@contember/engine-actions 1.3.0-alpha.8 → 1.3.0-beta.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/engine-actions",
-  "version": "1.3.0-alpha.8",
+  "version": "1.3.0-beta.2",
   "license": "proprietary",
   "main": "dist/src/index.js",
   "typings": "dist/src/index.d.ts",
@@ -10,27 +10,28 @@
   },
   "scripts": {
     "generate": "gql-gen --config graphql-actions.codegen.yml",
-    "test": "vitest"
+    "test": "vitest --no-threads"
   },
   "dependencies": {
-    "@contember/database": "^1.3.0-alpha.8",
-    "@contember/database-migrations": "^1.3.0-alpha.8",
-    "@contember/engine-common": "^1.3.0-alpha.8",
-    "@contember/engine-content-api": "^1.3.0-alpha.8",
-    "@contember/engine-system-api": "^1.3.0-alpha.8",
-    "@contember/engine-tenant-api": "^1.3.0-alpha.8",
-    "@contember/engine-http": "^1.3.0-alpha.8",
-    "@contember/engine-plugins": "^1.3.0-alpha.8",
-    "@contember/graphql-utils": "^1.3.0-alpha.8",
-    "@contember/schema": "^1.3.0-alpha.8",
-    "@contember/schema-utils": "^1.3.0-alpha.8",
-    "@contember/typesafe": "^1.3.0-alpha.8",
-    "@contember/logger": "^1.3.0-alpha.8",
+    "@contember/authorization": "1.3.0-beta.2",
+    "@contember/database": "1.3.0-beta.2",
+    "@contember/database-migrations": "1.3.0-beta.2",
+    "@contember/engine-common": "1.3.0-beta.2",
+    "@contember/engine-content-api": "1.3.0-beta.2",
+    "@contember/engine-http": "1.3.0-beta.2",
+    "@contember/engine-plugins": "1.3.0-beta.2",
+    "@contember/engine-system-api": "1.3.0-beta.2",
+    "@contember/engine-tenant-api": "1.3.0-beta.2",
+    "@contember/graphql-utils": "1.3.0-beta.2",
+    "@contember/logger": "1.3.0-beta.2",
+    "@contember/schema": "1.3.0-beta.2",
+    "@contember/schema-utils": "1.3.0-beta.2",
+    "@contember/typesafe": "1.3.0-beta.2",
     "@graphql-tools/schema": "^8.3.5",
     "graphql-tag": "^2.12.5"
   },
   "devDependencies": {
-    "@contember/engine-api-tester": "^1.3.0-alpha.8",
+    "@contember/engine-api-tester": "1.3.0-beta.2",
     "@graphql-codegen/cli": "^2.6.2",
     "@graphql-codegen/typescript": "^2.5.1",
     "@graphql-codegen/typescript-operations": "^2.4.2",
@@ -42,4 +43,4 @@
     "graphql": ">= 14.6.0",
     "pg": "^8.5.0"
   }
-}
+}

package/src/authorization/ActionsAuthorizationActions.ts

@@ -0,0 +1,14 @@
+import { Authorizator } from '@contember/authorization'
+
+export namespace ActionsAuthorizationActions {
+	export enum Resources {
+		variables = 'variables',
+		events = 'events',
+	}
+
+	export const VARIABLES_VIEW = Authorizator.createAction(Resources.variables, 'view')
+	export const VARIABLES_SET = Authorizator.createAction(Resources.variables, 'set')
+
+	export const EVENTS_VIEW = Authorizator.createAction(Resources.events, 'view')
+	export const EVENTS_PROCESS = Authorizator.createAction(Resources.events, 'process')
+}

package/src/authorization/ActionsPermissionsFactory.ts

@@ -0,0 +1,14 @@
+import { Permissions } from '@contember/authorization'
+import { ProjectRole } from '@contember/schema'
+import { ActionsAuthorizationActions } from './ActionsAuthorizationActions'
+
+export class ActionsPermissionsFactory {
+	public create(): Permissions {
+		const permissions = new Permissions()
+		permissions.allow(ProjectRole.ADMIN, { resource: Permissions.ALL, privilege: Permissions.ALL })
+		permissions.allow(ProjectRole.DEPLOYER, ActionsAuthorizationActions.VARIABLES_SET)
+		permissions.allow(ProjectRole.DEPLOYER, ActionsAuthorizationActions.VARIABLES_VIEW)
+
+		return permissions
+	}
+}

package/src/authorization/Identity.ts

@@ -0,0 +1,4 @@
+export interface Identity {
+	readonly id: string
+	readonly roles: string[]
+}

package/src/authorization/index.ts

@@ -0,0 +1,3 @@
+export * from './Identity'
+export * from './ActionsAuthorizationActions'
+export * from './ActionsPermissionsFactory'

package/src/dispatch/EventsRepository.ts

@@ -16,7 +16,7 @@ import { eventsToProcessSpecification, eventsToProcessStateSpecification } from
 const ACK_TIMEOUT_MS = 1_000 * 60 * 10 // 10 minutes
 const DEFAULT_REPEAT_INTERVAL_MS = 5_000 // 5 seconds
 const DEFAULT_MAX_ATTEMPTS = 10
-const DEFAULT_BATCH_SIZE = 20
+const DEFAULT_BATCH_SIZE = 1
 
 export class EventsRepository {
 

package/src/dispatch/WebhookFetcher.ts

@@ -0,0 +1,24 @@
+export type FetcherResponse = {
+	readonly headers: Headers
+	readonly ok: boolean
+	readonly status: number
+	readonly statusText: string
+	readonly responseText: string
+}
+
+export interface WebhookFetcher {
+	fetch(url: string, init: RequestInit): Promise<FetcherResponse>
+}
+
+export class WebhookFetcherNative implements WebhookFetcher {
+	async fetch(url: string, init: RequestInit): Promise<FetcherResponse> {
+		const response = await fetch(url, init)
+		return {
+			ok: response.ok,
+			headers: response.headers,
+			status: response.status,
+			statusText: response.statusText,
+			responseText: await response.text(),
+		}
+	}
+}

package/src/dispatch/WebhookTargetHandler.ts

@@ -1,69 +1,173 @@
 import { Actions } from '@contember/schema'
-import { HandledEvent, InvokeHandler, InvokeHandlerArgs } from './types'
+import { EventRow, HandledEvent, InvokeHandler, InvokeHandlerArgs, WebhookEvent, WebhookRequestPayload } from './types'
 import { VariablesMap } from '../model/VariablesManager'
+import * as Typesafe from '@contember/typesafe'
+import { FetcherResponse, WebhookFetcher } from './WebhookFetcher'
 
 const DEFAULT_TIMEOUT_MS = 30_000 // 30 seconds
 
+const ResponseType = Typesafe.noExtraProps(Typesafe.object({
+	failures: Typesafe.array(
+		Typesafe.intersection(
+			Typesafe.object({
+				eventId: Typesafe.string,
+			}),
+			Typesafe.partial({
+				error: Typesafe.string,
+			}),
+		),
+	),
+}))
+
+type EventResponseFactory = (eventRow: EventRow) => ({ ok: boolean; code?: number; response?: string; errorMessage?: string; durationMs?: number })
+
 export class WebhookTargetHandler implements InvokeHandler<Actions.WebhookTarget> {
+	constructor(
+		private readonly fetcher: WebhookFetcher,
+	) {
+	}
+
 	public async handle({ target, events, logger, variables }: InvokeHandlerArgs<Actions.WebhookTarget>): Promise<HandledEvent[]> {
-		const abortController = new AbortController()
 		const timeoutMs = target.timeoutMs
 
 		const start = process.hrtime.bigint()
 		const getDuration = () => Math.floor(Number((process.hrtime.bigint() - start) / BigInt(1_000_000)))
+
+		let eventResponseFactory: EventResponseFactory
 		try {
-			const resolvedUrl = this.resolveVariables(target.url, variables)
-			const resolvedHeaders = Object.fromEntries(Object.entries(target.headers ?? {})
-				.map(([key, value]) => [key, this.resolveVariables(value, variables)]))
-
-			const response = await withTimeout({ abortController, timeoutMs }, async () => {
-
-				return await fetch(resolvedUrl, {
-					method: 'POST',
-					headers: {
-						['User-Agent']: 'Contember Actions',
-						...resolvedHeaders,
-						['Content-type']: 'application/json',
-					},
-					signal: abortController.signal,
-					body: JSON.stringify({
-						events: events.map(it => it.payload),
-					}),
-				})
-			})
-			let responseText
-			try {
-				responseText = await withTimeout({ abortController, timeoutMs }, async () => {
-					return await response.text()
-				})
-			} catch {
-			}
-			const result = {
-				ok: response.ok,
-				code: response.status,
-				durationMs: getDuration(),
-				response: responseText,
-				errorMessage: !response.ok ? response.statusText : undefined,
-			}
 
-			// todo: per-event response format
+			const response = await this.fetch(timeoutMs ?? DEFAULT_TIMEOUT_MS, target, variables, events)
+
+			eventResponseFactory = this.createResponseFactory({
+				response: response,
+				events,
+			})
 
-			return events.map(it => ({ target, row: it, result }))
 		} catch (e) {
 			logger.warn(e)
-			const errorMessages = []
-			let err = e
-			while (typeof err === 'object' && err !== null && 'message' in err && typeof (err as any).message === 'string') {
-				errorMessages.push((err as any).message)
-				err = (err as any).cause
-			}
+			const errorMessages = this.extractErrorMessages(e)
 			const result = {
 				ok: false,
 				errorMessage: errorMessages.length ? errorMessages.join('; ') : undefined,
 				durationMs: getDuration(),
 			}
+			eventResponseFactory = () => ({ ok: false, errorMessage: errorMessages.length ? errorMessages.join('; ') : undefined })
+
 			return events.map(it => ({ target, row: it, result }))
 		}
+		const durationMs = getDuration()
+
+		return events.map(it => ({ target, row: it, result: { durationMs, ...eventResponseFactory(it) } }))
+	}
+
+	private createResponseFactory({ response, events }: {
+		response: FetcherResponse
+		events: EventRow[]
+	}): EventResponseFactory {
+		if (!response.ok) {
+			return () => ({
+				ok: false,
+				code: response.status,
+				response: response.responseText,
+				errorMessage: response.statusText,
+			})
+		}
+
+		if (response.responseText.trim() === ''
+			|| !response.headers.get('content-type')?.toLowerCase().includes('json')
+		) {
+			return () => ({
+				ok: true,
+				code: response.status,
+			})
+		}
+
+		try {
+			const responseData = ResponseType(JSON.parse(response.responseText))
+			const eventsInBatch = new Set(events.map(it => it.id))
+			const failedEvents = Object.fromEntries(responseData.failures?.map(it => [it.eventId, it]) ?? [])
+			const missingEvents =  Object.keys(failedEvents).filter(it => !eventsInBatch.has(it))
+
+			if (missingEvents.length) {
+				return () => ({
+					ok: false,
+					code: response.status,
+					response: response.responseText,
+					errorMessage: 'Invalid response: undefined events IDs: ' + missingEvents.join('; '),
+				})
+			}
+
+			return it => {
+				if (!failedEvents[it.id]) {
+					return { ok: true, code: response.status }
+				}
+				return {
+					ok: false,
+					code: response.status,
+					errorMessage: failedEvents[it.id].error,
+				}
+			}
+		} catch (e: any) {
+			return () => ({
+				ok: false,
+				code: response.status,
+				response: response.responseText,
+				errorMessage: 'Invalid response: ' + e.message,
+			})
+		}
+	}
+
+	private extractErrorMessages(e: unknown): string[] {
+		const errorMessages = []
+		let err = e
+		while (typeof err === 'object' && err !== null && 'message' in err && typeof (err as any).message === 'string') {
+			errorMessages.push((err as any).message)
+			err = (err as any).cause
+		}
+		return errorMessages
+	}
+
+	private async fetch(timeoutMs: number, target: Actions.WebhookTarget, variables: VariablesMap, events: EventRow[]): Promise<FetcherResponse> {
+		return await withTimeout(timeoutMs, async abortController => {
+			return await this.doFetch(target, variables, abortController, events)
+		})
+	}
+
+	private async doFetch(target: Actions.WebhookTarget, variables: VariablesMap, abortController: AbortController, events: EventRow[]): Promise<FetcherResponse> {
+		const resolvedUrl = this.resolveVariables(target.url, variables)
+		const resolvedHeaders = Object.fromEntries(Object.entries(target.headers ?? {})
+			.map(([key, value]) => [key, this.resolveVariables(value, variables)]))
+
+		const payload: WebhookRequestPayload = {
+			events: events.map(this.formatEventPayload),
+		}
+
+		return await this.fetcher.fetch(resolvedUrl, {
+			method: 'POST',
+			headers: {
+				['User-Agent']: 'Contember Actions',
+				...resolvedHeaders,
+				['Content-type']: 'application/json',
+			},
+			signal: abortController.signal,
+			body: JSON.stringify(payload),
+		})
+	}
+
+	private formatEventPayload(it: EventRow): WebhookEvent {
+		return {
+			meta: {
+				eventId: it.id,
+				transactionId: it.transaction_id,
+				createdAt: it.created_at.toISOString(),
+				lastStateChange: it.last_state_change.toISOString(),
+				numRetries: it.num_retries,
+				trigger: it.trigger,
+				target: it.target,
+				// todo: add stage and schema version
+			},
+			...it.payload,
+		}
 	}
 
 	private resolveVariables(subject: string, variables: VariablesMap) {
@@ -76,12 +180,13 @@ export class WebhookTargetHandler implements InvokeHandler<Actions.WebhookTarget
 	}
 }
 
-const withTimeout = async <T>({ abortController, timeoutMs }: { abortController: AbortController; timeoutMs?: number }, cb: () => Promise<T>): Promise<T> => {
+const withTimeout = async <T>(timeoutMs: number, cb: (abortController: AbortController) => Promise<T>): Promise<T> => {
+	const abortController = new AbortController()
 	const timeoutId = setTimeout(() => {
 		abortController.abort()
-	}, timeoutMs ?? DEFAULT_TIMEOUT_MS)
+	}, timeoutMs)
 	try {
-		return await cb()
+		return await cb(abortController)
 	} finally {
 		clearTimeout(timeoutId)
 	}

package/src/dispatch/types.ts

@@ -2,6 +2,7 @@ import { Logger } from '@contember/logger'
 import { Actions } from '@contember/schema'
 import { EventRow } from '../model/types'
 import { VariablesMap } from '../model/VariablesManager'
+import { AnyEventPayload } from '../triggers/Payload'
 
 export { EventRow }
 
@@ -29,3 +30,29 @@ export type InvocationResult = {
 	code?: number
 	response?: string
 }
+
+
+export type WebhookEvent =
+	& AnyEventPayload
+	& {
+		meta: {
+			eventId: string
+			transactionId: string
+			createdAt: string
+			lastStateChange: string
+			numRetries: number
+			trigger: string
+			target: string
+		}
+	}
+
+export type WebhookRequestPayload = {
+	events: WebhookEvent[]
+}
+
+export type WebhookResponsePayload = {
+	failures: {
+		eventId: string
+		error?: string
+	}
+}

package/src/graphql/http/ActionsApiMiddlewareFactory.ts

@@ -2,18 +2,22 @@ import { HttpController } from '@contember/engine-http'
 import { ActionsGraphQLHandler } from './ActionsGraphQLHandlerFactory'
 import { ActionsContext } from '../resolvers/ActionsContext'
 import { ActionsContextResolver } from './ActionsContextResolver'
+import { AuthorizationScope, Authorizator } from '@contember/authorization'
+import { Identity } from '../../authorization'
+import { ForbiddenError } from '@contember/graphql-utils'
 
 export class ActionsApiMiddlewareFactory {
 	constructor(
 		private readonly actionsContextResolver: ActionsContextResolver,
 		private readonly actionsGraphQLHandler: ActionsGraphQLHandler,
+		private readonly authorizator: Authorizator<Identity>,
 	) {
 	}
 
 	create(): HttpController {
 		return async ctx => {
 			const { timer, logger, koa } = ctx
-			const { projectContainer } = await this.actionsContextResolver.resolve(ctx)
+			const { projectContainer, identity } = await this.actionsContextResolver.resolve(ctx)
 
 			const systemDatabase = projectContainer.systemDatabaseContextFactory.create()
 
@@ -22,6 +26,11 @@ export class ActionsApiMiddlewareFactory {
 				db: systemDatabase,
 				logger,
 				contentSchemaResolver: projectContainer.contentSchemaResolver,
+				requireAccess: async (action, message) => {
+					if (!(await this.authorizator.isAllowed(identity, new AuthorizationScope.Global(), action))) {
+						throw new ForbiddenError(message || 'Forbidden')
+					}
+				},
 			}
 			const handler = this.actionsGraphQLHandler
 

package/src/graphql/http/ActionsContextResolver.ts

@@ -1,5 +1,11 @@
-import { ApplicationContext, HttpErrorResponse, ProjectContextResolver } from '@contember/engine-http'
-import { ProjectRole } from '@contember/schema'
+import { ApplicationContext, HttpErrorResponse, ProjectConfig, ProjectContainer, ProjectContextResolver } from '@contember/engine-http'
+import { Identity } from '../../authorization'
+
+export interface ActionsContext {
+	projectContainer: ProjectContainer
+	project: ProjectConfig
+	identity: Identity
+}
 
 export class ActionsContextResolver {
 	constructor(
@@ -8,7 +14,7 @@ export class ActionsContextResolver {
 	) {
 	}
 
-	async resolve(ctx: ApplicationContext) {
+	async resolve(ctx: ApplicationContext): Promise<ActionsContext> {
 		const { timer, projectGroup: { tenantContainer }, logger, authResult } = ctx
 		const projectContext = await this.projectContextResolver.resolve(ctx)
 		const { project } = projectContext
@@ -27,12 +33,15 @@ export class ActionsContextResolver {
 		)
 		logger.debug('Memberships fetched', { memberships })
 
-		const isProjectAdmin = memberships.some(it => it.role === ProjectRole.ADMIN)
-		if (!isProjectAdmin) {
+		if (memberships.length === 0) {
 			throw this.debug
 				? new HttpErrorResponse(404, `You are not allowed to access project ${project.slug}`)
 				: new HttpErrorResponse(404, `Project ${project.slug} NOT found`)
 		}
-		return projectContext
+		const roles = memberships.map(it => it.role)
+		return {
+			...projectContext,
+			identity: { id: authResult.identityId, roles },
+		}
 	}
 }

package/src/graphql/resolvers/ActionsContext.ts

@@ -1,9 +1,11 @@
 import { DatabaseContext } from '@contember/engine-system-api'
 import { ContentSchemaResolver } from '@contember/engine-http'
 import { Logger } from '@contember/logger'
+import { Authorizator } from '@contember/authorization'
 
 export interface ActionsContext {
 	logger: Logger
 	db: DatabaseContext
 	contentSchemaResolver: ContentSchemaResolver
+	requireAccess: (action: Authorizator.Action, message?: string) => Promise<void>
 }

package/src/graphql/resolvers/mutation/ProcessBatchMutationResolver.ts

@@ -1,6 +1,7 @@
 import { MutationResolvers } from '../../schema'
 import { ActionsContext } from '../ActionsContext'
 import { EventDispatcher } from '../../../dispatch/EventDispatcher'
+import { ActionsAuthorizationActions } from '../../../authorization'
 
 export class ProcessBatchMutationResolver implements MutationResolvers<ActionsContext> {
 	constructor(
@@ -8,6 +9,8 @@ export class ProcessBatchMutationResolver implements MutationResolvers<ActionsCo
 	) {
 	}
 	async processBatch(parent: unknown, args: unknown, ctx: ActionsContext) {
+		await ctx.requireAccess(ActionsAuthorizationActions.EVENTS_PROCESS)
+
 		await this.eventDispatcher.processBatch(ctx)
 		return {
 			ok: true,

package/src/graphql/resolvers/mutation/SetVariablesMutationResolver.ts

@@ -1,6 +1,7 @@
 import { MutationResolvers, MutationSetVariablesArgs } from '../../schema'
 import { ActionsContext } from '../ActionsContext'
 import { VariablesManager } from '../../../model/VariablesManager'
+import { ActionsAuthorizationActions } from '../../../authorization'
 
 export class SetVariablesMutationResolver implements MutationResolvers<ActionsContext> {
 	constructor(
@@ -10,6 +11,8 @@ export class SetVariablesMutationResolver implements MutationResolvers<ActionsCo
 
 
 	async setVariables(parent: unknown, { args }: MutationSetVariablesArgs, ctx: ActionsContext) {
+		await ctx.requireAccess(ActionsAuthorizationActions.VARIABLES_SET)
+
 		await this.variablesManager.setVariables(ctx.db, args)
 
 		return {

package/src/graphql/resolvers/query/EventsQueryResolver.ts

@@ -12,17 +12,24 @@ import { DatabaseContext, StagesQuery } from '@contember/engine-system-api'
 import { Client, DatabaseQuery } from '@contember/database'
 import { EventsInProcessingQuery } from '../../../model/EventsInProcessingQuery'
 import { FailedEventsQuery } from '../../../model/FailedEventsQuery'
+import { ActionsAuthorizationActions } from '../../../authorization'
 
 export class EventsQueryResolver implements QueryResolvers<ActionsContext> {
 	async eventsInProcessing(parent: unknown, { args }: QueryEventsInProcessingArgs, ctx: ActionsContext) {
+		await ctx.requireAccess(ActionsAuthorizationActions.EVENTS_VIEW)
+
 		return await this.fetchEvents(ctx.db, new EventsInProcessingQuery(args ?? {}))
 	}
 
 	async eventsToProcess(parent: unknown, { args }: QueryEventsToProcessArgs, ctx: ActionsContext) {
+		await ctx.requireAccess(ActionsAuthorizationActions.EVENTS_VIEW)
+
 		return await this.fetchEvents(ctx.db, new EventsToProcessQuery(args ?? {}))
 	}
 
 	async failedEvents(parent: unknown, { args }: QueryFailedEventsArgs, ctx: ActionsContext) {
+		await ctx.requireAccess(ActionsAuthorizationActions.EVENTS_VIEW)
+
 		return await this.fetchEvents(ctx.db, new FailedEventsQuery(args ?? {}))
 	}
 

package/src/graphql/resolvers/query/VariablesQueryResolver.ts

@@ -1,6 +1,7 @@
 import { QueryResolvers } from '../../schema'
 import { ActionsContext } from '../ActionsContext'
 import { VariablesManager } from '../../../model/VariablesManager'
+import { ActionsAuthorizationActions } from '../../../authorization'
 
 export class VariablesQueryResolver implements QueryResolvers<ActionsContext> {
 
@@ -10,6 +11,8 @@ export class VariablesQueryResolver implements QueryResolvers<ActionsContext> {
 	}
 
 	async variables(parent: unknown, args: unknown, ctx: ActionsContext) {
+		await ctx.requireAccess(ActionsAuthorizationActions.VARIABLES_VIEW)
+
 		return Object.entries(await this.variablesManager.fetchVariables(ctx.db)).map(([name, value]) => ({
 			name,
 			value,

package/src/index.ts

@@ -18,6 +18,9 @@ import { DispatchWorkerSupervisorFactory } from './dispatch/DispatchWorkerSuperv
 import { ProjectDispatcherFactory } from './dispatch/ProjectDispatcher'
 import { VariablesQueryResolver } from './graphql/resolvers/query/VariablesQueryResolver'
 import { VariablesManager } from './model/VariablesManager'
+import { AccessEvaluator, Authorizator } from '@contember/authorization'
+import { ActionsPermissionsFactory } from './authorization'
+import { WebhookFetcherNative } from './dispatch/WebhookFetcher'
 
 export {
 	TriggerListenersFactory,
@@ -49,7 +52,7 @@ export default class ActionsPlugin implements Plugin {
 				})
 				.addService('actions_eventDispatcher', ({ actions_variableManager }) => {
 					const eventsRepository = new EventsRepository()
-					const webhookTargetHandler = new WebhookTargetHandler()
+					const webhookTargetHandler = new WebhookTargetHandler(new WebhookFetcherNative())
 					const targetHandlerResolver = new TargetHandlerResolver(webhookTargetHandler)
 					return new EventDispatcher(eventsRepository, actions_variableManager, targetHandlerResolver)
 				})
@@ -57,7 +60,10 @@ export default class ActionsPlugin implements Plugin {
 					const projectDispatcherFactory = new ProjectDispatcherFactory(actions_eventDispatcher)
 					return new DispatchWorkerSupervisorFactory(projectDispatcherFactory)
 				})
-				.setupService('application', (it, { projectContextResolver, debugMode, actions_eventDispatcher, actions_dispatchWorkerSupervisorFactory, actions_variableManager }) => {
+				.addService('actions_authorizator', () => {
+					return new Authorizator.Default(new AccessEvaluator.PermissionEvaluator(new ActionsPermissionsFactory().create()))
+				})
+				.setupService('application', (it, { projectContextResolver, debugMode, actions_eventDispatcher, actions_dispatchWorkerSupervisorFactory, actions_variableManager, actions_authorizator }) => {
 					const handlerFactory = new ActionsGraphQLHandlerFactory()
 					const eventsQueryResolver = new EventsQueryResolver()
 					const processBatchMutationResolver = new ProcessBatchMutationResolver(actions_eventDispatcher)
@@ -71,7 +77,7 @@ export default class ActionsPlugin implements Plugin {
 					)
 
 					const actionsContextResolver = new ActionsContextResolver(debugMode, projectContextResolver)
-					const actionsMiddlewareFactory = new ActionsApiMiddlewareFactory(actionsContextResolver, handlerFactory.create(resolversFactory))
+					const actionsMiddlewareFactory = new ActionsApiMiddlewareFactory(actionsContextResolver, handlerFactory.create(resolversFactory), actions_authorizator)
 					const actionsWebsocketMiddlewareFactory = new ActionsWebsocketControllerFactory(debugMode, actionsContextResolver, actions_dispatchWorkerSupervisorFactory)
 					it.addRoute('actions', '/actions/:projectSlug', actionsMiddlewareFactory.create())
 					it.addWebsocketRoute('actions', '/actions/_worker', actionsWebsocketMiddlewareFactory.create())

package/src/model/types.ts

@@ -1,3 +1,5 @@
+import { AnyEventPayload } from '../triggers/Payload'
+
 export type EventRow = {
 	id: string
 	transaction_id: string
@@ -7,9 +9,11 @@ export type EventRow = {
 	num_retries: number
 	state: 'created' | 'retrying' | 'processing' | 'succeed' | 'failed' | 'stopped'
 	last_state_change: Date
-	stage_id: number
-	schema_id: string
+	stage_id: string
+	schema_id: number
 	target: string
-	payload: any
+	priority: number
+	trigger: string
+	payload: AnyEventPayload
 	log: any[]
 }

package/src/triggers/Payload.ts

@@ -72,11 +72,3 @@ export type BasicEventPayload =
 export type AnyEventPayload =
 	| BasicEventPayload
 	| WatchEventPayload
-
-export interface TriggerPayload {
-	// identityId: string
-	// apiKeyId: string
-	transactionId: string
-	createdAt: string
-	event: AnyEventPayload
-}

package/src/triggers/TriggerPayloadBuilder.ts

@@ -57,7 +57,7 @@ export class TriggerPayloadBuilder {
 				trigger: events[0].listener.trigger.name,
 				entity: events[0].entity.name,
 				id: eventsByPrimary.primary,
-				selection: selections[eventsByPrimary.primary],
+				selection: events[0].selection ?? selections[eventsByPrimary.primary],
 				events: eventsByPrimary.events.map(it => this.buildBaseEventPayloads(it)),
 			})
 		}