to_users.rb |  17 ++
 db/schema.rb                                  |   5 +
 ...o_factor_authentication_group_settings.png | Bin 0 -> 44874 bytes
 doc/security/two_factor_authentication.md     |  17 +-
 .../application_controller_spec.rb            | 201 +++++++++++++++++-
 spec/models/group_spec.rb                     |  42 ++++
 spec/models/members/group_member_spec.rb      |  17 +-
 spec/models/user_spec.rb                      |  42 ++++
 20 files changed, 433 insertions(+), 21 deletions(-)
 create mode 100644 app/views/groups/_group_admin_settings.html.haml
 delete mode 100644 app/views/groups/_group_lfs_settings.html.haml
 create mode 100644 changelogs/unreleased/feature-enforce-2fa-per-group.yml
 create mode 100644 db/migrate/20170124193147_add_two_factor_columns_to_namespaces.rb
 create mode 100644 db/migrate/20170124193205_add_two_factor_columns_to_users.rb
 create mode 100644 doc/security/img/two_factor_authentication_group_settings.png

diff --git a/app/controllers/admin/groups_controller.rb b/app/controllers/admin/groups_controller.rb
index cea3d088e94..f28bbdeff5a 100644
--- a/app/controllers/admin/groups_controller.rb
+++ b/app/controllers/admin/groups_controller.rb
@@ -72,7 +72,9 @@ class Admin::GroupsController < Admin::ApplicationController
       :name,
       :path,
       :request_access_enabled,
-      :visibility_level
+      :visibility_level,
+      :require_two_factor_authentication,
+      :two_factor_grace_period
     ]
   end
 end
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index b197fd2157e..28c4380ca84 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -267,11 +267,19 @@ class ApplicationController < ActionController::Base
   end
 
   def two_factor_authentication_required?
-    current_application_settings.require_two_factor_authentication
+    current_application_settings.require_two_factor_authentication ||
+      current_user.try(:require_two_factor_authentication)
   end
 
   def two_factor_grace_period
-    current_application_settings.two_factor_grace_period
+    if current_user.try(:require_two_factor_authentication)
+      [
+        current_application_settings.two_factor_grace_period,
+        current_user.two_factor_grace_period
+      ].min
+    else
+      current_application_settings.two_factor_grace_period
+    end
   end
 
   def two_factor_grace_period_expired?
diff --git a/app/controllers/groups_controller.rb b/app/controllers/groups_controller.rb
index 05f9ee1ee90..5f90df579a8 100644
--- a/app/controllers/groups_controller.rb
+++ b/app/controllers/groups_controller.rb
@@ -150,7 +150,9 @@ class GroupsController < Groups::ApplicationController
       :visibility_level,
       :parent_id,
       :create_chat_team,
-      :chat_team_name
+      :chat_team_name,
+      :require_two_factor_authentication,
+      :two_factor_grace_period
     ]
   end
 
diff --git a/app/models/group.rb b/app/models/group.rb
index 60274386103..106084175ff 100644
--- a/app/models/group.rb
+++ b/app/models/group.rb
@@ -27,11 +27,14 @@ class Group < Namespace
 
   validates :avatar, file_size: { maximum: 200.kilobytes.to_i }
 
+  validates :two_factor_grace_period, presence: true, numericality: { greater_than_or_equal_to: 0 }
+
   mount_uploader :avatar, AvatarUploader
   has_many :uploads, as: :model, dependent: :destroy
 
   after_create :post_create_hook
   after_destroy :post_destroy_hook
+  after_save :update_two_factor_requirement
 
   class << self
     # Searches for groups matching the given query.
@@ -223,4 +226,12 @@ class Group < Namespace
       type: public? ? 'O' : 'I' # Open vs Invite-only
     }
   end
+
+  protected
+
+  def update_two_factor_requirement
+    return unless require_two_factor_authentication_changed? || two_factor_grace_period_changed?
+
+    users.find_each(&:update_two_factor_requirement)
+  end
 end
diff --git a/app/models/members/group_member.rb b/app/models/members/group_member.rb
index 446f9f8f8a7..483425cd30f 100644
--- a/app/models/members/group_member.rb
+++ b/app/models/members/group_member.rb
@@ -3,11 +3,16 @@ class GroupMember < Member
 
   belongs_to :group, foreign_key: 'source_id'
 
+  delegate :update_two_factor_requirement, to: :user
+
   # Make sure group member points only to group as it source
   default_value_for :source_type, SOURCE_TYPE
   validates :source_type, format: { with: /\ANamespace\z/ }
   default_scope { where(source_type: SOURCE_TYPE) }
 
+  after_create :update_two_factor_requirement, unless: :invite?
+  after_destroy :update_two_factor_requirement, unless: :invite?
+
   def self.access_level_roles
     Gitlab::Access.options_with_owner
   end
diff --git a/app/models/user.rb b/app/models/user.rb
index 95a766f2ede..564e99df77b 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -963,6 +963,15 @@ class User < ActiveRecord::Base
     super
   end
 
+  def update_two_factor_requirement
+    periods = groups.where(require_two_factor_authentication: true).pluck(:two_factor_grace_period)
+
+    self.require_two_factor_authentication = periods.any?
+    self.two_factor_grace_period = periods.min || User.column_defaults['two_factor_grace_period']
+
+    save
+  end
+
   private
 
   def ci_projects_union
diff --git a/app/views/admin/groups/_form.html.haml b/app/views/admin/groups/_form.html.haml
index 589f4557b52..d9f05003904 100644
--- a/app/views/admin/groups/_form.html.haml
+++ b/app/views/admin/groups/_form.html.haml
@@ -13,7 +13,7 @@
     .col-sm-offset-2.col-sm-10
       = render 'shared/allow_request_access', form: f
 
-  = render 'groups/group_lfs_settings', f: f
+  = render 'groups/group_admin_settings', f: f
 
   - if @group.new_record?
     .form-group
diff --git a/app/views/groups/_group_admin_settings.html.haml b/app/views/groups/_group_admin_settings.html.haml
new file mode 100644
index 00000000000..2ace1e2dd1e
--- /dev/null
+++ b/app/views/groups/_group_admin_settings.html.haml
@@ -0,0 +1,28 @@
+- if current_user.admin?
+  .form-group
+    = f.label :lfs_enabled, 'Large File Storage', class: 'control-label'
+    .col-sm-10
+      .checkbox
+        = f.label :lfs_enabled do
+          = f.check_box :lfs_enabled, checked: @group.lfs_enabled?
+          %strong
+            Allow projects within this group to use Git LFS
+            = link_to icon('question-circle'), help_page_path('workflow/lfs/manage_large_binaries_with_git_lfs')
+          %br/
+          %span.descr This setting can be overridden in each project.
+
+- if can? current_user, :admin_group, @group
+  .form-group
+    = f.label :require_two_factor_authentication, 'Two-factor authentication', class: 'control-label col-sm-2'
+    .col-sm-10
+      .checkbox
+        = f.label :require_two_factor_authentication do
+          = f.check_box :require_two_factor_authentication
+          %strong
+            Require all users in this group to setup Two-factor authentication
+            = link_to icon('question-circle'), help_page_path('security/two_factor_authentication', anchor: 'enforcing-2fa-for-all-users-in-a-group')
+  .form-group
+    .col-sm-offset-2.col-sm-10
+      .checkbox
+        = f.text_field :two_factor_grace_period, class: 'form-control'
+        .help-block Amount of time (in hours) that users are allowed to skip forced configuration of two-factor authentication
diff --git a/app/views/groups/_group_lfs_settings.html.haml b/app/views/groups/_group_lfs_settings.html.haml
deleted file mode 100644
index 3c622ca5c3c..00000000000
--- a/app/views/groups/_group_lfs_settings.html.haml
+++ /dev/null
@@ -1,11 +0,0 @@
-- if current_user.admin?
-  .form-group
-    .col-sm-offset-2.col-sm-10
-      .checkbox
-        = f.label :lfs_enabled do
-          = f.check_box :lfs_enabled, checked: @group.lfs_enabled?
-          %strong
-            Allow projects within this group to use Git LFS
-            = link_to icon('question-circle'), help_page_path('workflow/lfs/manage_large_binaries_with_git_lfs')
-          %br/
-          %span.descr This setting can be overridden in each project.
diff --git a/app/views/groups/edit.html.haml b/app/views/groups/edit.html.haml
index 80a77dab97f..00ff40224ba 100644
--- a/app/views/groups/edit.html.haml
+++ b/app/views/groups/edit.html.haml
@@ -27,7 +27,7 @@
         .col-sm-offset-2.col-sm-10
           = render 'shared/allow_request_access', form: f
 
-      = render 'group_lfs_settings', f: f
+      = render 'group_admin_settings', f: f
 
       .form-group
         %hr
diff --git a/changelogs/unreleased/feature-enforce-2fa-per-group.yml b/changelogs/unreleased/feature-enforce-2fa-per-group.yml
new file mode 100644
index 00000000000..6dd99e4245f
--- /dev/null
+++ b/changelogs/unreleased/feature-enforce-2fa-per-group.yml
@@ -0,0 +1,4 @@
+---
+title: Support 2FA requirement per-group
+merge_request: 8763
+author: Markus Koller
diff --git a/db/migrate/20170124193147_add_two_factor_columns_to_namespaces.rb b/db/migrate/20170124193147_add_two_factor_columns_to_namespaces.rb
new file mode 100644
index 00000000000..ca4429c676c
--- /dev/null
+++ b/db/migrate/20170124193147_add_two_factor_columns_to_namespaces.rb
@@ -0,0 +1,21 @@
+class AddTwoFactorColumnsToNamespaces < ActiveRecord::Migration
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  disable_ddl_transaction!
+
+  def up
+    add_column_with_default(:namespaces, :require_two_factor_authentication, :boolean, default: false)
+    add_column_with_default(:namespaces, :two_factor_grace_period, :integer, default: 48)
+
+    add_concurrent_index(:namespaces, :require_two_factor_authentication)
+  end
+
+  def down
+    remove_column(:namespaces, :require_two_factor_authentication)
+    remove_column(:namespaces, :two_factor_grace_period)
+
+    remove_index(:namespaces, :require_two_factor_authentication) if index_exists?(:namespaces, :require_two_factor_authentication)
+  end
+end
diff --git a/db/migrate/20170124193205_add_two_factor_columns_to_users.rb b/db/migrate/20170124193205_add_two_factor_columns_to_users.rb
new file mode 100644
index 00000000000..bef1b2062c8
--- /dev/null
+++ b/db/migrate/20170124193205_add_two_factor_columns_to_users.rb
@@ -0,0 +1,17 @@
+class AddTwoFactorColumnsToUsers < ActiveRecord::Migration
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  disable_ddl_transaction!
+
+  def up
+    add_column_with_default(:users, :require_two_factor_authentication, :boolean, default: false)
+    add_column_with_default(:users, :two_factor_grace_period, :integer, default: 48)
+  end
+
+  def down
+    remove_column(:users, :require_two_factor_authentication)
+    remove_column(:users, :two_factor_grace_period)
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index ccf18d07179..2d2507828d4 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -692,6 +692,8 @@ ActiveRecord::Schema.define(version: 20170402231018) do
     t.text "description_html"
     t.boolean "lfs_enabled"
     t.integer "parent_id"
+    t.boolean "require_two_factor_authentication", default: false, null: false
+    t.integer "two_factor_grace_period", default: 48, null: false
   end
 
   add_index "namespaces", ["created_at"], name: "index_namespaces_on_created_at", using: :btree
@@ -702,6 +704,7 @@ ActiveRecord::Schema.define(version: 20170402231018) do
   add_index "namespaces", ["parent_id", "id"], name: "index_namespaces_on_parent_id_and_id", unique: true, using: :btree
   add_index "namespaces", ["path"], name: "index_namespaces_on_path", using: :btree
   add_index "namespaces", ["path"], name: "index_namespaces_on_path_trigram", using: :gin, opclasses: {"path"=>"gin_trgm_ops"}
+  add_index "namespaces", ["require_two_factor_authentication"], name: "index_namespaces_on_require_two_factor_authentication", using: :btree
   add_index "namespaces", ["type"], name: "index_namespaces_on_type", using: :btree
 
   create_table "notes", force: :cascade do |t|
@@ -1246,6 +1249,8 @@ ActiveRecord::Schema.define(version: 20170402231018) do
     t.boolean "authorized_projects_populated"
     t.boolean "ghost"
     t.boolean "notified_of_own_activity"
+    t.boolean "require_two_factor_authentication", default: false, null: false
+    t.integer "two_factor_grace_period", default: 48, null: false
   end
 
   add_index "users", ["admin"], name: "index_users_on_admin", using: :btree
diff --git a/doc/security/img/two_factor_authentication_group_settings.png b/doc/security/img/two_factor_authentication_group_settings.png
new file mode 100644
index 0000000000000000000000000000000000000000..a1b3c58bfdc6dfb12e406484a62f3cca83b40b18
GIT binary patch
literal 44874
zcmdSBcRZH;9|x);D<cU}M3N+AD;c+$y~)T(w#dp>GK!FpRYZ}IRS0Egg>0dLveFVo
zvd;VN`JMB}`RlyS`RjOkmB+a6>-vt*=e@qy4IM2N8Y)&Q5)u-cGpdSuBqXGD_`H;2
zJN}Ms5t76|r1tWf@+2f>an$S9WcdGs=T-GINl5&8NJy@Pk&yhwm#)l_ka!D`kjz_=
zkeo~*Az^mETcazDZ|t;DS5YL{BK~*3_E7@9Lhf}&Q;B?X2RS1R_2S&kNc=L%8AW*m
z-?6W?m(3Z^Ed3dOnz}#fAcK-eY&Plc!`HJ@cI;%-uqXZ9mEw8w$7|n=%dJaYXS<}b
zZH!0{Q`{a9c<z!m&hgtjc#WU;L(s2Z8IL}MESTEa*Ax~$w||~n;LMwrOBs5Q;(vbv
zS%%**k;v1N{`Y5fSbkvl|Mh>4+eHuT{@-`xZ}G_eKmFG0H%t@tq-nWFqyCQR1)2q}
z*9wN1S?KVa7ysS2N^eO}&s*J+Nfgx_2;&Lk3RAKk=OSKCHtp{p{w0Sr2dKhByY03T
zzOd%#<s0xB#_2G&*gf4#MW&?7KWw@Dj*pRQMkKv^vyFAJWQS;vP1$C|?X5E@XMTAn
zzYQ_G*(0zlksayA!7{?A)F;}#>xXt9`#X}!&4E(6p+j9#U55+2^E(v=46ZpPiN-7+
z`Zo>*>zx{HZhP=<$(>?iV(HRPvq~bQ7A<F5vm9&k^768?3Ew1BLL(v~?Ck79O3J*w
zz14E`)YYSNKiAZp6i+Y8%KBN6z80d#xVn9#*wiH`sMdgQsJC~*eN$U^XTkZ3;^J8P
z?3|q6NrTIyiA#n~#)UO~Dd9a_Q;!C79y&59b?p7s{BAKhd`Pdl-^6(0yuC~IqpQRJ
z=fyd1H?nTg*VljQHeQ#P$Ls02q-?D8@T&FBV-_<LkxaHR?Bu6rCz~Ug1<%<^TQS^t
z+0v4uo-81{@k{^9aM3BBuYcBl)N|n9-Yf+UL7Lch+b5se;w<Zf@3q*3hlMFBDV3S<
zD>p@C2dj?7J)090TT=fuxHQ}2>FG(cYnQ?FLtZrn1qE(~>DgIhW8+g&QbD}E%my2C
zeGi`6_w3xcv(j;3XKefQ;^xNM?95Dtl&3O3Q`^gzRW&u=-&ODN$}5;v-a9mBFV>xx
zuloB>BrVh4y_%`QE$`n4ElzcC{CFPmcT1;UqTr5ldP87}nDg-S%RlZ2S{9d-&>g<g
zKhu+0f4(iY$n04}WMt>Ghr6;aV}<jZV%e>APrUs1@82i7wtT<c^e8AO$j;9G_3KwG
z`{`G+OR4JI3>{M)34YQa`g7E!_G>*jy_mIawA7I!lbYuF8BI10w|2|^)ktN=)w!>S
zI5MhNevH@q{<P85jH#~nQ&bF#iJ{?qSYGahYs8yp$OQQ-aHg_Ne5ehmC@=S4`QH7D
zSxMKp<Xq67g)F&)B=))H0util-#^rzif(z;(<6KNyLoVMU2LqDyL)L|T%6OMhKqrB
zjjQM99*~!Gb~<tEh3ly_I66Ll|ES2-hMZg=J(S+)-)6fNlKR<1SNDYd>$^rprunI{
zqM8blOshRDcgMCf8udSH4AuTEsZZ;<{;t|n{SN=<x6eulSyp8xT=DHABPsMATbn^L
znc5Wbs@xS76<voJe{W?BinJ6gzP~*FzBWLDhbJOCue`h*BZaZnVf0@A^D~l;Ln~ce
zQ<J-*r{H$s&`{|IZI_wZ@NC|2g07Cv#LSGHl~u#bzOvD;H8nLiZ{A$~_BJ^w>9qf^
zJnt{V98qt`QZW#<L2JvUrKJf+v_so&=6)U<8=IeZO3O`ByWs6zp~Guy+LqYr@JZp=
zrgD+L;ocJ*ti=<CDrtnQ33thyoSfO7OnYwYu2Q<scdHj(-#b-kR1_5xb3n+7<ZiD+
zq&Q#Yn6Yr`*H=l$R##UI4GsVP{Y%Zn&&$iJs;({~BC_X(BEE=vQIYB*zSek+{PX9}
z3X!zlmoK~V7LAo|(>-<hyR`d+9PY=$f+jb=U@@F9*%Hm{C!Jx!Kit=+`(<~<&)fp~
z3OB<?t`GE|STCi94Bgy{SepBE@<>=-$7)s->%AbS+Q-8JdCu=^ys^FZMz`P=Q7(>~
zmYY2HagC%sV8xh}m`G1})!Av^m11pYC+<0;VYsL4@ne^nuGHMz-1pBf+dm!EAxrO;
z3H-BA<NXCgIprZ0-BM6k=z00_kG=<OLxsjFF|5CrznL94a1X_Wh9)Lo|55Bdk)3Kg
zp8q_jwOVCaoNN@`O;ho4N0H_)v5XnRbAfv0i|r3WJ^I#z>l`Hh71QnO&KfEv*=3_H
z*tr79Zx_s>vcm{jgsk3yfos=9HL;Ndl8-Ums4^FbYdc?Nf|28A`Z7Pym!y`K+bGdw
zQ)Vlis><Ep*LRgHb>2U|d9v#H^Ad~ach+Zb`w!%5mJUyORBP}aRMoSv=$>67+rG_H
zCS}hf?M#`F&Gpr#S+h!)GZbgk)V3#^X37M8$BknIIuedFtL;`~pbE#pnF}z#itn7(
zP{$%|95OOAY?<~*?Ui?U9hr94(o!&9)yvzve(t+`jvi$;A+F)Jsk-`?XXC+dpW16D
z3s~%=-Jgfvpvhm+d6s|p%bSuPA8MV?pHE0g@ccbLR9Y$|L^<Lj{=k(svN@6Dx%QVY
zU#iUoZqkPnwi!0enB*H!Wm;RwwVg<MWh*Sn6|YLcx&10hta^?fQ*_Iu`~3X;pFkN#
zLrcpN13ugu@9_Kg8(&ACqW(|S?#|((6xrEup~!$wOjLA2H8^+^CE++f|IS@3B+MAU
z>rEF(t!fN;5_B0`L}_aFIwf}4Zog_Z`}!V6e{9TDAlb6U>+{b~ZF`PriHeBqSe+zf
z>Eu0lu%lKs=<lzvFj8h_=ArF}8E)XqF^Xgr*YdEySR~yKI%ITCH>qB8a81jNiHV`(
zkm<51^YZd?NV9u7DxCVbu8y5?sPsW&yY<u2K$*<Gr{)62d`VUzgyR#1k>bJv{`m$4
z1vEk}^6YcdSXg2kh2n~avtjfVTE<E|34Nk8HoS~f)#kJhVq0v)#?A_P4n4e}{2S|$
z`MBxelM9^}I`33Jf6gHr9Qg6&jiX188W)>i^6`-g`YZab4(m5=zm$!eo2=`YC`(z_
zK?zaO!8dP=#gZsFPo6xPmX?MR{%yF(OjDC)f0m>F=#vZB^2dxGUyq9m`LkfHr`KQZ
zI51Y>JUcm=rNcYwVq{Sp*jN{k)a0+t_Mm0QhKr^bR%T1Kk7f6{pkIBPY$fj>?+PFv
z<x3Pz59i?~cJcL+B~5z{M+*MGhC3!FJpKGuU*6dB;K74a-t(fi?YEw}jWZB3WJ5mS
zle16lR{#EGm-f9y{{$B{F)`8J-kzA47=K9R;#m0&dV=m?-vbqtjQxA|>|tiU{NuxE
z!^>3qM+5ElQ-|Gp`0(Mkx6k$v43zkId09?+IcR8TVDk@`SoZvpBgxWfw<)u-&>HaS
zymLHc{in*QQ_oRtQH+L$hnMI2K23KfGb$axeDd(*qKxS3>Z-)<ze@HoS2O+g?b{4{
z_B1y)A7<$2Ocq>2nMEUCSXd}87j3Uo&>hS;9l+{3<5s_c7K)D{+{@RmE{h+!7Z2a+
zuw}SGYBa@gBdl{eL-Nwc_V`2FuTG%G0j*dS1mz`Da-t|6K72SUD@#-p^LSU3!if8a
zh2FxCEQQE}!D9UUyVA@J4Tq{dXD@wf-AzzaQ#%Rl&`c*wPbju{&cwn}b)l1KQRYHC
zA&W)I!!|H*{pLQAckka{yLL^&Wkil*cXZ3opFf);Xwt=9(@IL*jEs!Dy?<jCf&v4j
zPoKtEX3B<W=?<n#xasNX&2*=e%Vg?5((?Y?-_p`@n4jMTd*q-GCNA-)eqd10>C>kp
zckM%g37TlQirR7N)G2_N$M!uLF5;&|M1VaqE?&G?S67$7qltceU_d!4`;LGGD-+Z5
z`l=_Py(?7&NJ1b<Z7-EleelLk8dh#bs@d*z3BScD3AYcwJ`Wrb6fD77Ks`U@xA-tN
z7S-a6wl*Cd-OADu8}9Jz*?pW-Z!AL&oUnQM`^y`=j*H9J>$?x3mVKI@9;$RT(_y?B
zD4t%6OF@+m&D&U8iEP`ZmLq)pIL%<irBApbCue6sxB9KkfHD&e-9f?n_5NauQ*-gI
zZ!7bEmuT>qm0HPLS>1p3Yz2d9bN;-2cN&>ybWDszrAz9gN3)o53QqJwDq30}Z|`q_
zGXDN2m2}bUh+Rlk^~$zNpKoJVu3SM4G&V9)R#J-DC&F{$L?1@<<jKFNT0-QLoS{w%
za<gt9UZ5f`;$wN4UE<>YcPCTi4<~d)&>q0XGj`tz=<;@8z;nDVDC`ynPW&r>j$SoZ
z!mV5M#>Q`|s;cl7h3~g%-8*S$W_Ah<3}rSbXk*)so!Ak+0Re9Y2N{`|VzIJNg5%gv
z&jXlbWSl#D_N;@$T%mDE3gJFyfnOy{((s!%W+o<*Cr|nZ1gx#DN=Zqb$?1RfO3l^P
zRZvh6FL~?ME!3T!jMHpB7mhim(R<7XHx_2IvPWJR(s(<pxT2`MdDG&ux-<92*r-%R
z?<3y%o-b0u;kUc9-L<9vA^I)hfilk0?6lJX%hAk&wAku^aoES*nX;MmTnQZ)$LlN%
z49anLb8~Y6E8jKK#g9u#tpYD@+qMn+F~6XIE6ltu5KE=wQ)|p~ug`jNat%PdN?h?{
zAEd$woD4S<xpZA!i&VL{pP#^@(qLtgJezO8bNKM*`FUVqyVb>Mz|_+|Us)uNHT3M+
zx6jel^*xa51C_W?&--}KbLY<K=W5)Di4hYQKlj|H=-RdBq+`ap8mYJM-VMYOvu=*i
zOc9#Il!x7V_39OVZzn0K%jgrOd;?kznRjDjf6-~tXh#9+M#>~EzPsW)lva(K+<VN3
z-?V%V-&IytMtwURmM69(;zRX`;#Eh-<kG5khV*EqYr0<k;J^Tz#KpUnmEte8#r=;<
zj>jH2m0MVdI%IR<g7-|<J{@lb$Hq%uXz7?@ES#4w6|c(Ox_x`GQ?Q<8-@Y=F#{-YF
z_Yf|Ac(FRscn!#pfgmg*f)(&CTZuYXE-e>}DFEY#yT$&|7D(<%Iq?awm6eqht5NFm
z_jep2>wPc$JkxTIXrz>)#Z<b!ZEbC3N0<4tFp0_~swwNcFoBx6pLP}%<Hn5}N=iy7
zF$2B5ET??<DHb+X#!D>gWq<^Ec<i<|H&AF@(O#^qtbpWmaxS1lq6lH;fJ18BCz}K;
zY961fO}lY!r+(w$;4eTEfR@8ychSgzI?+}61qHzavWtt0D=U{#WY}c_RR_FK;PFZi
z^^SghkkC0z75=d`h7DU7;N^W?5a`vG7DY!-PfvS$UVgqVUy`4n-y^Mi{(pZtnwy(r
zMFY2HO8Yg9%+u1+1_uY@*H9dH@7^6oFOZDA@aOOEFI82NSvpm|KR*IW|MYzUNG{|5
zOI1PP6Y3Z$oYPRj5S{FL!|W33D89GL^(r|ND(Sf=wl}h}tO36TEb9W%GCqE^A+%%v
zejl%|M+Fi{cDA)8F7(d>k0hLjT^1%9F<x348ZR#YV9)Fc`T0>vON*A#(A<3e*Jph+
z-{em4zPJOYc#=CmeforoE#uh#5RFFMg<|eSK>;7O3FaDY3w;D-ZEd9Ne53X2o2_q3
zEbT8`Xl#CfbpkN2;8kO451JQF|HN@1cW}@^L7|ybA>xJqZ@hw(tZe3}ml{P!M@Qe#
zkhhl?_m3T<Xn>Vi0ZhkDDZ-mnP(VU9-?g{%N=ut(={Pt!wZ42gH$NZz>gM^Uqt(^b
zs1BX&?N#6(xYs{{!Ot$fS5sGyq+!E`ctTFc{_^F^hq<|9Z{O}AjJPmyPBo@`9M*KE
ztg`1|TDA<bZY@3)w{(nx<^ltIq@juKN=;Q|Uw$M}7ir&O-AcPMM7PcQJWvi$`+nNU
zwohnM(>=0VVI{k0XdY>%+u7TzP>ceLqAHYHH#?+#A9&OQ9B3_7<+n7064}z)%0ST5
z*QYyh((C8P7A!3hb}9C_<a_rHu(45JN&x~6*<5{8Tuj8@O$!rK*htKK_kMf-+*n^<
z1glwGd>QX|GbZN3vb>|S^AFVMZ(|jnv#*mnY#SRJ^YinEhlc^Iz`v#0d&b7n{*5zM
z_pkXOb)JOZKgPGPU(kuEXlRl;r!iR%lw-KUuD5&~4_@nTZB^!qud1$IU0ah4`~w&i
zvK1T>5;9~beC)UUwVf4?0}=GXu4Cm8KQNZQ{{F#P5_(Oh%P2->&o0Kq#=h?AVx$T;
z7q~o9YK;p47~zOYA@dU!7DgLk+q-vqZVm;a8XJz9S>PA8UsgI}*m#9AI5Th&H60x&
zaa?rt+V3}(m@_7J_Fy1*ESvG?m$eVlzX)0rN4p1fQi^8U+}xbnXcdpjmfRm(SGQSU
zSa|pD-TnLbE61>+Mx`z+xU<JSDk`cy-$rX`IgXlpPx4YWDh`{t%Y9z8gY=J0E9M9D
z^*K2?17$cEYQK+FsB^`4Wy;Emi;D{jKf(QgX<zd2*#2l7Bi=RXPP)Aj0PowkZ`kzy
zxc2+^@1qvi`YrLu%GMhe8r?hTJ&*p>7JI<@h5UXV&WGq8;KitD)d4FPFI+gxIRz<%
z{^~n4dICjq=Uxg@X?8cf5V0gIe;q}aDSG^vo8gAJfVQS4X7vle0}9c~{LnGNb-9DR
zgM(r8=HltD*495!XtC<ma{9+Zwl>ga1Ox;YCYn1toq>stXx*itqEge);6HvmNiBzm
zhX>u@>LU^&*zobGym#-O+`%g}4cP9*;Fp&!eIBbQeExjx8abU6Ytx#`l*cMWqjWLn
zN}Cocj2yZyE?eQ((afGlyiTw0N?qGY!zU=1Ddv3V>C>eM8aC5%hsmiaQB>yIfR)^w
z9C@YQHINJig&iNH<#iLIqcO8)R{opoOFf`y^W*ih(yy&p8CX~(T}Da)jmE1koyRBu
z^d1faJK&J=m_l8|P}|#_<y_p)_t9Mvd#z`dI=m?~bi0a*%G~4Y*C{A^K2&=?%E_6I
zlihSUe|{iaDf&zT&%INZFSg&}v^ohnFiVHxFg-#1;yd5XbwBXkYI7OT5E>d9hj6TL
z;7>Ys>5<20pAswJt}Hi-sr{SN$(F%?Cdp|diLx3d7a#`kOZgzZ3t$!6o%8TxN^0u#
z(*cza9vnLVYB(y#g(=6NpH+H!<IRQIv60tbW)=24nf|);h%9M4yIJx5V@i4iibfYH
zqLR5N+f)C+E9}UMsi`Tra=_|hPGzOf#f!x^ZczGdrQ98*Ha0P#pj)%v!R_ZJZeU>W
z!uKbafB>z{5;Uv^&9;LH9giPB4qlyRUJP!&jqa@fd_MBsyLZ^_pogg%t)G6P#$pp(
zj|w7CoDddH1DpkaLL08O>rO)%`tkNzPk;YyKM^+HhNh+_3QlOMonU=6#LcNj(s4mJ
zH6lV;Q&SVT7yuPS7Hu27L!H8JZQ1ofH{M>_W2zl(H;XA%!|2>Ot-2JEt1UJ+T5PU2
zoeumX#2<p*@V4CX5F?fBqPY64S!^(LYwRd8GBT7TlsBNL&wURf=j#Nobla(O-+uSb
z{LrC8BbDTZ%S}y$c-5&dU(^SF5v4rKdR+1f%6JAg76?mhY^;##;FFAov=1E}XN--X
zRaLQ6@;Es;os^WMCs0vQDRRXZ79KMv8=9V;K2h>HK`jRj!QbB>nq{VlJ?&Tj?(XiO
z-}8phVNq|tPMbZkrF^L!8uGlZE`#32)%CQ~U>*^8jE;^D4OKu0-LZ4mmD)s|d$qN-
zSZKg8VFc@FrsI!`iUiH84l+`aZNC~9N9UKRm*g0$m(Lj8GF7{ePV?IP7Za^v+{e1Y
zyIKJST}RyW#HlGb5AsQqPr6HXDW8($cy+bt29aL)d>z43$29F{Wjz`A#~nIq?r{tl
zz)W|V*p8Oa-4v&(&$IJrojG$xNh!RfM9}L_dU|?%yza$|0=}E6M|ZIK%WH)b8bAHK
ze--0{i^%pIV%;8J45T5P+BG`5uWoT+VWc+T^0{*vV}o|DBIi+HfMD`;ABek*klZ73
zMfAkb&`==lv|P@dJ5XS5D54h^B!u?N9%H1MV=gl>*VkVHX8?$#VH58f9=?-Lv6KC)
z4cXgst|Nuw`(5mADE0%&gK`WF4RuU=_zE|D`q_GO-vC}6U;jS(lsv=rfV8iUrKM$-
z!IQK62WT<~XY?6$`^%X!KfQTn!k;84`^&wj!sWCkyXGFI=sD+~6!Opic@DQi9(|_h
z<hdTWBeDYxBj)B!fI&MO8{h|?5w4s&=aPD6o12)2bGtfsa5J1SFc`cqe+?wnS2_dK
z?XiBNI>`_v>2@<Sv&E|tr6+h9qW~rN&8z4`S)kaWZySz_x&!V&QoC}6ggx#JfLm{G
zFRDASoaN>UA6AIAx=OuWu4!-f6SC;e={i(%)R<;KF(IofXgv#)%}QLl&33|-7(DDT
zH#7)7KE6MJbr~5M`T0k6PZY@pa5y?S5lIm6|E&)ql9G}#GVC`G+x^I6wVE0n9wy4;
z+S+b_u+ZoC@K^nKSG}}2-3e_(qTKr|KT~pNc+yF~Ox=jiX_Pi??H+V-H2*J<&^%|l
zpq;FIe~(oIm}^MGy_2QWoS*61vVs1E(6Po3*OpSl1T;7&^z?ZdEo!{V%F7ega<*S>
z=<jEEQXp54@|vY%VrJ%SXSeg5Gkcs0MSO=Xk%Gj=)&;J5`1}9;^YasjOdv%7t^7`z
zOb$jyFDUG5D?e7|`XEZ2ZwjMClYaX2DHKq#F0!FYp*yAX?Yb3DSoti)`tn$Xv<8I@
z#QbHZZa9Jv0P+Bo`hyFCx%hk;c16DgYSc*E#~ybip~H$hkA^TOZy2ty*QU%wAi419
ze#X3IE_&WlYhmt+2swrWbIgS6id@?oS!splj?UEbgxx}$^!eN${`oPS4uHF+S{tAb
zA)Zke@sU>gYuz?wF0QU1H>)38q9H_6?%@Gz;fBoe=#j_|No%LDvX>g`5nQ{Iu6X*o
zO#b)*tl>7|-f2_z<jE7LH*V+8i`aFgfapT);Nj+e_~;Qj)}fOpO|x{clIfhAHzdyK
zGb$Z}Ve>x3LZBdd{59Xul;>H-!*`Clq<tAlo1-VxDY|U`kAVto1_d1OlV+b1v8`9(
zW;hLn0kzI*aW4~7f!&0yk@SZT9{}~khh7k}u9P!{5lQwD?Tm5&ec%bm8X9$qGX#^B
zX8YDCozt%$FTAL&RaaN{lg_BG50R52`C75#`R-yOrNL%_z?qtJ+=YUB%P|qsIKhTR
zHP7?w$cY8cD;LOS(O(GsOe>!UR4gqsb3bEuH{LcbN-Yh!N#9>!cx<5(c&~L}V9#P;
zaP`IQZxV`%T%DW>Aa^Du8QR!zaTl&%U!^gv!CYdGzj*P2N$}hYtHw~URd_OxD=lC6
z#^*i$#Q7>Q*O5JL_R}YQ^tb1qwJ;Tn)9Mlu5*8K~=*s|o5K8v3vSMG01L7Vz64_$o
z7Z6Z5OdVAOe==lChLijB>Dq#VSABiEUs!AGw15_K{`@Bq``1%5GgRSCSV?FDsPs+W
zCEb_){`r%boa|Zs4v3XzpKw@<&FI^=&!0aB&G`y?hSgV4Tnri%g3i_$Wmjf0!GtCQ
zs{IWuN9N+YDsWP>vu7{Z+RCx(E^cy$mXws}@S^wqT3Vu}q`bNj1Lz6Ns3B}ObuGjC
zmV%b)P#M*O>)mz=A9WUG7!&r5bgdRxG}}Gp)L{~(`yezEn7f}TIwvcuEO2!ZP&_3q
zO~Aa$z5n4E5WdvZR1HTUg4eHK!@{^#&j;6Hu}wJVst~B4kB<+&pDbv}6SiN<<Kg4S
zU2osMZD>H}M5maYB|;($-HH51R(p7Sc?Jdsz?rO^GYbOtg`(p?Nx+z3e-#!K_~T}=
zPv9&-a_b0qd$ZfFIb9Xh@C=3D-(UHd)ZAP<BcnT}_V24MHKYDDHck@d`I#BixwxA*
zAM(CxZdRyR1|7Aqcz@ii5-P}9fn-oS_&Y{i@p396v6fYi*IR5xJ{G2F@4YBSe|ZDI
zm0sibS(XG96?JuIuyBYjGFb46Twr)dj~#o!OXWqjPyfLS)3Nj~H@Jmq)0KD`KAj(Z
zcJH17_32deM!T|?dVW7DE6v5#vmW-jD-sRqDa%jZ>mh<%`h4nYYH-3XT)03cK)qwf
zH7U;-udgFN!Ma1%|6G!nZ-n8{IGU})3j&zx5{70z0%nFf`5-$R)4zqQ8ySZp`V#OK
zYyUJ4&kQ~TfqYvV@C;>p>7gYrBf;g!YLChf5SfW9&~{26UIcV|Q*05i{8h?#!77~a
zb2c+1_u<1|u)apmih>ij#c{ypR8&?b>}1BO4c_>>n{fBuy^z13AAtkLu$<t6IV2-f
z2iF#i0njGVTwv?_^B?!Qcv6NtJ39vl%R{y{51jG=pte?4-f8lhl9Cdn(7xI3b;^ky
zH&d}q&eeG313ThcA(>d(lpJE|qJKII5FW7X0)k*=MUroXron%m?c(LILx35)e0<<0
zZyK)d$k96**Y>ou^v|a_+2D=eZy<1>{V*{zH_J3YX9me9s6uxK#sg}q2S<PML|9*c
z079!mh@Y=7Pyl)2*B?LV0zMpU(*JfZU_Y%rXcRu6+(UOo&%C3S0|0ij`l7u()Tb&k
zYNoJ=2oK4-0H=V|0D`rFtGE4PZ$Zw24~<Cz6Um_0J9n-Qas*~TJ4MKPtlSX<VD_gk
z1|EjUV1GY~F<2z%?i(!2I1bql@E(Z#XuRH%D?ahgomiF=p>3ZUC$2UDt--PaMTWk7
z@U5Di9Z$+hs_<+SsPb~gb#K5Vcoa9HqD-G%JP_FoGJlo68^sX<35yb@2G{=k_is_n
z<ix~=HK~+O?lK}XAbsEs05ci!@nzU?QBhPpW$pmVN=jsZzGHoHUbR<MZP%9F7(~Oq
ze0c?92jzk2al9D63qwXZcE2B5-r(RMm}{e*lCQfCil4c8m+t|{2I83Nt2@Z&zkI0=
zSP|gj%Ekf+yLJ8gb$rWve((&i3r~Wfkr9EB7p7o-{^$OjXbqlYM~{96LiY8Q)V<Uz
zuK@7njZKbH9E(~3bSWbvqn7go%LMbIrKLqrMx|^AWKw*tcC0=mghC%M4|BG>yo~gM
zhJ8{}(%~aVmV94e%Hak;C;%=*H&s?w??ho~X(3C~81T~3>BS0Q<~O0|;Bdn-qeYxS
zhnYFKpZK9ym5`E>VsiE@{Ny*|<6B^63o9#;4EJ+@55Dwf?dW<3u7P6Bm-H$vjdf1A
zv=;mnTnqx15L5;DvurFZgMg4jL#V-YKCMqoTqyMJz3+7Xdgn`pP5zZmDUTy7j=>kS
zE*(#A;mc=QaX3HlsOY$#oBcm~b5WM|)bZoroI4lt<#uIUy?QkxgFU@_7`(Yb9UL9P
zG<)32RL33;j!YPBY;0^8yoJ?3@DGR_SLH~wDv5>$Gc&3hCabW#d~jq$lABvmTU!u3
z%;SiuiAmSJQ*S_7!~zpLr^iM|8@F5hKK>0@3U#@uDYSWVWOVdu04En$)8HUnJbiwq
zxP2l-Kc{pTnMA1E!Ryh{1O5Hr!hQg2(7#{!En%Tjau%6Z^bZbpy?(vCvVz74^yhiz
zOb28}X=!ODev@8kp#+M!HcxkVcORdKsw%7vYzU%V0f7Ka1@#+|2M(v))YP-^olyC~
z^a~5W+?Dbq8m2n2Xh4P*7WWbo^wBxchS}Re03jb^Q{rQNJ&>B3+P6B#l=%((Ib&lL
zMMbY~V-WP&J_=!(cXxFW#gzjGpe%m>@q>efrG0h@JEFO%38f9&<-CneS2uJBH+J~b
zckax5{J8yR9u!+9CMIa@qGDo0Z{A1<3(q5J0_`cKIIMWI+S4AL1egrJ^#L^vvf0~_
z5txmxuHPmmtlU)wL=UjA%+1a|g5QDC2Cg(UW!tVswB|r(F+u7oDo1#DS^=1_ug1rT
z7Bi5fsAfPw0Qt_H*iBH1wC_ruIB_CAI}g7ib?VfY&!53VE8WIr#KoD+ZP8y*xi<d(
z*57-Z-p1Az*zOIk3oIon8~1Zy|NffGKWGK#@%p<cC@6OAVx%AiriXrBSy_qdjX7|_
zPIGX`%gW+R?-myma~-d%y>@K}rpm)3^b@E#^d(#%ec9)!DcB%(wzi5N*eq`5$^ZL6
zdxp+){`F-quU*vCB5+50dnssWkWYA4UXFz^G%)bVT@sZL{52K`d)~YhU%!4`NL(CN
zMUaWf2u2NM<mBb=UDF=5FJ7QNlDi$QC@Z6+qr-UP`dEdm8sKTk7c?};ArS$CEG#Sx
zRTg87ZW&LHGRkCcKZ{Zd#!r-*#KiV~km`6?V8hxE=~diyEG!&)N%iM1U$9$H5CDPm
zw5X!80|NtriPFTJnXsJ_6K&6*--G+Rc#)lr?QM;>bMDiI`xT|7*Q27I0CeM%n>Wp0
z_?`$e5qW;kF>M)8iiSoES5sL@OHIut<}?UF25`tR4dPqqPsnZS>+3K`vHqKyn*nPK
z+^%3KA#pB9NJ>^gW5?=(!Z<lONgw`N6j_ZECr^%n(JT_+bOEoQn0WS(m!O+?I~Spd
z?O)UD1&WUsGmQJ{27U~#Gbs@2-@Pl&J!No+=3M91i2ov0Vf0a(C92h%m-bN91+9Fy
zz%;{pq~wGRiMIjq5B(|`Q&+N1eTKmLmDS0&<I(=rnr;^cRXTm-6s9if()`6Te^yz!
znfQ!0kSj#{e3v6tI3yf_W5>RrYyveIywCXiGb&N-0u0p~dyc@>VPIf*f{vp6ylOH$
zhU&4;B(w0>t$i~6hbH6#po+nIf%l91M}5Vz-GuGRefY5a_N=(M7}1f|uEbRkK?uuI
zCr`r7qNj4yi_Gj7j9KP!eEd`<C?ohqc@Np19}Dp{iK5-vyw!x&2~8y<>k5r5(f-M`
zF)@+8H#(sm8>20Rf6!{Yqn^iV?-d7y-{S6)QyX?d*|!C5`_V~yenTxM+Pue(6{5iq
z_YVr9KxFOp(#0Jm*PT{x&6j4qClgeTY!J6&<{IJbl5$#=O?j3el4)3Y?Nh<qLqo51
zi>`~R`ehsNaeixyOrx9)$xF>-K5*c`kt2`j470|fB82kw4Fv6J3CB`4!|(Dsv0e+d
z9^Bqc5-TS~6M#Y*t;ps3mV0W<^;h7~CRun7$_6$r)J^1#4)RszrEznxvUJHWI0-Y~
zrn40a4N6+rds9PMm;Ms+4cWIlBBWmP(lBT?iYpD-g|-^3P!`^JWqZrXS4N*!L&5Nx
zT6aYL<HzsnL$+YATbs>5zDJsbf{JuQ<ohsPjG18&!NxF0@2s&g`Po>xc4hCpf~7cZ
zlZvHO3DM9amDcuRqw^87^hrm1yl8Y&-xp|J{I#?F=KdjzQ4Q_JgVrCt*|Y+gl#V*4
zb=$0t?OPk$C(_n;@gJa7jM-u+`E-PfDY^$XWO_Ql%NY6)U9IWD`0FiI5!pkcnwC}W
zSy24AxCqF*2>S6ObK?WZibCaU&$D>+$~;Or*oy$e4JhE)Gn;}P!C7)yI=;(a&jN&^
z^OgH=@<HHnBn*UQQ&1Nv|I3uIF38%REKqU^sy=waWoC<KYyMAvNCur!cCc&pf8ozt
zt*acu2RcIPc5Kv-Ft5n=clA)e+_p*6#=M9AdckI4;Ek()pRN5b9J(sGWtRKjUiv3^
zO32AlF1l^c^a`X<6<?~z`QyBOE9cWV&(_I`L&P5lU3cyMay`&f=tr(`c!%_AmU^An
zYZJqR{fn88e_B%U&S&o8Fzh6(yUlX2kNo?EgB;s5Ri?(nRJlL?^j*+e3LzOX5E%Dm
z2bLk|GG_K{jfDm>2&ZcBBtUK{IFPKC<5B%$@~7J!H~nwpe@vAABM?+OA9IcGhZg`h
zeH6w4SUx<lR%rOg!HC{gx-#5&i0=Z)9|>!p_TVup1v!FUgCFDh!Q9P3cj)2xz}%&w
z5W{b<@+V>f!)`%9gG8B}oV+KAq%-0|0sE?I;7la9?w%Qi*=wqh4v{gDS-sLz*-`b1
zM{N0$Qa*cF{lOu81K9*qOUs_Sy99%!!6=Z4cvyaw`hqYr2A~$~2$Cdt2Px8l#t~hS
zp{Z3i*R5W|uAkbvYe$$y7WV%^Uh5A3*+rD@{=o(#Hb)_&pJfOCi4B>|q6gyLV$tbA
zAt7rmBeY=g?4rfFb04sa(f1wFii?VpRJp_G4HdNbnZ{rEJ$>@z_KP@U+d9`Oe>**Y
z;pBvsOG#a!Y_XlTPtYSi)Q51qmJMG2gTBqV+W{6Tnm!h6N+(<Ko7AWjw;^uFa=oEz
z8k|nkqE34u)WoX}+77T*#Ir`pZw@@P4l~v-DR8;jRqzp+xOX+))Llw5rbIypeOR}M
zBKFPD5M_81&le}(yOS_eVE5T*ZT_khc`$v5%2Bdh=Alo8DeGPnZ!1y0GcZu`?#KA}
zWVn*j?m&(eG3xtr{hwJk8@^OQCP(khqmgo7hj+wf8Ez>W=5xDl))5olgbot`v$jKF
z28M>{Yt47W_v}f4{}HN7u7b?cs0+HgPjk~*e&~56MMZ$^1~DSGWhPLhcoN{_H|<6a
zZLXISs1eBof~uX}4912>JEP0)DY|hA>$HbdawqIHWVKXO$Vu-zrnT4{WsE}13wp44
z`tjsWBu^Erktjo+4j}dXWnIR@@v1Lv%HaHgr1B()Jyt5>1;QezUbv709TRq77sF7l
z*!&G#1O_!r2mVj!1+FADsr|J2)PH;tWQ%Um<4Xc|2I|n*d(aFrH@y7b-YX%Ppepl=
zAO}!e<aN6$fEK0M<N9{;!dQ5PaA@bWFcqnxfwA$@YT#A5hCu|Y5e~U?=Z@2y@St$;
zx^HgGLF5|Z)pEdSV$$^ZnF=c_@3h!BIyyG)&U;o|ti_jvdnu?B3(L*}vPbkeCx@(+
zExLt)f>h`rWL8$?;#ZJ`f2$(%DR*#UX|<OgnKCMbQH6Bm83@;LhoX(Wy$c|y2T4>B
zu|v|2CEp+te#Fkq9`cR6SVPf+|3c@h=J!9NWHh8RjJo*zOH_v+Dt$e(v<j{%30n@+
z2uxDxF|8&c@eIi+P)?*f#s>yOWMxB!AD=~yJpu$2)|GJ@w2F=Ci%vTh5&FEDg@vXr
zQ9D+?$+B&{`0UdeTnq+qbkq+R4QYUTQl7bT2ThRv0Gk3PM*n7{Qi7fUYJVhE14dJo
zWynSal0%S8F8lZd6GI|xaR}uZ7nx4Ot<yD7R&IqMgCOX8*ftVw0?D2D78#B0<NFA7
zL61cK64{q<YG%}>+qs`PU`D}Iw|dr<F3~eS4x)Q=zf?cWk0K_A-H9Eaex9oflmaeB
zD_rz_0Ury=iG5mDX*2Wl5C92C1kjUg4i60-Klg&TVMR5cISn~My9I7Sj*L0F1tu(a
z7;@jhgD}G+VJ;)!wlvdyjGy23>FD{^n|RGQMXr5fPKjWhz?$dJpGWvg_|iv3kUrVX
zKj&dnKqH6$ya7Fdbi2Hd&oW|K9v&Vb3yrUCcTOXBi&uwD8RY1g4|7+CmsI^`b{^0j
zUalTW0KKqP!xg;k9s<%|(5D(wkJ3{>N<<^u)g9JG19h~!v(v1?X$U?JVo(rDeGoMS
z83$=EHm}x06Rh|K`ihHy`cSNw{}tLfhIz!L(u5yM$!ACmaJIlRF$S=8H7Snr@ufjL
z1ihN_K&G2?7aeV6LUOVMxHd+Fo&elC49mpO4|AH5nwno!6twZzJ4a6nQw*NYKmaAv
zfo5lJ&JQjAt|W3-Vi1I2iSs6@0S!ZmVqs&8R?J4tMS%J^FYop2JoxK0O_j%wA4hP~
z7C8Z3NCnSeMUa*az}>;JCE8pF*<nqg>LKa=0VsOt(!WAZvAB}8d+P0ucjiR8vbOTb
zkyZRQ(ou*gA_j<iBHlO#3jgF1k0!K3y+d|HRFiJMWGTc10BgJ^W(A9mJ#puyAY@K^
zdfXtxg1bQzfX#=f8@J{F+5#A82m&gQ)qwDAY_j$80~e=mfP=w{C@d^QKpIf?5Es|E
z`e4n0UwB7M)Q7qt^?`B-&?Y7<hx8DsL1QT{UjF%W-zgs#N5{`lZSZ2)o!d08<q^_y
z5x0ATK?d%{yg_P^<>n5{{ftHOzN3SvX?RozzDhib%oSBQfhU2Clr(R+|CyU5Z`4s&
zxD6OL8K18vN=hwJdykn`IN>#v27Y1Jr{p5hbAGNjt1J9|0=8#FSeWgF3rTnG&>lEh
zj`k<2nR(J1I_86df~efj$Bc_1>L(^8A%XdKZB5X$JP&3L@{y24_U+pzs=2nh8Xg{g
zKsNYAY3Tw41CUwxGYEa%R^>h!yk3RTP~^&TJPDo!F%Lfqtu{VB-rCw4$3S=)u{>e;
zurp4>QYf*MoqK{bDNx1@#ca$}#l`o3A<&CzwzafCR=W#J`Na$Aqem$dcODNtv4r^2
z%Gc3^+|MwXpgI8ZLr6R+A~Mj}XpJq`)w><M;V+UoXV0$UZ}>r(!GCY$5|=tTDe2VI
z6apQPzrDYW?bV8nj%E{e&^dc{6dMQ}5q(Ny;8)e9PhY=%!|4XgvuCB8hxxIe(VlLp
z5Hr8EC>}UYvV)u!F7#u|`Z|bKD6jV&{Ri`OVdlc(3i&m+TXO&a{0pWFcZ~EBYN$LV
zRvNNQNHk<S`a|`>DnJ0Jq_7YS53j|jIRO0+G9ktuIT4^DQ3;9hXKoyt1K?~BHQKwo
z$-4i;hJj2Ax}uBUvYDL8Gis1XSX*05Pf7WO#drVy75XN-r>lW7q$lqrCE>V&hMC!0
zXhuj-fb35NF&^W52&V+y4HquW4)NwYEG%4C*e&R)8h0i8P(v*(Lr|chJs{b2+1>p<
z@2jpZ4M-o*yP&YQeL8Dqrl7n1>J>_I<UC0a>A`X3oN5ZE*30*rYzhba1cS$#GSu9=
z<5B^({#~S7kt>dm@4J0i9r`6A1OsK~+c4LD{{Bx)9<!hJCkm~5_g<3RAC+z3j9gfx
zg{wv?Axj8e6p9zt3&cn)GK?Nqn9JMB7)Mhlr+Kjd=;-Ku&&;f?CsB@xv1^z!us;Bg
zaN6RYG%;O+Q%7H*8HL?~So&vm70dVANZGZvPayCy|58dVZ{My#eCZX0@{Tcr<cIJ`
zZ?8Kp6to(MK~xjXUnVm%KK>^d<ze+ZD0~QZ6AK9J@$5X*OEe0!Cf0rXFo!K|Z5XRP
z1g%UNBql{eHUrTS;hDnT`1<x)95GCZ6?)QZ&dR}I1h^UQvRw~%!?XwI!_-_yguVcn
zOwG(-%Up(L59mC#u~YRQl0t-oNx(d>q~r%gAE2y5DzWqgyjK6f0CFto4Ul9uXS&%4
z?GS<iSAn0MY;C6|CP-*C2-i*cq3_1V#X-j6K$tqZCG^CZ`Z%UL9k#el`~vaoa8fce
zIe3fe>cC<zA~AziiZ%|TiI^hl>gwX>=N~S%fX)7MuJ6!ws)+mV01@a|Me{J65ZsC3
z4fF$`XcPra4GkX6w1@fm`}XcdrP;aW#>qX>-@j<4z7h2giq^C4GEv$T>lK9&nexrG
zV6AFy<%R+ZzbM)b!Zj$X*oCsv(szx{96#^iQ035<4fTC%`K=o~p+m|yOUueSy1Sv2
z5{0s|^W>bQ1Y7t70Edog5&ZWxj(6D)y*%DkdAd~@okj>n0>?AH`4mtF$Yns(&e3xu
zrqXnI8Hp!S5P9HKG&2hrDlo);MO-qks3<%r$UV#HIE~13?+;5miU7f)q9S-Ju+&&x
z(-2M}Jux#i<z8)m<j4_+c*tMKLLiogwXQ%Qyha+AgChiCPLwwJ2k_lLe*Abp3VZ|o
zk%3@vip;d_`m0~+IP-+z))zeFgU=u*-MPcWOU3T6o8aN;>Fnf$`Lz|^7uSaS+QDf(
ze!qa-;1uKny@CQ!)sL?NfB*gM41{IfM4F@5G3kzXfi#5P{nV}-NFi|c^?~EZiy%M?
zDT2aa4Dms+u@_Ut#I#fG+8#N&7`s<j=j9v$+^ozBUZH5f-Lt)Tk#-Bkm4%fRxxMGr
z)r|oMC^^wg5Hf^CA)F|f+=*dWTv`HXPwh)dOeEcR1H@q?Ge783+kZ57>vFG`;-;oh
z#I_~DrF}*t?Ck7djUh-=Vy7SgAp)v|;{&19+dKavvkgTFUHuD+(WOh5aFC$9tPF=;
zFvn1J!NjJQR;}dajWQy(=M^;#DQ+j-zU}2P;SPgAtt<OQth%6$vd58E4xqkZ+aY*n
zhq8wTK?rngZtaiBaUomN%+e7$>jdPZm#?9v6(Of4lL`0I&Cag%`pelR&hpzwE%}+6
zo%f=N2_xQyhM><ll%+sUxQ@)8mzQ~s*HOuxsNq=E2Wh$@Plj*v5x>3i)@UDFde5xL
z+p~sy$!30`2!c^Kq(N906&7|XpUiY%?2E}U9_s5$Mb1W46Q$4CIJtRJBSk3d{(UO|
zN=RSQ7z(g3c`apis~m+8u~ph#tq<*=Y%5F~y~$wk{7SAP&flDgW5KinK%jEy=;|WZ
zf_N<e#`2Hxo?V=@kvp_cHmCqHkH!3x0|J?ZtoE+@=vJH{K}g?(nV*SzU7S$~=bKdJ
zP6AdUq<|)lxM>b7b&M1b--#&HMq*>*OG3^Ta3`WR7IX;NBrHnQ0hk8(+bZa4;jR4G
z&7Ku)A%R0;@eM)?i;FnD2Z>oqaTfw0v5pjpy$CbIc7&(NK=76RfZ{^Fiv=MqVwj4R
zbqwf@Hgf6v`%^rE&JSpe!+U0Dr>A!lfRWLO!3&VX12F>N1rJZjMQEn<jNC5NRN6?-
zk1r_+6zSc;3ls8C@}Wmia-zS&i^aC1qo%$FX-`H5MHR^|KRMzD3Ag`+r=tZ=uG+Df
zkqLk77yULlsjIK=`DOU{t-HF{pFO*b?)4xK{+?>WCwN)xvLPW`NV~xK;JH>@z|Pt&
zN=-h*y-nBfdBecKQxH0SrnSF+F)G*}S6twZBHMX!^vPk)hk1DvE=s@~Xs#Gtg))Fo
zw4f(xyM$<mzKV*c)0D&@OAc5GlXPie!AdK_6Nfh7Km)38-|-dca~w#7$H13FAXpJp
zafadC3*X7PxshB=HjrtS9^4wZ2=daCKYjU`jvYQs_Q8>IS$aT^)pFr~<esE9w*8qp
zd<jFtr1^LlgT5t)I293+NlMyHfVhgY1r`?Y_D+b4v*U~gD3lUcAKaxQnrVs#=7wkx
zkaW?zar6iW$9j;};W~7Pk`wEc2vbm?;G6(H?%K5r4yiE;Ej4vC#33;Fkr5Me@<{M9
zYtX2F8G4)#YFM<;d<aXh+Wh;sZwJ`fKVWL`Zp=(f?5BLX+S<rpTYJ=E#|DA6z+D7>
z!<3pK3kgz=lOyQcoJpPN<|uwha=>eWp*X}^Y)6MQB=ji1uOnr*Dq3E@7Jz4wChjq%
zn(K%qi-8YUpRiyhirqL@fE-~~)+BrssFrizzti?5K_e#~EI_@Pm_p*_z-fO`WZ}{7
za1AJN78Op0s;a7I&QKmoHy02*e*8kH>S2a6XV0dZ@QX`GXsfESVC;YyfcR0uL`6j(
z>gA)B5QV6fADOpqEudwBw$xNt?<PS0s(}HC!NiRpV~mpBS{D%$BeG`jhy`{f!gT{a
zP#?p9-4|S4kEb}{VA{inq+bOH5Cp`YzGwU><?7-B;(Y>6D8h^|hCnXi6tW}Yj`N-t
z7zL1|3m2xrld<xmqN9NYV8Bn{%820p#fw15JJ^amVSt%Jx%}n#D5J@c*u`r=1Dg2w
z(F1Nedz^$-0}0F9g+zItgtI0lH*w4X$6Rp}xsHEV#zQiZ5Jt8RSNLh@?uqlt1VYm-
zPKB{b*8n)Kz(^oF$mx0_$nY<~RQLwi42}vSjg+6(+c-ir)Ya34teYU}<!asg3-vB7
zHC1f>vGPADbyaZ$dWogkPEuX+cY+9KkB+8}PATgqVlFc?Ez!y-IQP@GLCEdwjLzo8
z5MYDiZ?Fb<SEqd!<e*uxpRPeA>#Df*<gkDMHmR)NBC(r8*MP}XI$MfG4W*AX^DXX%
zj%@^456fEr9FVu^=?nJuh|4A+`N+sf`u4;6#>Q&kW~Ac$yK0fRw&y`>J|-q9;K%?O
z0QGI<vALfSt^oD2wX=gIdIX;Eks|}5aKc^BpI-tl0)_(|g^g5x@%>nPyXryuKWl3e
zkHaqs^ohQQ!3;?aCxc+bA@OC5)NZ~3(x2ikY4e-f_V%#Y#sRe8Pa!JdYexBU1w#dY
z?(+QLjh~;CR8*WD9Hfyz&(1rlpG!(cc9f9{%SU+!KU3$($jJCO$K6O5aX79`Z{8%g
z*kF~v9vS%qodL=Q^6bb;C8eiBexjnIoAsy$Edy!+b$eP-;eF{6XPBa*A~HC@z)>w9
zPn>VPa+sf<0x>F_*1Ru(-UV5&byY)`F}V}Ii<gfN4pIW{gN+`f%<O@%6Y<7H$d!(Y
z%EQZxn9)G8o5e2d7MwDWe#GW`U%$Qx_KKG0<?i0w*GEZ9i~UsZIZLagyD&y~tF616
zX8G|G6Ml>!rr1}BJMSl04bTd##OMCM3u<dOkY?7<)RbqhqUYDf<+Pia85>JjH-!O1
zFc55oM*$j<VnMDAMG)RATF8^9Pmw5qxr|Gu;Oy(`!?9@WMTmHaUjrs*JC1$$a1J?6
z6dLGR1A~J&fC>sT@kZ&t2RPiSrwK39Xb;)Lu~I1d?ypkei|HSGs8<>BZm5M^TwD!N
z*JEP5Jw44}<GuJ&(q}4DqH^8QF`*)`hJ~a5!=vcIxsH(Ef9xOj@yY0B@U&d3%K*f|
zo<w12xw~~VDb%tC_8~8?1MU+$$DWWpRLr#%$^O5GOsHEm@GXAZekrbCZS>#q=j|#q
zFH-4;2Npd17I^Y=-x<86CeLMjF}$5=RELo?Uf7O%PiXu8utPe+OR4!aS*qp&D{wlA
z62|g!@Sg=3vN$j#z1kBfrIF*5Exg!F*;`B}X0B<xYeIZobs&xL8hz74i`A-SgA3R8
zq#O?^IGpE0lh|9@Q6MZjmZbCC$->G1N~N5gso@#c*c>{;#=-5bwl#8^!9$$en8jUA
zaVnyTi3*Yqi~DD#ajWG(?Lvyo6-^n~cj8+3O_hR;_CH$t98<N7*$R8Z>SgKvdu|2=
z=bX3VEy1=JHVK$^R(5v7`T9qEJ2?HrHZNcKj!U;j2H4$w;gKbUKpT--p7iDu5P03u
zL8(IfPY)X3?r@T;omt+yI_`(6+@|>dj(0D{T!H-(cr-;$XGoPW6%s{PJF=uNK)Uj2
zyo%}HC{L*qe}c$Mh=2M?|46g_e}1mV|GTGw{QvB?CIVfzQQ*-e^ikP$l?S)N`-3gy
zj5$8mYe(WS3=cM`cXoux@1cjkmS$JBDb_>2rJ{WAHvX?yG>f+>dvon=G)8<~LOv)k
z2w_6j3^`p!JglVt&4%m~9S1#1ES?sd4a;8(XQ@_w?mHq{Dzv4?_}eeNb=T)DTJMd7
z?sX2`_smMJz9NCeYkVXUVI}W}OM2}0m1R1Q9CNJ6${(4NCt7-|;*L#T>;1i=_cHOY
z2Sk0>3z=_+IBgV|CPS;@jp~^VDc)Xxk<*ekEjKzU3eaaT_E?fyR5pMp3i9Udh4DXn
zRdsde_>!C)91snTS5>6w>+k<NM%WNDP)Ri5H{xYPD;$6FS~iE%GJC<zr$3+aEOHn6
z`seNJmXp65Z!N@x=c9e#H2I<w&+BJ?*TS{392d*)FP;g`G2xTw{TMLH@=SC%+wm`3
zT{2PZY2WH;(@+T~lmW5;NBy%8at!!dY|1ovP_w@wxfWThXJHz&{>C^<M<Z2u8Y&$s
z2!b!CF^av-78Rcg;;(Y#f7#IX{v<5=Slv~(-JCXr^OrNQ6G9evCWH<zBaMYMM~V73
z$q@ns3}{%|T3QGj{Jq}5(ckchc`+_rpP)oMKi1uilMe=`fTuX)Rnd(>hv8GR4f#QV
z0pmxoZtfitlH=p!@7}%W$jYhN<yv0mZq602ks+Ph_UX7qO=9z;Xh9iI#ml=S7D5o^
z(F@l9eklRtKy(zN2jL6G%%3W54h~L^ec4Ve1s2p?NKIWv?NEr=bt5j0JbL5MfP4&e
zFWh9%e@dFr;A8>O5`aE~2Yg^|4Qjmu^W=u+2g8il3aq7^-WTPzYJa|8KbFq1Pgk?@
z`=QzgJ_IA9VW`Sg=EY7qI1%vb6(7$3Do8xzQHeHfhBj9Zg9L|2khfa-cNFuQ`qG{s
zTAF++zn4cI+NHUmX@L@Beld)|W1y%s>YIg^eXW2wa9L(`fz@?&!3h#05#bF6#CTq2
z$R<v3nqR(rS#r_XtyC?|PS@aKzI)4Lq=e<2#9>u#y=taRXS=-7p&k#f#HW>4s5u`K
zi_zlorLtN))C5pvFEcYWX(+&?lcOVEvACwj^dNoU6yMBj!l>PVduI$DZ1Qvz{8bA2
z5KgI^TUc;TF&I6YlC{u)7~%=>24Qxb0Cbb=cd+0v9nI@#O)T-@Sy$H`MB)ly743|I
zlPmsu^JK%NRu`RP`W2i7ofJ8GXDF=8OdzvJ`~Pw<HDyKGuDG}ku}xS(jq}bUw<7up
zoJ4|;Q>btlC^$8l2&|7Q>+ddw5g&>YpPBjN-$PMIwiAyR`k*0$@q=e{zIui8q7H6u
zB}`f5dO%`0@On)*S1;eCFS`YFKKsFgEYYD${k>dzuBH!MA&nx+KK0WVULTOtH-?H!
z?SXbWr?wT~K@^w`;nZC<czlP%NkP`lw+`OK6?90=J1sA!=Iht5zkYeSx&8R_$2Z$%
z`gSXS4KNm1ITjtHn)DVMxT|>nibL$YG>E}4Jecv?0DD+7I=of_fr`2s-UZ_Ynq71i
zgbL9L+6w}@wMG@3KuVDR!XD{zRPT<b8>boki^Il9bmEKaIMqcwuG!b;zQ?&-+wl3B
zA`S8MAV6d!MxC9VMR@l8i!9=VF3uBN^qLEHC~v5s@!mwIhRBG+fY8*s2L|-LUj@!-
zwFJUdAey=eMb6C4<r#&W{t)%2TkZX&>rC732gM3B%=`O0Kd=}?I%{fJ>zpKmWxTZY
z*SxVJbnHN<u58=!Q13HB=r|Dss_^Ug@2t*2Tm5uN9SV^HcCYVt*pwkOnwgOy1Bn5v
zltTRC;?6aW2Wh!y8Ivr`m)_?(kG52_)`W)j8X0wac|<wCwyS#|IJ5f2X0jmbDyy`(
zCIxF8v1&c*YRm4E-2WN`j<}KFEyMc(T*rIED7u6{dijZGS0LLAaRkg9V~Re^6b;W{
z(o<o@4)Ht~gVE8{e)XA}`3A^(N43}tO+&D}-C>I<p4hljg9!`3xvT6a!A_7i0+HM$
zr5Bd7Kse#a6TRQ$=XerM&_LD`PQ_z&ARa^dC2A~NpQBs0cUI%pQN_LA@1*_?U4Q1F
z10L@KYu160Vj1U3AgZcz!*|6AK7d4UsSXMwBwN&Z?Ub^4j#B_J<B0p2YICiDa){5S
z*eZFsxe-T6P05ulK)MN8f3o{@)p8gLNWvQ|Q#GJf)^{Uo*l`;VD49|?RY$=o&8`h~
z3Mo+Jy6}Jr_*Mv;LT`c>utQt$W#yS1z1E-9Avid1F7Sv~4M=Jdr<WqO4LpJ{4KR;G
zHK3VqAZ1>2r~F0XpaIkQcgg$}(rw%fl!r*tyJtMA-DM)1tzGzb;_RCS4W8kH7{z0G
z$26uJiUm21mvBPO*!a<3(rs!wd`VrGFnpK@MY4oklrgx6I8$|%Ro=p*+MJhB-2B&@
z;bC^1JcPDo^^4$nuveFx;lvR<24V)LA&Pcym$I|5p+Qhk5R`>o()k9jRI_v4@t(%U
zIJJ`E0l@k|psMgn4P?x_Jn^b>=be5N6kcb_(#>9D!DDm`6P%K-+{G|XHnZBXG#Emn
zfbZtNx_J1|-ldyYcC*w_^5m;>hdyWWROcoVl)J#rcx%u?o2R32mGBUqI-CN>^`+`=
zBNNU{ZQOAv%rW4B(~&TgG-Ymv3b*lKBz-5|;#oqy%mv~sBDW0#7SJomY4`IUJ!<{h
zapaW75jF1HfB*VdXpz_Ee`uALy1%EFt?L!cSWsIT-vtsa#0`aRfauRpYjEILpK^>2
z&vj!nv(9%lhMg!#xG3pMAHymt#54!!Z5qm%mBk+DQ6z_7>+-r{gQpu^f`$T(g#JmE
zkj5i@#++dv0!4H-1*bZ#ZQaqmmEr?yNAthoc|;1$W`e8}&)lzM-pFVTZwpWFkv_sl
zd+vV-#^%r->5E6gguY1saomsmBJ6?5ySfjQae|*rhWKa>;`v_Q%dr12FmN-##{Jj-
zoZ#oM&UtP3^chZiBg70&1Z4nGXk-%LcDJ>)T?X#~L6%)#*x~m>c?3_lfL7q*LVUgm
z{5uOAv_Z>3a{y(*lN9!ABu04eCLY$t2lP_ngR-vrcF`@N$$@(za=GgQ0|6(_AUxnW
zAjuKD6*o@7qoiUmQK)gCBn`lw6AxaQnV#0XcTx;!OH%R=<S3oTid?Cu1AOrQFni#8
zLu;qt1YPEU&4zuHot=&A0Hb_q_cZyq*)qKKC!=5CAiaBjSrEAf1d7pncN|8TK^E>0
zAD>h2efd&qoU<`>M0U7&(jCb{4-`pIZm2XkDFVt(y#2hq>-1a<H&6y4gYG+U0J6da
zd`AZhME-Gz8;Jp&=z_A}$YM8amU$pmV<)wF-o5|ZlVeI5Hrl7Lrs0$!_KatPpwht=
zgwg{KH0%~c6&yAPih>(4_b4+sl!uX-8Op^Nltr9RLynS)l5!L`!pV)_;^f@+lK7k~
zE2{}GQ^z#oGiu=DQF0=HMMFhpTI1yi#pw}zGU7p%&ltS-c<j>pIxKh+YDE?)p@SHN
zais2HVB&cvcqERm(6;X?GolrT?`!a|AwC5m(prglXb-9-rhhkq_(T(gY>=~t3V}nz
zjjAXRxawV$l$X4{QItW#`IL0w%HW()CIkYAK$sB<PDpl9v9Ug$o;%Kj5jb@_nmnKa
z;xHL3D+U5=)pr0ZxCwGHG92a6yeqkz>6K7WhO}QlkO)$Eh;RZn;>kS7eb_z4bif(r
zpr;q|o;MI$H!3-I8eM}Z=dWT((>U8RR$vIQgz>;UJiE>xNC&)GUth8-AA*&#ipukv
znuzdl(9M0K;ul^eA}J~puzZvLc18vw+Qer(5LDs#|KA?R)9^0efKAWHh>3yWc0$6T
zBsC}o+js21m;$B{yG`pU(h&4*1TCha^?d)%jt3om?mxUBj~w^SeLLY(PJ2{Cocn|>
z0(^r<8MQ$IMFl|!RWnVLl9VV$BA5&s4q>+s2?&IzaR{cmrUr?{4Y<WOFGthcAp4G^
z!V?o#5ZmHaiA{P1hu`rqo<aEh$TB5#+)oX=1se%j(_r|mj7rl}Q`|?61mIw6KtLRu
z#CPETsf`3yU-m}3r&~D90{;n4@K@jplxzGH@#F}P26THkOvIhl6%>_?Smp2o6}l8P
z9OTC1I3OvaaX%|7+XuS=C)tq`gN6h>CFR4_&%_7lz>$U(2S**p#3S;gdGKh7D-mmd
z{=h=sy>lJu1EMzgZA^@y3Y>@i4p|1Br4E{vq?8n_=EtxUg&6UuJ77t#??^nzJ;P-|
z#b1FyzObOGrS-bI`*0Y)S><Cq@d!f}d;R(XQWMg?r3QQu(YBDKxqI&(ar2=5<M0Ha
zC<Zydv=qu1ew+{hC7Bp%6Iz4LCx#Qm05n+U!1RdMA^U)oJhieeP7UBV6bb<zgeLfZ
zbob^_J-2NeFO|wvzX%a3LK;YtR8l{gqa;aaG9^PPLr6)b$Pl5C6iO2%QKlxTOrbIl
zAtFP`kTSGCU-$hyYrpT>d#%0K+J9~9UC(<P`VH6jy3Xr7kMlT=bHRBFfdDgg$`o9g
zK7aj+T)>yMhMGETc|AQZdg64U5fdaNB<MD{#n@>q6PF!W+VE*{<gzBio8Ly6WOVho
ztQ~#+_xH5KnBDz#BpgOB%|5Ykz4!Iy@8>E8UlrhmCY{QlcPHw9Ze1&{UIE(+qQ{^h
zMMXtI+Z&8QJpFJhQolGCP7mOqpr)eZ0r3eV5R`k_4_EXI>k#X^txIo#^ufU)A)GXE
zB3--9%}>|!+@TFMku_6+L>xYha}@X#XNv<Ecla<J(o#0v!TtMJJUUZ;_pY9yp$|M4
zUsI=ylcYKVLsQJv!26Cy?u|ps;nhweF}v(CcLs;oDbK3}Q7a*>(e@9&cWzP;6P?-1
zF5sTfuiw6Z&s|axHzq<fKqN~5=q?h4!{O`EgYB12uC*hP>&csoP~b<A2oq@kdK<v6
zYip^C2co2cp!UR~WeN?+sZ*~(I{V@KhkFI-l9rYhM1PkBmlu`q14yRD)53~%3U(!$
z|D`Xic#=DFw!?M{J&YxyqLd&4kjKw;aG)E9i%O@RS=^5c^1K$aGYBSNmt@|e<;^r+
z*kZy0X3BVQplYWjbqmPR4k;#k|Gzf>(Qg^3yGMucWix+1lJ}=51t>2lw=kg5P*Y35
zlm*7l@4qHD(bP=*$EUycSC578K%tBqRZut@0hA+GFZ#BA9s2b?eJ>1e#Ih-Hl&)QS
zg!9A9nS0T!Kpuc_Eo=q?GaH!FARSx56H?P~zdJ(-On!YB4Ma#tDGy%oK)AbKVMgUw
z4mQ}PbB=?fBkGSYtiHGmS`EDxK>-UH0aKqoH||qo98XFDVU_ExSIa}?JJSTwi`E`J
zdOf#4AO6hQv*2sJ$8KB$GapU9q=dwqTZb;Jc&L}?nu`q~#d)t4cL1Epfcnx&f%C&z
z%>UJN9YUB=7OHe)3NG#_|KMeI6T^l?pwX{K5Bkh!{C;ornY!=LA<Fo%Fv#)nWamv>
zE~8w7$cP39ZW@@3`v0x5jZ8|M6&>yE-EdlZeeD33%Z?p8{`xEFF1xFKdnu#?(vyN!
zr%s;qV?~wJfHKG#a&hhX@I02#i(EUT58>4iLK;s9A^*2`m3461*#<~oCAxPw^ObZ0
zeq$1+l8yw*=y$w3P%v1stLsZBL@r9&=)|E2{L>Ak9D#`d$;UP82jTFxhUf$TsOBM8
z{Ma>b!vg}$EiG?wMrp5ME}-;$VE1)${)M+9ufL`Um@}uD#Dd&F=w0C7qW_Vu0YUO?
zW~ORT7ZuZAl-7K6qD}rku0e2Tb5#mwTFPdfJ139gCaeVB0)~Jj=zow&!qtW_^qjsA
zM^dP<f)EnMfs@b*S;QHEjmWWimgzE{<cdQmu<6gPR2GRmp=>B^a=$bSOCuWa7#YxB
zLl3mK`Oj5&q5?^g?Fev>HO~XsQEY;aYN)h8gaX?S@3tMTWeYR}>T!CfY%~t)133sS
z2&dSe{b-RWc7mKEwe2B6n~R{Al9Cd4C)YONshgO-4p?s^O(A-8XDMU3Zy%pt92OE1
zf``QZhgl0J?MUP+aT>~(WPkbcCHi|zRFoiR?_L3271H0HKBH3U#PV~oY;Wik^%{5Y
z->;x+SXS1q1=p8cb|f!Oui{^$tngWyY;Zylo1F(bbl5Oq&FJ`jiF^4Xwo{hv$@01<
z6+_=&sQ-1v$>Z6E*{MDrgS{Tu9-rK*p1<$ND}mPEa(3CvOS^9jSCRbnn9xd>ySo_R
z1rAIso19C&x3V&Q*ODt&L}Edbu(@>&ZCotkC{|#3^)*_fVQMPGHX`t}X<8Z@Cx}md
z<&s%}pm3^ID$#<4Ke%gg-4Mj^1gZQ#t;^Y}q+I)_zNUN(7Q0}6LBE_%8I2q^<z)3o
zn7=qIKo(mE6o@Y(Arw4A+I(m2X3v={5kyt4*p6z5Lk!^xy0|3d<&BB2SZXl5(8y9%
zgh+99-e2PpMIIYBzVnv{Y(yH*_BJ+XR4}?a%Owg+M<l+wyWa(Z2~;xroPmLqZBu1?
z>$}}XOU|Xcc=__jsPj<WE??exEk+aA7(`yj-$@@7iOnJ|69N|EUl15lwA87a*nNqK
z15h7IN=o+MvvlRkuEB^9v7Z2`AvGYZ_dX+t>LGXXTVA5OSfC^)Y$F3>zYnB`E{^SA
z*e8F@ySqXk=;%>;kXX+}UhikHB8nCl#K=iD>+u{ljc=obBzMfTPbck!z`Epy5`Rdm
z5-X*3G@@ZDSKPe$u_~n!J{C5EWCyh$K3pWDKnM(h4d%P-SwwHh-TR<~02e(HCit65
z{WWXgL*_UaN(_tqN&UZgiJ(u0Gu)fFPuQU=8cjbHuc6?}=<V5<DC)+Vm~bJme<X+H
zP8_H<o0|uVRrP>SJJa~#ik&)l>I82XYtAZ?8%%yeo1Xq}lOOJtc;ofAo<2R4v<#uG
zlV3{-er>D+4N90Bq~f1|1PL}Ytj)TK4ivv|Ted7<3``RK0N3c}d=N4-=s%Rr+Y}yG
zRjr{d&qH<RrX_jAH6lnFzV&cjT~GEA+Y?phl5M@?D~3Z08$P_bsj1caBR4pb6H1vr
z6d2U<h;Y9e9&Kcg6dvvBS;C<nf4h*!O%5YbkzCUa&c8@jRT`!}vcyvkIXLc>L*+!^
z1&aBuDy4hXb^R+39w66w$n$>)BhqjP%|~*x%S1(<Qu4851qThpWvmOnBJ_(_tVq9b
zVbhEmy8{9WiGC_3KDyWnFH!nHhK;iTsU0Bm2mE&^TEHG<k9Ka2EPZ9(ChqG&?oErg
zqZ&LP0aaip@I@1Bs_Ry}H&=5KaT{wU&WpO^f*@dST#u~bT6lV_53=S~!f;JFSjcaZ
z0TQ4}vSVTzc4Wk85@Be!UHTd}a&ie$qzHf}o2f)7a}i3;A2yE93Eo9BpPPWtd5O1F
z7&wt^Rq&{UrH^<|u>8vRZ(~0p+h!4qUU)`5+a4AcxMn`RHL@XAjx@FLN~itcc|84O
z_<{`$ZS+xz{v;@}Nw{xs@rDV-g<v_@d+l00qYKzPfm^pCsDo#Ljr{iQ<yceI+_{T&
zs-3+(npTA6{d@Or`BE{?J8yoLy)PFEHOSU-BMPilPtPBMm^5(UE1*rdAN_~{oEi%C
zZSpFPPEPV)X3$<Gitq$yuJkZB53tuhJlf;1nX0Uu+_2%p#}S8E98y&3TLMJYKi*Tk
z(T+qEvOI2bEuo_1jaEL$3`o=nFw3Ns%@@K-ePW93Mjs!1s1B64QbVBs(m~Qp#1Bg9
zs5Z)V=!BV5WA4>@_kV2{bUr3ydY6~0?PXS7%KLuNKCB`mEppENDIL|^3<a6=bG^9y
zjqSBJip63UZjPg)AM8DL4b(Zoa)#z9&kzNS@HI3Px%q=c59%w4u3Wq5R|UkEXTU!o
zW%!B>DUAWxlhdY5K_3FyR!eKztXUBv8y?eHjR#}MFf27Cd>ou?ZPg>M&wkHF*b1!t
zFjS(g$l>ObC%*q>B5ujpzSC;on25c*%I6mK4aqT_We9!qyKrYgzxb;;=@~Z-o~n<@
z8}Xarw#Uw!@4vYuu%r9Zr7~RuuIL7dP!3N#K09oO)O}YfT-x`%*FZiVO>oX=c;4QJ
zTV&qfAKvPtye=ML)rqrbd;W@tf?ZmAjs*q=Z24pK)@i#13GXj%XRbRrWrLlfCU`**
zy~uFJPklzALCr{$Vv2e<2$9?~f-rmGvq_ycE{QX->@`xxrIM?v-<st>yu>|$pwi!D
z@=RM77d4RZ6DM>>kCrJUl<=TOB6>%94XN)!a@mj{9_HO<H=MH=a0e(7K`aF+wI4OM
zaO0z^x3-4EJ*9FDcvBC-WA7iECdkx?RLCx9=!;&~)kTJfXD+`#j1nGjgWME($jr5I
zY1M-L@QgyO(N#~5W&X5HvE6z{_Tab`@2l_L1z)^z&s;nidH9|^73^QCY5AN-(N9+a
z=dgOzg0}}+wsxQRBHUo;@Zp$Q${Lu!`>?mS2iPf&=uo|T;Z@Baeud6xp6{YI88&RN
z=3p&-slm>Wk|wJQPrS~Q&j}b+GX!0UZUYDA4@eI67;aXRCQJxe0Iz!_&c4+y?Kaig
zeyP+w8u~CG{rvCPa)o-hI~+ryz^m)5cIEM7<(GZHyy)Q2D-cEn{3BjpzWhCBazwL{
zIFurRrw48gvDA+Y0s0IbC6<sps^HIf&ktW(esS(k+Gn{EDRs5D&@gQ!MSzt0#1lXe
zs<FABb-$x#)z6mQNu0ow^X}#4>FKN<@^gDu)`*bexg=9hLZdFlcxJmBc6EszF}d>~
zdZpH<(J^%?;i~N!b|506yP~4SOeAKrk;y@;sp&5<-WJJ`!PwLT<!kH+pY$M=&qgL{
z3><irq6DV^+?{q<41jK$^RC@`X>7?a^!UfrOtxc8`St6a8M~l)z*1t2ZbpK8%<Ul2
zg091+S1PJa6&tQN7{6eoL0IeO+RCoU@$Q{-gG2_gcPncZEF%KxJo`TWwYXBjPY;$A
z_b<21EE}6{3JT;5K$qdPt#Dm?c0sSERN2q;MMi%bl>$KnN@2?omy8xFDlT@c4@QF<
zsEXFSzt{D9G9=5v7o@c-XMZsg_>cWpj9OHm3Yj=3C#Gcbv*AbRU{Q|KJo}fWx^+(Y
z35&XY%~xj^KiN_{PI5<7)!r2bn|Oevby%yYiVD)ol_a<QN^Y|oHB>|L%IBhizAVA5
z-oqj<EGqBjsjhd|Pa{@idL_xoL1T->2jr#4AKmAl7eK2R-wv*10T;lEG{v?Llu;EG
z`MsOEb`MXLm}2cbx&~y1bY(3n&W6iBZ{5BvvT-}(@%$M^Z?GNza{kTM<|NzgcVA_t
zq`B)}S>HNOLuO{6=O)zh@+jZ>%E@$*S26*y?PKWa4CkDhK`=t4nzOp!kyw?G)*2JU
zm4F-7Ya%Ia59(dPO4Z$6Q+qsymeTE?1&Porm32GzC=XCT=xoz10y;Z@b4El20YQJZ
z^2Cf?sjK(7Yq}l|)U}#uTj8Pq)tLwgb~!ukQ13Vr>A?|&(q$9Bc<NOLtn5;<HK*Ok
z1=AO#UeGX~%*c+&>%9Yd4;mS{<$1S7TNETlhFxslftLcdU1XlTDV4x70=7^vKsF*a
z($nuJU9;Y%y2l3p(k=e8oz9v+8{*VnE!z6-o_0fkc=?5MnaS|s9;A%)hG@)0PF6>Y
zZ&|5ybn<|`jXowAz_G%V0|9rHhK!uGgo2((0>gkSrmnu;$h}G<^S$cbfT5s#cn{(8
zQQ+%xjh4g>6PxMY9kO4smZ(XHAXICyNY2P-Mn0$++;NBNC%@Yr+^@~dt{BsIH++E1
z%(omCx-g59@JZm2>wPg1ubn(vyL+oc20ncPQI89f)xuyCtUnMdACvTeRl)hzawESx
z%j-t0pU#kj15*jR<2Kw_cdsqZRZ;EA(?_8di?uo?EGu%!KHS5$-}&Efu2l}`A98ca
zOg%Ja5p{R(Zt=~UF7>xnJ@-dd^JZ|WtFxrEwvnfU{6I@{TfRIbIQSBU4{1ov2CN!Z
z;AXsHOYN5ys&r}#Y&l)0E-aeVJ9+w&C1?o+H;_AbAXRc{2Cm&lH?a1Vf~*vI8B2jD
zRsRhh^A*Gnhyl5p*-9hVl4O&=9=vE3ocyTMiDtqaWjPD~#?z37K;Y=Zg<Davce$lK
zY?$4&(C60jiW5Hj(5<Tf@BvE&c=Ip<DLdef-qb!aJ7fNv0HY20F)p`oeB;rM)YaW`
z6(u2WEvKYwHaG&*1IzyXdk<#C&E7S@zMiJte;LZ6Z-j4fR_-vhAl;U6+jn&R^7@EI
zC&%_YfK<GPQC>ww$xc}wd&a?hNT#@}tn6Eac@&UpX87+a@5}klT|8z?bVc3chY!(1
zJ-Tt@0|^>*3AG>-z-HWh>JhIHKVSdH=_+9F6x)4Aw$?|Pe*65HAw1-EY-srNw>hU-
zS#+UY?ro)D$BUUN9-bKkMuLI|Zt&=^S)*7p_NMe4d8q+79^pDX9zR{&3^?3e=R(_s
zl$gB<l;T2ujIIvmHX0~WYoJHSdia^4J$UWaI}5<1x1yr0wY4ruA$c-n@1iQ}kBcX&
zXFA%}EjT*sD0K)8oMl_<b8alf_$w`K6M!4f&A`F<i3-lo;E8zj(9rnxBWtp{t81TV
zJ6S0Sn#bTv<oc*;{<_t5X07?4av=kIhJkX)s!`QohH9C+5LzgJz+dNn^u9GeU2iD4
z$u3e~w`L7`s(kWkIs|Sph~%Q|waMoOYyRxgy<0aDaJp6(0plqNYhi>gUTpp=p<Z`O
zStC6`$n}ri2z1D5*;A`mkN9vqaH+ntGg`$+E=E$$^J@@IJ%9G>uzqHzBLky;wlf*N
z#oFp0yB2a$au8sV(2?uCy)g{JbjltmO`zEvGFnVu{>2M(**nN@_`sEwlK$!Ly)ZUL
z%n7Q^2cAtvuA$h};yWzz{ijd3^8>Jsm(4?K7a4h<<5d20NQdx!Q!~~B!@PU*M!F)|
zwqZ!^rPUoC&jRRt52yXzQkQkIQd{{ZZ*LNyMke*UGL^o%UiRS)8>E#s{k1hmDA&LS
zq(LBPE>^FG*rYdVRB%!Br2dwhqV--}?z-5^uy4+HvK}1T8o2}ch!E0QkRVa$2DOIx
zuOli06t2=Pp+$|F0nvasp^^KMJr7mCQFi>=d`a(fAzxDqXCys4dv(-WoBkoktu-Hy
ziT*Bo=JWFEbjPF`FZ)rhbLWiH8rbjhzN9-|f(gXs#irGMC(_e{E)A;vErAK18$eX1
z+(-k1vuDl-KClZ_1jKsGn7pJU3~&5M3Hfj#QB$gA@3Me2IR;CtqaTXNS>u;47wFQ^
z@>J8h3eZLSS1{V8nb_CR(`?$b&f*%<N+HJsI;N>gTI)f#-Esk6GTi@kYU<RFIekTm
z#BDri^mP~F7X`X1K#~xFd-TWwmj*uvm86%)4OhNM56?_=Q*fLx&Bq6=mt$=E<K?fL
z$k?EO$%TxhoQHv8>ia`*a_7-BfBiZ?%XI>spLCNW<(bhTB1VKb+1Th2O2Ep*t2!ET
zM%R>SOT<PZ-z|FWMV3t++IjekcFWi&98>OhKHz9#1xb20F@*U+-8#nJJWQHGRYk`K
z(*8LDWq3H$Z$$E#1Qd*(CXAwB(>o1w?s53x_{`%G5tVGM!i4rIc4|`l^?e5Q8>xHD
zW*K{5`;Y1|L_C44qTs{{Hcjh@DlCcCE&&o~ippz@p&`P|<CwpFdI~=mB66Xmtavh5
z0swU+mpT<Owh1uW$}S4!P}mBeQt4yL_yT}Zfcrlps?#l|@Izyi|MQdaxN+mI-dF6_
z4Pm`tk<E%0DECt}a?nsb7#SJ3jjs+R&VA>g*qdM+#oU4{ru>_<$?9<HbIzR`J#u6$
z4QInhP9n`cMqI&B0@`eCZt!q*rI9^QBumjJtM>P*xGfSR%s_$yxRgZ;0r^zk{AYB>
z5?_86g_RI?YrNCa)455c_Y8`fy>qzS)od{2<Huiff`G@t`1gR{0c9DgIL_@@HwRwG
z!Gm-me2=ZOHzUFL$@<|RWaQI$B(<}w<9LZqLxNbZ1(!AoR?7U1rj{1SRbbq4b{;I(
zzW7R@n8MDR;R%6VUHgz|bvm_THSN2~WciupuS)c<kOMzE9797vSvf5wW$yg>Pm--v
z!n;e@;io|V4ca}{DaOb(Xq{5Mm~VN{Tn^iiLhNo)I#R?gr;uY1!V^#rJ|3KIdL&r-
zb&an;Ck1dBa?Z5T2h8Cjtw}>c@^$LuY~@BMH^+_zy|eawf>xK7g3(`7unJ@>sv^AS
zT3cHFLW2?e_5n{fyn1!iR+9pZ&tG3#d*$NegVE-Ik)$T!_d2YTiK8KW^X4uQBTTvm
z8sH8DK8i8N*wrtkeC&RHdp}8bwWsHn1uq5U1pO!ZA??T&M%I%7LF<=~F>7h8Spob?
z{uVy<H~|~1EhrorI86>6`%GuL{3iWRQQF>^fDslPb0L#ow1|zKoR}!FYE4i$v5GzE
zqw)%oz&P3jM~<ix3UFU0h|?rQw~kOKJb}qU66>S&&}XhD+yF%iPZ;Y@>KT0dAkkQE
zB2yt(_=G#sr@ypi`sGjt?qu>+Q7e&J()()Mp-L8C1RUxMdMR)#x^{i-X$U0U`1mXF
z3HgqjqGbe1#oV-6Rc)J2z53e!@X^r=w9-YN^FCa+3ahVwE$<llB`^J@=IW@lxn4si
zZ5=iVrbumU2v%d?KaZ>_-C0q$Y2!xfOTFc86jKy;j0GsLd4QBtRkfYn5dG=%92{tt
zgP>}2$cX5J22B_xwg003)fE(u@7_(RJOhgn*&vZ__3F=@cfe5kA@DwlBtWcyBa*%A
z>uy9#J~V`G$kT<%#e^HUp<L0?=Q&-`D|HcJghyMCn!cMh<E~vd5uXTi0j%OzvA%35
zN`{7pQz<DFR0EZjW07eS#024?>q%r)u8*-SMz*jb3JxMQ5jeN=ZMK$xietD>q61D7
zC{vA&Idk;(L=7%pJiW-~I7Emo=;pNi_(4%lgOZMQW6Q7q8~sLxW(LoV?*w@Uq~hQ~
z!DiIjI-C|vKtOxNmo)j_zmKIUhaG5Cl%eYtS?gR9t^ci2nU*ujbReh<F&+!2lPBfw
zz9iU@!4Q48Ah?nqT<$PD(N=kdZUI^btm0U=j%vIT9Z=qp=!Qey`>K=(Ds=)2RXeAj
zaam@vpBo#u99qG{I+L9Z7;I~4xien)<pkggNm-D-6Vd?QFK^z2gbnB%7edM^CYm9f
zfHG0A3SS-?a;V*bQ0WgL(bY#dl^Nu+79ipoS~KJ%lO~l?tbwW-8XMEpCj~>>g;f#{
zl$T__jf#rORVZHjv8`a=L&bXe>J?`kgn+LJn$5LDCOus?D?1xC+DDx2)vgp34barQ
z#^3WFw9{e4L2`l8_E%MWqp&a_iGeR4F&<!(7KM$4Gu6I4JgN`zi!aAV=5hnz-LuDv
zw1%4j05dpvf{#xwl&i{Nav`tq!y^R0c%jh0|Eficq~6g&5AlM*0h@4~t+65#!-SbK
zFqQvNPt$@yxvRSq>vQuLSmhQJsN$0bZ<+gxbQyGx^}sUE#|MYuYy2&r8O}6*gq=Ef
z#+;3I`XsVV+6bfxf=wUYn}?jU;U>1rCo{qjK^Xr_3lJe6sE#SlARL(4doB@8quO&K
zxiGg$#WGLKMVA_|XV_vEjnm`iri8yot3F0{jAbD+1y{z80AC3R*L0Pe0nY~y8AA6?
zn9{>1ayCi3HA=Qds)X8MR>Lwp?YD2ALYIgk2iUOl-^d^rEmD6{DIPx_cNG{V^cpyo
z<h@a6)36Jecg77i%BBaiXajTedJ`Gx@T_fk_7sQ{*3*Lrxd2FfaXo$gF7SSg*Po1x
z>_uVt^eIM|WG=ex=@ZrXb+{xsYhURr4A(fLMW0-gDw&2!Ux<eVw8A@bA~6A?kHN3P
z#gwy;_wQF^uaV`FG3YP9hb{YDE34sTdCV!avJ$+!2ppbY)&P_}tVcpf2EZ@o)*%l+
zcyO>t7WQ^n7-OA6_wH5rYctqYUfu(@?foffX`L6tlE%~!3kyioG)<B&(e@Oim)Q>q
z%v{mXcZnQfp`o6<!S&h6frL6DI42U)KU)Vj6;mHMC3L!sIqse%%DsCBZ`-!jkDVA9
zIfsi?b?%6;#Qpj!j}4SvZLn$H%sIAmBlpf)S3AS;_~g`6B@IvSty^L>T*ovrsiVVg
zfg3yeR^+t<i9Po}SfsgEzQYK=sbl<ePUdSCKVRO^wqVOC`?9t}v=1SkgV!t>*X@;8
zz>p5ah0K$!({x&`>x#yB<;4}hfWq<a0(i~mQWdBx(b~P@PmXOmCtdI4UNR|lq29>N
zQ=c8$V-+;~+9dZ7d9Ffkm)$#e@?~(A68sRjw=Td78eCczqS(Rj1E-EhB#`{7A00ax
zb8(FC%R_auI?0@SL9)x)hUIsfJz>>wGe7yem3E8Ao=f>gSN{yZ_A9NaZI`$#dF^kf
zZf`36S3OIMG$}vjv(IVJ-l1Rh^GNg$UVWrL{b=dmj_I7nl=f+v2PW%`7@R#V{Ni)9
zqvz$VM_rJP&=>cZoKyPYsq3vd(-RB&h6GxUv78|xaMUe}0_8`Aq(m<3FuzE#q_)nv
z-lkfz_JhmC6n8I!s_m)gkMuRna8XOm@t^<5YIx9ww%C|A`64hW2qY>FT~ktz-|<Ko
z7`4(l+*7tT`FVbmV@`ml+zKgN10aiU)hYKM{AJ6=!ZP)sf=!BMYf~Ghx!IcrJ~CVE
z7})-Gf%K51#yxwCs^6U0y`kD6>iEU_Xh!0e*<Lzmp0n(T*%EPz!Q5}Y8X@Jq9yR(_
zdzm_3n5=%DbtQzUMhUH-#%oiPq^fVkS&m8VZZ~_ujh;^6P~EnxDvAc%7I!@PC|v%j
z8No@@#yDWiNrNs?5z!k;;|4}vZ}Gj1%lVP{iTk>~opm*@-h4^w*7H$WU)54#wDa!F
zJ!15|kNe@?YrAfmwDyeuwGY-kly{FjJ)$)Ff|kBr&W?%3GgoS)o{b#ZT~E^g;wAUF
zM{GmJj@%LTb%m;B@h~@ycC&8zYlI{X73VqhIq%TtPh0VUq@ib&(O`x9cXayRwX1BC
zmBe>@1QMi3zkmOR@0NeCvWJ>54Toq)ig=b|kMi1b+ui&Hs?#fb;Y*Q`u`4w6HiDRY
zM!jnBux8KL5V<)<`DZQ4&V>r1A2T1#e;oE|ojSyD9DMyu=O~SV7bQ@m1dUeH^KI^`
zpYI=h?ce9k&G1@DwfFvk69?Ai54C;uIRC7+@b9*&#&`c88mWT1m;d}Z|2w%mCRl%8
zPWYGl?S(h__qYFl{VUmoWvv6B+o-hl`LAHj+|X%WyW0Hje_7bcwwn28|GOl<nxLer
zBK_7LSp7K#5o82|z^eN_|Joi>aEDuMO?n4Mp71y^f5NGOO)c;NQ6+ONYWFmaHTx^s
zWuJ7dY5x+*OMcOTu}u@4f9=YR{zphh$-de7>7Tus=2+|v?|e1=uK}?j3b2ZJzwUoL
zxc|okvj6u_wG6i26e9Ec@F|^M|9QGWg85nJ+xi(Xof%hZ)4+#zGyBh5&ym3!QEPnV
znZL70oCn+$EJqgU%_XNrWgS*hG<y91_@~Py<gP-krdiF5K9N{s$9V=F3-WHnKy-GI
zTKlc+{f}ai<)~C>*@%>(XV_Xuh141t!ll?w6_{K~qgTzR=mjV^FBtQ_zc0|-Je%$x
z?Dg-X`m<j6X(KF9mSm&EhY-QMqm<-inX4~Ik!97mcaLkNat(4{!3O;KsOUeRv&{&h
zqmzsv%$W;y1t}}{`Cp4Z1GOu+Zp|1L`8>}%L^MFLQ~cOXxDGev1poDT<N>#>{kuK<
z6@cxQWOG}trDu#{1^g>!Ll1!361enyTjg%un#jk|%rF%~EUR?zKS#;82j-N&D$V3(
z$0S8+&(&iLD{OiuqA-;rA));c?wIROpI%}qXoSKa-2CND*9{HF|9W}~<w=@w(5)n&
zm4Fc<3${+M#u-O&c1D>?y{9vD=opX@ddYx~h6tG`^bkScJY?LwJZ$H`JGt#W5ByhU
zroFaUHol?(o(3;g!9U>>$0Q;322G5MjTIOuq#furWGR<n1O=uQy!r13iI-_+5ktUM
zyW@^9D6Hf>5Fm9ikkBGGH+v@O09k|PP}b2?7RDmb|G5$EG|&Ct)6$~Sft~ff-7t$E
zjKx4;T;ol)<>2s$Y?}&((PVHSK|>YAvJ+-H&0F-JAA25Lq-s{1O*IU3!9=O=+x^54
zRrXG%-92<i;<A`TjRfnc$jGG>UheLlCS6_^`_H)()#k^eQWA$AKI~Y0O7IBXOd<>l
z>6@f6HN_UEV#un0zs$czAjH*bVUG>AUaKRX*w=9DPa(_;FIGFR9iKhc>}Jm7nTkgL
z{nN+o7a0BLLI1xCr)7~HocjK?_TlHBn@&IZ_|6)O%d$7hiY-$9eZ{7alJCFoQ40Uz
zC0F~U*fk5EhYcHGA5A(XkYk1a`=y1*bHH9GV*0H*!CISYr(sh`LImOI{~V(*4I!tS
zm@ocEqAhaE6Mt^kZrI={7Us6X*IOp><R8P!zb~r4cc{#z|8W!C|JRuH??3(D;pN}M
zDZC1QWzjDtDgRpknp3kIl8@MGj+=Sb<7`JKg^5Gjc6wc&uM?kE>%ZcJ{~d?7&A%kO
zwv_%Da^X$B<yzjit+R7X-`eY9A?(oHb($BRuc|v?=JdnkEA_*^jfuZ_;$E7q=FlDP
zHak76N0zmz`Y+2Z8h*>a(5zLnvi-CDKQ}a(r0NW4v%Oz)GsrjT=dW`u3j<Wk{70aX
zzO1b{Ve^6upHG?gO%OCf=qLy~IbKnT8arCMty{>|jfOf()AY3%wU3ii+v_u>q3daH
zVmH;)ezTqojdF_tEos62%Ube>;mXFKijfROdF|B_d2;4}z53~|+dkDM2#;dRx5Q3i
zC9Pi%Xib=jv<xe&^XFTqy*D2g*;ak$$GcQ!#%U<NsjEwSs&Uz3fq?6O3;r-s*zo$(
zarywD^S9VmF?$Xj5sI(px37*{S8AQ{-uvmY>WyC-qJ86!vm3+nWny-hMN0TRqeuoI
zoDDm2uXj{M*ZWfb3lom4`%~&~H~V^sJg_q8&u{8s_`g#G?<UJJiW3UYw-8(bTyV3h
zmCOqDPtnQjqNAnt^IdX06@ob70p8{CX&qj;-`}bZ0=9sXweGIt(dq3zgS810DCFNo
z+_@q6U06m-EKj%EU+0m&$@JLOJ+V3QiQyIVWPfdjB}tozxdv*B3b%HEL!_?xs=gs3
za9q{XAQ22Q_(~uVdz%A;?qtWLj$7<=!r&Or#DfOCh7)QrXbZzm8TT{<7D&$dJ)z8=
z1qJ$!ogJo#+wyA1yZY{Uq&!x({*u@0Yaq4Q<oM_4->sQwJ`<`^GL*V=0H4G}ut58a
z7XO^l;|3^w?V|`qrK{4o_`Bg&D)o)#+C7IOSpy*lHMBKu@t$t;=7&%(T1GWiT8$gg
zyu<3l-ic#Z#OwK)zV<1$D~^zBTHkO6Q|!J9+b!IiTdY(f{EvoPd5q$|E)~LtO@Vwh
za4Pwo53AM`-+As}!%hPnTt;2}H9*2r<JOQEv(&{!OY`P4qGF=`{nP{P>U5>mzI<d_
zSi;exU*4a}7kb!8J`H>i96l@v_<d@fX3zeHHQ&{&FLNI?@h=!l^P{yDDlr2rFT$Ql
zh;yHYVHu;uvwvl~opQON?Y)wER<TnFtPR_r3Z^Dt;9Pi_1^5ae9CMiz-qs~uVuFG&
zR~1F?Eh`mU&ja<Y=M#2Row-u=Bf&drpK`T#L`=)=Bd#-0v<%oQdyM%xj6qXbc0GB`
ztfO6Lu0&#Hv+1O{EDW>fT>a4p4aS(*mMpY8&ObJC$eG72D!uLVq-|Q><pAqkv`lcm
zjV}33+Qb957d;=f-}>94L_Om^1|MG?AEnvR+jPQAus(V{Zy#pYQFBrLQfHeBDq3ol
zms2m5FZqKw5E#(2ZUgEP%9Ub;pQ{66`-(kVu*kv{`7&*J2+m91?rV#yi5Ex2+$b*>
zOiiJW@jM_MMn5ho-DL62^u~$i@oQ7oT`8UPZPJ#Zk~2s8znYPjy6D6?ET-s}TF-z{
z0ZRG8v@N0K#NZ6~^#yfSLoKE&3kgz_zZAE?v_c^tVlZwq={k(^8MbHN@&=)ugYAbK
z;++jQFIr_2LQrkk8JDaz)HN&SqIOBW+3vftueDD1YxED89WwJvjlzM~G1eN4(Nb+^
z;yg@82U`r3bE*48VmMq)HHDJmP@9ymO-=Z19>!ft%_70tcjG*`9FN?k{XPhTk)Vh4
z>NQDrguecKMm<xGZ@;z`N)e`>+qBenB<9ZlRCo8Vy|#3OB*tJF!Cp1{s9q^ur>b|e
zA23p{wyw_U!n&>(Wkm6e7jZs*yneuzKw!Pwi!=n^WY82GDBU~vnLXyf)Ikf6XWMJ%
z&3BwPPYVjxz-BX_6AHV@<!(FDM$g{XeY*vB)XdTj`l)Bn+Rd(T57v!Y_F&IWCF`(M
ztfBFAYTN1+C5O2%e#TG_%&QOXYqOkwtaWzr)uKWgZdvwx2HQ!)M{c3JhHvG_H_s=A
zOe$`{U^mTLBdTMOK0}zyJ@rD0=>zS~&mTAQv(J`~sdn1)?QLyqU%pJt$mse!b!b4A
zjB_{>gqDoDapKV2_QlSkPQjkL-F0q*dsVufG3hcP!TQAc!+*lnbqi^PSPXD+hZOVb
zOA8e!kBKuy-_CNHOS=LM*YlR>qd!dj(Jpwrj(cE;U@o>1ScG10vD=3`M@wnh^$wWb
z;JkB#`~;Rgr{e?9{i$a|MNQv7&SSnPd2Gsp5=+mRq!)h*^ew6#BFY!txb50H;iF^w
zco^UKa{!%gpL+2)ezqHIH}QORBl^|5ek#^|&?lqwry<-m+C4{q*!V`e=uFm&1qy!_
zCv|BFGR~+UoA4qt;1nTN@WaYiByJ#z4f$zuMJ;VtIr8%NwhiY}$MxjidwW>k3;)w<
zJ1i1@js3UQ`Jq;E<3@UFY7E<q{1y5nc0A){Q%;_A#Lo#3juYi*YfIDiKDaZIU}4CY
z<^ee2TRUKq3e69=Dalq7!Gg4Wf57i)vUBsij^hwUD%??x-uX|0H3yF;L&Ib+qtGdZ
zk=`&v3l1tI&6Q9PE9z(=T>zBE;Hfd~hDi&^pz??3o#o`{ADpw*6#Sa7eI-h99Q42h
zVX=ur#R)L3N?@?cs<Dv|qXput(<m~ADZO{{8P}2>d(L%8{R#Q<)cm{wk=G$B0V%Fx
z4ElMCT)*GvGct5+$u+a-K!VaB9&!gGZ7fD(wOL$->>CiS`d&|Qf+wemh+~tYPjdy&
zte&&|XKw;rf{_Fr-HrT~H^tIvP)rhS8G-ui;bA2t&I_~bA=t0Hf3jcp#3$KH<xQfP
zyCIO8fB2eCujH~3Skw4%gG5803Mppn9^`sRFAU#>5($WnwHWhdbN$=EHKG8pA*XXw
zbu6AZI06^yahSMZ2e#iEIsn|)?1vvv9e!Z8ujT>N^ei1!iGmpQI=$Wm4fLomES4`@
zhI7|ff;CVMY<_4Ou30|BJ18YVA{fxZzkye~JA{tRN18m0>`AZ|d=dD4kf>U0mu{bs
zk?}jhFDM_1G%I$!q5^3KpeHFm*0*-CeU8wjjlk{`jpSbwa@w0X65!d!&*A|li`0Ru
zkI`;G>ryf@-NgnT&(cqwdQR_cyTxgKDk+QC3ZA6IS{mUa%=D9W>+BXhDhhR=*@wz*
z!v-W+*O}#A@K>uRzr+U<=_^bduHK!fp*eQ!Z;m4;Mpg8cu|urTy~>)+49RIBAAmLW
zPb;aXvhw?e2EloO_8<5>e6LFVr__(!{Hbz+?L-T;k*}#g>MPjQq#ZDBnD`~Hp$1N-
zskuYs#fM<`0hiKJQP<JASyUup;^CF|q^QW1m!%QT$arWVbj)dh@<Tk(%q_#TwV$9S
zA+I`qd{BG^GpTe>*j}iid&qub3J@lFd_xG$iW5@S$qX!~Y)1OSkY2iGD-*17mo##_
zeS|~w=g-du{pp;TOKg6E6&`8AP)$0pBxlrsQHKt(<LSP{K?I|iV#%q?n0b@i9v?Yv
z9s)@gM%jEkIHdR_w30I6S>*@Ck?S0Pb^0(g^x-<TeXX>j%H-8)cSB)+f{u=PLag%8
z9oKH%`t$MJ^C)9`=p>j_U|!FQf>nD6!m`;VmS#&n%oGNHU!)$SDR|uG-N%n(@lAt`
zOxD4U^)!q_;n;=MWh&HH>F#kQt|S4B+G9%J)9UI`0|smrordkwGi=nNGLg89FaTkb
zlv6A_hFGw1<N5i+?%%!3WST7(E*S6Z``6QxaCn;26)YZs^8iEw_;4W70CR{-AQK?%
z#TU*;yqdEOwF_xFcLLv<KWD-5@9ZuX7@{-cPB6kJbC|dcY7`rol|>vvpnUO1GO!W)
zIze%p@?;iILPDa?vmS_WzoF}fc+fHF20A5Lw%3+qD_^Qiefk(NG*Pl@+jM$rIKjb8
zK!(fotvn7wdr4`ZO`D3fGnsn1#?nCZBZn951afVjEt7CP=_+DT3Zg)viWmlXU|aJq
z_9*j1dJS0o!`IKoW*=XE*RmZ*Y%UzRuh6m;^Ud;S&n^Qw0@%YkU$UDyRPaxza8@C8
z<VljwWAnw>+9}-cv=hGlwZY|8H?Zf)*P!-Qv6tyNfrST!)0+QbCX2^D?;b33gAaE7
z)~&-B)UggI<gnwO$>bj%eztu&^aj1beSc+ek1#o&-X)7cKh7IR0hXJ=^L!OLt1LIo
z4Ew#^#rE3wXsXlY5RCX35r7~>u~W2^{PeTIi6{7xLl7e&wbR@oE1}uHb$Rdmg`7U;
z_U5vnR>DULxyHxj5Mi<AnB^LrpWg<UP`K=>Ng0O>!Zyo*&kY|25y(<Vxamv&q<*J8
z1a}qEJxs0D5E?->PT6NA(w2g&Au~r3*T>PL;aql@FXy@jJrW21`s>}wqi+%E@Y$ey
zJ!cMQa5FyQy!Az|*PYaAIY$Bzgp(pEEC*1S0i9xt{7OkAI+C0`ny-fkKw`I;Z)699
zt3+qOu|PC9vs7GlkpG0agNSN^)(Q<>UfhT(2_z90SugM`&uShaoEttjj)cUt15=Uq
zX;E8s`95Uk_E)Lt>GLmb%z@~{AT-o$7g-!+EFv*D2Z!>-%a?j+|L7XxTZ%2j$vb{h
z<@b?1SZe^l3*{9f&2oM?zF8zLLk~%U+FMB}7b+}u#HR;YuXvJV8LnAMaheYwKIDSC
zSyrYhxc+mYv9%Guu6&&I$X>Qt5Mr>8g?kPIaAq?>3AyT^8U(KqJrvB2s+%`g)|O$|
zF=wTZw&O*F=`q{Wk80FY`3d4ZWb&xk(TrcFxWjAYL8z8UmW<;Z2Zru9dixYx2U}aI
z-HHsRLCDPI#b!r2hNSf~M3~eU`x$jeyOeGW?i|b5J4`K3?IuXTnV2S+I}2hJ(m1uA
zYq-TZ{>))maM35rCT0E^Hw86x6+>77+O_1y8F-tZuT&d&3uk!JX;4SH#!hy2(zjF+
zyEVvY3C6s`oG#OYGSSh2652~qF`b>1fQGRay&8iJ|8Zj)!$Bc#fUmtMFG7n;dzjuo
zNnl~3ATuPc(oCgw29^CMb4@)D^-xsQonlAvL}NQ)9+Pt?SAK<R;jwse4r3`|lA;Tl
zr0fVuh0Ye#V=aaOtEmNuY}oQPj0;amO~v&frM}+^l8Yb_i7Uw#cmZRr3ZyQs``BmZ
z_Em6*C=E${nOA^2Ts>?+f2>NylR4!7G`)oizj=V?%R(s*6RND$>(=oEgPzLp?SL_9
z<_4|fT*(~vJ%kYj2@%6m9WZl>kAKcpjsCDOM|Pneay>fS+C7&;l!v8*@CNXg7Cr}A
zD0JBUaOFFyaggkpD?{|OWA}CMo=q-Cq@96OT>us5o$ZSj9^nfWUsXLPSn@UCsldJD
zZdw%gD=3^sB%vO&aZhksh{fEEBWvAlE@*+ckO6Ui<dSX>Z)DZx4?B0qIOEZ!&9pQH
z0pZ4K7jO0?hlw%P5V2yD-f;)Ew6^ZBAd4B$7{=Xcxz_Sl^vIB;cWmun+`_4Mxvsz0
zS8M6%b^CM<f+YN&%uG=ys$!?3&A+%v_<pFE(&y*hy>_jhq3~*LJ%;X9kZN%d@OQt0
z0dx*{BJR&Gk5xNHup`^N@kfiKgpk3tfwm9RM%bg|aqr*0#mxm#u;3aj@*+@kEa_pR
zO&C0A(B~H42PuqOiB{FeG32$EOL^MSqm@hxfYZUv0jD8z9IgAIJGelZrINa7A-u#R
z2?-<cE($QKdHdGTv!(#Yr)bN2K)?Xg)QTAyH+?iUcHE`C&pb3)DbzfkL8Y%YZ=8n*
z?bEb5!wFpk6ONK8NCZ|wqvof=Dr64KOw~Q5fsYpJ%_U2O+d|-meIXT_ZaaH{lT*XX
zm)-jH%lOMLz|E(l*7f{^OTs-U%uxKrRogSHI(_a)h~I(;u%Ge4jvAv347N2zzc!4o
z7_F=8oMlfy7xr^%axy9vferKN(=)v6J--5)apq4_zbH-!4ifrr&`0|3Nj`eC__de$
zN6VvTmv;U^ndb}5ZphxrHML|1>^(a9>}j@=7L(y1U^A@|E)_SwYAo6~dhofH<N#0s
zP<S}!Jcad<*iF0i)n{a#Rp`v4Ey*nJ;o|&Y=HQ5Ore+C5R48J3^O05yV<`MjsPyPm
z!nWfu!63jCn<*Bmx2#7k+0*eI@XQ$|B6Aaiy-^WFww=24Uf#X_+Mm(+&pNBCg^SAM
z%dEuRw(9>9iF!X8_EJ;F`s}#<i=XNoN;rEV+t@hUX!pu~8E12<g4ZRj`x#>VevPra
zv2o?YLyr!gG&*_G&ffZ*orUJOYr|)%hX<*&?^f2lXXLZI%Tk$De(%>b)XB>@J-g5l
z=Up+j;qazgW6z~`S?7tf*twh>wIF<lpv&MX|DpM(`8Eh*j;A7vwR3aZTJPt>+{77+
zw$O$Rd3I@ou=w=7401cyj;WlBPQ&O7u9E!e6W%^5JiI{n1~Om5?=X=p2XXGfkI<LW
z(#S+5o40>R2c_J(vy1h8o>fTk>Nhuf+bm%3*xK&57=Tpo)n^|#DLuo26^lqQ%%={H
zAh2Cqb&mQq4*fEoZl~^Ff8De+e)GK-o>GB@3{TZ3fjx4>Oha+igG@D%?3r`tn!kTX
z<<qa{7VVzb3FBp5#;P{K8H0ufE1H?M(Mu0AM<G5Y#%SFKrDWsDQx9*f9}3c8ZGFTp
z4f>mc7-z-OSMSysy`8_!MQIzBH!E>rOG&xoo?~?A<i(49Z^(tpMg)A@;O7S`><>ul
zI>Wx&*MZo2YvIu#rycfojZuQNM&xw}repjDI_TDnU~;>>Sz7g@=g+M)pZWj!qH^l~
zPegHo_WxTelo#S7K{HERE23O!8(w}(=k`p~TDk=bp1@7(TACK`nt0S&gM4?Zs1JiQ
zD=H?*ZU&l#5XS}3rP$>2mF^Rdeg^)+AO#8<=NUneM1ZQP>EY5>%W@u(96Rg&DC#^M
zbpapy*$M;WzH&;!oM&&NLzH-3im^`kzJ17H4vA>H#j$>ZUqcIyDqm^K1@_QHdp30F
z2&FED_xq?ZehM=2M_3U!){yL*#*Z^J4E<!eVw<l=fSE{HxwCYq`7b@Eb^ha@yD}tb
z>F!5cZmagTPpd9+b5)XlvTXN^o{EaFW#(!3+~*KrrmL%~s@Q4u`T|qmy_2O>js{DA
zgRjM93Vod&2ea<S4@2#*x2NyH4CK1xbo=AE&08MYczciZwfLJTr<A@zIPMB3$!CJ7
z@AL8J)^9d@rmFt2AS-<1rT#LlMMGXTPW;s}WOQPUn`BF6O^xcRxQaUEF5B3P#5-_A
zufX0NZ(Z%bZ`%YP48$`x)l>9X+jLtewc(Ou+<U`u<5Xm&YQCu4>ebtHhrPU{@dBSO
zdl>ey?Q3S59duF}dQ>jECcg5@gH$~C;Gx*q?y^!OPYugzt;1qzo{djc5>HOC_4|5f
z5-L@m?OEp+b0+OK*wF9iFX_O9)Kqt_?HVQA2d<Qq5JGQORH$Gt0}|l#Sjo>=tfABe
z9v0hV{qxPu>+^puKp)3600fKC@k94czWk^4{rYDchA4I60)qkwnCD&Fu<k;y`boLn
zt4>|M{Osepu#%U5{`iFyE8OaHa=k>ygR1rs<*1lD23Zqfy}h%aH{=7VMp&7)kd=-%
zvp;$#QyY!N6g}fnqdGkPa?#NP|CIqRPbf_2v~Tr=r=3$|>;fsaXfBXx7>^in=Y=O@
zae&44lor4G3;|22Q!sR}tQq@uNcF0F^Cn1~Q0TnnfZV?R52U621@{Aq`S!9D<RL$^
z9+Y0aDozNuOPg?RvySIT=8Qf5==Zs#my6b$D_4S^H>mXPO-0fvSYk+um&FJqe<MZ&
z%##f1s#f**aqPZ*rws>%YQ%KVUO3TgC)B<!#b&SiUKcrLODPn(r!P6yRA6UztER|b
zUQVw5+r~A?9T+|#Gf4fZ?Tn}QSu6y8Cr)Vi+;-Dv@hF>4*rqn>l)ebOv+7)k7<OX-
zt&5ELd0y1K*N5lZrd4yYb#%HKl!_gPm0ek3aN+4Es))8%Ds2D&eRf@aw`QMZmbNjp
zd%7v;hz>5sbP4lu1u=v%pDo;bWF}sz-YviV=<Z#nIa;tot^eX$Y1^Q1Jo0KIthjP@
zx^3TDsOo4Js^Q{QcBF&$N6tX$VAUXGYz?;trer=UC=Iq%zBu}DRXM@1=c*d(u=N(+
zp{VYm$~mi*n|IwkB1PUguHmvqFF>COh9}-nUfs~%2~y@@#Qfwlfldr}per018yl8A
z@$>H=(<aV1<~c?Bhp6?ppZ&7I@g)<Ct&d5hx&=)AB&(KSEn9BlsT^k)a_C&}z73z=
z7=`qj-*A%Q@`RP&exdF!-wrx|>DHy&2`+IDEB1{pP+Z#k?m(5cn;w4NBwZjE6{bJa
zb8^1Dj&!=ZSXym>`Pt&3V<!IzN;ZT{O-}KPA}GgUCF&Kyg@5R+S)m%K7OjbtveY+?
z|LENWBQ~1ghZfK6zvmoH6==h?6!jKWQSBFO)qV*&1()mcw|ny#JnBO?%GCK1F6J5M
zo>71^4Q27%?<KvQuB^45@_AU*p10pu9|4gi3lp%)>#s@kf~?0|Fjdf}!|it8mT-4v
z*rnNP!%n<Hx{q%Y;Ew8i`NL|~VbP0~CIW1mbb52NrbXNDtJ9T2Fx}gSu6Gg`>N+~u
zIv7*`k<5`0sLj3r2I}S2baV9c^t80%X_87l>%yWtsc6?;lb9qM<&`eq*r`U&;Ci7I
zCO*U@%uB!dm;jq=_k90tqpab=iABq63$7`?>34dHT9;h)K`%;z3_ELNp4yk~rEqIh
z^sOy7ZF8H<&V-Mw|BN@H!pXFbQj+a+3maX6QwF3p+`4gN%Z1aSMd6aT%|=-!QI>EL
z@N&7@(A@UX!{2z*_w<J=mM9Shq&0J#rxckd0SPm>V$a(%J9qCEV#^+rCOrSQ+iGrp
zwQIEM?{1YHH9Ki-Ip#Wk&c24GpT8d%t-jKsf*S14?*{+pB<XkDzP1P>F+1l+oY~R$
zPVn=-tGbg|!y~Znf70N=)os(Fs;1a~Y~=zRQ}uFd+Qm%w$IfGWs#K{@38hMR%{$UD
zO|e<YM{5qYKBQ)XFyNZjsf*tqEzke`(L-?1`TTh`F2jC@$ArwM+s&$R!yzv=oQnq|
z<v?0?cICS@MgC*^%RezOGTPBucUaYuE2@@&{je(EzSYoHA3bVRimj%s%HEHjKL#xA
z;<MI&iX*+0e{5-PF7bA7h$&xG<UPt{47-D{QXBXntyaG*VV8Fx0<qConFcZMoy$F8
za5}xa90&NDzn*wkpf8l~+O=@g(^c!mVu>AeV9oo_*e~s{%EN;!h5;)*Wu+P&b7$PT
zJ|&>Q&(=-q<qTib{JgvkkU>D7;ZjhfF{u&!39|x`TaH7<jO39F`KmZP0zhHbsf$h5
zu#Ee#ZWBtW@$zG(lnXpHnbtGp`f0=q+-Gbe$5Xv>RZC(~bz6^<AeDczsyR^Jlzhb8
z&S!+gtgUUHMu)6DB>O%En`7>&X?%t5&Zn!!t$8c5&_+#pxwT%H*h{w2O>L2WpAHi3
zml%v0)BAf<^vyTaj%ICi<oM;4Xca0OtIim<G@0BaAFt=go07-<o|0mV<OkbDY>bYj
zrA<@smZcpV8QJ{asqGOv?)7kg^K;pi=2Jx>=CUKYP_b+xy^(#rS59*1U09f&YDXS>
zJE=MX@Ga8Q=srlXld+M}x=&A-TnOWr=Z82YZbtIcRWgU*3$h?E@CyFCee0IHKKYJY
zX8N{}5EMRRMvQpjl?T4wGcl-Y>FEdB{q>lcrPKv_Fe9rTq;~4mZq!NpgI%R0e4cDD
z>Hk*t^j^}h3AX)bDD@uqa*a{3j?yi;P`42^d-zC@-0|wl%}7bv?xGZGr*r0QJN=s5
zP~Go=pK(rs<sPn(lafGP0dKk>rO??B!>3=|Q=8H8_LVQ~x^E}uZ8rf?Yln=(@gTw4
zZN-W%hNmB{Kv^rXfQAjoM6t|AiM?SL!)_#~uKrd(JNsc=Ow2Xiou#ijN(Y*4qp_Ib
z>Z9+YHVqYO@k)uM$Br7m*L*cK<A{N0J}LQH0W>1{qr;RrB5J%&|267^^rBZJm``7)
zHKgxU*hX1hZl4%fGFIBRpJ26x*YAl&=}M5R6#-_A50}QzwzH!V@$&RHzkHQ=7n)id
zFIj&|OiFq~*y5hAdbg(SSDjE|CiHQHtN_=mK#O{GYuqJg-M7ruU8=m})xaR8kxo6n
zHAbV+(AR<<$8Q4ehetVSC}EJwU^4>}+xUUIOl0O2B+^sr0{Gur6DV)6;(=gsFstk2
zxOqXn?9D^G269=F{d0dZe}qutDX%?J@H4qLct$MM@{eiq_s1mHlj@oeU6;%IJNNGY
zEZ5{6j$H=&`e-6}NB_2;&k-o@&gd*1NDmM0bj?>Eo)tW73Sc0$J1ec^J9qzHt=O~Y
zWv)a|i^4fhn_qw1IJUnPRB9sjB$drypKWSDqLgZ@+1EqxqCt>WQO6bntfO%=QI>hH
zP$T|fFQi?%bZGHIltQXO06D^PtzWx#kh;3r;v_7b{Jgxng)9arVm|DtQ%=-?Y%O}5
zhkcu-Sg7yhwD|sb5rVWP>+wgHj<PAF=s@oH7q_s(#JS1Tb=-g;{XV<O7vZt4p{Yq3
z;I?vQ$<Sc?i>C4NMs9R>=)eIrO~M%q7v0g%eZSnDHr(9UF6|q6WcVpJ{XS~H_Ql0@
z+4+l4HYA$0+x#i74rGP%k_QA0_6)3nf%*KsD)LhT3qAk3`8x7)^v{47J--!9Qnk;x
zCvW=0+1(w;8@Sf-=p9H_@7^tA;A+cNVBLo(u^okP*YBRuHkb1kE-=D!C7C8OrOED(
z8<vk5ZTHSv1Antts983$Xgw#%7KZ7*M&j9U@yqUty0BflXlY1wrM~b*5{Hy%Z)7Bx
zdk%c}NXL!HiLoiH*^O_d_Vv@bkqJ5ADpZD`S=^QnUNTMde)`-mY&>mo$AY>q0jt~1
z5nWN1l_G;x6)`lHqy<kcRc(4GXLP#=iMp#RfD||qg5c36CcgDmLmN-H?3Hl1=bqE|
zb^G;l>umj+%7>88C;IxBA;a5!#@YWzv5E+|b0kG_-z`73bh6i&!g{_<2>Jf$Y3F{7
zBuN1;3*7#l+cC<bZw<W;=|DBWa5T<z<7%cyTMCjEE`(f6E?cYTIQ=GpeCufl!RNSL
znty9$e4?@BD)m=(X+3tQZ25SIUQ1?BbJ@T>n9d0<AoN&|A1~qS4J1O7LH&9Wq5?p*
z3dI_?W$gv*%scN43b~*l<}y#E@0RbMZ>vdSqRcDx?u`)xX(4t?Y8eB%s9bUs#u`%k
zmG<AX^UTK=2YWu2+HTQAxo9>#++A{XT6H~X9u7XH->PO|@=x%383Zcsaq+YCy(tmp
z>JjA>B!*Q*lO`osny*Jei+Bao3%84uwa^~r-6OAe2<$V%rTtVhk7Y%gi~?LA;7q_8
zr{7g^oMwTd3l<Y3;rP0$<XwIBxyn7qUYi?+fJ9{-?nalu<y)Wr44;(?!NZ)7Bh%mK
z2>oX?E+<a7F{MSf4KWQatmuFtI_(+zJ?f6z8HWss05kMGAJ^HZVtg|3=m>5xwf+0{
z;qR!icXGO&R-PZT)0u@$lCzviVnbYNw)Q0E)V^5K=onQ_9>H+kEN!T0D-D$Ql!ooz
z4fHxMu2+WLd#^ltcmk;g)DqU=482(X(TWw+$(YY!VFx+PS83ab*qb$Z<~jXCirWV$
zs9I?#a{nmrnwZ<|@7zBCq=Pz8Mvhg!10MJHZ)3}#g7*I$=2URwG&MZCCMiiew6qB_
z7v&yKj|Q>RkK2@7z53|mI-f(6)lWNQxaT}_&vDm};f6X<dekm0p?>>}<nCc5M7)sf
zKbe1y9Y3C>jp6RmJ8qzlUpHR5;|2wV>%Bj{(f99poYs35fe5%}J^1*Y7diKMfwgsG
zcKq)yHli0p-Mr~KWMyS>t+3gF8$45GX8hha^|-uAV*&a>QZD2`*cLGy_Wie9h1{+N
z{@a=d-YO&+=SGAekC@1pvKNo<n@c1=<A<T)*8UN{LufY2*!VG?T-emW`MBeDWG}Cl
zVMneYvx_A^@kH{Gt3m9PB@m`o<Mb6#P9G~|+qNgG*3&!1D2H;=W|+@c5*T|o9MrAT
zs<CL8KUR0R_0k_i_e`xHAU&8A)Lbw+G(&cItYs2&2^lYq!D9A9CJs8xn^)qxn!Ai<
zAV~#{lQAK;&B{tv7%b0m2;J%x)Xw-aRqMo~0f|$Ogv*5-O-ox&ul3F(mEiFTX1yVc
zJ2}NqJx*~Ea6AMsn)5^IK4|b@J6l@-Ah^>Pb}>N$iGFnS!~6Hw(}R#v@%5w}(%s!N
zS?cZ5x%ZZ24?Qq7zzpuB+9Re^;^ANXLL@827L*QrLA$3@@PHvh>cG~yHv>oQw$}K{
zZH&L)NtzwWm3(szCCR`+^EVu`8ER3b(=+VxN4a1za2!d=sr!LCFYR?TWIC*Tw8Fro
z9gU<a_fZGii8XkT!-kz?5~HdJt;|q_fa&`Ba*t;8@ir+SpMw6#;hQ|Uth_v+-7>hs
zQ>X5zd?)o8Itb7wLd>pma_8rtbo$d2>FF#VT_8U@cgyN+E*Q~WbZnrs?N29+)dkgN
z1#~T$j8;*HT9RZ9V8i;Pv=7z%6f3JaDYkLz16E4)D_+vQEf&%2Pqh|bKh&ak+$?!V
zrdc!}SlA<2obYhPHnoUDhp31LI6U%vEVpb_-yE(;lBNNB-EtnWWq+8A=<;ff5$eP-
zMsw*#zxrI1QvGfXc4oNEua^mmN!Sa{A8MfTxbKgHE(?w?OB0Z!@j($shH8A0@$5Ez
zd~<8x)P@VcCp_!%`9AD^Sa(jp>*u^Ez5RQfcdtL%;?UApmnc5i1E)_n9k$NxvOU<T
zi-OEa?W2VrTJf7ssK<?6_I&R)k7*C~)n_dVj8j&%YP!_?jPr#dluUHfx!ea06J-@r
z798ty`&^>0noZ=8yYv<h&5$XXEa0nun)BOMLaUy*e0|&1#iC!AVlD@#m#$w?x9X(!
z&jrol&o>P^(=aTn;ak{5bMw#nU1Bn)e!kT1tn=!=UFIK<`kq!0()C(&%^AyI-IJ3f
z9x5i^9Xc%0?9I9XiDmtLEs8tO2p_bv@sz^Q(vL?TZ*cmt_Ik~rIHe$KVE43Bml5{G
zAzG7_a&G7uqR{xTY-zdjrvqQhmX1FccB&|4HMnWqy)uI=(SUVQLs#xoIQ@ORPptYO
zlb1E-O?yLcc&TTHn%zFMSX{oTr-ypnk{JVEyexSXyrH9qyTW3}(7m3my%KaTUUT&c
z*_XI&*X-MUCKYZmpC3I^BpY6`#PEEdTerkwdkeMV_yzNOmwi^sIyF#kSFlFmhlu+l
zdYkk|C@9Q#C&qy6)9huP#txV&<$Wfs(#PWUi#2^GZJgHa#>~SdrQ$2G<?)U4CLitf
zY_9r1g_TdA>Rz@s?mKF?PsP5SM>?e6UNE)4&f>?tY?ODamroo}U;FgIjX^6-TPC~`
zv8MlI#~n)K<r{C4Oi(i+M*VcI!z*izHKajh-WQ&`9nDqQ(!<BgOAj}<kim5!7DQ}9
z2R2XyBb$_CuY##vx4tZusyDK+e$p$qEjg-rT(F|zIBmDPs@%36O7<vMtvz-m*Qqh^
zLv`M?n*A45VnjQB_NpDB)0SNj9kS*kc3sxizkZl4m;~JZ-(NchHIBPvV#%lc@2}OP
zkDMGRyyky?m2~_6;tzg|8}D;aY4_9Fwe8xq8?<JE{hCECYZe<V^jggSYp16>VziF#
zNFCkLwtBioBSspH7@?&*!bn%wKCja2fBe8ok44LtZ1}(bfuXg_Z}9^n;T>jqELpSO
f#cOf9S#HQ77ke$-db=Zk*KW#$85SqS&RhQvQwGB$

literal 0
HcmV?d00001

diff --git a/doc/security/two_factor_authentication.md b/doc/security/two_factor_authentication.md
index c8499380c18..f02f7b807cf 100644
--- a/doc/security/two_factor_authentication.md
+++ b/doc/security/two_factor_authentication.md
@@ -8,7 +8,7 @@ their phone.
 You can read more about it here:
 [Two-factor Authentication (2FA)](../profile/two_factor_authentication.md)
 
-## Enabling 2FA
+## Enforcing 2FA for all users
 
 Users on GitLab, can enable it without any admin's intervention. If you want to
 enforce everyone to setup 2FA, you can choose from two different ways:
@@ -28,6 +28,21 @@ period to `0`.
 
 ---
 
+## Enforcing 2FA for all users in a group
+
+If you want to enforce 2FA only for certain groups, you can enable it in the
+group settings and specify a grace period as above. To change this setting you
+need to be administrator or owner of the group.
+
+If there are multiple 2FA requirements (i.e. group + all users, or multiple
+groups) the shortest grace period will be used.
+
+---
+
+![Two factor authentication group settings](img/two_factor_authentication_group_settings.png)
+
+---
+
 ## Disabling 2FA for everyone
 
 There may be some special situations where you want to disable 2FA for everyone
diff --git a/spec/controllers/application_controller_spec.rb b/spec/controllers/application_controller_spec.rb
index 81cbccd5436..64cfb87da5d 100644
--- a/spec/controllers/application_controller_spec.rb
+++ b/spec/controllers/application_controller_spec.rb
@@ -100,8 +100,6 @@ describe ApplicationController do
   end
 
   describe '#route_not_found' do
-    let(:controller) { ApplicationController.new }
-
     it 'renders 404 if authenticated' do
       allow(controller).to receive(:current_user).and_return(user)
       expect(controller).to receive(:not_found)
@@ -115,4 +113,203 @@ describe ApplicationController do
       controller.send(:route_not_found)
     end
   end
+
+  context 'two-factor authentication' do
+    let(:controller) { ApplicationController.new }
+
+    describe '#check_2fa_requirement' do
+      subject { controller.send :check_2fa_requirement }
+
+      it 'does not redirect if 2FA is not required' do
+        allow(controller).to receive(:two_factor_authentication_required?).and_return(false)
+        expect(controller).not_to receive(:redirect_to)
+
+        subject
+      end
+
+      it 'does not redirect if user is not logged in' do
+        allow(controller).to receive(:two_factor_authentication_required?).and_return(true)
+        allow(controller).to receive(:current_user).and_return(nil)
+        expect(controller).not_to receive(:redirect_to)
+
+        subject
+      end
+
+      it 'does not redirect if user has 2FA enabled' do
+        allow(controller).to receive(:two_factor_authentication_required?).and_return(true)
+        allow(controller).to receive(:current_user).twice.and_return(user)
+        allow(user).to receive(:two_factor_enabled?).and_return(true)
+        expect(controller).not_to receive(:redirect_to)
+
+        subject
+      end
+
+      it 'does not redirect if 2FA setup can be skipped' do
+        allow(controller).to receive(:two_factor_authentication_required?).and_return(true)
+        allow(controller).to receive(:current_user).twice.and_return(user)
+        allow(user).to receive(:two_factor_enabled?).and_return(false)
+        allow(controller).to receive(:skip_two_factor?).and_return(true)
+        expect(controller).not_to receive(:redirect_to)
+
+        subject
+      end
+
+      it 'redirects to 2FA setup otherwise' do
+        allow(controller).to receive(:two_factor_authentication_required?).and_return(true)
+        allow(controller).to receive(:current_user).twice.and_return(user)
+        allow(user).to receive(:two_factor_enabled?).and_return(false)
+        allow(controller).to receive(:skip_two_factor?).and_return(false)
+        allow(controller).to receive(:profile_two_factor_auth_path)
+        expect(controller).to receive(:redirect_to)
+
+        subject
+      end
+    end
+
+    describe '#two_factor_authentication_required?' do
+      subject { controller.send :two_factor_authentication_required? }
+
+      it 'returns false if no 2FA requirement is present' do
+        allow(controller).to receive(:current_user).and_return(nil)
+
+        expect(subject).to be_falsey
+      end
+
+      it 'returns true if a 2FA requirement is set in the application settings' do
+        stub_application_setting require_two_factor_authentication: true
+        allow(controller).to receive(:current_user).and_return(nil)
+
+        expect(subject).to be_truthy
+      end
+
+      it 'returns true if a 2FA requirement is set on the user' do
+        user.require_two_factor_authentication = true
+        allow(controller).to receive(:current_user).and_return(user)
+
+        expect(subject).to be_truthy
+      end
+    end
+
+    describe '#two_factor_grace_period' do
+      subject { controller.send :two_factor_grace_period }
+
+      it 'returns the grace period from the application settings' do
+        stub_application_setting two_factor_grace_period: 23
+        allow(controller).to receive(:current_user).and_return(nil)
+
+        expect(subject).to eq 23
+      end
+
+      context 'with a 2FA requirement set on the user' do
+        let(:user) { create :user, require_two_factor_authentication: true, two_factor_grace_period: 23 }
+
+        it 'returns the user grace period if lower than the application grace period' do
+          stub_application_setting two_factor_grace_period: 24
+          allow(controller).to receive(:current_user).and_return(user)
+
+          expect(subject).to eq 23
+        end
+
+        it 'returns the application grace period if lower than the user grace period' do
+          stub_application_setting two_factor_grace_period: 22
+          allow(controller).to receive(:current_user).and_return(user)
+
+          expect(subject).to eq 22
+        end
+      end
+    end
+
+    describe '#two_factor_grace_period_expired?' do
+      subject { controller.send :two_factor_grace_period_expired? }
+
+      before do
+        allow(controller).to receive(:current_user).and_return(user)
+      end
+
+      it 'returns false if the user has not started their grace period yet' do
+        expect(subject).to be_falsey
+      end
+
+      context 'with grace period started' do
+        let(:user) { create :user, otp_grace_period_started_at: 2.hours.ago }
+
+        it 'returns true if the grace period has expired' do
+          allow(controller).to receive(:two_factor_grace_period).and_return(1)
+
+          expect(subject).to be_truthy
+        end
+
+        it 'returns false if the grace period is still active' do
+          allow(controller).to receive(:two_factor_grace_period).and_return(3)
+
+          expect(subject).to be_falsey
+        end
+      end
+    end
+
+    describe '#two_factor_skippable' do
+      subject { controller.send :two_factor_skippable? }
+
+      before do
+        allow(controller).to receive(:current_user).and_return(user)
+      end
+
+      it 'returns false if 2FA is not required' do
+        allow(controller).to receive(:two_factor_authentication_required?).and_return(false)
+
+        expect(subject).to be_falsey
+      end
+
+      it 'returns false if the user has already enabled 2FA' do
+        allow(controller).to receive(:two_factor_authentication_required?).and_return(true)
+        allow(user).to receive(:two_factor_enabled?).and_return(true)
+
+        expect(subject).to be_falsey
+      end
+
+      it 'returns false if the 2FA grace period has expired' do
+        allow(controller).to receive(:two_factor_authentication_required?).and_return(true)
+        allow(user).to receive(:two_factor_enabled?).and_return(false)
+        allow(controller).to receive(:two_factor_grace_period_expired?).and_return(true)
+
+        expect(subject).to be_falsey
+      end
+
+      it 'returns true otherwise' do
+        allow(controller).to receive(:two_factor_authentication_required?).and_return(true)
+        allow(user).to receive(:two_factor_enabled?).and_return(false)
+        allow(controller).to receive(:two_factor_grace_period_expired?).and_return(false)
+
+        expect(subject).to be_truthy
+      end
+    end
+
+    describe '#skip_two_factor?' do
+      subject { controller.send :skip_two_factor? }
+
+      it 'returns false if 2FA setup was not skipped' do
+        allow(controller).to receive(:session).and_return({})
+
+        expect(subject).to be_falsey
+      end
+
+      context 'with 2FA setup skipped' do
+        before do
+          allow(controller).to receive(:session).and_return({ skip_tfa: 2.hours.from_now })
+        end
+
+        it 'returns false if the grace period has expired' do
+          Timecop.freeze(3.hours.from_now) do
+            expect(subject).to be_falsey
+          end
+        end
+
+        it 'returns true if the grace period is still active' do
+          Timecop.freeze(1.hour.from_now) do
+            expect(subject).to be_truthy
+          end
+        end
+      end
+    end
+  end
 end
diff --git a/spec/models/group_spec.rb b/spec/models/group_spec.rb
index 5d87938235a..8ffde6f7fbb 100644
--- a/spec/models/group_spec.rb
+++ b/spec/models/group_spec.rb
@@ -55,6 +55,8 @@ describe Group, models: true do
     it { is_expected.to validate_uniqueness_of(:name).scoped_to(:parent_id) }
     it { is_expected.to validate_presence_of :path }
     it { is_expected.not_to validate_presence_of :owner }
+    it { is_expected.to validate_presence_of :two_factor_grace_period }
+    it { is_expected.to validate_numericality_of(:two_factor_grace_period).is_greater_than_or_equal_to(0) }
   end
 
   describe '.visible_to_user' do
@@ -315,4 +317,44 @@ describe Group, models: true do
         to include(master.id, developer.id)
     end
   end
+
+  describe '#update_two_factor_requirement' do
+    let(:user) { create(:user) }
+
+    before do
+      group.add_user(user, GroupMember::OWNER)
+    end
+
+    it 'is called when require_two_factor_authentication is changed' do
+      expect_any_instance_of(User).to receive(:update_two_factor_requirement)
+
+      group.update!(require_two_factor_authentication: true)
+    end
+
+    it 'is called when two_factor_grace_period is changed' do
+      expect_any_instance_of(User).to receive(:update_two_factor_requirement)
+
+      group.update!(two_factor_grace_period: 23)
+    end
+
+    it 'is not called when other attributes are changed' do
+      expect_any_instance_of(User).not_to receive(:update_two_factor_requirement)
+
+      group.update!(description: 'foobar')
+    end
+
+    it 'calls #update_two_factor_requirement on each group member' do
+      other_user = create(:user)
+      group.add_user(other_user, GroupMember::OWNER)
+
+      calls = 0
+      allow_any_instance_of(User).to receive(:update_two_factor_requirement) do
+        calls += 1
+      end
+
+      group.update!(require_two_factor_authentication: true, two_factor_grace_period: 23)
+
+      expect(calls).to eq 2
+    end
+  end
 end
diff --git a/spec/models/members/group_member_spec.rb b/spec/models/members/group_member_spec.rb
index 370aeb9e0a9..024380b7ebb 100644
--- a/spec/models/members/group_member_spec.rb
+++ b/spec/models/members/group_member_spec.rb
@@ -61,7 +61,7 @@ describe GroupMember, models: true do
 
     describe '#after_accept_request' do
       it 'calls NotificationService.accept_group_access_request' do
-        member = create(:group_member, user: build_stubbed(:user), requested_at: Time.now)
+        member = create(:group_member, user: build(:user), requested_at: Time.now)
 
         expect_any_instance_of(NotificationService).to receive(:new_group_member)
 
@@ -75,4 +75,19 @@ describe GroupMember, models: true do
       it { is_expected.to eq 'Group' }
     end
   end
+
+  describe '#update_two_factor_requirement' do
+    let(:user) { build :user }
+    let(:group_member) { build :group_member, user: user }
+
+    it 'is called after creation and deletion' do
+      expect(user).to receive(:update_two_factor_requirement)
+
+      group_member.save
+
+      expect(user).to receive(:update_two_factor_requirement)
+
+      group_member.destroy
+    end
+  end
 end
diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb
index a9e37be1157..b2f686a1819 100644
--- a/spec/models/user_spec.rb
+++ b/spec/models/user_spec.rb
@@ -1521,4 +1521,46 @@ describe User, models: true do
       end
     end
   end
+
+  describe '#update_two_factor_requirement' do
+    let(:user) { create :user }
+
+    context 'with 2FA requirement on groups' do
+      let(:group1) { create :group, require_two_factor_authentication: true, two_factor_grace_period: 23 }
+      let(:group2) { create :group, require_two_factor_authentication: true, two_factor_grace_period: 32 }
+
+      before do
+        group1.add_user(user, GroupMember::OWNER)
+        group2.add_user(user, GroupMember::OWNER)
+
+        user.update_two_factor_requirement
+      end
+
+      it 'requires 2FA' do
+        expect(user.require_two_factor_authentication).to be true
+      end
+
+      it 'uses the shortest grace period' do
+        expect(user.two_factor_grace_period).to be 23
+      end
+    end
+
+    context 'without 2FA requirement on groups' do
+      let(:group) { create :group }
+
+      before do
+        group.add_user(user, GroupMember::OWNER)
+
+        user.update_two_factor_requirement
+      end
+
+      it 'does not require 2FA' do
+        expect(user.require_two_factor_authentication).to be false
+      end
+
+      it 'falls back to the default grace period' do
+        expect(user.two_factor_grace_period).to be 48
+      end
+    end
+  end
 end