@appsemble/utils 0.29.11 → 0.30.1

package/validation.js

@@ -1,11 +1,18 @@
+import { PredefinedAppRole, predefinedAppRolePermissions, } from '@appsemble/types';
 import cronParser from 'cron-parser';
 import { ValidationError, Validator } from 'jsonschema';
 import languageTags from 'language-tags';
 import { getAppBlocks, normalizeBlockName } from './blockUtils.js';
 import { has } from './has.js';
-import { findPageByName, normalize, partialNormalized } from './index.js';
+import { findPageByName, getAppInheritedRoles, getAppPossibleGuestPermissions, getAppPossiblePermissions, getAppRolePermissions, normalize, partialNormalized, } from './index.js';
 import { iterApp } from './iterApp.js';
 import { serverActions } from './serverActions.js';
+const allResourcePermissionPattern = /^\$resource:all:(get|query|create|delete|patch|update)$/;
+const resourcePermissionPattern = /^\$resource:[^:]+:(get|query|create|delete|patch|update)$/;
+const allOwnResourcePermissionPattern = /^\$resource:all:own:(get|query|delete|patch|update)$/;
+const ownResourcePermissionPattern = /^\$resource:[^:]+:own:(get|query|delete|patch|update)$/;
+const allResourceViewPermissionPattern = /^\$resource:all:(get|query):[^:]+$/;
+const resourceViewPermissionPattern = /^\$resource:[^:]+:(get|query):[^:]+$/;
 /**
  * Check whether or not the given link represents a link related to the Appsemble core.
  *
@@ -65,18 +72,18 @@ function validateUniquePageNames(definition, report) {
     }
     checkPages(definition.pages);
 }
-function validateUsersSchema(definition, report) {
+function validateMembersSchema(definition, report) {
     var _a;
-    if (!definition.users) {
+    if (!definition.members) {
         return;
     }
-    for (const [propertyName, propertyDefinition] of Object.entries(definition.users.properties)) {
+    for (const [propertyName, propertyDefinition] of Object.entries(definition.members.properties)) {
         // Handled by schema validation
         if (!(propertyDefinition === null || propertyDefinition === void 0 ? void 0 : propertyDefinition.schema)) {
             continue;
         }
         const { schema } = propertyDefinition;
-        const prefix = ['users', 'properties', propertyName, 'schema'];
+        const prefix = ['members', 'properties', propertyName, 'schema'];
         validateJSONSchema(schema, prefix, report);
         if (!('type' in schema) && !('enum' in schema)) {
             report(schema, 'must define type or enum', prefix);
@@ -86,7 +93,7 @@ function validateUsersSchema(definition, report) {
             const resourceDefinition = (_a = definition.resources) === null || _a === void 0 ? void 0 : _a[resourceName];
             if (!resourceDefinition) {
                 report(resourceName, 'refers to a resource that doesn’t exist', [
-                    'users',
+                    'members',
                     'properties',
                     propertyName,
                     'reference',
@@ -342,12 +349,275 @@ function validateBlocks(definition, blockVersions, report) {
         },
     });
 }
+function validatePermissions(appDefinition, permissions, inheritedPermissions, possiblePermissions, report, path) {
+    var _a, _b, _c, _d;
+    const checked = [];
+    for (const [index, permission] of permissions.entries()) {
+        if (checked.includes(permission)) {
+            report(appDefinition, 'duplicate permission declaration', [...path, 'permissions', index]);
+            return;
+        }
+        if (!possiblePermissions.includes(permission)) {
+            if (resourcePermissionPattern.test(permission) ||
+                ownResourcePermissionPattern.test(permission)) {
+                const [, resourceName] = permission.split(':');
+                if (resourceName && resourceName !== 'all' && !((_a = appDefinition.resources) === null || _a === void 0 ? void 0 : _a[resourceName])) {
+                    report(appDefinition, `resource ${resourceName} does not exist in the app's resources definition`, [...path, 'permissions', index]);
+                    return;
+                }
+            }
+            if (resourceViewPermissionPattern.test(permission)) {
+                const [, resourceName, , resourceView] = permission.split(':');
+                if (resourceName === 'all') {
+                    for (const [rName, resourceDefinition] of Object.entries(appDefinition.resources)) {
+                        if (!((_b = resourceDefinition.views) === null || _b === void 0 ? void 0 : _b[resourceView])) {
+                            report(appDefinition, `resource ${rName} is missing a definition for the ${resourceView} view`, [...path, 'permissions', index]);
+                            return;
+                        }
+                    }
+                }
+                else {
+                    if (!((_d = (_c = appDefinition.resources[resourceName]) === null || _c === void 0 ? void 0 : _c.views) === null || _d === void 0 ? void 0 : _d[resourceView])) {
+                        report(appDefinition, `resource ${resourceName} is missing a definition for the ${resourceView} view`, [...path, 'permissions', index]);
+                        return;
+                    }
+                }
+            }
+            report(appDefinition, 'invalid permission', [...path, 'permissions', index]);
+            return;
+        }
+        if (inheritedPermissions.includes(permission)) {
+            report(appDefinition, 'permission is already inherited from another role', [
+                ...path,
+                'permissions',
+                index,
+            ]);
+            return;
+        }
+        const otherPermissions = permissions.filter((p) => p !== permission);
+        if (resourcePermissionPattern.test(permission)) {
+            const [, , resourceAction] = permission.split(':');
+            if (otherPermissions.some((p) => {
+                if (allResourcePermissionPattern.test(p)) {
+                    const [, , otherResourceAction] = p.split(':');
+                    return otherResourceAction === resourceAction;
+                }
+                return false;
+            })) {
+                report(appDefinition, `redundant permission. A permission for the ${resourceAction} resource action with scope all is already declared`, [...path, 'permissions', index]);
+                return;
+            }
+            if (inheritedPermissions.some((p) => {
+                if (allResourcePermissionPattern.test(p)) {
+                    const [, , otherResourceAction] = p.split(':');
+                    return otherResourceAction === resourceAction;
+                }
+                return false;
+            })) {
+                report(appDefinition, `redundant permission. A permission for the ${resourceAction} resource action with scope all is already inherited from another role`, [...path, 'permissions', index]);
+                return;
+            }
+        }
+        if (ownResourcePermissionPattern.test(permission)) {
+            const [, resourceName, , resourceAction] = permission.split(':');
+            if (otherPermissions.some((p) => {
+                if (resourcePermissionPattern.test(p)) {
+                    const [, otherResourceName, otherResourceAction] = p.split(':');
+                    return (resourceName !== 'all' &&
+                        otherResourceName === resourceName &&
+                        otherResourceAction === resourceAction);
+                }
+                return false;
+            })) {
+                report(appDefinition, `redundant permission. A permission for the ${resourceAction} resource action on resource ${resourceName} is already declared`, [...path, 'permissions', index]);
+                return;
+            }
+            if (otherPermissions.some((p) => {
+                if (allOwnResourcePermissionPattern.test(p)) {
+                    const [, , , otherResourceAction] = p.split(':');
+                    return otherResourceAction === resourceAction;
+                }
+                return false;
+            })) {
+                report(appDefinition, `redundant permission. An own permission for the ${resourceAction} resource action with scope all is already declared`, [...path, 'permissions', index]);
+                return;
+            }
+            if (otherPermissions.some((p) => {
+                if (allResourcePermissionPattern.test(p)) {
+                    const [, , otherResourceAction] = p.split(':');
+                    return otherResourceAction === resourceAction;
+                }
+                return false;
+            })) {
+                report(appDefinition, `redundant permission. A permission for the ${resourceAction} resource action with scope all is already declared`, [...path, 'permissions', index]);
+                return;
+            }
+            if (inheritedPermissions.some((p) => {
+                if (resourcePermissionPattern.test(p)) {
+                    const [, otherResourceName, otherResourceAction] = p.split(':');
+                    return (resourceName !== 'all' &&
+                        otherResourceName === resourceName &&
+                        otherResourceAction === resourceAction);
+                }
+                return false;
+            })) {
+                report(appDefinition, `redundant permission. A permission for the ${resourceAction} resource action on resource ${resourceName} is already inherited from another role`, [...path, 'permissions', index]);
+                return;
+            }
+            if (inheritedPermissions.some((p) => {
+                if (allOwnResourcePermissionPattern.test(p)) {
+                    const [, , , otherResourceAction] = p.split(':');
+                    return otherResourceAction === resourceAction;
+                }
+                return false;
+            })) {
+                report(appDefinition, `redundant permission. An own permission for the ${resourceAction} resource action with scope all is already inherited from another role`, [...path, 'permissions', index]);
+                return;
+            }
+            if (inheritedPermissions.some((p) => {
+                if (allResourcePermissionPattern.test(p)) {
+                    const [, , otherResourceAction] = p.split(':');
+                    return otherResourceAction === resourceAction;
+                }
+                return false;
+            })) {
+                report(appDefinition, `redundant permission. A permission for the ${resourceAction} resource action with scope all is already inherited from another role`, [...path, 'permissions', index]);
+                return;
+            }
+        }
+        if (resourceViewPermissionPattern.test(permission)) {
+            const [, resourceName, resourceAction, resourceView] = permission.split(':');
+            // $resource:type:query:public, $resource:type:query:private
+            if (otherPermissions.some((p) => {
+                if (resourceViewPermissionPattern.test(p)) {
+                    const [, otherResourceName, otherResourceAction] = p.split(':');
+                    return (otherResourceName !== 'all' &&
+                        otherResourceName === resourceName &&
+                        otherResourceAction === resourceAction);
+                }
+                return false;
+            })) {
+                report(appDefinition, `a view permission for the ${resourceAction} action on resource ${resourceName} is already declared`, [...path, 'permissions', index]);
+                return;
+            }
+            // $resource:type:query:public, $resource:all:query:private
+            if (otherPermissions.some((p) => {
+                if (allResourceViewPermissionPattern.test(p)) {
+                    const [, , otherResourceAction, otherResourceView] = p.split(':');
+                    return otherResourceAction === resourceAction && otherResourceView !== resourceView;
+                }
+                return false;
+            })) {
+                report(appDefinition, `a view permission for the ${resourceAction} action with scope all is already declared`, [...path, 'permissions', index]);
+                return;
+            }
+            // $resource:type:query:public, $resource:type:query
+            if (otherPermissions.some((p) => {
+                if (resourcePermissionPattern.test(p)) {
+                    const [, otherResourceName, otherResourceAction] = p.split(':');
+                    return otherResourceName === resourceName && otherResourceAction === resourceAction;
+                }
+                return false;
+            })) {
+                report(appDefinition, `redundant permission. A permission for the ${resourceAction} action on resource ${resourceName} without a specific view is already declared`, [...path, 'permissions', index]);
+                return;
+            }
+            // $resource:type:query:public, $resource:all:query
+            if (otherPermissions.some((p) => {
+                if (resourcePermissionPattern.test(p)) {
+                    const [, otherResourceName, otherResourceAction] = p.split(':');
+                    return otherResourceName === 'all' && otherResourceAction === resourceAction;
+                }
+                return false;
+            })) {
+                report(appDefinition, `redundant permission. A permission for the ${resourceAction} resource action with scope all without a specific view is already declared`, [...path, 'permissions', index]);
+                return;
+            }
+            // $resource:type:query:public, $resource:all:query:public
+            if (otherPermissions.some((p) => {
+                if (allResourceViewPermissionPattern.test(p)) {
+                    const [, otherResourceName, otherResourceAction, otherResourceView] = p.split(':');
+                    return (otherResourceName === 'all' &&
+                        otherResourceAction === resourceAction &&
+                        otherResourceView === resourceView);
+                }
+                return false;
+            })) {
+                report(appDefinition, `redundant permission. A permission for the ${resourceAction} resource action with scope all for this view is already declared`, [...path, 'permissions', index]);
+                return;
+            }
+            // $resource:type:query:private
+            // $resource:type:query:public
+            if (inheritedPermissions.some((p) => {
+                if (resourceViewPermissionPattern.test(p)) {
+                    const [, otherResourceName, otherResourceAction] = p.split(':');
+                    return (otherResourceName !== 'all' &&
+                        otherResourceName === resourceName &&
+                        otherResourceAction === resourceAction);
+                }
+                return false;
+            })) {
+                report(appDefinition, `a view permission for the ${resourceAction} action on resource ${resourceName} is already inherited from another role`, [...path, 'permissions', index]);
+                return;
+            }
+            // $resource:all:query:private
+            // $resource:type:query:public
+            if (inheritedPermissions.some((p) => {
+                if (allResourceViewPermissionPattern.test(p)) {
+                    const [, , otherResourceAction, otherResourceView] = p.split(':');
+                    return otherResourceAction === resourceAction && otherResourceView !== resourceView;
+                }
+                return false;
+            })) {
+                report(appDefinition, `a view permission for the ${resourceAction} action with scope all is already inherited from another role`, [...path, 'permissions', index]);
+                return;
+            }
+            // $resource:type:query
+            // $resource:type:query:public
+            if (inheritedPermissions.some((p) => {
+                if (resourcePermissionPattern.test(p)) {
+                    const [, otherResourceName, otherResourceAction] = p.split(':');
+                    return otherResourceName === resourceName && otherResourceAction === resourceAction;
+                }
+                return false;
+            })) {
+                report(appDefinition, `redundant permission. A permission for the ${resourceAction} action on resource ${resourceName} without a specific view is already inherited from another role`, [...path, 'permissions', index]);
+                return;
+            }
+            // $resource:all:query
+            // $resource:type:query:public
+            if (inheritedPermissions.some((p) => {
+                if (allResourcePermissionPattern.test(p)) {
+                    const [, , otherResourceAction] = p.split(':');
+                    return otherResourceAction === resourceAction;
+                }
+                return false;
+            })) {
+                report(appDefinition, `redundant permission. A permission for the ${resourceAction} resource action with scope all without a specific view is already inherited from another role`, [...path, 'permissions', index]);
+                return;
+            }
+            // $resource:all:query:public
+            // $resource:type:query:public
+            if (inheritedPermissions.some((p) => {
+                if (allResourceViewPermissionPattern.test(p)) {
+                    const [, , otherResourceAction, otherResourceView] = p.split(':');
+                    return otherResourceAction === resourceAction && otherResourceView === resourceView;
+                }
+                return false;
+            })) {
+                report(appDefinition, `redundant permission. A permission for the ${resourceAction} resource action with scope all for this view is already inherited from another role`, [...path, 'permissions', index]);
+                return;
+            }
+        }
+        checked.push(permission);
+    }
+}
 function checkCyclicRoleInheritance(roles, name, report) {
-    let lastchecked;
+    let lastChecked;
     const stack = [];
     const checkRoleRecursively = (role) => {
         var _a, _b;
-        lastchecked = role;
+        lastChecked = role;
         if (stack.includes(role)) {
             return true;
         }
@@ -355,8 +625,8 @@ function checkCyclicRoleInheritance(roles, name, report) {
         return (_b = (_a = roles[role]) === null || _a === void 0 ? void 0 : _a.inherits) === null || _b === void 0 ? void 0 : _b.some(checkRoleRecursively);
     };
     const duplicate = checkRoleRecursively(name);
-    if (duplicate && lastchecked === name) {
-        report(roles[name], 'cyclicly inherits itself', ['security', 'roles', name]);
+    if (duplicate && lastChecked === name) {
+        report(roles[name], 'cyclically inherits itself', ['security', 'roles', name]);
     }
 }
 /**
@@ -367,59 +637,92 @@ function checkCyclicRoleInheritance(roles, name, report) {
  */
 function validateSecurity(definition, report) {
     const { notifications, security } = definition;
-    const defaultAllow = ['$none', '$public', '$team:member', '$team:manager'];
-    if (!security) {
-        if (notifications === 'login') {
-            report(notifications, 'only works if security is defined', ['notifications']);
-        }
-        return;
-    }
-    const checkRoleExists = (name, path, allow = defaultAllow) => {
-        if (!has(security.roles, name) && !allow.includes(name)) {
+    const predefinedRoles = Object.keys(PredefinedAppRole);
+    const checkRoleExists = (name, path, roles = predefinedRoles) => {
+        if (!has(security.roles, name) && !roles.includes(name)) {
             report(name, 'does not exist in this app’s roles', path);
             return false;
         }
         return true;
     };
-    const checkRoles = (object, path, allow = defaultAllow) => {
+    const checkRoles = (object, path) => {
         if (!(object === null || object === void 0 ? void 0 : object.roles)) {
             return;
         }
         for (const [index, role] of object.roles.entries()) {
-            checkRoleExists(role, [...path, 'roles', index], allow);
+            checkRoleExists(role, [...path, 'roles', index], ['$guest', ...predefinedRoles]);
         }
     };
-    checkRoleExists(security.default.role, ['security', 'default', 'role']);
-    checkRoles(definition, []);
-    if (definition.resources) {
-        for (const [resourceName, resource] of Object.entries(definition.resources)) {
-            checkRoles(resource, ['resources', resourceName], [...defaultAllow, '$author']);
-            checkRoles(resource.count, ['resources', resourceName, 'count'], [...defaultAllow, '$author']);
-            checkRoles(resource.create, ['resources', resourceName, 'create']);
-            checkRoles(resource.delete, ['resources', resourceName, 'delete'], [...defaultAllow, '$author']);
-            checkRoles(resource.get, ['resources', resourceName, 'get'], [...defaultAllow, '$author']);
-            checkRoles(resource.query, ['resources', resourceName, 'query'], [...defaultAllow, '$author']);
-            checkRoles(resource.update, ['resources', resourceName, 'update'], [...defaultAllow, '$author']);
-            if (resource.views) {
-                for (const [viewName, view] of Object.entries(resource.views)) {
-                    checkRoles(view, ['resources', resourceName, 'views', viewName], [...defaultAllow, '$author']);
-                }
-            }
+    if (!security) {
+        if (notifications === 'login') {
+            report(notifications, 'only works if security is defined', ['notifications']);
         }
+        return;
     }
-    iterApp(definition, { onBlock: checkRoles, onPage: checkRoles });
-    for (const [name, role] of Object.entries(security.roles)) {
-        if (!(role === null || role === void 0 ? void 0 : role.inherits)) {
-            continue;
+    if ((!security.default || !security.roles) && !security.guest) {
+        report(definition, 'invalid security definition. Must define either guest or roles and default', ['security']);
+        return;
+    }
+    if (security.guest) {
+        if (security.guest.inherits && security.guest.inherits.length && !security.roles) {
+            report(definition, 'guest can not inherit roles if the roles property is not defined', [
+                'security',
+                'guest',
+                'inherits',
+            ]);
+            return;
         }
-        let found = false;
-        for (const [index, inheritee] of role.inherits.entries()) {
-            found || (found = checkRoleExists(inheritee, ['security', 'roles', name, 'inherits', index]));
+        const inheritedPermissions = getAppRolePermissions(security, security.guest.inherits || []);
+        const possibleGuestPermissions = getAppPossibleGuestPermissions(definition);
+        if (inheritedPermissions.some((ip) => !possibleGuestPermissions.includes(ip))) {
+            report(definition, 'invalid security definition. Guest cannot inherit roles that contain own resource permissions', ['security', 'guest', 'inherits']);
+            return;
+        }
+        if (security.guest.permissions) {
+            validatePermissions(definition, security.guest.permissions, inheritedPermissions, possibleGuestPermissions, report, ['security', 'guest']);
         }
-        if (found) {
-            checkCyclicRoleInheritance(security.roles, name, report);
+    }
+    else {
+        checkRoleExists(security.default.role, ['security', 'default', 'role']);
+    }
+    if (security.roles) {
+        const possibleAppPermissions = getAppPossiblePermissions(definition);
+        for (const [name, role] of Object.entries(security.roles)) {
+            if (predefinedRoles.includes(name)) {
+                report(definition, `not allowed to overwrite role ${name}`, ['security', 'roles', name]);
+            }
+            const inheritedPermissions = [];
+            if (role === null || role === void 0 ? void 0 : role.inherits) {
+                let found = false;
+                for (const [index, inherited] of (role.inherits || []).entries()) {
+                    found || (found = checkRoleExists(inherited, ['security', 'roles', name, 'inherits', index]));
+                }
+                if (found) {
+                    checkCyclicRoleInheritance(security.roles, name, report);
+                }
+                const inheritedRoles = getAppInheritedRoles(security, [name]).filter((r) => r !== name);
+                for (const inheritedRole of inheritedRoles) {
+                    const roleDefinition = security.roles[inheritedRole];
+                    if (roleDefinition) {
+                        const rolePermissions = roleDefinition.permissions;
+                        if (rolePermissions) {
+                            inheritedPermissions.push(...rolePermissions);
+                        }
+                    }
+                    else {
+                        const predefinedRolePermissions = predefinedAppRolePermissions[inheritedRole];
+                        if (predefinedRolePermissions) {
+                            inheritedPermissions.push(...predefinedRolePermissions);
+                        }
+                    }
+                }
+            }
+            if (role.permissions) {
+                validatePermissions(definition, role.permissions, inheritedPermissions, possibleAppPermissions, report, ['security', 'roles', name]);
+            }
         }
     }
+    iterApp(definition, { onBlock: checkRoles, onPage: checkRoles });
 }
 /**
  * Validates the hooks in resource definition to ensure its properties are valid.
@@ -522,21 +825,21 @@ function validateActions(definition, report) {
     const urlRegex = new RegExp(`^${partialNormalized.source}:`);
     iterApp(definition, {
         onAction(action, path) {
-            var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o;
+            var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k;
             if (path[0] === 'cron' && !serverActions.has(action.type)) {
                 report(action.type, 'action type is not supported for cron jobs', [...path, 'type']);
                 return;
             }
-            if (action.type.startsWith('user.') && !definition.security) {
-                report(action.type, 'refers to a user action but the app doesn’t have a security definition', [...path, 'type']);
+            if (action.type.startsWith('app.member.') && !definition.security) {
+                report(action.type, 'refers to an app member action but the app doesn’t have a security definition', [...path, 'type']);
                 return;
             }
-            if (['user.register', 'user.create', 'user.update'].includes(action.type) &&
+            if (['app.member.register', 'app.member.properties.patch', 'app.member.current.patch'].includes(action.type) &&
                 Object.values((_a = action.properties) !== null && _a !== void 0 ? _a : {})[0] &&
-                ((_b = definition.users) === null || _b === void 0 ? void 0 : _b.properties)) {
+                ((_b = definition.members) === null || _b === void 0 ? void 0 : _b.properties)) {
                 for (const propertyName of Object.keys(Object.values((_c = action.properties) !== null && _c !== void 0 ? _c : {})[0])) {
-                    if (!((_d = definition.users) === null || _d === void 0 ? void 0 : _d.properties[propertyName])) {
-                        report(action.type, 'contains a property that doesn’t exist in users.properties', [
+                    if (!((_d = definition.members) === null || _d === void 0 ? void 0 : _d.properties[propertyName])) {
+                        report(action.type, 'contains a property that doesn’t exist in app member properties', [
                             ...path,
                             'properties',
                         ]);
@@ -547,58 +850,68 @@ function validateActions(definition, report) {
                 // All of the actions starting with `resource.` contain a property called `resource`.
                 const { resource: resourceName, view } = action;
                 const resource = (_e = definition.resources) === null || _e === void 0 ? void 0 : _e[resourceName];
+                const [, resourceAction] = action.type.split('.');
                 if (!resource) {
                     report(action.type, 'refers to a resource that doesn’t exist', [...path, 'resource']);
                     return;
                 }
                 if (!action.type.startsWith('resource.subscription.')) {
-                    const type = action.type.split('.')[1];
-                    const roles = (_g = (_f = resource === null || resource === void 0 ? void 0 : resource[type]) === null || _f === void 0 ? void 0 : _f.roles) !== null && _g !== void 0 ? _g : resource === null || resource === void 0 ? void 0 : resource.roles;
-                    if (!roles) {
-                        report(action.type, 'refers to a resource action that is currently set to private', [
-                            ...path,
-                            'resource',
-                        ]);
+                    if (!definition.security) {
+                        report(action.type, 'missing security definition', [...path, 'resource']);
                         return;
                     }
-                    if (roles && !roles.length && !definition.security) {
-                        report(action.type, 'refers to a resource action that is accessible when logged in, but the app has no security definitions', [...path, 'resource']);
-                        return;
+                    const allPermissions = ((_f = definition.security.guest) === null || _f === void 0 ? void 0 : _f.permissions) || [];
+                    if (definition.security.roles) {
+                        const allRolePermissions = getAppRolePermissions(definition.security, Object.keys(definition.security.roles));
+                        allPermissions.push(...allRolePermissions);
                     }
-                    if ((type === 'get' || type === 'query') && view) {
-                        if (!((_h = resource.views) === null || _h === void 0 ? void 0 : _h[view])) {
-                            report(action.type, 'refers to a view that doesn’t exist', [...path, 'view']);
-                            return;
+                    if (!allPermissions.some((permission) => {
+                        if (resourcePermissionPattern.test(permission)) {
+                            const [, permissionResourceName, permissionResourceAction] = permission.split(':');
+                            return (['all', resourceName].includes(permissionResourceName) &&
+                                (permissionResourceAction === resourceAction ||
+                                    (resourceAction === 'count' && permissionResourceAction === 'query')));
                         }
-                        const viewRoles = (_j = resource === null || resource === void 0 ? void 0 : resource.views) === null || _j === void 0 ? void 0 : _j[view].roles;
-                        if (!(viewRoles === null || viewRoles === void 0 ? void 0 : viewRoles.length)) {
-                            report(action.type, 'refers to a resource view that is currently set to private', [
-                                ...path,
-                                'view',
-                            ]);
-                            return;
-                        }
-                        if (viewRoles && !viewRoles.length && !definition.security) {
-                            report(action.type, 'refers to a resource action that is accessible when logged in, but the app has no security definitions', [...path, 'view']);
-                            return;
+                        if (ownResourcePermissionPattern.test(permission)) {
+                            const [, permissionResourceName, , permissionResourceAction] = permission.split(':');
+                            return (['all', resourceName].includes(permissionResourceName) &&
+                                (permissionResourceAction === resourceAction ||
+                                    (resourceAction === 'count' && permissionResourceAction === 'query')));
                         }
+                        return false;
+                    })) {
+                        report(action.type, 'there is no-one in the app, who has permissions to use this action', [...path, 'resource']);
+                        return;
+                    }
+                    if (view &&
+                        !allPermissions.some((permission) => {
+                            if (resourceViewPermissionPattern.test(permission)) {
+                                const [, permissionResourceName, permissionResourceAction, permissionResourceView] = permission.split(':');
+                                return (['all', resourceName].includes(permissionResourceName) &&
+                                    permissionResourceAction === resourceAction &&
+                                    (!permissionResourceView || permissionResourceView === view));
+                            }
+                            return false;
+                        })) {
+                        report(action.type, 'there is no-one in the app, who has permissions to use this action', [...path, 'resource']);
+                        return;
                     }
                 }
             }
             if (action.type.startsWith('flow.')) {
-                const page = (_k = definition.pages) === null || _k === void 0 ? void 0 : _k[Number(path[1])];
+                const page = (_g = definition.pages) === null || _g === void 0 ? void 0 : _g[Number(path[1])];
                 if (page.type !== 'flow' && page.type !== 'loop') {
                     report(action.type, 'flow actions can only be used on pages with the type ‘flow’ or ‘loop’', [...path, 'type']);
                     return;
                 }
-                if (action.type === 'flow.cancel' && !((_l = page.actions) === null || _l === void 0 ? void 0 : _l.onFlowCancel)) {
+                if (action.type === 'flow.cancel' && !((_h = page.actions) === null || _h === void 0 ? void 0 : _h.onFlowCancel)) {
                     report(action.type, 'was defined but ‘onFlowCancel’ page action wasn’t defined', [
                         ...path,
                         'type',
                     ]);
                     return;
                 }
-                if (action.type === 'flow.finish' && !((_m = page.actions) === null || _m === void 0 ? void 0 : _m.onFlowFinish)) {
+                if (action.type === 'flow.finish' && !((_j = page.actions) === null || _j === void 0 ? void 0 : _j.onFlowFinish)) {
                     report(action.type, 'was defined but ‘onFlowFinish’ page action wasn’t defined', [
                         ...path,
                         'type',
@@ -612,7 +925,7 @@ function validateActions(definition, report) {
                 if (page.type === 'flow' &&
                     action.type === 'flow.next' &&
                     Number(path[3]) === page.steps.length - 1 &&
-                    !((_o = page.actions) === null || _o === void 0 ? void 0 : _o.onFlowFinish)) {
+                    !((_k = page.actions) === null || _k === void 0 ? void 0 : _k.onFlowFinish)) {
                     report(action.type, 'was defined on the last step but ‘onFlowFinish’ page action wasn’t defined', [...path, 'type']);
                     return;
                 }
@@ -858,7 +1171,7 @@ export async function validateAppDefinition(definition, getBlockVersions, contro
         validateHooks(definition, report);
         validateLanguage(definition, report);
         validateResourceReferences(definition, report);
-        validateUsersSchema(definition, report);
+        validateMembersSchema(definition, report);
         validateResourceSchemas(definition, report);
         validateSecurity(definition, report);
         validateBlocks(definition, blockVersionMap, report);