@aphexcms/cms-core 2.0.10 → 2.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/api/api-keys.d.ts +4 -0
- package/dist/api/api-keys.d.ts.map +1 -1
- package/dist/api/assets.d.ts.map +1 -1
- package/dist/api/index.d.ts +1 -0
- package/dist/api/index.d.ts.map +1 -1
- package/dist/api/index.js +1 -0
- package/dist/api/roles.d.ts +22 -0
- package/dist/api/roles.d.ts.map +1 -0
- package/dist/api/roles.js +26 -0
- package/dist/api/schemas/api-keys.d.ts +50 -4
- package/dist/api/schemas/api-keys.d.ts.map +1 -1
- package/dist/api/schemas/api-keys.js +22 -3
- package/dist/api/schemas/organizations.d.ts +4 -22
- package/dist/api/schemas/organizations.d.ts.map +1 -1
- package/dist/api/schemas/organizations.js +13 -2
- package/dist/api/schemas/roles.d.ts +77 -0
- package/dist/api/schemas/roles.d.ts.map +1 -0
- package/dist/api/schemas/roles.js +42 -0
- package/dist/app-augment.d.ts +32 -0
- package/dist/app-augment.d.ts.map +1 -0
- package/dist/app-augment.js +18 -0
- package/dist/auth/auth-hooks.d.ts +2 -1
- package/dist/auth/auth-hooks.d.ts.map +1 -1
- package/dist/auth/auth-hooks.js +22 -2
- package/dist/client/index.d.ts +4 -2
- package/dist/client/index.d.ts.map +1 -1
- package/dist/client/index.js +6 -2
- package/dist/components/AdminApp.svelte +300 -140
- package/dist/components/AdminApp.svelte.d.ts +8 -0
- package/dist/components/AdminApp.svelte.d.ts.map +1 -1
- package/dist/components/admin/DocumentEditor.svelte +633 -350
- package/dist/components/admin/DocumentEditor.svelte.d.ts +2 -0
- package/dist/components/admin/DocumentEditor.svelte.d.ts.map +1 -1
- package/dist/components/admin/DocumentVersionPanel.svelte +46 -20
- package/dist/components/admin/DocumentVersionPanel.svelte.d.ts.map +1 -1
- package/dist/components/admin/MediaBrowser.svelte +70 -30
- package/dist/components/admin/MediaBrowser.svelte.d.ts.map +1 -1
- package/dist/components/admin/ObjectModal.svelte +70 -95
- package/dist/components/admin/ObjectModal.svelte.d.ts +1 -2
- package/dist/components/admin/ObjectModal.svelte.d.ts.map +1 -1
- package/dist/components/admin/PermissionsDebug.svelte +119 -0
- package/dist/components/admin/PermissionsDebug.svelte.d.ts +4 -0
- package/dist/components/admin/PermissionsDebug.svelte.d.ts.map +1 -0
- package/dist/components/admin/SchemaField.svelte +3 -1
- package/dist/components/admin/SchemaField.svelte.d.ts.map +1 -1
- package/dist/components/admin/confirm-dialog/ConfirmDialogHost.svelte +8 -10
- package/dist/components/admin/confirm-dialog/ConfirmDialogHost.svelte.d.ts.map +1 -1
- package/dist/components/admin/fields/ArrayField.svelte +104 -108
- package/dist/components/admin/fields/ArrayField.svelte.d.ts.map +1 -1
- package/dist/components/admin/fields/FileField.svelte +22 -17
- package/dist/components/admin/fields/FileField.svelte.d.ts.map +1 -1
- package/dist/components/admin/fields/ImageField.svelte +21 -15
- package/dist/components/admin/fields/ImageField.svelte.d.ts.map +1 -1
- package/dist/components/admin/fields/ReferenceField.svelte +142 -112
- package/dist/components/admin/fields/ReferenceField.svelte.d.ts.map +1 -1
- package/dist/components/admin/fields/TextareaField.svelte +4 -3
- package/dist/components/admin/fields/TextareaField.svelte.d.ts +2 -2
- package/dist/components/admin/fields/TextareaField.svelte.d.ts.map +1 -1
- package/dist/components/layout/Sidebar.svelte +21 -11
- package/dist/components/layout/Sidebar.svelte.d.ts.map +1 -1
- package/dist/components/layout/sidebar/NavMain.svelte +1 -0
- package/dist/db/interfaces/document.d.ts.map +1 -1
- package/dist/db/interfaces/index.d.ts +3 -1
- package/dist/db/interfaces/index.d.ts.map +1 -1
- package/dist/db/interfaces/organization.d.ts +1 -1
- package/dist/db/interfaces/organization.d.ts.map +1 -1
- package/dist/db/interfaces/role.d.ts +25 -0
- package/dist/db/interfaces/role.d.ts.map +1 -0
- package/dist/db/interfaces/role.js +1 -0
- package/dist/engine.d.ts.map +1 -1
- package/dist/engine.js +5 -0
- package/dist/field-access.d.ts +30 -0
- package/dist/field-access.d.ts.map +1 -0
- package/dist/field-access.js +79 -0
- package/dist/hooks.d.ts +2 -0
- package/dist/hooks.d.ts.map +1 -1
- package/dist/hooks.js +19 -13
- package/dist/lib/api/api-keys.d.ts +4 -0
- package/dist/lib/api/api-keys.d.ts.map +1 -1
- package/dist/lib/api/api-keys.js.map +1 -1
- package/dist/lib/api/assets.d.ts.map +1 -1
- package/dist/lib/api/assets.js.map +1 -1
- package/dist/lib/api/index.d.ts +1 -0
- package/dist/lib/api/index.d.ts.map +1 -1
- package/dist/lib/api/index.js +1 -0
- package/dist/lib/api/index.js.map +1 -1
- package/dist/lib/api/roles.d.ts +22 -0
- package/dist/lib/api/roles.d.ts.map +1 -0
- package/dist/lib/api/roles.js +27 -0
- package/dist/lib/api/roles.js.map +1 -0
- package/dist/lib/api/schemas/api-keys.d.ts +50 -4
- package/dist/lib/api/schemas/api-keys.d.ts.map +1 -1
- package/dist/lib/api/schemas/api-keys.js +22 -3
- package/dist/lib/api/schemas/api-keys.js.map +1 -1
- package/dist/lib/api/schemas/organizations.d.ts +4 -22
- package/dist/lib/api/schemas/organizations.d.ts.map +1 -1
- package/dist/lib/api/schemas/organizations.js +13 -2
- package/dist/lib/api/schemas/organizations.js.map +1 -1
- package/dist/lib/api/schemas/roles.d.ts +77 -0
- package/dist/lib/api/schemas/roles.d.ts.map +1 -0
- package/dist/lib/api/schemas/roles.js +43 -0
- package/dist/lib/api/schemas/roles.js.map +1 -0
- package/dist/lib/app-augment.d.ts +32 -0
- package/dist/lib/app-augment.d.ts.map +1 -0
- package/dist/lib/app-augment.js +19 -0
- package/dist/lib/app-augment.js.map +1 -0
- package/dist/lib/auth/auth-hooks.d.ts +2 -1
- package/dist/lib/auth/auth-hooks.d.ts.map +1 -1
- package/dist/lib/auth/auth-hooks.js +22 -2
- package/dist/lib/auth/auth-hooks.js.map +1 -1
- package/dist/lib/client/index.d.ts +4 -2
- package/dist/lib/client/index.d.ts.map +1 -1
- package/dist/lib/client/index.js +6 -2
- package/dist/lib/client/index.js.map +1 -1
- package/dist/lib/db/interfaces/document.d.ts.map +1 -1
- package/dist/lib/db/interfaces/index.d.ts +3 -1
- package/dist/lib/db/interfaces/index.d.ts.map +1 -1
- package/dist/lib/db/interfaces/organization.d.ts +1 -1
- package/dist/lib/db/interfaces/organization.d.ts.map +1 -1
- package/dist/lib/db/interfaces/role.d.ts +25 -0
- package/dist/lib/db/interfaces/role.d.ts.map +1 -0
- package/dist/lib/db/interfaces/role.js +2 -0
- package/dist/lib/db/interfaces/role.js.map +1 -0
- package/dist/lib/engine.d.ts.map +1 -1
- package/dist/lib/engine.js +5 -0
- package/dist/lib/engine.js.map +1 -1
- package/dist/lib/field-access.d.ts +30 -0
- package/dist/lib/field-access.d.ts.map +1 -0
- package/dist/lib/field-access.js +80 -0
- package/dist/lib/field-access.js.map +1 -0
- package/dist/lib/hooks.d.ts +2 -0
- package/dist/lib/hooks.d.ts.map +1 -1
- package/dist/lib/hooks.js +19 -13
- package/dist/lib/hooks.js.map +1 -1
- package/dist/lib/local-api/collection-api.d.ts +2 -0
- package/dist/lib/local-api/collection-api.d.ts.map +1 -1
- package/dist/lib/local-api/collection-api.js +98 -30
- package/dist/lib/local-api/collection-api.js.map +1 -1
- package/dist/lib/local-api/index.d.ts.map +1 -1
- package/dist/lib/local-api/index.js.map +1 -1
- package/dist/lib/local-api/permissions.d.ts +26 -26
- package/dist/lib/local-api/permissions.d.ts.map +1 -1
- package/dist/lib/local-api/permissions.js +122 -80
- package/dist/lib/local-api/permissions.js.map +1 -1
- package/dist/lib/permissions-context.svelte.d.ts +44 -0
- package/dist/lib/permissions-context.svelte.d.ts.map +1 -0
- package/dist/lib/permissions-context.svelte.js +80 -0
- package/dist/lib/permissions-context.svelte.js.map +1 -0
- package/dist/lib/routes/assets.d.ts.map +1 -1
- package/dist/lib/routes/assets.js.map +1 -1
- package/dist/lib/routes/document-versions.d.ts.map +1 -1
- package/dist/lib/routes/document-versions.js.map +1 -1
- package/dist/lib/routes/organizations-by-id.d.ts.map +1 -1
- package/dist/lib/routes/organizations-by-id.js +6 -3
- package/dist/lib/routes/organizations-by-id.js.map +1 -1
- package/dist/lib/routes/organizations-invitations.d.ts.map +1 -1
- package/dist/lib/routes/organizations-invitations.js +17 -7
- package/dist/lib/routes/organizations-invitations.js.map +1 -1
- package/dist/lib/routes/organizations-members.d.ts.map +1 -1
- package/dist/lib/routes/organizations-members.js +15 -7
- package/dist/lib/routes/organizations-members.js.map +1 -1
- package/dist/lib/routes/organizations.d.ts.map +1 -1
- package/dist/lib/routes/organizations.js +3 -0
- package/dist/lib/routes/organizations.js.map +1 -1
- package/dist/lib/routes/roles-by-name.d.ts +4 -0
- package/dist/lib/routes/roles-by-name.d.ts.map +1 -0
- package/dist/lib/routes/roles-by-name.js +112 -0
- package/dist/lib/routes/roles-by-name.js.map +1 -0
- package/dist/lib/routes/roles.d.ts +4 -0
- package/dist/lib/routes/roles.d.ts.map +1 -0
- package/dist/lib/routes/roles.js +91 -0
- package/dist/lib/routes/roles.js.map +1 -0
- package/dist/lib/routes-exports.d.ts +2 -0
- package/dist/lib/routes-exports.d.ts.map +1 -1
- package/dist/lib/routes-exports.js +3 -0
- package/dist/lib/routes-exports.js.map +1 -1
- package/dist/lib/save-state-context.svelte.d.ts +8 -0
- package/dist/lib/save-state-context.svelte.d.ts.map +1 -0
- package/dist/lib/save-state-context.svelte.js +9 -0
- package/dist/lib/save-state-context.svelte.js.map +1 -0
- package/dist/lib/schema-utils/validator.d.ts.map +1 -1
- package/dist/lib/schema-utils/validator.js +14 -0
- package/dist/lib/schema-utils/validator.js.map +1 -1
- package/dist/lib/server/index.d.ts +1 -0
- package/dist/lib/server/index.d.ts.map +1 -1
- package/dist/lib/server/index.js +1 -0
- package/dist/lib/server/index.js.map +1 -1
- package/dist/lib/services/index.d.ts +1 -0
- package/dist/lib/services/index.d.ts.map +1 -1
- package/dist/lib/services/index.js +1 -0
- package/dist/lib/services/index.js.map +1 -1
- package/dist/lib/services/roles-service.d.ts +35 -0
- package/dist/lib/services/roles-service.d.ts.map +1 -0
- package/dist/lib/services/roles-service.js +91 -0
- package/dist/lib/services/roles-service.js.map +1 -0
- package/dist/lib/services/version-service.d.ts.map +1 -1
- package/dist/lib/services/version-service.js.map +1 -1
- package/dist/lib/types/auth.d.ts +43 -9
- package/dist/lib/types/auth.d.ts.map +1 -1
- package/dist/lib/types/auth.js +31 -26
- package/dist/lib/types/auth.js.map +1 -1
- package/dist/lib/types/capabilities.d.ts +104 -0
- package/dist/lib/types/capabilities.d.ts.map +1 -0
- package/dist/lib/types/capabilities.js +217 -0
- package/dist/lib/types/capabilities.js.map +1 -0
- package/dist/lib/types/index.d.ts +1 -0
- package/dist/lib/types/index.d.ts.map +1 -1
- package/dist/lib/types/index.js +1 -0
- package/dist/lib/types/index.js.map +1 -1
- package/dist/lib/types/organization.d.ts +13 -4
- package/dist/lib/types/organization.d.ts.map +1 -1
- package/dist/lib/types/schemas.d.ts +71 -0
- package/dist/lib/types/schemas.d.ts.map +1 -1
- package/dist/lib/types/sidebar.d.ts +1 -1
- package/dist/lib/types/sidebar.d.ts.map +1 -1
- package/dist/lib/utils/mime-detect.d.ts.map +1 -1
- package/dist/lib/utils/mime-detect.js +28 -6
- package/dist/lib/utils/mime-detect.js.map +1 -1
- package/dist/local-api/collection-api.d.ts +2 -0
- package/dist/local-api/collection-api.d.ts.map +1 -1
- package/dist/local-api/collection-api.js +98 -30
- package/dist/local-api/index.d.ts.map +1 -1
- package/dist/local-api/permissions.d.ts +26 -26
- package/dist/local-api/permissions.d.ts.map +1 -1
- package/dist/local-api/permissions.js +122 -80
- package/dist/permissions-context.svelte.d.ts +44 -0
- package/dist/permissions-context.svelte.d.ts.map +1 -0
- package/dist/permissions-context.svelte.js +79 -0
- package/dist/plugins/README.md +20 -20
- package/dist/routes/assets.d.ts.map +1 -1
- package/dist/routes/document-versions.d.ts.map +1 -1
- package/dist/routes/organizations-by-id.d.ts.map +1 -1
- package/dist/routes/organizations-by-id.js +6 -3
- package/dist/routes/organizations-invitations.d.ts.map +1 -1
- package/dist/routes/organizations-invitations.js +17 -7
- package/dist/routes/organizations-members.d.ts.map +1 -1
- package/dist/routes/organizations-members.js +15 -7
- package/dist/routes/organizations.d.ts.map +1 -1
- package/dist/routes/organizations.js +3 -0
- package/dist/routes/roles-by-name.d.ts +4 -0
- package/dist/routes/roles-by-name.d.ts.map +1 -0
- package/dist/routes/roles-by-name.js +111 -0
- package/dist/routes/roles.d.ts +4 -0
- package/dist/routes/roles.d.ts.map +1 -0
- package/dist/routes/roles.js +90 -0
- package/dist/routes-exports.d.ts +2 -0
- package/dist/routes-exports.d.ts.map +1 -1
- package/dist/routes-exports.js +3 -0
- package/dist/save-state-context.svelte.d.ts +8 -0
- package/dist/save-state-context.svelte.d.ts.map +1 -0
- package/dist/save-state-context.svelte.js +8 -0
- package/dist/schema-utils/validator.d.ts.map +1 -1
- package/dist/schema-utils/validator.js +14 -0
- package/dist/server/index.d.ts +1 -0
- package/dist/server/index.d.ts.map +1 -1
- package/dist/server/index.js +1 -0
- package/dist/services/index.d.ts +1 -0
- package/dist/services/index.d.ts.map +1 -1
- package/dist/services/index.js +1 -0
- package/dist/services/roles-service.d.ts +35 -0
- package/dist/services/roles-service.d.ts.map +1 -0
- package/dist/services/roles-service.js +90 -0
- package/dist/services/version-service.d.ts.map +1 -1
- package/dist/types/auth.d.ts +43 -9
- package/dist/types/auth.d.ts.map +1 -1
- package/dist/types/auth.js +31 -26
- package/dist/types/capabilities.d.ts +104 -0
- package/dist/types/capabilities.d.ts.map +1 -0
- package/dist/types/capabilities.js +216 -0
- package/dist/types/index.d.ts +1 -0
- package/dist/types/index.d.ts.map +1 -1
- package/dist/types/index.js +1 -0
- package/dist/types/organization.d.ts +13 -4
- package/dist/types/organization.d.ts.map +1 -1
- package/dist/types/schemas.d.ts +71 -0
- package/dist/types/schemas.d.ts.map +1 -1
- package/dist/types/sidebar.d.ts +1 -1
- package/dist/types/sidebar.d.ts.map +1 -1
- package/dist/utils/mime-detect.d.ts.map +1 -1
- package/dist/utils/mime-detect.js +28 -6
- package/package.json +6 -2
|
@@ -1,45 +1,45 @@
|
|
|
1
1
|
import type { LocalAPIContext } from './types.js';
|
|
2
2
|
import type { SchemaType } from '../types/schemas.js';
|
|
3
|
+
import type { Document } from '../types/document.js';
|
|
3
4
|
import type { CMSConfig } from '../types/config.js';
|
|
4
|
-
/**
|
|
5
|
-
* Permission error thrown when access is denied
|
|
6
|
-
*/
|
|
7
5
|
export declare class PermissionError extends Error {
|
|
8
6
|
readonly operation: string;
|
|
9
7
|
readonly resource: string;
|
|
10
8
|
constructor(message: string, operation: string, resource: string);
|
|
11
9
|
}
|
|
12
|
-
/**
|
|
13
|
-
* Checks permissions for Local API operations
|
|
14
|
-
*/
|
|
15
10
|
export declare class PermissionChecker {
|
|
16
11
|
private _config;
|
|
17
12
|
private schemas;
|
|
18
13
|
constructor(_config: CMSConfig, schemas: Map<string, SchemaType>);
|
|
19
|
-
/**
|
|
20
|
-
* Get the CMS config
|
|
21
|
-
* Available for future per-collection permission logic
|
|
22
|
-
*/
|
|
23
14
|
get config(): CMSConfig;
|
|
15
|
+
canRead(context: LocalAPIContext, collectionName: string, doc?: Document): Promise<void>;
|
|
16
|
+
canCreate(context: LocalAPIContext, collectionName: string): Promise<void>;
|
|
17
|
+
canUpdate(context: LocalAPIContext, collectionName: string, doc?: Document): Promise<void>;
|
|
24
18
|
/**
|
|
25
|
-
*
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
/**
|
|
29
|
-
* Check if the current context has write permissions (create/update)
|
|
30
|
-
*/
|
|
31
|
-
canWrite(context: LocalAPIContext, collectionName: string): Promise<void>;
|
|
32
|
-
/**
|
|
33
|
-
* Check if the current context has delete permissions
|
|
34
|
-
*/
|
|
35
|
-
canDelete(context: LocalAPIContext, collectionName: string): Promise<void>;
|
|
36
|
-
/**
|
|
37
|
-
* Check if the current context has publish permissions
|
|
19
|
+
* @deprecated Prefer `canCreate` or `canUpdate` — this method conflates the
|
|
20
|
+
* two and was only kept for legacy call sites. It now aliases `canUpdate`
|
|
21
|
+
* for safety (update is the more restrictive default for mutation).
|
|
38
22
|
*/
|
|
39
|
-
|
|
23
|
+
canWrite(context: LocalAPIContext, collectionName: string, doc?: Document): Promise<void>;
|
|
24
|
+
canDelete(context: LocalAPIContext, collectionName: string, doc?: Document): Promise<void>;
|
|
25
|
+
canPublish(context: LocalAPIContext, collectionName: string, doc?: Document): Promise<void>;
|
|
26
|
+
canUnpublish(context: LocalAPIContext, collectionName: string, doc?: Document): Promise<void>;
|
|
27
|
+
validateCollection(collectionName: string): void;
|
|
28
|
+
private assert;
|
|
29
|
+
private logDenial;
|
|
30
|
+
private requireAuth;
|
|
40
31
|
/**
|
|
41
|
-
*
|
|
32
|
+
* Evaluate an access rule for a given operation.
|
|
33
|
+
*
|
|
34
|
+
* Three kinds of declared rules:
|
|
35
|
+
* - `OrganizationRole[]` — role allowlist (as before).
|
|
36
|
+
* - `(ctx) => boolean` — arbitrary policy, receives auth + optional doc.
|
|
37
|
+
* Use for ownership rules like `doc.createdBy === auth.user.id`.
|
|
38
|
+
* - `undefined` — fall back to capability check.
|
|
39
|
+
*
|
|
40
|
+
* A declared-but-excluded role/policy for a session caller is an explicit
|
|
41
|
+
* deny; the capability map does not re-grant access.
|
|
42
42
|
*/
|
|
43
|
-
|
|
43
|
+
private isAllowed;
|
|
44
44
|
}
|
|
45
45
|
//# sourceMappingURL=permissions.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../src/lib/local-api/permissions.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../src/lib/local-api/permissions.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAgB,MAAM,kBAAkB,CAAC;AACjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAKjD,qBAAa,eAAgB,SAAQ,KAAK;aAGxB,SAAS,EAAE,MAAM;aACjB,QAAQ,EAAE,MAAM;gBAFhC,OAAO,EAAE,MAAM,EACC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM;CAKjC;AAmCD,qBAAa,iBAAiB;IAE5B,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,OAAO;gBADP,OAAO,EAAE,SAAS,EAClB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC;IAGzC,IAAI,MAAM,IAAI,SAAS,CAEtB;IAEK,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxF,SAAS,CAAC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK1E,SAAS,CAAC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhG;;;;OAIG;IACG,QAAQ,CAAC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzF,SAAS,CAAC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1F,UAAU,CACf,OAAO,EAAE,eAAe,EACxB,cAAc,EAAE,MAAM,EACtB,GAAG,CAAC,EAAE,QAAQ,GACZ,OAAO,CAAC,IAAI,CAAC;IAIV,YAAY,CACjB,OAAO,EAAE,eAAe,EACxB,cAAc,EAAE,MAAM,EACtB,GAAG,CAAC,EAAE,QAAQ,GACZ,OAAO,CAAC,IAAI,CAAC;IAIhB,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI;YAYlC,MAAM;IAmBpB,OAAO,CAAC,SAAS;IAsBjB,OAAO,CAAC,WAAW;IAenB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,SAAS;CAmCjB"}
|
|
@@ -1,9 +1,16 @@
|
|
|
1
1
|
// local-api/permissions.ts
|
|
2
2
|
//
|
|
3
|
-
// Permission checking for the Local API layer
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
3
|
+
// Permission checking for the Local API layer.
|
|
4
|
+
//
|
|
5
|
+
// Every operation resolves to a capability. A check passes when either:
|
|
6
|
+
// 1. The collection schema declares `access[operation]` and the caller's
|
|
7
|
+
// effective organization role appears in the list, OR
|
|
8
|
+
// 2. `auth.capabilities` (hydrated by the auth hook via RolesService)
|
|
9
|
+
// contains the capability.
|
|
10
|
+
//
|
|
11
|
+
// `overrideAccess` short-circuits everything for system operations.
|
|
12
|
+
import { hasCapability, effectiveOrganizationRole } from '../types/capabilities.js';
|
|
13
|
+
import { cmsLogger } from '../utils/logger.js';
|
|
7
14
|
export class PermissionError extends Error {
|
|
8
15
|
operation;
|
|
9
16
|
resource;
|
|
@@ -14,9 +21,33 @@ export class PermissionError extends Error {
|
|
|
14
21
|
this.name = 'PermissionError';
|
|
15
22
|
}
|
|
16
23
|
}
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
24
|
+
const OPERATION_CAPABILITY = {
|
|
25
|
+
read: 'document.read',
|
|
26
|
+
create: 'document.create',
|
|
27
|
+
update: 'document.update',
|
|
28
|
+
delete: 'document.delete',
|
|
29
|
+
publish: 'document.publish',
|
|
30
|
+
unpublish: 'document.unpublish'
|
|
31
|
+
};
|
|
32
|
+
// Human-readable action phrasing for error messages. Keep in sync with
|
|
33
|
+
// OPERATION_CAPABILITY and any new Operation keys.
|
|
34
|
+
const OPERATION_LABEL = {
|
|
35
|
+
read: 'view',
|
|
36
|
+
create: 'create',
|
|
37
|
+
update: 'edit',
|
|
38
|
+
delete: 'delete',
|
|
39
|
+
publish: 'publish',
|
|
40
|
+
unpublish: 'unpublish'
|
|
41
|
+
};
|
|
42
|
+
function denialMessage(operations, collectionName) {
|
|
43
|
+
const actions = operations.map((op) => OPERATION_LABEL[op]);
|
|
44
|
+
const action = actions.length === 1
|
|
45
|
+
? actions[0]
|
|
46
|
+
: actions.length === 2
|
|
47
|
+
? `${actions[0]} or ${actions[1]}`
|
|
48
|
+
: `${actions.slice(0, -1).join(', ')}, or ${actions[actions.length - 1]}`;
|
|
49
|
+
return `You don't have permission to ${action} ${collectionName} documents. Ask an admin if you need access.`;
|
|
50
|
+
}
|
|
20
51
|
export class PermissionChecker {
|
|
21
52
|
_config;
|
|
22
53
|
schemas;
|
|
@@ -24,94 +55,105 @@ export class PermissionChecker {
|
|
|
24
55
|
this._config = _config;
|
|
25
56
|
this.schemas = schemas;
|
|
26
57
|
}
|
|
27
|
-
/**
|
|
28
|
-
* Get the CMS config
|
|
29
|
-
* Available for future per-collection permission logic
|
|
30
|
-
*/
|
|
31
58
|
get config() {
|
|
32
59
|
return this._config;
|
|
33
60
|
}
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
*/
|
|
37
|
-
async canRead(context, collectionName) {
|
|
38
|
-
// Always allow if overrideAccess is true (system operations)
|
|
39
|
-
if (context.overrideAccess) {
|
|
40
|
-
return;
|
|
41
|
-
}
|
|
42
|
-
// Require authentication for read operations
|
|
43
|
-
if (!context.user) {
|
|
44
|
-
throw new PermissionError('Authentication required for read operations', 'read', collectionName);
|
|
45
|
-
}
|
|
46
|
-
// All authenticated users can read (role-based restrictions handled by RLS)
|
|
47
|
-
// Additional per-collection permission logic can be added here in the future
|
|
48
|
-
return;
|
|
61
|
+
async canRead(context, collectionName, doc) {
|
|
62
|
+
await this.assert(context, collectionName, 'read', doc);
|
|
49
63
|
}
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
return;
|
|
57
|
-
}
|
|
58
|
-
// Require authentication for write operations
|
|
59
|
-
if (!context.user) {
|
|
60
|
-
throw new PermissionError('Authentication required for write operations', 'write', collectionName);
|
|
61
|
-
}
|
|
62
|
-
// Check if user has write role (not a viewer)
|
|
63
|
-
// Viewers have read-only access
|
|
64
|
-
if (context.user.role === 'viewer') {
|
|
65
|
-
throw new PermissionError('Write permission denied. Viewers have read-only access.', 'write', collectionName);
|
|
66
|
-
}
|
|
67
|
-
// Additional per-collection permission logic can be added here in the future
|
|
68
|
-
return;
|
|
64
|
+
async canCreate(context, collectionName) {
|
|
65
|
+
// `create` has no target doc by definition.
|
|
66
|
+
await this.assert(context, collectionName, 'create');
|
|
67
|
+
}
|
|
68
|
+
async canUpdate(context, collectionName, doc) {
|
|
69
|
+
await this.assert(context, collectionName, 'update', doc);
|
|
69
70
|
}
|
|
70
71
|
/**
|
|
71
|
-
*
|
|
72
|
+
* @deprecated Prefer `canCreate` or `canUpdate` — this method conflates the
|
|
73
|
+
* two and was only kept for legacy call sites. It now aliases `canUpdate`
|
|
74
|
+
* for safety (update is the more restrictive default for mutation).
|
|
72
75
|
*/
|
|
73
|
-
async
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
76
|
+
async canWrite(context, collectionName, doc) {
|
|
77
|
+
await this.canUpdate(context, collectionName, doc);
|
|
78
|
+
}
|
|
79
|
+
async canDelete(context, collectionName, doc) {
|
|
80
|
+
await this.assert(context, collectionName, 'delete', doc);
|
|
81
|
+
}
|
|
82
|
+
async canPublish(context, collectionName, doc) {
|
|
83
|
+
await this.assert(context, collectionName, 'publish', doc);
|
|
84
|
+
}
|
|
85
|
+
async canUnpublish(context, collectionName, doc) {
|
|
86
|
+
await this.assert(context, collectionName, 'unpublish', doc);
|
|
87
|
+
}
|
|
88
|
+
validateCollection(collectionName) {
|
|
89
|
+
if (!this.schemas.has(collectionName)) {
|
|
90
|
+
throw new Error(`Collection "${collectionName}" not found in schema. Available collections: ${Array.from(this.schemas.keys()).join(', ')}`);
|
|
85
91
|
}
|
|
86
|
-
// Additional per-collection permission logic can be added here in the future
|
|
87
|
-
return;
|
|
88
92
|
}
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
async canPublish(context, collectionName) {
|
|
93
|
-
// Always allow if overrideAccess is true (system operations)
|
|
94
|
-
if (context.overrideAccess) {
|
|
93
|
+
// ---- internals -----------------------------------------------------------
|
|
94
|
+
async assert(context, collectionName, operation, doc) {
|
|
95
|
+
if (context.overrideAccess)
|
|
95
96
|
return;
|
|
97
|
+
const auth = this.requireAuth(context, operation, collectionName);
|
|
98
|
+
if (this.isAllowed(auth, collectionName, operation, doc))
|
|
99
|
+
return;
|
|
100
|
+
this.logDenial(auth, operation, collectionName, [OPERATION_CAPABILITY[operation]]);
|
|
101
|
+
throw new PermissionError(denialMessage([operation], collectionName), operation, collectionName);
|
|
102
|
+
}
|
|
103
|
+
logDenial(auth, operation, collectionName, missingCapabilities) {
|
|
104
|
+
const who = auth.type === 'session'
|
|
105
|
+
? `user=${auth.user.id} role="${auth.organizationRole}"`
|
|
106
|
+
: auth.type === 'api_key'
|
|
107
|
+
? `apiKey=${auth.keyId}`
|
|
108
|
+
: auth.type;
|
|
109
|
+
const caps = 'capabilities' in auth && Array.isArray(auth.capabilities)
|
|
110
|
+
? auth.capabilities.join(',')
|
|
111
|
+
: '(none)';
|
|
112
|
+
cmsLogger.warn('[RBAC]', `DENY ${operation} on "${collectionName}" — ${who} has=[${caps}] needs=[${missingCapabilities.join('|')}]`);
|
|
113
|
+
}
|
|
114
|
+
requireAuth(context, operation, collectionName) {
|
|
115
|
+
if (!context.auth) {
|
|
116
|
+
throw new PermissionError(`You must be signed in to ${OPERATION_LABEL[operation]} ${collectionName} documents.`, operation, collectionName);
|
|
96
117
|
}
|
|
97
|
-
|
|
98
|
-
if (!context.user) {
|
|
99
|
-
throw new PermissionError('Authentication required for publish operations', 'publish', collectionName);
|
|
100
|
-
}
|
|
101
|
-
// Check if user has write role (not a viewer)
|
|
102
|
-
if (context.user.role === 'viewer') {
|
|
103
|
-
throw new PermissionError('Publish permission denied. Viewers have read-only access.', 'publish', collectionName);
|
|
104
|
-
}
|
|
105
|
-
// Additional per-collection permission logic can be added here in the future
|
|
106
|
-
return;
|
|
118
|
+
return context.auth;
|
|
107
119
|
}
|
|
108
120
|
/**
|
|
109
|
-
*
|
|
121
|
+
* Evaluate an access rule for a given operation.
|
|
122
|
+
*
|
|
123
|
+
* Three kinds of declared rules:
|
|
124
|
+
* - `OrganizationRole[]` — role allowlist (as before).
|
|
125
|
+
* - `(ctx) => boolean` — arbitrary policy, receives auth + optional doc.
|
|
126
|
+
* Use for ownership rules like `doc.createdBy === auth.user.id`.
|
|
127
|
+
* - `undefined` — fall back to capability check.
|
|
128
|
+
*
|
|
129
|
+
* A declared-but-excluded role/policy for a session caller is an explicit
|
|
130
|
+
* deny; the capability map does not re-grant access.
|
|
110
131
|
*/
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
132
|
+
isAllowed(auth, collectionName, operation, doc) {
|
|
133
|
+
const schema = this.schemas.get(collectionName);
|
|
134
|
+
const declared = schema?.access?.[operation];
|
|
135
|
+
if (declared) {
|
|
136
|
+
if (typeof declared === 'function') {
|
|
137
|
+
try {
|
|
138
|
+
return declared({ auth, doc });
|
|
139
|
+
}
|
|
140
|
+
catch (err) {
|
|
141
|
+
// A throwing policy is a bug, not a grant — log and deny.
|
|
142
|
+
cmsLogger.error('[RBAC]', `access policy for "${collectionName}.${operation}" threw:`, err);
|
|
143
|
+
return false;
|
|
144
|
+
}
|
|
145
|
+
}
|
|
146
|
+
// Array-shaped rule (role allowlist)
|
|
147
|
+
const role = effectiveOrganizationRole(auth);
|
|
148
|
+
if (role && declared.includes(role))
|
|
149
|
+
return true;
|
|
150
|
+
if (auth.type === 'session' && role) {
|
|
151
|
+
return false;
|
|
152
|
+
}
|
|
153
|
+
// Unrecognized role (custom roles, API keys) → fall through to
|
|
154
|
+
// capability check so they can still gain access via capabilities.
|
|
114
155
|
}
|
|
156
|
+
return hasCapability(auth, OPERATION_CAPABILITY[operation]);
|
|
115
157
|
}
|
|
116
158
|
}
|
|
117
159
|
//# sourceMappingURL=permissions.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../../src/lib/local-api/permissions.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,EAAE;AACF,
|
|
1
|
+
{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../../src/lib/local-api/permissions.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,EAAE;AACF,+CAA+C;AAC/C,EAAE;AACF,wEAAwE;AACxE,2EAA2E;AAC3E,2DAA2D;AAC3D,wEAAwE;AACxE,gCAAgC;AAChC,EAAE;AACF,oEAAoE;AAOpE,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAmB,MAAM,uBAAuB,CAAC;AAClG,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAGxB;IACA;IAHjB,YACC,OAAe,EACC,SAAiB,EACjB,QAAgB;QAEhC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,cAAS,GAAT,SAAS,CAAQ;QACjB,aAAQ,GAAR,QAAQ,CAAQ;QAGhC,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAC/B,CAAC;CACD;AAID,MAAM,oBAAoB,GAAkC;IAC3D,IAAI,EAAE,eAAe;IACrB,MAAM,EAAE,iBAAiB;IACzB,MAAM,EAAE,iBAAiB;IACzB,MAAM,EAAE,iBAAiB;IACzB,OAAO,EAAE,kBAAkB;IAC3B,SAAS,EAAE,oBAAoB;CAC/B,CAAC;AAEF,uEAAuE;AACvE,mDAAmD;AACnD,MAAM,eAAe,GAA8B;IAClD,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,WAAW;CACtB,CAAC;AAEF,SAAS,aAAa,CAAC,UAAuB,EAAE,cAAsB;IACrE,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,MAAM,MAAM,GACX,OAAO,CAAC,MAAM,KAAK,CAAC;QACnB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YACrB,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE;YAClC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;IAC7E,OAAO,gCAAgC,MAAM,IAAI,cAAc,8CAA8C,CAAC;AAC/G,CAAC;AAED,MAAM,OAAO,iBAAiB;IAEpB;IACA;IAFT,YACS,OAAkB,EAClB,OAAgC;QADhC,YAAO,GAAP,OAAO,CAAW;QAClB,YAAO,GAAP,OAAO,CAAyB;IACtC,CAAC;IAEJ,IAAI,MAAM;QACT,OAAO,IAAI,CAAC,OAAO,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAwB,EAAE,cAAsB,EAAE,GAAc;QAC7E,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAwB,EAAE,cAAsB;QAC/D,4CAA4C;QAC5C,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAwB,EAAE,cAAsB,EAAE,GAAc;QAC/E,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,OAAwB,EAAE,cAAsB,EAAE,GAAc;QAC9E,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAwB,EAAE,cAAsB,EAAE,GAAc;QAC/E,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,UAAU,CACf,OAAwB,EACxB,cAAsB,EACtB,GAAc;QAEd,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,YAAY,CACjB,OAAwB,EACxB,cAAsB,EACtB,GAAc;QAEd,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,kBAAkB,CAAC,cAAsB;QACxC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACd,eAAe,cAAc,iDAAiD,KAAK,CAAC,IAAI,CACvF,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CACnB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACd,CAAC;QACH,CAAC;IACF,CAAC;IAED,6EAA6E;IAErE,KAAK,CAAC,MAAM,CACnB,OAAwB,EACxB,cAAsB,EACtB,SAAoB,EACpB,GAAc;QAEd,IAAI,OAAO,CAAC,cAAc;YAAE,OAAO;QAEnC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,CAAC;YAAE,OAAO;QAEjE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACnF,MAAM,IAAI,eAAe,CACxB,aAAa,CAAC,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,EAC1C,SAAS,EACT,cAAc,CACd,CAAC;IACH,CAAC;IAEO,SAAS,CAChB,IAAU,EACV,SAAiB,EACjB,cAAsB,EACtB,mBAAiC;QAEjC,MAAM,GAAG,GACR,IAAI,CAAC,IAAI,KAAK,SAAS;YACtB,CAAC,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,EAAE,UAAU,IAAI,CAAC,gBAAgB,GAAG;YACxD,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;gBACxB,CAAC,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE;gBACxB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACf,MAAM,IAAI,GACT,cAAc,IAAI,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;YACzD,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;YAC7B,CAAC,CAAC,QAAQ,CAAC;QACb,SAAS,CAAC,IAAI,CACb,QAAQ,EACR,QAAQ,SAAS,QAAQ,cAAc,OAAO,GAAG,SAAS,IAAI,YAAY,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAC1G,CAAC;IACH,CAAC;IAEO,WAAW,CAClB,OAAwB,EACxB,SAAoB,EACpB,cAAsB;QAEtB,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,eAAe,CACxB,4BAA4B,eAAe,CAAC,SAAS,CAAC,IAAI,cAAc,aAAa,EACrF,SAAS,EACT,cAAc,CACd,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC,IAAI,CAAC;IACrB,CAAC;IAED;;;;;;;;;;;OAWG;IACK,SAAS,CAChB,IAAU,EACV,cAAsB,EACtB,SAAoB,EACpB,GAAc;QAEd,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC;QAE7C,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;gBACpC,IAAI,CAAC;oBACJ,OAAO,QAAQ,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;gBAChC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACd,0DAA0D;oBAC1D,SAAS,CAAC,KAAK,CACd,QAAQ,EACR,sBAAsB,cAAc,IAAI,SAAS,UAAU,EAC3D,GAAG,CACH,CAAC;oBACF,OAAO,KAAK,CAAC;gBACd,CAAC;YACF,CAAC;YACD,qCAAqC;YACrC,MAAM,IAAI,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,EAAE,CAAC;gBACrC,OAAO,KAAK,CAAC;YACd,CAAC;YACD,+DAA+D;YAC/D,mEAAmE;QACpE,CAAC;QAED,OAAO,aAAa,CAAC,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7D,CAAC;CACD"}
|
|
@@ -0,0 +1,44 @@
|
|
|
1
|
+
import type { Capability } from './types/capabilities.js';
|
|
2
|
+
export interface PermissionsContext {
|
|
3
|
+
/** Current capability list (reactive). */
|
|
4
|
+
readonly capabilities: readonly string[];
|
|
5
|
+
/**
|
|
6
|
+
* Effective organization role name (reactive). `null` when the caller has
|
|
7
|
+
* no role (API key, unauthenticated). Used for role-name-based checks
|
|
8
|
+
* such as field-level access lists.
|
|
9
|
+
*/
|
|
10
|
+
readonly role: string | null;
|
|
11
|
+
/** True if the session has the named capability. */
|
|
12
|
+
can(cap: Capability): boolean;
|
|
13
|
+
/** True if the session has at least one of the capabilities. */
|
|
14
|
+
canAny(...caps: Capability[]): boolean;
|
|
15
|
+
/** True if the session has every one of the capabilities. */
|
|
16
|
+
canAll(...caps: Capability[]): boolean;
|
|
17
|
+
}
|
|
18
|
+
/**
|
|
19
|
+
* Publish a capability context to descendants.
|
|
20
|
+
*
|
|
21
|
+
* `getCapabilities` is a getter rather than a static array so reactive
|
|
22
|
+
* sources (Svelte state, `$page.data.rbac.capabilities`) propagate: every
|
|
23
|
+
* `can()` call re-reads through the closure.
|
|
24
|
+
*
|
|
25
|
+
* @example
|
|
26
|
+
* ```svelte
|
|
27
|
+
* <script>
|
|
28
|
+
* import { page } from '$app/state';
|
|
29
|
+
* import { setPermissionsContext } from '@aphexcms/cms-core';
|
|
30
|
+
* setPermissionsContext(() => page.data.rbac?.capabilities ?? []);
|
|
31
|
+
* </script>
|
|
32
|
+
* ```
|
|
33
|
+
*/
|
|
34
|
+
export declare function setPermissionsContext(getCapabilities: () => readonly string[], getRole?: () => string | null): PermissionsContext;
|
|
35
|
+
/**
|
|
36
|
+
* Read the capability context set by an ancestor.
|
|
37
|
+
*
|
|
38
|
+
* When no provider is present (e.g. a component rendered in isolation during
|
|
39
|
+
* tests or Storybook), returns a deny-all stub with a one-time dev warning
|
|
40
|
+
* rather than throwing — that way consumers degrade to "no affordances shown"
|
|
41
|
+
* instead of crashing the tree.
|
|
42
|
+
*/
|
|
43
|
+
export declare function usePermissions(): PermissionsContext;
|
|
44
|
+
//# sourceMappingURL=permissions-context.svelte.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"permissions-context.svelte.d.ts","sourceRoot":"","sources":["../../src/lib/permissions-context.svelte.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAIvD,MAAM,WAAW,kBAAkB;IAClC,0CAA0C;IAC1C,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oDAAoD;IACpD,GAAG,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC;IAC9B,gEAAgE;IAChE,MAAM,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IACvC,6DAA6D;IAC7D,MAAM,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;CACvC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACpC,eAAe,EAAE,MAAM,SAAS,MAAM,EAAE,EACxC,OAAO,GAAE,MAAM,MAAM,GAAG,IAAiB,GACvC,kBAAkB,CAsBpB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,IAAI,kBAAkB,CAKnD"}
|
|
@@ -0,0 +1,80 @@
|
|
|
1
|
+
// Svelte context for capability-based UI gating.
|
|
2
|
+
//
|
|
3
|
+
// Set once at the root of the admin shell with a reactive capability source;
|
|
4
|
+
// descendants consume via `usePermissions()`. Mirrors the server-side
|
|
5
|
+
// `hasCapability()` API so the same mental model applies on both sides.
|
|
6
|
+
import { getContext, setContext } from 'svelte';
|
|
7
|
+
const KEY = Symbol.for('aphex.permissions');
|
|
8
|
+
/**
|
|
9
|
+
* Publish a capability context to descendants.
|
|
10
|
+
*
|
|
11
|
+
* `getCapabilities` is a getter rather than a static array so reactive
|
|
12
|
+
* sources (Svelte state, `$page.data.rbac.capabilities`) propagate: every
|
|
13
|
+
* `can()` call re-reads through the closure.
|
|
14
|
+
*
|
|
15
|
+
* @example
|
|
16
|
+
* ```svelte
|
|
17
|
+
* <script>
|
|
18
|
+
* import { page } from '$app/state';
|
|
19
|
+
* import { setPermissionsContext } from '@aphexcms/cms-core';
|
|
20
|
+
* setPermissionsContext(() => page.data.rbac?.capabilities ?? []);
|
|
21
|
+
* </script>
|
|
22
|
+
* ```
|
|
23
|
+
*/
|
|
24
|
+
export function setPermissionsContext(getCapabilities, getRole = () => null) {
|
|
25
|
+
const ctx = {
|
|
26
|
+
get capabilities() {
|
|
27
|
+
return getCapabilities();
|
|
28
|
+
},
|
|
29
|
+
get role() {
|
|
30
|
+
return getRole();
|
|
31
|
+
},
|
|
32
|
+
can(cap) {
|
|
33
|
+
return getCapabilities().includes(cap);
|
|
34
|
+
},
|
|
35
|
+
canAny(...caps) {
|
|
36
|
+
const current = getCapabilities();
|
|
37
|
+
return caps.some((c) => current.includes(c));
|
|
38
|
+
},
|
|
39
|
+
canAll(...caps) {
|
|
40
|
+
const current = getCapabilities();
|
|
41
|
+
return caps.every((c) => current.includes(c));
|
|
42
|
+
}
|
|
43
|
+
};
|
|
44
|
+
setContext(KEY, ctx);
|
|
45
|
+
return ctx;
|
|
46
|
+
}
|
|
47
|
+
/**
|
|
48
|
+
* Read the capability context set by an ancestor.
|
|
49
|
+
*
|
|
50
|
+
* When no provider is present (e.g. a component rendered in isolation during
|
|
51
|
+
* tests or Storybook), returns a deny-all stub with a one-time dev warning
|
|
52
|
+
* rather than throwing — that way consumers degrade to "no affordances shown"
|
|
53
|
+
* instead of crashing the tree.
|
|
54
|
+
*/
|
|
55
|
+
export function usePermissions() {
|
|
56
|
+
const ctx = getContext(KEY);
|
|
57
|
+
if (ctx)
|
|
58
|
+
return ctx;
|
|
59
|
+
warnOnce();
|
|
60
|
+
return DENY_ALL;
|
|
61
|
+
}
|
|
62
|
+
const DENY_ALL = Object.freeze({
|
|
63
|
+
capabilities: Object.freeze([]),
|
|
64
|
+
role: null,
|
|
65
|
+
can: () => false,
|
|
66
|
+
canAny: () => false,
|
|
67
|
+
canAll: () => false
|
|
68
|
+
});
|
|
69
|
+
let warned = false;
|
|
70
|
+
function warnOnce() {
|
|
71
|
+
if (warned)
|
|
72
|
+
return;
|
|
73
|
+
warned = true;
|
|
74
|
+
if (typeof window !== 'undefined') {
|
|
75
|
+
// eslint-disable-next-line no-console
|
|
76
|
+
console.warn('[aphex] usePermissions() called outside a PermissionsContext provider. ' +
|
|
77
|
+
'All capability checks will return false. Call setPermissionsContext() in an ancestor.');
|
|
78
|
+
}
|
|
79
|
+
}
|
|
80
|
+
//# sourceMappingURL=permissions-context.svelte.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"permissions-context.svelte.js","sourceRoot":"","sources":["../../src/lib/permissions-context.svelte.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,EAAE;AACF,6EAA6E;AAC7E,sEAAsE;AACtE,wEAAwE;AAExE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAGhD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AAmB5C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CACpC,eAAwC,EACxC,UAA+B,GAAG,EAAE,CAAC,IAAI;IAEzC,MAAM,GAAG,GAAuB;QAC/B,IAAI,YAAY;YACf,OAAO,eAAe,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,IAAI;YACP,OAAO,OAAO,EAAE,CAAC;QAClB,CAAC;QACD,GAAG,CAAC,GAAG;YACN,OAAO,eAAe,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,CAAC,GAAG,IAAI;YACb,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,CAAC,GAAG,IAAI;YACb,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC;KACD,CAAC;IACF,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc;IAC7B,MAAM,GAAG,GAAG,UAAU,CAAiC,GAAG,CAAC,CAAC;IAC5D,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,QAAQ,EAAE,CAAC;IACX,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,MAAM,QAAQ,GAAuB,MAAM,CAAC,MAAM,CAAC;IAClD,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAsB;IACpD,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK;IAChB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;IACnB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;CACnB,CAAC,CAAC;AAEH,IAAI,MAAM,GAAG,KAAK,CAAC;AACnB,SAAS,QAAQ;IAChB,IAAI,MAAM;QAAE,OAAO;IACnB,MAAM,GAAG,IAAI,CAAC;IACd,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QACnC,sCAAsC;QACtC,OAAO,CAAC,IAAI,CACX,yEAAyE;YACxE,uFAAuF,CACxF,CAAC;IACH,CAAC;AACF,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/assets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,eAAO,MAAM,IAAI,EAAE,cAuFlB,CAAC;AAEF,eAAO,MAAM,GAAG,EAAE,
|
|
1
|
+
{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/assets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,eAAO,MAAM,IAAI,EAAE,cAuFlB,CAAC;AAEF,eAAO,MAAM,GAAG,EAAE,cAmEjB,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"assets.js","sourceRoot":"","sources":["../../../src/lib/routes/assets.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,MAAM,CAAC,MAAM,IAAI,GAAmB,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;IACjE,IAAI,CAAC;QACJ,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAEzB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAS,CAAC;QAE1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,yBAAyB;QACzB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAExC,kFAAkF;QAClF,MAAM,mBAAmB,GAAG,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAkB,CAAC;QAC9E,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAkB,CAAC;QAC5D,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3F,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAElE,oEAAoE;QACpE,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YAC7D,gBAAgB;YAChB,OAAO;SACP,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,uCAAuC;QACvC,MAAM,KAAK,GAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAY,IAAI,SAAS,CAAC;QAC7D,MAAM,WAAW,GAAI,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAY,IAAI,SAAS,CAAC;QACzE,MAAM,GAAG,GAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAY,IAAI,SAAS,CAAC;QACzD,MAAM,UAAU,GAAI,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAY,IAAI,SAAS,CAAC;QAEvE,0CAA0C;QAC1C,MAAM,UAAU,GAAI,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAY,IAAI,SAAS,CAAC;QACvE,MAAM,SAAS,GAAI,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAY,IAAI,SAAS,CAAC;QAErE,4DAA4D;QAC5D,6EAA6E;QAC7E,MAAM,oBAAoB,GAAI,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAY,IAAI,IAAI,CAAC,cAAc,CAAC;QAE/F,2BAA2B;QAC3B,MAAM,UAAU,GAAG;YAClB,cAAc,EAAE,oBAAoB,EAAE,kCAAkC;YACxE,MAAM;YACN,gBAAgB,EAAE,IAAI,CAAC,IAAI;YAC3B,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK;YACL,WAAW;YACX,GAAG;YACH,UAAU;YACV,SAAS,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;YAC7D,QAAQ,EAAE;gBACT,UAAU;gBACV,SAAS;aACT;SACD,CAAC;QAEF,iCAAiC;QACjC,gEAAgE;QAChE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;QAE/E,OAAO,IAAI,CAAC;YACX,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,KAAK;SACX,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;QAC/C,OAAO,IAAI,CACV;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,qBAAqB;YAC5B,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;IACH,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,GAAG,GAAmB,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE;IAC5D,IAAI,CAAC;QACJ,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAEzB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,WAAW,GAAG,eAAe,CAAC,SAAS,
|
|
1
|
+
{"version":3,"file":"assets.js","sourceRoot":"","sources":["../../../src/lib/routes/assets.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,MAAM,CAAC,MAAM,IAAI,GAAmB,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;IACjE,IAAI,CAAC;QACJ,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAEzB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAS,CAAC;QAE1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,yBAAyB;QACzB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAExC,kFAAkF;QAClF,MAAM,mBAAmB,GAAG,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAkB,CAAC;QAC9E,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAkB,CAAC;QAC5D,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3F,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAElE,oEAAoE;QACpE,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YAC7D,gBAAgB;YAChB,OAAO;SACP,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,uCAAuC;QACvC,MAAM,KAAK,GAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAY,IAAI,SAAS,CAAC;QAC7D,MAAM,WAAW,GAAI,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAY,IAAI,SAAS,CAAC;QACzE,MAAM,GAAG,GAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAY,IAAI,SAAS,CAAC;QACzD,MAAM,UAAU,GAAI,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAY,IAAI,SAAS,CAAC;QAEvE,0CAA0C;QAC1C,MAAM,UAAU,GAAI,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAY,IAAI,SAAS,CAAC;QACvE,MAAM,SAAS,GAAI,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAY,IAAI,SAAS,CAAC;QAErE,4DAA4D;QAC5D,6EAA6E;QAC7E,MAAM,oBAAoB,GAAI,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAY,IAAI,IAAI,CAAC,cAAc,CAAC;QAE/F,2BAA2B;QAC3B,MAAM,UAAU,GAAG;YAClB,cAAc,EAAE,oBAAoB,EAAE,kCAAkC;YACxE,MAAM;YACN,gBAAgB,EAAE,IAAI,CAAC,IAAI;YAC3B,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK;YACL,WAAW;YACX,GAAG;YACH,UAAU;YACV,SAAS,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;YAC7D,QAAQ,EAAE;gBACT,UAAU;gBACV,SAAS;aACT;SACD,CAAC;QAEF,iCAAiC;QACjC,gEAAgE;QAChE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;QAE/E,OAAO,IAAI,CAAC;YACX,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,KAAK;SACX,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;QAC/C,OAAO,IAAI,CACV;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,qBAAqB;YAC5B,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;IACH,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,GAAG,GAAmB,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE;IAC5D,IAAI,CAAC;QACJ,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAEzB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,WAAW,GAAG,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC9F,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YAC1B,OAAO,IAAI,CACV;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,0BAA0B;gBACjC,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM;aAChC,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG;YACf,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,SAAS;YACrC,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC,QAAQ;YACnC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM;YAC/B,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACnC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC;SACpC,CAAC;QAEF,2CAA2C;QAC3C,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACtD,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC;YACrD,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,EAAE;gBAC5C,GAAG,OAAO;gBACV,KAAK,EAAE,MAAM;gBACb,MAAM,EAAE,CAAC;aACT,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,CAAC;QAE/C,OAAO,IAAI,CAAC;YACX,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,aAAa;YACnB,UAAU,EAAE;gBACX,KAAK;gBACL,IAAI,EAAE,WAAW;gBACjB,QAAQ;gBACR,UAAU;gBACV,WAAW,EAAE,WAAW,GAAG,UAAU;gBACrC,WAAW,EAAE,WAAW,GAAG,CAAC;aAC5B;SACD,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;QAClD,OAAO,IAAI,CACV;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,wBAAwB;YAC/B,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;IACH,CAAC;AACF,CAAC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"document-versions.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/document-versions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAMpD,eAAO,MAAM,GAAG,EAAE,
|
|
1
|
+
{"version":3,"file":"document-versions.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/document-versions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAMpD,eAAO,MAAM,GAAG,EAAE,cAqEjB,CAAC;AAGF,eAAO,MAAM,UAAU,EAAE,cAkCxB,CAAC;AAGF,eAAO,MAAM,cAAc,EAAE,cA0C5B,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"document-versions.js","sourceRoot":"","sources":["../../../src/lib/routes/document-versions.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,0DAA0D;AAC1D,MAAM,CAAC,MAAM,GAAG,GAAmB,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE;IACpE,IAAI,CAAC;QACJ,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QACtD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC;QAEtB,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,WAAW,GAAG,iBAAiB,CAAC,SAAS,
|
|
1
|
+
{"version":3,"file":"document-versions.js","sourceRoot":"","sources":["../../../src/lib/routes/document-versions.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,0DAA0D;AAC1D,MAAM,CAAC,MAAM,GAAG,GAAmB,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE;IACpE,IAAI,CAAC;QACJ,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QACtD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC;QAEtB,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,WAAW,GAAG,iBAAiB,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAChG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YAC1B,OAAO,IAAI,CACV;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,0BAA0B;gBACjC,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM;aAChC,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QAE5C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,YAAY,CACxD,eAAe,EACf,OAAO,CAAC,cAAc,EACtB,EAAE,EACF,EAAE,KAAK,EAAE,MAAM,EAAE,CACjB,CAAC;QAEF,uCAAuC;QACvC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC3F,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;QAE1C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAChD,MAAM,OAAO,CAAC,GAAG,CAChB,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAc,EAAE,EAAE;gBACpC,4EAA4E;gBAC5E,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;oBAClC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;oBAC/B,OAAO;gBACR,CAAC;gBACD,IAAI,CAAC;oBACJ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;oBAC7D,IAAI,IAAI,EAAE,CAAC;wBACV,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;oBAC9C,CAAC;gBACF,CAAC;gBAAC,MAAM,CAAC;oBACR,wBAAwB;gBACzB,CAAC;YACF,CAAC,CAAC,CACF,CAAC;QACH,CAAC;QAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YAC1D,GAAG,CAAC;YACJ,aAAa,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI;SACpE,CAAC,CAAC,CAAC;QAEJ,OAAO,IAAI,CAAC;YACX,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,iBAAiB;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK;SACnB,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACpF,CAAC;AACF,CAAC,CAAC;AAEF,oEAAoE;AACpE,MAAM,CAAC,MAAM,UAAU,GAAmB,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;IACtE,IAAI,CAAC;QACJ,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QACtD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,MAAgC,CAAC;QAEzD,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,IAAI,CACV,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,EAAE,EACxE,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,UAAU,CACtD,eAAe,EACf,OAAO,CAAC,cAAc,EACtB,EAAE,EACF,aAAa,CACb,CAAC;QAEF,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAClF,CAAC;AACF,CAAC,CAAC;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,cAAc,GAAmB,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;IAC1E,IAAI,CAAC;QACJ,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QACtD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,MAAgC,CAAC;QAEzD,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,IAAI,CACV,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,EAAE,EACxE,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,cAAc,CAC5D,eAAe,EACf,OAAO,CAAC,cAAc,EACtB,EAAE,EACF,aAAa,EACb,OAAO,CAAC,IAAI,EAAE,EAAE,CAChB,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,IAAI,CACV,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,qCAAqC,EAAE,EAChE,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;YACX,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,uBAAuB,aAAa,EAAE;SAC/C,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACtF,CAAC;AACF,CAAC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"organizations-by-id.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/organizations-by-id.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;
|
|
1
|
+
{"version":3,"file":"organizations-by-id.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/organizations-by-id.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAMpD,eAAO,MAAM,GAAG,EAAE,cAmEjB,CAAC;AAGF,eAAO,MAAM,KAAK,EAAE,cA8GnB,CAAC;AAGF,eAAO,MAAM,MAAM,EAAE,cAmFpB,CAAC"}
|
|
@@ -2,6 +2,7 @@
|
|
|
2
2
|
import { json } from '@sveltejs/kit';
|
|
3
3
|
import { cmsLogger } from '../utils/logger.js';
|
|
4
4
|
import { updateOrganizationRequest } from '../api/schemas/organizations.js';
|
|
5
|
+
import { hasCapability } from '../types/capabilities.js';
|
|
5
6
|
// GET /api/organizations/[id] - Get organization by ID
|
|
6
7
|
export const GET = async ({ params, locals }) => {
|
|
7
8
|
try {
|
|
@@ -72,13 +73,15 @@ export const PATCH = async ({ params, request, locals }) => {
|
|
|
72
73
|
message: 'Organization ID is required'
|
|
73
74
|
}, { status: 400 });
|
|
74
75
|
}
|
|
75
|
-
//
|
|
76
|
+
// Require `org.settings` capability + membership in the target org.
|
|
77
|
+
// Membership check stands regardless — even a capability holder can only
|
|
78
|
+
// edit orgs they actually belong to.
|
|
76
79
|
const membership = await databaseAdapter.findUserMembership(auth.user.id, id);
|
|
77
|
-
if (!membership || (
|
|
80
|
+
if (!membership || !hasCapability(auth, 'org.settings')) {
|
|
78
81
|
return json({
|
|
79
82
|
success: false,
|
|
80
83
|
error: 'Forbidden',
|
|
81
|
-
message: '
|
|
84
|
+
message: 'You do not have permission to update organization settings'
|
|
82
85
|
}, { status: 403 });
|
|
83
86
|
}
|
|
84
87
|
const rawBody = await request.json();
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"organizations-by-id.js","sourceRoot":"","sources":["../../../src/lib/routes/organizations-by-id.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;
|
|
1
|
+
{"version":3,"file":"organizations-by-id.js","sourceRoot":"","sources":["../../../src/lib/routes/organizations-by-id.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD,uDAAuD;AACvD,MAAM,CAAC,MAAM,GAAG,GAAmB,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;IAC/D,IAAI,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC;QAEtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,IAAI,CACV;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC1C,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QAED,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,IAAI,CACV;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,wBAAwB;gBAC/B,OAAO,EAAE,6BAA6B;aACtC,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QAED,iDAAiD;QACjD,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,OAAO,IAAI,CACV;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,2CAA2C;aACpD,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,OAAO,IAAI,CACV;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,wBAAwB;aAC/B,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;YACX,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,YAAY;SAClB,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QACxD,OAAO,IAAI,CACV;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,8BAA8B;YACrC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;IACH,CAAC;AACF,CAAC,CAAC;AAEF,sDAAsD;AACtD,MAAM,CAAC,MAAM,KAAK,GAAmB,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;IAC1E,IAAI,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC;QAEtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,IAAI,CACV;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC1C,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QAED,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,IAAI,CACV;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,wBAAwB;gBAC/B,OAAO,EAAE,6BAA6B;aACtC,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,yEAAyE;QACzE,qCAAqC;QACrC,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;YACzD,OAAO,IAAI,CACV;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,4DAA4D;aACrE,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,IAAI,CACV;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,sBAAsB;gBAC7B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC3B,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAEzB,mEAAmE;QACnE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5E,IAAI,WAAW,IAAI,WAAW,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC1C,OAAO,IAAI,CACV;oBACC,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,qBAAqB;oBAC5B,OAAO,EAAE,2BAA2B,IAAI,CAAC,IAAI,kBAAkB;iBAC/D,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;YACH,CAAC;QACF,CAAC;QAED,sBAAsB;QACtB,MAAM,UAAU,GAIZ,EAAE,CAAC;QAEP,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACzD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACzD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,UAAU,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAErE,MAAM,mBAAmB,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QAErF,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC1B,OAAO,IAAI,CACV;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,wBAAwB;aAC/B,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;YACX,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,mBAAmB;SACzB,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QACzD,OAAO,IAAI,CACV;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,+BAA+B;YACtC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;IACH,CAAC;AACF,CAAC,CAAC;AAEF,0DAA0D;AAC1D,MAAM,CAAC,MAAM,MAAM,GAAmB,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;IAClE,IAAI,CAAC;QACJ,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC;QAEtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,IAAI,CACV;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC1C,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QAED,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,IAAI,CACV;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,wBAAwB;gBAC/B,OAAO,EAAE,6BAA6B;aACtC,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAChD,OAAO,IAAI,CACV;gBACC,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,wCAAwC;aACjD,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;QACH,CAAC;QAED,sCAAsC;QACtC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;QAElE,0BAA0B;QAC1B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC9B,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACzE,IAAI,WAAW,EAAE,oBAAoB,KAAK,EAAE,EAAE,CAAC;gBAC9C,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC7E,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;gBAE5E,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClD,MAAM,eAAe,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;gBAC1F,CAAC;qBAAM,CAAC;oBACP,MAAM,eAAe,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACxD,CAAC;YACF,CAAC;QACF,CAAC;QAED,2CAA2C;QAC3C,MAAM,eAAe,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAE3C,8CAA8C;QAC9C,MAAM,eAAe,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;QAE/C,0BAA0B;QAC1B,MAAM,eAAe,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QAE7C,OAAO,IAAI,CAAC;YACX,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,mCAAmC;SAC5C,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QACzD,OAAO,IAAI,CACV;YACC,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,+BAA+B;YACtC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SACjE,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;IACH,CAAC;AACF,CAAC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"organizations-invitations.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/organizations-invitations.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;
|
|
1
|
+
{"version":3,"file":"organizations-invitations.d.ts","sourceRoot":"","sources":["../../../src/lib/routes/organizations-invitations.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAMpD,eAAO,MAAM,IAAI,EAAE,cA6IlB,CAAC;AAGF,eAAO,MAAM,MAAM,EAAE,cAsEpB,CAAC"}
|