@acmekit/core-flows 2.13.1

package/dist/rbac/steps/index.d.ts

@@ -0,0 +1,12 @@
+export * from "./create-rbac-policies";
+export * from "./create-rbac-role-parents";
+export * from "./create-rbac-role-policies";
+export * from "./create-rbac-roles";
+export * from "./delete-rbac-policies";
+export * from "./delete-rbac-role-policies";
+export * from "./delete-rbac-roles";
+export * from "./set-role-parent";
+export * from "./update-rbac-policies";
+export * from "./update-rbac-roles";
+export * from "./validate-user-permissions";
+//# sourceMappingURL=index.d.ts.map

package/dist/rbac/steps/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/rbac/steps/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAA;AACtC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,qBAAqB,CAAA;AACnC,cAAc,6BAA6B,CAAA"}

package/dist/rbac/steps/index.js

@@ -0,0 +1,28 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./create-rbac-policies"), exports);
+__exportStar(require("./create-rbac-role-parents"), exports);
+__exportStar(require("./create-rbac-role-policies"), exports);
+__exportStar(require("./create-rbac-roles"), exports);
+__exportStar(require("./delete-rbac-policies"), exports);
+__exportStar(require("./delete-rbac-role-policies"), exports);
+__exportStar(require("./delete-rbac-roles"), exports);
+__exportStar(require("./set-role-parent"), exports);
+__exportStar(require("./update-rbac-policies"), exports);
+__exportStar(require("./update-rbac-roles"), exports);
+__exportStar(require("./validate-user-permissions"), exports);
+//# sourceMappingURL=index.js.map

package/dist/rbac/steps/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/rbac/steps/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yDAAsC;AACtC,6DAA0C;AAC1C,8DAA2C;AAC3C,sDAAmC;AACnC,yDAAsC;AACtC,8DAA2C;AAC3C,sDAAmC;AACnC,oDAAiC;AACjC,yDAAsC;AACtC,sDAAmC;AACnC,8DAA2C"}

package/dist/rbac/steps/set-role-parent.d.ts

@@ -0,0 +1,10 @@
+export type SetRoleParentStepInput = Array<{
+    role_id: string;
+    parent_ids: string[];
+}>;
+export declare const setRoleParentStepId = "set-role-parent";
+export declare const setRoleParentStep: import("@acmekit/framework/workflows-sdk").StepFunction<SetRoleParentStepInput, {
+    created: any[];
+    removedCount: number;
+}>;
+//# sourceMappingURL=set-role-parent.d.ts.map

package/dist/rbac/steps/set-role-parent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-role-parent.d.ts","sourceRoot":"","sources":["../../../src/rbac/steps/set-role-parent.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,sBAAsB,GAAG,KAAK,CAAC;IACzC,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB,CAAC,CAAA;AAEF,eAAO,MAAM,mBAAmB,oBAAoB,CAAA;AAEpD,eAAO,MAAM,iBAAiB;;;EAwG7B,CAAA"}

package/dist/rbac/steps/set-role-parent.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setRoleParentStep = exports.setRoleParentStepId = void 0;
+const utils_1 = require("@acmekit/framework/utils");
+const workflows_sdk_1 = require("@acmekit/framework/workflows-sdk");
+exports.setRoleParentStepId = "set-role-parent";
+exports.setRoleParentStep = (0, workflows_sdk_1.createStep)(exports.setRoleParentStepId, async (data, { container }) => {
+    const service = container.resolve(utils_1.Modules.RBAC);
+    const allCompensationData = [];
+    if (!data || data.length === 0) {
+        return new workflows_sdk_1.StepResponse({ created: [], removedCount: 0 }, allCompensationData);
+    }
+    const allToRemoveIds = [];
+    const allToCreate = [];
+    for (const roleData of data) {
+        const existingParent = await service.listRbacRoleParents({
+            role_id: roleData.role_id,
+        });
+        const existingInheritedRoleIds = existingParent.map((ri) => ri.parent_id);
+        allCompensationData.push({
+            role_id: roleData.role_id,
+            previous_inherited_role_ids: existingInheritedRoleIds,
+        });
+        const toAdd = roleData.parent_ids.filter((id) => !existingInheritedRoleIds.includes(id));
+        const toRemove = existingInheritedRoleIds.filter((id) => !roleData.parent_ids.includes(id));
+        if (toRemove.length > 0) {
+            const toRemoveRecords = existingParent.filter((ri) => toRemove.includes(ri.parent_id));
+            allToRemoveIds.push(...toRemoveRecords.map((ri) => ri.id));
+        }
+        if (toAdd.length > 0) {
+            allToCreate.push(...toAdd.map((parent_id) => ({
+                role_id: roleData.role_id,
+                parent_id,
+            })));
+        }
+    }
+    if (allToRemoveIds.length > 0) {
+        await service.deleteRbacRoleParents(allToRemoveIds);
+    }
+    let created = [];
+    if (allToCreate.length > 0) {
+        created = await service.createRbacRoleParents(allToCreate);
+    }
+    return new workflows_sdk_1.StepResponse({ created, removedCount: allToRemoveIds.length }, allCompensationData);
+}, async (compensationData, { container }) => {
+    if (!compensationData || compensationData.length === 0) {
+        return;
+    }
+    const service = container.resolve(utils_1.Modules.RBAC);
+    for (const roleCompensation of compensationData) {
+        const currentParent = await service.listRbacRoleParents({
+            role_id: roleCompensation.role_id,
+        });
+        if (currentParent.length > 0) {
+            await service.deleteRbacRoleParents(currentParent.map((ri) => ri.id));
+        }
+        if (roleCompensation.previous_inherited_role_ids.length > 0) {
+            await service.createRbacRoleParents(roleCompensation.previous_inherited_role_ids.map((parent_id) => ({
+                role_id: roleCompensation.role_id,
+                parent_id,
+            })));
+        }
+    }
+});
+//# sourceMappingURL=set-role-parent.js.map

package/dist/rbac/steps/set-role-parent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-role-parent.js","sourceRoot":"","sources":["../../../src/rbac/steps/set-role-parent.ts"],"names":[],"mappings":";;;AAAA,oDAAkD;AAClD,oEAA2E;AAQ9D,QAAA,mBAAmB,GAAG,iBAAiB,CAAA;AAEvC,QAAA,iBAAiB,GAAG,IAAA,0BAAU,EACzC,2BAAmB,EACnB,KAAK,EAAE,IAA4B,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;IACpD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAqB,eAAO,CAAC,IAAI,CAAC,CAAA;IAEnE,MAAM,mBAAmB,GAGpB,EAAE,CAAA;IAEP,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,4BAAY,CACrB,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,EAChC,mBAAmB,CACpB,CAAA;IACH,CAAC;IAED,MAAM,cAAc,GAAa,EAAE,CAAA;IACnC,MAAM,WAAW,GAGZ,EAAE,CAAA;IAEP,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC;YACvD,OAAO,EAAE,QAAQ,CAAC,OAAO;SAC1B,CAAC,CAAA;QAEF,MAAM,wBAAwB,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,CAAA;QAEzE,mBAAmB,CAAC,IAAI,CAAC;YACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,2BAA2B,EAAE,wBAAwB;SACtD,CAAC,CAAA;QAEF,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,CACtC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAC/C,CAAA;QACD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,MAAM,CAC9C,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAC1C,CAAA;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,eAAe,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CACnD,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,SAAS,CAAC,CAChC,CAAA;YACD,cAAc,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;QAC5D,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,WAAW,CAAC,IAAI,CACd,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBAC3B,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,SAAS;aACV,CAAC,CAAC,CACJ,CAAA;QACH,CAAC;IACH,CAAC;IAED,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,OAAO,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAAA;IACrD,CAAC;IAED,IAAI,OAAO,GAAU,EAAE,CAAA;IACvB,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,GAAG,MAAM,OAAO,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAA;IAC5D,CAAC;IAED,OAAO,IAAI,4BAAY,CACrB,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,CAAC,MAAM,EAAE,EAChD,mBAAmB,CACpB,CAAA;AACH,CAAC,EACD,KAAK,EACH,gBAEa,EACb,EAAE,SAAS,EAAE,EACb,EAAE;IACF,IAAI,CAAC,gBAAgB,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAqB,eAAO,CAAC,IAAI,CAAC,CAAA;IAEnE,KAAK,MAAM,gBAAgB,IAAI,gBAAgB,EAAE,CAAC;QAChD,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC;YACtD,OAAO,EAAE,gBAAgB,CAAC,OAAO;SAClC,CAAC,CAAA;QAEF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,OAAO,CAAC,qBAAqB,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;QACvE,CAAC;QAED,IAAI,gBAAgB,CAAC,2BAA2B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5D,MAAM,OAAO,CAAC,qBAAqB,CACjC,gBAAgB,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBAC/D,OAAO,EAAE,gBAAgB,CAAC,OAAO;gBACjC,SAAS;aACV,CAAC,CAAC,CACJ,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC,CACF,CAAA"}

package/dist/rbac/steps/update-rbac-policies.d.ts

@@ -0,0 +1,8 @@
+import { UpdateRbacPolicyDTO } from "@acmekit/types";
+export type UpdateRbacPoliciesStepInput = {
+    selector: Record<string, any>;
+    update: Omit<UpdateRbacPolicyDTO, "id">;
+};
+export declare const updateRbacPoliciesStepId = "update-rbac-policies";
+export declare const updateRbacPoliciesStep: import("@acmekit/framework/workflows-sdk").StepFunction<UpdateRbacPoliciesStepInput, import("@acmekit/types").RbacPolicyDTO[]>;
+//# sourceMappingURL=update-rbac-policies.d.ts.map

package/dist/rbac/steps/update-rbac-policies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-rbac-policies.d.ts","sourceRoot":"","sources":["../../../src/rbac/steps/update-rbac-policies.ts"],"names":[],"mappings":"AAKA,OAAO,EAAsB,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAExE,MAAM,MAAM,2BAA2B,GAAG;IACxC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC7B,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAA;CACxC,CAAA;AAED,eAAO,MAAM,wBAAwB,yBAAyB,CAAA;AAE9D,eAAO,MAAM,sBAAsB,gIAuDlC,CAAA"}

package/dist/rbac/steps/update-rbac-policies.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.updateRbacPoliciesStep = exports.updateRbacPoliciesStepId = void 0;
+const utils_1 = require("@acmekit/framework/utils");
+const workflows_sdk_1 = require("@acmekit/framework/workflows-sdk");
+exports.updateRbacPoliciesStepId = "update-rbac-policies";
+exports.updateRbacPoliciesStep = (0, workflows_sdk_1.createStep)(exports.updateRbacPoliciesStepId, async (data, { container }) => {
+    const service = container.resolve(utils_1.Modules.RBAC);
+    const { selects, relations } = (0, utils_1.getSelectsAndRelationsFromObjectArray)([
+        data.update,
+    ]);
+    const prevData = await service.listRbacPolicies(data.selector, {
+        select: selects,
+        relations,
+    });
+    // Normalize resource and operation to lowercase if present
+    const normalizedUpdate = { ...data.update };
+    if (normalizedUpdate.resource) {
+        normalizedUpdate.resource = normalizedUpdate.resource.toLowerCase();
+    }
+    if (normalizedUpdate.operation) {
+        normalizedUpdate.operation = normalizedUpdate.operation.toLowerCase();
+    }
+    const updates = (prevData ?? []).map((p) => ({
+        id: p.id,
+        ...normalizedUpdate,
+    }));
+    const updated = await service.updateRbacPolicies(updates);
+    return new workflows_sdk_1.StepResponse(updated, {
+        prevData,
+        updateKeys: Object.keys(data.update ?? {}),
+    });
+}, async (compensationData, { container }) => {
+    if (!compensationData?.prevData?.length) {
+        return;
+    }
+    const service = container.resolve(utils_1.Modules.RBAC);
+    const updates = compensationData.prevData.map((p) => {
+        const payload = { id: p.id };
+        for (const key of compensationData.updateKeys) {
+            payload[key] = p[key];
+        }
+        return payload;
+    });
+    await service.updateRbacPolicies(updates);
+});
+//# sourceMappingURL=update-rbac-policies.js.map

package/dist/rbac/steps/update-rbac-policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-rbac-policies.js","sourceRoot":"","sources":["../../../src/rbac/steps/update-rbac-policies.ts"],"names":[],"mappings":";;;AAAA,oDAGiC;AACjC,oEAA2E;AAQ9D,QAAA,wBAAwB,GAAG,sBAAsB,CAAA;AAEjD,QAAA,sBAAsB,GAAG,IAAA,0BAAU,EAC9C,gCAAwB,EACxB,KAAK,EAAE,IAAiC,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;IACzD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAqB,eAAO,CAAC,IAAI,CAAC,CAAA;IAEnE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,IAAA,6CAAqC,EAAC;QACnE,IAAI,CAAC,MAAM;KACZ,CAAC,CAAA;IAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE;QAC7D,MAAM,EAAE,OAAO;QACf,SAAS;KACV,CAAC,CAAA;IAEF,2DAA2D;IAC3D,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAA;IAC3C,IAAI,gBAAgB,CAAC,QAAQ,EAAE,CAAC;QAC9B,gBAAgB,CAAC,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;IACrE,CAAC;IACD,IAAI,gBAAgB,CAAC,SAAS,EAAE,CAAC;QAC/B,gBAAgB,CAAC,SAAS,GAAG,gBAAgB,CAAC,SAAS,CAAC,WAAW,EAAE,CAAA;IACvE,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3C,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,GAAG,gBAAgB;KACpB,CAAC,CAA0B,CAAA;IAE5B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAA;IAEzD,OAAO,IAAI,4BAAY,CAAC,OAAO,EAAE;QAC/B,QAAQ;QACR,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;KAC3C,CAAC,CAAA;AACJ,CAAC,EACD,KAAK,EACH,gBAAuE,EACvE,EAAE,SAAS,EAAE,EACb,EAAE;IACF,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACxC,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAqB,eAAO,CAAC,IAAI,CAAC,CAAA;IAEnE,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAClD,MAAM,OAAO,GAAwB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAA;QACjD,KAAK,MAAM,GAAG,IAAI,gBAAgB,CAAC,UAAU,EAAE,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAA;QACvB,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC,CAA0B,CAAA;IAE3B,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAA;AAC3C,CAAC,CACF,CAAA"}

package/dist/rbac/steps/update-rbac-role-policies.d.ts

@@ -0,0 +1,8 @@
+import { UpdateRbacRolePolicyDTO } from "@acmekit/types";
+export type UpdateRbacRolePoliciesStepInput = {
+    selector: Record<string, any>;
+    update: Omit<UpdateRbacRolePolicyDTO, "id">;
+};
+export declare const updateRbacRolePoliciesStepId = "update-rbac-role-policies";
+export declare const updateRbacRolePoliciesStep: import("@acmekit/framework/workflows-sdk").StepFunction<UpdateRbacRolePoliciesStepInput, import("@acmekit/types").RbacRolePolicyDTO[]>;
+//# sourceMappingURL=update-rbac-role-policies.d.ts.map

package/dist/rbac/steps/update-rbac-role-policies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-rbac-role-policies.d.ts","sourceRoot":"","sources":["../../../src/rbac/steps/update-rbac-role-policies.ts"],"names":[],"mappings":"AAKA,OAAO,EAAsB,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AAE5E,MAAM,MAAM,+BAA+B,GAAG;IAC5C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC7B,MAAM,EAAE,IAAI,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAA;CAC5C,CAAA;AAED,eAAO,MAAM,4BAA4B,8BAA8B,CAAA;AAEvE,eAAO,MAAM,0BAA0B,wIA8CtC,CAAA"}

package/dist/rbac/steps/update-rbac-role-policies.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.updateRbacRolePoliciesStep = exports.updateRbacRolePoliciesStepId = void 0;
+const utils_1 = require("@acmekit/framework/utils");
+const workflows_sdk_1 = require("@acmekit/framework/workflows-sdk");
+exports.updateRbacRolePoliciesStepId = "update-rbac-role-policies";
+exports.updateRbacRolePoliciesStep = (0, workflows_sdk_1.createStep)(exports.updateRbacRolePoliciesStepId, async (data, { container }) => {
+    const service = container.resolve(utils_1.Modules.RBAC);
+    const { selects, relations } = (0, utils_1.getSelectsAndRelationsFromObjectArray)([
+        data.update,
+    ]);
+    const prevData = await service.listRbacRolePolicies(data.selector, {
+        select: selects,
+        relations,
+    });
+    const updates = (prevData ?? []).map((rp) => ({
+        id: rp.id,
+        ...data.update,
+    }));
+    const updated = await service.updateRbacRolePolicies(updates);
+    return new workflows_sdk_1.StepResponse(updated, {
+        prevData,
+        updateKeys: Object.keys(data.update ?? {}),
+    });
+}, async (compensationData, { container }) => {
+    if (!compensationData?.prevData?.length) {
+        return;
+    }
+    const service = container.resolve(utils_1.Modules.RBAC);
+    const updates = compensationData.prevData.map((rp) => {
+        const payload = { id: rp.id };
+        for (const key of compensationData.updateKeys) {
+            payload[key] = rp[key];
+        }
+        return payload;
+    });
+    await service.updateRbacRolePolicies(updates);
+});
+//# sourceMappingURL=update-rbac-role-policies.js.map

package/dist/rbac/steps/update-rbac-role-policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-rbac-role-policies.js","sourceRoot":"","sources":["../../../src/rbac/steps/update-rbac-role-policies.ts"],"names":[],"mappings":";;;AAAA,oDAGiC;AACjC,oEAA2E;AAQ9D,QAAA,4BAA4B,GAAG,2BAA2B,CAAA;AAE1D,QAAA,0BAA0B,GAAG,IAAA,0BAAU,EAClD,oCAA4B,EAC5B,KAAK,EAAE,IAAqC,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;IAC7D,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAqB,eAAO,CAAC,IAAI,CAAC,CAAA;IAEnE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,IAAA,6CAAqC,EAAC;QACnE,IAAI,CAAC,MAAM;KACZ,CAAC,CAAA;IAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,EAAE;QACjE,MAAM,EAAE,OAAO;QACf,SAAS;KACV,CAAC,CAAA;IAEF,MAAM,OAAO,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5C,EAAE,EAAE,EAAE,CAAC,EAAE;QACT,GAAG,IAAI,CAAC,MAAM;KACf,CAAC,CAA8B,CAAA;IAEhC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAE7D,OAAO,IAAI,4BAAY,CAAC,OAAO,EAAE;QAC/B,QAAQ;QACR,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;KAC3C,CAAC,CAAA;AACJ,CAAC,EACD,KAAK,EACH,gBAAuE,EACvE,EAAE,SAAS,EAAE,EACb,EAAE;IACF,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACxC,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAqB,eAAO,CAAC,IAAI,CAAC,CAAA;IAEnE,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACnD,MAAM,OAAO,GAAwB,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAA;QAClD,KAAK,MAAM,GAAG,IAAI,gBAAgB,CAAC,UAAU,EAAE,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAA;QACxB,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC,CAA8B,CAAA;IAE/B,MAAM,OAAO,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAA;AAC/C,CAAC,CACF,CAAA"}

package/dist/rbac/steps/update-rbac-roles.d.ts

@@ -0,0 +1,8 @@
+import { UpdateRbacRoleDTO } from "@acmekit/types";
+export type UpdateRbacRolesStepInput = {
+    selector: Record<string, any>;
+    update: Omit<UpdateRbacRoleDTO, "id">;
+};
+export declare const updateRbacRolesStepId = "update-rbac-roles";
+export declare const updateRbacRolesStep: import("@acmekit/framework/workflows-sdk").StepFunction<UpdateRbacRolesStepInput, import("@acmekit/types").RbacRoleDTO[]>;
+//# sourceMappingURL=update-rbac-roles.d.ts.map

package/dist/rbac/steps/update-rbac-roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-rbac-roles.d.ts","sourceRoot":"","sources":["../../../src/rbac/steps/update-rbac-roles.ts"],"names":[],"mappings":"AAKA,OAAO,EAAsB,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAEtE,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC7B,MAAM,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAA;CACtC,CAAA;AAED,eAAO,MAAM,qBAAqB,sBAAsB,CAAA;AAExD,eAAO,MAAM,mBAAmB,2HA8C/B,CAAA"}

package/dist/rbac/steps/update-rbac-roles.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.updateRbacRolesStep = exports.updateRbacRolesStepId = void 0;
+const utils_1 = require("@acmekit/framework/utils");
+const workflows_sdk_1 = require("@acmekit/framework/workflows-sdk");
+exports.updateRbacRolesStepId = "update-rbac-roles";
+exports.updateRbacRolesStep = (0, workflows_sdk_1.createStep)(exports.updateRbacRolesStepId, async (data, { container }) => {
+    const service = container.resolve(utils_1.Modules.RBAC);
+    const { selects, relations } = (0, utils_1.getSelectsAndRelationsFromObjectArray)([
+        data.update,
+    ]);
+    const prevData = await service.listRbacRoles(data.selector, {
+        select: selects,
+        relations,
+    });
+    const updates = (prevData ?? []).map((r) => ({
+        id: r.id,
+        ...data.update,
+    }));
+    const updated = await service.updateRbacRoles(updates);
+    return new workflows_sdk_1.StepResponse(updated, {
+        prevData,
+        updateKeys: Object.keys(data.update ?? {}),
+    });
+}, async (compensationData, { container }) => {
+    if (!compensationData?.prevData?.length) {
+        return;
+    }
+    const service = container.resolve(utils_1.Modules.RBAC);
+    const updates = compensationData.prevData.map((r) => {
+        const payload = { id: r.id };
+        for (const key of compensationData.updateKeys) {
+            payload[key] = r[key];
+        }
+        return payload;
+    });
+    await service.updateRbacRoles(updates);
+});
+//# sourceMappingURL=update-rbac-roles.js.map

package/dist/rbac/steps/update-rbac-roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-rbac-roles.js","sourceRoot":"","sources":["../../../src/rbac/steps/update-rbac-roles.ts"],"names":[],"mappings":";;;AAAA,oDAGiC;AACjC,oEAA2E;AAQ9D,QAAA,qBAAqB,GAAG,mBAAmB,CAAA;AAE3C,QAAA,mBAAmB,GAAG,IAAA,0BAAU,EAC3C,6BAAqB,EACrB,KAAK,EAAE,IAA8B,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;IACtD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAqB,eAAO,CAAC,IAAI,CAAC,CAAA;IAEnE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,IAAA,6CAAqC,EAAC;QACnE,IAAI,CAAC,MAAM;KACZ,CAAC,CAAA;IAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE;QAC1D,MAAM,EAAE,OAAO;QACf,SAAS;KACV,CAAC,CAAA;IAEF,MAAM,OAAO,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3C,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,GAAG,IAAI,CAAC,MAAM;KACf,CAAC,CAAwB,CAAA;IAE1B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAEtD,OAAO,IAAI,4BAAY,CAAC,OAAO,EAAE;QAC/B,QAAQ;QACR,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;KAC3C,CAAC,CAAA;AACJ,CAAC,EACD,KAAK,EACH,gBAAuE,EACvE,EAAE,SAAS,EAAE,EACb,EAAE;IACF,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACxC,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAqB,eAAO,CAAC,IAAI,CAAC,CAAA;IAEnE,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAClD,MAAM,OAAO,GAAwB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAA;QACjD,KAAK,MAAM,GAAG,IAAI,gBAAgB,CAAC,UAAU,EAAE,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAA;QACvB,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC,CAAwB,CAAA;IAEzB,MAAM,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;AACxC,CAAC,CACF,CAAA"}

package/dist/rbac/steps/validate-user-permissions.d.ts

@@ -0,0 +1,16 @@
+export type ValidateUserPermissionsStepInput = {
+    actor_id: string;
+    actor?: string;
+    policy_ids?: string[];
+    actions?: {
+        resource: string;
+        operation: string;
+    }[];
+};
+export declare const validateUserPermissionsStepId = "validate-user-permissions";
+/**
+ * Validates that a user has access to all the policies they are trying to assign.
+ * A user can only create roles and add policies that they themselves have access to.
+ */
+export declare const validateUserPermissionsStep: import("@acmekit/framework/workflows-sdk").StepFunction<ValidateUserPermissionsStepInput, unknown>;
+//# sourceMappingURL=validate-user-permissions.d.ts.map

package/dist/rbac/steps/validate-user-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-user-permissions.d.ts","sourceRoot":"","sources":["../../../src/rbac/steps/validate-user-permissions.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,gCAAgC,GAAG;IAC7C,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,OAAO,CAAC,EAAE;QACR,QAAQ,EAAE,MAAM,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;KAClB,EAAE,CAAA;CACJ,CAAA;AAED,eAAO,MAAM,6BAA6B,8BAA8B,CAAA;AAExE;;;GAGG;AACH,eAAO,MAAM,2BAA2B,oGA0DvC,CAAA"}

package/dist/rbac/steps/validate-user-permissions.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateUserPermissionsStep = exports.validateUserPermissionsStepId = void 0;
+const utils_1 = require("@acmekit/framework/utils");
+const workflows_sdk_1 = require("@acmekit/framework/workflows-sdk");
+exports.validateUserPermissionsStepId = "validate-user-permissions";
+/**
+ * Validates that a user has access to all the policies they are trying to assign.
+ * A user can only create roles and add policies that they themselves have access to.
+ */
+exports.validateUserPermissionsStep = (0, workflows_sdk_1.createStep)(exports.validateUserPermissionsStepId, async (data, { container }) => {
+    const { actor_id, actor, policy_ids, actions } = data;
+    if (!policy_ids?.length && !actions?.length) {
+        return;
+    }
+    const query = container.resolve(utils_1.ContainerRegistrationKeys.QUERY);
+    const { data: users } = await query.graph({
+        entity: actor ?? "user",
+        fields: ["rbac_roles.id", "rbac_roles.policies.*"],
+        filters: { id: actor_id },
+    });
+    if (!users?.[0]?.rbac_roles || users[0].rbac_roles.length === 0) {
+        throw new utils_1.AcmeKitError(utils_1.AcmeKitError.Types.FORBIDDEN, "Forbidden");
+    }
+    const operationMap = new Map();
+    users[0].rbac_roles.forEach((role) => {
+        role.policies.forEach((policy) => {
+            const op = policy.operation === "*" ? "*" : (0, utils_1.toSnakeCase)(policy.operation);
+            operationMap.set(`${policy.resource}:${op}`, policy.id);
+        });
+    });
+    const allUserPolicies = users[0].rbac_roles.flatMap((role) => role.policies || []);
+    const userPolicyIds = new Set(allUserPolicies.map((p) => p.id));
+    let unauthorizedPolicies = [];
+    if (policy_ids?.length) {
+        unauthorizedPolicies = policy_ids.filter((policyId) => !userPolicyIds.has(policyId));
+    }
+    else if (actions?.length) {
+        unauthorizedPolicies = actions
+            .filter((action) => {
+            const op = action.operation === "*" ? "*" : (0, utils_1.toSnakeCase)(action.operation);
+            return (!operationMap.has(`${action.resource}:${op}`) &&
+                !operationMap.has(`${action.resource}:*`));
+        })
+            .map((action) => `${action.resource}:${action.operation}`);
+    }
+    if (unauthorizedPolicies.length) {
+        throw new utils_1.AcmeKitError(utils_1.AcmeKitError.Types.FORBIDDEN, "Forbidden");
+    }
+});
+//# sourceMappingURL=validate-user-permissions.js.map

package/dist/rbac/steps/validate-user-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-user-permissions.js","sourceRoot":"","sources":["../../../src/rbac/steps/validate-user-permissions.ts"],"names":[],"mappings":";;;AAAA,oDAIiC;AACjC,oEAA6D;AAYhD,QAAA,6BAA6B,GAAG,2BAA2B,CAAA;AAExE;;;GAGG;AACU,QAAA,2BAA2B,GAAG,IAAA,0BAAU,EACnD,qCAA6B,EAC7B,KAAK,EAAE,IAAsC,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;IAC9D,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,IAAI,CAAA;IAErD,IAAI,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAC5C,OAAM;IACR,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,iCAAyB,CAAC,KAAK,CAAC,CAAA;IAChE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC;QACxC,MAAM,EAAE,KAAK,IAAI,MAAM;QACvB,MAAM,EAAE,CAAC,eAAe,EAAE,uBAAuB,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE;KAC1B,CAAC,CAAA;IAEF,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,oBAAY,CAAC,oBAAY,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IACnE,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,EAAE,CAAA;IAC9B,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACnC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;YAC/B,MAAM,EAAE,GACN,MAAM,CAAC,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAA,mBAAW,EAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAChE,YAAY,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QACzD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CACjD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAC9B,CAAA;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAE/D,IAAI,oBAAoB,GAAa,EAAE,CAAA;IAEvC,IAAI,UAAU,EAAE,MAAM,EAAE,CAAC;QACvB,oBAAoB,GAAG,UAAU,CAAC,MAAM,CACtC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC3C,CAAA;IACH,CAAC;SAAM,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;QAC3B,oBAAoB,GAAG,OAAO;aAC3B,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;YACjB,MAAM,EAAE,GACN,MAAM,CAAC,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAA,mBAAW,EAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAEhE,OAAO,CACL,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;gBAC7C,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,CAC1C,CAAA;QACH,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,IAAI,oBAAoB,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,IAAI,oBAAY,CAAC,oBAAY,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IACnE,CAAC;AACH,CAAC,CACF,CAAA"}

package/dist/rbac/workflows/create-rbac-policies.d.ts

@@ -0,0 +1,6 @@
+export type CreateRbacPoliciesWorkflowInput = {
+    policies: any[];
+};
+export declare const createRbacPoliciesWorkflowId = "create-rbac-policies";
+export declare const createRbacPoliciesWorkflow: import("@acmekit/framework/workflows-sdk").ReturnWorkflow<CreateRbacPoliciesWorkflowInput, import("@acmekit/types").RbacPolicyDTO[], []>;
+//# sourceMappingURL=create-rbac-policies.d.ts.map

package/dist/rbac/workflows/create-rbac-policies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-rbac-policies.d.ts","sourceRoot":"","sources":["../../../src/rbac/workflows/create-rbac-policies.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,+BAA+B,GAAG;IAC5C,QAAQ,EAAE,GAAG,EAAE,CAAA;CAChB,CAAA;AAED,eAAO,MAAM,4BAA4B,yBAAyB,CAAA;AAElE,eAAO,MAAM,0BAA0B,0IAKtC,CAAA"}

package/dist/rbac/workflows/create-rbac-policies.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRbacPoliciesWorkflow = exports.createRbacPoliciesWorkflowId = void 0;
+const workflows_sdk_1 = require("@acmekit/framework/workflows-sdk");
+const steps_1 = require("../steps");
+exports.createRbacPoliciesWorkflowId = "create-rbac-policies";
+exports.createRbacPoliciesWorkflow = (0, workflows_sdk_1.createWorkflow)(exports.createRbacPoliciesWorkflowId, (input) => {
+    return new workflows_sdk_1.WorkflowResponse((0, steps_1.createRbacPoliciesStep)(input));
+});
+//# sourceMappingURL=create-rbac-policies.js.map

package/dist/rbac/workflows/create-rbac-policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-rbac-policies.js","sourceRoot":"","sources":["../../../src/rbac/workflows/create-rbac-policies.ts"],"names":[],"mappings":";;;AAAA,oEAIyC;AACzC,oCAAiD;AAMpC,QAAA,4BAA4B,GAAG,sBAAsB,CAAA;AAErD,QAAA,0BAA0B,GAAG,IAAA,8BAAc,EACtD,oCAA4B,EAC5B,CAAC,KAAoD,EAAE,EAAE;IACvD,OAAO,IAAI,gCAAgB,CAAC,IAAA,8BAAsB,EAAC,KAAK,CAAC,CAAC,CAAA;AAC5D,CAAC,CACF,CAAA"}

package/dist/rbac/workflows/create-rbac-role-policies.d.ts

@@ -0,0 +1,11 @@
+export type CreateRbacRolePoliciesWorkflowInput = {
+    actor_id?: string;
+    actor?: string;
+    policies: {
+        role_id: string;
+        policy_id: string;
+    }[];
+};
+export declare const createRbacRolePoliciesWorkflowId = "create-rbac-role-policies";
+export declare const createRbacRolePoliciesWorkflow: import("@acmekit/framework/workflows-sdk").ReturnWorkflow<CreateRbacRolePoliciesWorkflowInput, import("@acmekit/types").RbacRolePolicyDTO[], []>;
+//# sourceMappingURL=create-rbac-role-policies.d.ts.map

package/dist/rbac/workflows/create-rbac-role-policies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-rbac-role-policies.d.ts","sourceRoot":"","sources":["../../../src/rbac/workflows/create-rbac-role-policies.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,mCAAmC,GAAG;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE;QACR,OAAO,EAAE,MAAM,CAAA;QACf,SAAS,EAAE,MAAM,CAAA;KAClB,EAAE,CAAA;CACJ,CAAA;AAED,eAAO,MAAM,gCAAgC,8BAA8B,CAAA;AAE3E,eAAO,MAAM,8BAA8B,kJA8B1C,CAAA"}

package/dist/rbac/workflows/create-rbac-role-policies.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRbacRolePoliciesWorkflow = exports.createRbacRolePoliciesWorkflowId = void 0;
+const workflows_sdk_1 = require("@acmekit/framework/workflows-sdk");
+const steps_1 = require("../steps");
+const validate_user_permissions_1 = require("../steps/validate-user-permissions");
+exports.createRbacRolePoliciesWorkflowId = "create-rbac-role-policies";
+exports.createRbacRolePoliciesWorkflow = (0, workflows_sdk_1.createWorkflow)(exports.createRbacRolePoliciesWorkflowId, (input) => {
+    const validationData = (0, workflows_sdk_1.transform)({ input }, ({ input }) => {
+        if (!input.actor_id) {
+            return null;
+        }
+        const policyIds = new Set();
+        input.policies.forEach((rp) => policyIds.add(rp.policy_id));
+        return {
+            actor_id: input.actor_id,
+            actor: input.actor,
+            policy_ids: Array.from(policyIds),
+        };
+    });
+    (0, workflows_sdk_1.when)({ validationData }, ({ validationData }) => {
+        return !!validationData?.actor_id && !!validationData?.policy_ids?.length;
+    }).then(() => {
+        (0, validate_user_permissions_1.validateUserPermissionsStep)(validationData);
+    });
+    const rolePolicies = (0, steps_1.createRbacRolePoliciesStep)({
+        policies: input.policies,
+    });
+    return new workflows_sdk_1.WorkflowResponse(rolePolicies);
+});
+//# sourceMappingURL=create-rbac-role-policies.js.map

package/dist/rbac/workflows/create-rbac-role-policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-rbac-role-policies.js","sourceRoot":"","sources":["../../../src/rbac/workflows/create-rbac-role-policies.ts"],"names":[],"mappings":";;;AAAA,oEAMyC;AACzC,oCAAqD;AACrD,kFAAgF;AAWnE,QAAA,gCAAgC,GAAG,2BAA2B,CAAA;AAE9D,QAAA,8BAA8B,GAAG,IAAA,8BAAc,EAC1D,wCAAgC,EAChC,CAAC,KAAwD,EAAE,EAAE;IAC3D,MAAM,cAAc,GAAG,IAAA,yBAAS,EAAC,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACxD,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YACpB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;QACnC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;QAE3D,OAAO;YACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;SAClC,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,IAAA,oBAAI,EAAC,EAAE,cAAc,EAAE,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE;QAC9C,OAAO,CAAC,CAAC,cAAc,EAAE,QAAQ,IAAI,CAAC,CAAC,cAAc,EAAE,UAAU,EAAE,MAAM,CAAA;IAC3E,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;QACX,IAAA,uDAA2B,EAAC,cAAc,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,MAAM,YAAY,GAAG,IAAA,kCAA0B,EAAC;QAC9C,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAA;IAEF,OAAO,IAAI,gCAAgB,CAAC,YAAY,CAAC,CAAA;AAC3C,CAAC,CACF,CAAA"}

package/dist/rbac/workflows/create-rbac-roles.d.ts

@@ -0,0 +1,14 @@
+export type CreateRbacRolesWorkflowInput = {
+    actor_id?: string;
+    actor?: string;
+    roles: {
+        name: string;
+        description?: string | null;
+        metadata?: Record<string, unknown> | null;
+        parent_ids?: string[];
+        policy_ids?: string[];
+    }[];
+};
+export declare const createRbacRolesWorkflowId = "create-rbac-roles";
+export declare const createRbacRolesWorkflow: import("@acmekit/framework/workflows-sdk").ReturnWorkflow<CreateRbacRolesWorkflowInput, import("@acmekit/types").RbacRoleDTO[], []>;
+//# sourceMappingURL=create-rbac-roles.d.ts.map

package/dist/rbac/workflows/create-rbac-roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-rbac-roles.d.ts","sourceRoot":"","sources":["../../../src/rbac/workflows/create-rbac-roles.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAA;QACZ,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;QACzC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;QACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;KACtB,EAAE,CAAA;CACJ,CAAA;AAED,eAAO,MAAM,yBAAyB,sBAAsB,CAAA;AAE5D,eAAO,MAAM,uBAAuB,qIAyEnC,CAAA"}

package/dist/rbac/workflows/create-rbac-roles.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRbacRolesWorkflow = exports.createRbacRolesWorkflowId = void 0;
+const workflows_sdk_1 = require("@acmekit/framework/workflows-sdk");
+const steps_1 = require("../steps");
+const validate_user_permissions_1 = require("../steps/validate-user-permissions");
+exports.createRbacRolesWorkflowId = "create-rbac-roles";
+exports.createRbacRolesWorkflow = (0, workflows_sdk_1.createWorkflow)(exports.createRbacRolesWorkflowId, (input) => {
+    const validationData = (0, workflows_sdk_1.transform)({ input }, ({ input }) => {
+        const allPolicyIds = new Set();
+        input.roles.forEach((role) => {
+            role.policy_ids?.forEach((policyId) => allPolicyIds.add(policyId));
+        });
+        return {
+            actor_id: input.actor_id,
+            actor: input.actor,
+            policy_ids: Array.from(allPolicyIds),
+        };
+    });
+    (0, workflows_sdk_1.when)({ validationData }, ({ validationData }) => {
+        return !!validationData?.actor_id && !!validationData?.policy_ids?.length;
+    }).then(() => {
+        (0, validate_user_permissions_1.validateUserPermissionsStep)(validationData);
+    });
+    const roleData = (0, workflows_sdk_1.transform)({ input }, ({ input }) => ({
+        roles: input.roles.map((r) => ({
+            name: r.name,
+            description: r.description,
+            metadata: r.metadata,
+        })),
+    }));
+    const createdRoles = (0, steps_1.createRbacRolesStep)(roleData);
+    const parentData = (0, workflows_sdk_1.transform)({ input, createdRoles }, ({ input, createdRoles }) => {
+        const parents = [];
+        createdRoles.forEach((role, index) => {
+            const inheritedRoleIds = input.roles[index].parent_ids || [];
+            inheritedRoleIds.forEach((inheritedRoleId) => {
+                parents.push({
+                    role_id: role.id,
+                    parent_id: inheritedRoleId,
+                });
+            });
+        });
+        return { role_parents: parents };
+    });
+    const policiesData = (0, workflows_sdk_1.transform)({ input, createdRoles }, ({ input, createdRoles }) => {
+        const allPolicies = [];
+        createdRoles.forEach((role, index) => {
+            const policyIds = input.roles[index].policy_ids || [];
+            policyIds.forEach((policy_id) => {
+                allPolicies.push({
+                    role_id: role.id,
+                    policy_id: policy_id,
+                });
+            });
+        });
+        return { policies: allPolicies };
+    });
+    (0, steps_1.createRbacRoleParentsStep)(parentData);
+    (0, steps_1.createRbacRolePoliciesStep)(policiesData);
+    return new workflows_sdk_1.WorkflowResponse(createdRoles);
+});
+//# sourceMappingURL=create-rbac-roles.js.map

package/dist/rbac/workflows/create-rbac-roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-rbac-roles.js","sourceRoot":"","sources":["../../../src/rbac/workflows/create-rbac-roles.ts"],"names":[],"mappings":";;;AAAA,oEAMyC;AACzC,oCAIiB;AACjB,kFAAgF;AAcnE,QAAA,yBAAyB,GAAG,mBAAmB,CAAA;AAE/C,QAAA,uBAAuB,GAAG,IAAA,8BAAc,EACnD,iCAAyB,EACzB,CAAC,KAAiD,EAAE,EAAE;IACpD,MAAM,cAAc,GAAG,IAAA,yBAAS,EAAC,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACxD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAA;QACtC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YAC3B,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;QACpE,CAAC,CAAC,CAAA;QACF,OAAO;YACL,QAAQ,EAAE,KAAK,CAAC,QAAS;YACzB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC;SACrC,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,IAAA,oBAAI,EAAC,EAAE,cAAc,EAAE,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE;QAC9C,OAAO,CAAC,CAAC,cAAc,EAAE,QAAQ,IAAI,CAAC,CAAC,cAAc,EAAE,UAAU,EAAE,MAAM,CAAA;IAC3E,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;QACX,IAAA,uDAA2B,EAAC,cAAc,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,MAAM,QAAQ,GAAG,IAAA,yBAAS,EAAC,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QACpD,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;SACrB,CAAC,CAAC;KACJ,CAAC,CAAC,CAAA;IAEH,MAAM,YAAY,GAAG,IAAA,2BAAmB,EAAC,QAAQ,CAAC,CAAA;IAElD,MAAM,UAAU,GAAG,IAAA,yBAAS,EAC1B,EAAE,KAAK,EAAE,YAAY,EAAE,EACvB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE;QAC1B,MAAM,OAAO,GAAU,EAAE,CAAA;QAEzB,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YACnC,MAAM,gBAAgB,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,UAAU,IAAI,EAAE,CAAA;YAC5D,gBAAgB,CAAC,OAAO,CAAC,CAAC,eAAe,EAAE,EAAE;gBAC3C,OAAO,CAAC,IAAI,CAAC;oBACX,OAAO,EAAE,IAAI,CAAC,EAAE;oBAChB,SAAS,EAAE,eAAe;iBAC3B,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAA;IAClC,CAAC,CACF,CAAA;IAED,MAAM,YAAY,GAAG,IAAA,yBAAS,EAC5B,EAAE,KAAK,EAAE,YAAY,EAAE,EACvB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE;QAC1B,MAAM,WAAW,GAAU,EAAE,CAAA;QAC7B,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YACnC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,UAAU,IAAI,EAAE,CAAA;YACrD,SAAS,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE;gBAC9B,WAAW,CAAC,IAAI,CAAC;oBACf,OAAO,EAAE,IAAI,CAAC,EAAE;oBAChB,SAAS,EAAE,SAAS;iBACrB,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAA;IAClC,CAAC,CACF,CAAA;IAED,IAAA,iCAAyB,EAAC,UAAU,CAAC,CAAA;IAErC,IAAA,kCAA0B,EAAC,YAAY,CAAC,CAAA;IAExC,OAAO,IAAI,gCAAgB,CAAC,YAAY,CAAC,CAAA;AAC3C,CAAC,CACF,CAAA"}

package/dist/rbac/workflows/delete-rbac-policies.d.ts

@@ -0,0 +1,6 @@
+export type DeleteRbacPoliciesWorkflowInput = {
+    ids: string[];
+};
+export declare const deleteRbacPoliciesWorkflowId = "delete-rbac-policies";
+export declare const deleteRbacPoliciesWorkflow: import("@acmekit/framework/workflows-sdk").ReturnWorkflow<DeleteRbacPoliciesWorkflowInput, unknown, any[]>;
+//# sourceMappingURL=delete-rbac-policies.d.ts.map

package/dist/rbac/workflows/delete-rbac-policies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete-rbac-policies.d.ts","sourceRoot":"","sources":["../../../src/rbac/workflows/delete-rbac-policies.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,+BAA+B,GAAG;IAC5C,GAAG,EAAE,MAAM,EAAE,CAAA;CACd,CAAA;AAED,eAAO,MAAM,4BAA4B,yBAAyB,CAAA;AAElE,eAAO,MAAM,0BAA0B,4GAOtC,CAAA"}

package/dist/rbac/workflows/delete-rbac-policies.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deleteRbacPoliciesWorkflow = exports.deleteRbacPoliciesWorkflowId = void 0;
+const workflows_sdk_1 = require("@acmekit/framework/workflows-sdk");
+const steps_1 = require("../steps");
+exports.deleteRbacPoliciesWorkflowId = "delete-rbac-policies";
+exports.deleteRbacPoliciesWorkflow = (0, workflows_sdk_1.createWorkflow)(exports.deleteRbacPoliciesWorkflowId, (input) => {
+    (0, steps_1.deleteRbacPoliciesStep)(input.ids);
+});
+//# sourceMappingURL=delete-rbac-policies.js.map

package/dist/rbac/workflows/delete-rbac-policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete-rbac-policies.js","sourceRoot":"","sources":["../../../src/rbac/workflows/delete-rbac-policies.ts"],"names":[],"mappings":";;;AAAA,oEAA+E;AAC/E,oCAAiD;AAMpC,QAAA,4BAA4B,GAAG,sBAAsB,CAAA;AAErD,QAAA,0BAA0B,GAAG,IAAA,8BAAc,EACtD,oCAA4B,EAC5B,CACE,KAAoD,EAChC,EAAE;IACtB,IAAA,8BAAsB,EAAC,KAAK,CAAC,GAAG,CAAC,CAAA;AACnC,CAAC,CACF,CAAA"}

package/dist/rbac/workflows/delete-rbac-role-policies.d.ts

@@ -0,0 +1,6 @@
+export type DeleteRbacRolePoliciesWorkflowInput = {
+    role_policy_ids: string[];
+};
+export declare const deleteRbacRolePoliciesWorkflowId = "delete-rbac-role-policies";
+export declare const deleteRbacRolePoliciesWorkflow: import("@acmekit/framework/workflows-sdk").ReturnWorkflow<DeleteRbacRolePoliciesWorkflowInput, any, []>;
+//# sourceMappingURL=delete-rbac-role-policies.d.ts.map

package/dist/rbac/workflows/delete-rbac-role-policies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete-rbac-role-policies.d.ts","sourceRoot":"","sources":["../../../src/rbac/workflows/delete-rbac-role-policies.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,mCAAmC,GAAG;IAChD,eAAe,EAAE,MAAM,EAAE,CAAA;CAC1B,CAAA;AAED,eAAO,MAAM,gCAAgC,8BAA8B,CAAA;AAE3E,eAAO,MAAM,8BAA8B,yGAS1C,CAAA"}