@contember/engine-content-api 1.0.0-rc.9 → 1.1.0-alpha.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/engine-content-api",
-  "version": "1.0.0-rc.9",
+  "version": "1.1.0-alpha.2",
   "license": "Apache-2.0",
   "main": "dist/src/index.js",
   "typings": "dist/src/index.d.ts",
@@ -10,19 +10,19 @@
     "test": "uvu dist/tests/cases/ \\.js$"
   },
   "dependencies": {
-    "@contember/database": "^1.0.0-rc.9",
-    "@contember/dic": "^1.0.0-rc.9",
-    "@contember/engine-common": "^1.0.0-rc.9",
-    "@contember/graphql-utils": "^1.0.0-rc.9",
-    "@contember/schema": "^1.0.0-rc.9",
-    "@contember/schema-utils": "^1.0.0-rc.9",
+    "@contember/database": "^1.1.0-alpha.2",
+    "@contember/dic": "^1.1.0-alpha.2",
+    "@contember/engine-common": "^1.1.0-alpha.2",
+    "@contember/graphql-utils": "^1.1.0-alpha.2",
+    "@contember/schema": "^1.1.0-alpha.2",
+    "@contember/schema-utils": "^1.1.0-alpha.2",
     "@graphql-tools/schema": "^7.1.5",
     "graphql-tag": "^2.12.5"
   },
   "devDependencies": {
-    "@contember/database-tester": "^1.0.0-rc.9",
-    "@contember/engine-api-tester": "^1.0.0-rc.9",
-    "@contember/schema-definition": "^1.0.0-rc.9",
+    "@contember/database-tester": "^1.1.0-alpha.2",
+    "@contember/engine-api-tester": "^1.1.0-alpha.2",
+    "@contember/schema-definition": "^1.1.0-alpha.2",
     "@graphql-codegen/cli": "^1.15.2",
     "@graphql-codegen/typescript": "^1.15.2",
     "@graphql-codegen/typescript-operations": "^1.15.2",

package/src/acl/Authorizator.ts

@@ -1,8 +1,48 @@
 import { Acl } from '@contember/schema'
 
-export interface Authorizator {
-	isAllowed(operation: Acl.Operation, entity: string): boolean
-	isAllowed(operation: Acl.Operation.create | Acl.Operation.read | Acl.Operation.update, entity: string, field: string,): boolean
 
-	isCustomPrimaryAllowed(entity: string): boolean
+export type AuthorizationResult = 'yes' | 'no' | 'maybe'
+
+export class Authorizator {
+	constructor(private readonly permissions: Acl.Permissions) {
+	}
+
+	getEntityPermission(operation: Acl.Operation, entity: string): AuthorizationResult {
+		if (!this.permissions[entity]) {
+			return 'no'
+		}
+		const entityPermissions: Acl.EntityPermissions = this.permissions[entity]
+
+		if (operation === Acl.Operation.delete) {
+			return this.predicateToResult(entityPermissions.operations.delete)
+		}
+		const fieldPermissions = entityPermissions.operations[operation]
+		if (!fieldPermissions) {
+			return 'no'
+		}
+		return Object.values(fieldPermissions).filter(it => !!it).length > 0 ? 'yes' : 'no'
+	}
+
+	getFieldPermissions(operation: Acl.Operation.create | Acl.Operation.read | Acl.Operation.update, entity: string, field: string): AuthorizationResult {
+		const fieldPermissions = this.permissions[entity]?.operations[operation]?.[field]
+		if (!fieldPermissions) {
+			return 'no'
+		}
+		return this.predicateToResult(fieldPermissions)
+	}
+
+	private predicateToResult(predicate: Acl.Predicate | undefined): AuthorizationResult {
+		if (!predicate) {
+			return 'no'
+		}
+		if (predicate === true) {
+			return 'yes'
+		}
+		return 'maybe'
+	}
+
+
+	isCustomPrimaryAllowed(entity: string): boolean {
+		return this.permissions?.[entity]?.operations?.customPrimary || false
+	}
 }

package/src/acl/index.ts

@@ -3,6 +3,5 @@ export * from './PermissionFactory'
 export * from './PermissionsByIdentityFactory'
 export * from './PredicateFactory'
 export * from './PredicatesInjector'
-export * from './StaticAuthorizator'
 export * from './VariableInjector'
 export * from './VariableUtils'

package/src/introspection/IntrospectionSchemaFactory.ts

@@ -107,7 +107,7 @@ export class IntrospectionSchemaFactory {
 			},
 		})
 		return Object.values(getEntity(this.model, entityName).fields)
-			.filter(it => this.authorizator.isAllowed(Acl.Operation.read, entityName, it.name))
+			.filter(it => this.authorizator.getFieldPermissions(Acl.Operation.read, entityName, it.name) !== 'no')
 			.map((it): ContentSchema._Column | ContentSchema._Relation => ({
 				...additionalInfo[it.name],
 				name: it.name,
@@ -154,7 +154,7 @@ export class IntrospectionSchemaFactory {
 
 	public create(): ContentSchema._Schema {
 		const entities = Object.values(this.model.entities)
-			.filter(it => this.authorizator.isAllowed(Acl.Operation.read, it.name))
+			.filter(it => this.authorizator.getEntityPermission(Acl.Operation.read, it.name) !== 'no')
 			.map(entity => ({
 				name: entity.name,
 				customPrimaryAllowed: this.authorizator.isCustomPrimaryAllowed(entity.name),

package/src/schema/EntityTypeProvider.ts

@@ -53,14 +53,14 @@ export class EntityTypeProvider {
 	}
 
 	public getEntity(entityName: string): GraphQLObjectType {
-		if (!this.authorizator.isAllowed(Acl.Operation.read, entityName)) {
+		if (this.authorizator.getEntityPermission(Acl.Operation.read, entityName) === 'no') {
 			throw new ImplementationException()
 		}
 		return this.entities(entityName)
 	}
 
 	public getConnection(entityName: string): GraphQLObjectType {
-		if (!this.authorizator.isAllowed(Acl.Operation.read, entityName)) {
+		if (this.authorizator.getEntityPermission(Acl.Operation.read, entityName) === 'no') {
 			throw new ImplementationException()
 		}
 		return this.connections(entityName)
@@ -100,7 +100,7 @@ export class EntityTypeProvider {
 
 		const fields: { [field: string]: GraphQLFieldConfig<any, any> } = accessibleFields.reduce(
 			(result, fieldName) => {
-				const fieldTypeVisitor = new FieldTypeVisitor(this.columnTypeResolver, this)
+				const fieldTypeVisitor = new FieldTypeVisitor(this.columnTypeResolver, this, this.authorizator)
 				const type: GraphQLOutputType = acceptFieldVisitor(this.schema, entity, fieldName, fieldTypeVisitor)
 
 				const fieldArgsVisitor = new FieldArgsVisitor(this.whereTypeProvider, this.orderByTypeProvider)

package/src/schema/FieldAccessVisitor.ts

@@ -8,10 +8,10 @@ export class FieldAccessVisitor implements Model.ColumnVisitor<boolean>, Model.R
 	) {}
 
 	visitColumn(entity: Model.Entity, column: Model.AnyColumn) {
-		return this.authorizator.isAllowed(this.operation, entity.name, column.name)
+		return this.authorizator.getFieldPermissions(this.operation, entity.name, column.name) !== 'no'
 	}
 
 	visitRelation({}, {}, targetEntity: Model.Entity) {
-		return this.authorizator.isAllowed(this.operation, targetEntity.name)
+		return this.authorizator.getEntityPermission(this.operation, targetEntity.name) !== 'no'
 	}
 }

package/src/schema/MutationProvider.ts

@@ -69,7 +69,7 @@ export class MutationProvider {
 		if (entity.view) {
 			return undefined
 		}
-		if (!this.authorizator.isAllowed(Acl.Operation.delete, entityName)) {
+		if (this.authorizator.getEntityPermission(Acl.Operation.delete, entityName) === 'no') {
 			return undefined
 		}
 		const uniqueWhere = this.whereTypeProvider.getEntityUniqueWhereType(entityName)
@@ -180,7 +180,7 @@ export class MutationProvider {
 			errorMessage: { type: GraphQLString },
 			errors: { type: this.resultSchemaTypeProvider.errorListResultType },
 		}
-		if (this.authorizator.isAllowed(Acl.Operation.read, entityName)) {
+		if (this.authorizator.getEntityPermission(Acl.Operation.read, entityName) !== 'no') {
 			const nodeType = this.entityTypeProvider.getEntity(entityName)
 			fields.node = { type: nodeType, resolve: aliasAwareResolver }
 		}

package/src/schema/QueryProvider.ts

@@ -19,7 +19,7 @@ export class QueryProvider {
 	) {}
 
 	public getQueries(entity: Model.Entity): { [fieldName: string]: GraphQLFieldConfig<any, Context, any> } {
-		if (!this.authorizator.isAllowed(Acl.Operation.read, entity.name)) {
+		if (this.authorizator.getEntityPermission(Acl.Operation.read, entity.name) === 'no') {
 			return {}
 		}
 		return {

package/src/schema/WhereTypeProvider.ts

@@ -22,14 +22,14 @@ export class WhereTypeProvider {
 	) {}
 
 	public getEntityWhereType(entityName: string): GraphQLInputObjectType {
-		if (!this.authorizator.isAllowed(Acl.Operation.read, entityName)) {
+		if (this.authorizator.getEntityPermission(Acl.Operation.read, entityName) === 'no') {
 			throw new ImplementationException()
 		}
 		return this.whereSingleton(entityName)
 	}
 
 	public getEntityUniqueWhereType(entityName: string): undefined | GraphQLInputObjectType {
-		if (!this.authorizator.isAllowed(Acl.Operation.read, entityName)) {
+		if (this.authorizator.getEntityPermission(Acl.Operation.read, entityName) === 'no') {
 			return undefined
 		}
 		return this.uniqueWhereSingleton(entityName)

package/src/schema/entities/FieldTypeVisitor.ts

@@ -1,20 +1,21 @@
 import { GraphQLList, GraphQLNonNull, GraphQLOutputType } from 'graphql'
-import { Model } from '@contember/schema'
+import { Acl, Model } from '@contember/schema'
 import { ColumnTypeResolver } from '../ColumnTypeResolver'
 import { EntityTypeProvider } from '../EntityTypeProvider'
+import { Authorizator } from '../../acl'
 
 export class FieldTypeVisitor implements Model.ColumnVisitor<GraphQLOutputType>, Model.RelationByGenericTypeVisitor<GraphQLOutputType> {
-	private columnTypeResolver: ColumnTypeResolver
-	private entityTypeProvider: EntityTypeProvider
-
-	constructor(columnTypeResolver: ColumnTypeResolver, entityTypeProvider: EntityTypeProvider) {
-		this.columnTypeResolver = columnTypeResolver
-		this.entityTypeProvider = entityTypeProvider
+	constructor(
+		private readonly columnTypeResolver: ColumnTypeResolver,
+		private readonly entityTypeProvider: EntityTypeProvider,
+		private readonly authorizator: Authorizator,
+	) {
 	}
 
 	public visitColumn(entity: Model.Entity, column: Model.AnyColumn): GraphQLOutputType {
 		const basicType = this.columnTypeResolver.getType(column)
-		return column.nullable ? basicType : new GraphQLNonNull(basicType)
+		const permissions = this.authorizator.getFieldPermissions(Acl.Operation.read, entity.name, column.name)
+		return column.nullable || permissions === 'maybe' ? basicType : new GraphQLNonNull(basicType)
 	}
 
 	public visitHasMany(entity: Model.Entity, relation: Model.Relation): GraphQLOutputType {

package/src/schema/mutations/CreateEntityInputFieldVisitor.ts

@@ -19,7 +19,7 @@ export class CreateEntityInputFieldVisitor implements
 		if (entity.primary === column.name && !this.authorizator.isCustomPrimaryAllowed(entity.name)) {
 			return undefined
 		}
-		if (!this.authorizator.isAllowed(Acl.Operation.create, entity.name, column.name)) {
+		if (this.authorizator.getFieldPermissions(Acl.Operation.create, entity.name, column.name) === 'no') {
 			return undefined
 		}
 		const type = this.columnTypeResolver.getType(column)

package/src/schema/mutations/CreateEntityRelationAllowedOperationsVisitor.ts

@@ -65,9 +65,9 @@ export class CreateEntityRelationAllowedOperationsVisitor implements
 	): Input.CreateRelationOperation[] {
 		const result: Input.CreateRelationOperation[] = []
 
-		const canReadTargetEntity = this.authorizator.isAllowed(Acl.Operation.read, targetEntity.name)
-		const canCreateTargetEntity = this.authorizator.isAllowed(Acl.Operation.create, targetEntity.name)
-		const canCreateOwning = this.authorizator.isAllowed(Acl.Operation.create, owningEntity.name, owningRelation.name)
+		const canReadTargetEntity = this.authorizator.getEntityPermission(Acl.Operation.read, targetEntity.name) !== 'no'
+		const canCreateTargetEntity = this.authorizator.getEntityPermission(Acl.Operation.create, targetEntity.name) !== 'no'
+		const canCreateOwning = this.authorizator.getFieldPermissions(Acl.Operation.create, owningEntity.name, owningRelation.name) !== 'no'
 
 		if (canReadTargetEntity && canCreateOwning) {
 			result.push(Input.CreateRelationOperation.connect)

package/src/schema/mutations/EntityInputProvider.ts

@@ -51,7 +51,7 @@ export class EntityInputProvider<Operation extends EntityInputType> {
 					throw new ImplementationException(`EntityInputProvider: Invalid operation ${this.operation}`)
 			}
 		})()
-		if (!this.authorizator.isAllowed(operation, entity.name)) {
+		if (this.authorizator.getEntityPermission(operation, entity.name) === 'no') {
 			return undefined
 		}
 

package/src/schema/mutations/UpdateEntityInputFieldVisitor.ts

@@ -18,7 +18,7 @@ export class UpdateEntityInputFieldVisitor implements
 		if (entity.primary === column.name) {
 			return undefined
 		}
-		if (!this.authorizator.isAllowed(Acl.Operation.update, entity.name, column.name)) {
+		if (this.authorizator.getFieldPermissions(Acl.Operation.update, entity.name, column.name) === 'no') {
 			return undefined
 		}
 		const type = this.columnTypeResolver.getType(column)

package/src/schema/mutations/UpdateEntityRelationAllowedOperationsVisitor.ts

@@ -76,15 +76,11 @@ export class UpdateEntityRelationAllowedOperationsVisitor implements
 	): Input.UpdateRelationOperation[] {
 		const result: Input.UpdateRelationOperation[] = []
 
-		const canReadTargetEntity = this.authorizator.isAllowed(Acl.Operation.read, targetEntity.name)
-		const canCreateTargetEntity = this.authorizator.isAllowed(Acl.Operation.create, targetEntity.name)
-		const canUpdateTargetEntity = this.authorizator.isAllowed(Acl.Operation.update, targetEntity.name)
-		const canDeleteTargetEntity = this.authorizator.isAllowed(Acl.Operation.delete, targetEntity.name)
-		const canUpdateOwningRelation = this.authorizator.isAllowed(
-			Acl.Operation.update,
-			owningEntity.name,
-			owningRelation.name,
-		)
+		const canReadTargetEntity = this.authorizator.getEntityPermission(Acl.Operation.read, targetEntity.name) !== 'no'
+		const canCreateTargetEntity = this.authorizator.getEntityPermission(Acl.Operation.create, targetEntity.name) !== 'no'
+		const canUpdateTargetEntity = this.authorizator.getEntityPermission(Acl.Operation.update, targetEntity.name) !== 'no'
+		const canDeleteTargetEntity = this.authorizator.getEntityPermission(Acl.Operation.delete, targetEntity.name) !== 'no'
+		const canUpdateOwningRelation = this.authorizator.getFieldPermissions(Acl.Operation.update, owningEntity.name, owningRelation.name) !== 'no'
 
 		if (canReadTargetEntity && canUpdateOwningRelation) {
 			result.push(Input.UpdateRelationOperation.connect)

package/src/schema/mutations/UpdateEntityRelationInputFieldVisitor.ts

@@ -174,7 +174,7 @@ export class UpdateEntityRelationInputFieldVisitor implements
 	}
 
 	private createWhereInput(targetEntity: Model.Entity): GraphQLInputFieldConfig | undefined {
-		if (!this.authorizator.isAllowed(Acl.Operation.read, targetEntity.name)) {
+		if (this.authorizator.getEntityPermission(Acl.Operation.read, targetEntity.name) === 'no') {
 			return undefined
 		}
 		const uniqueWhere = this.whereTypeBuilder.getEntityUniqueWhereType(targetEntity.name)

package/tests/cases/integration/graphQlSchema/graphQlSchemaBuilder.test.ts

@@ -3,7 +3,7 @@ import { Acl, Model } from '@contember/schema'
 import * as path from 'path'
 
 import { AllowAllPermissionFactory, SchemaBuilder, SchemaDefinition } from '@contember/schema-definition'
-import { GraphQlSchemaBuilderFactory, StaticAuthorizator } from '../../../../src'
+import { GraphQlSchemaBuilderFactory, Authorizator } from '../../../../src'
 import * as model from './model'
 import { promises as fs } from 'fs'
 import * as assert from 'uvu/assert'
@@ -23,7 +23,7 @@ const testSchema = async (test: Test) => {
 	const schema = schemaResult instanceof SchemaBuilder ? schemaResult.buildSchema() : schemaResult
 	const schemaWithAcl = { ...schema, acl: { roles: {}, variables: {} } }
 	const permissions = test.permissions(schemaWithAcl)
-	const authorizator = new StaticAuthorizator(permissions)
+	const authorizator = new Authorizator(permissions)
 	const graphQlSchemaBuilder = schemaFactory.create(schemaWithAcl, authorizator)
 	const graphQlSchema = graphQlSchemaBuilder.build()
 
@@ -110,6 +110,34 @@ graphqlSchemaBuilderTest('restricted access to fields by permissions', async ()
 		graphQlSchemaFile: 'schema-acl.gql',
 	})
 })
+
+
+graphqlSchemaBuilderTest('conditionally restricted read', async () => {
+	await testSchema({
+		schema: builder =>
+			builder.entity('Test', e =>
+				e
+					.column('a', c => c.type(Model.ColumnType.String).notNull()),
+			),
+		permissions: () => ({
+			Test: {
+				predicates: {
+					testPredicate: {
+						a: { eq: 'Foo' },
+					},
+				},
+				operations: {
+					read: {
+						id: true,
+						a: 'testPredicate',
+					},
+				},
+			},
+		}),
+		graphQlSchemaFile: 'schema-acl-predicate.gql',
+	})
+})
+
 const oneHasManySchema = (builder: SchemaBuilder) =>
 	builder.entity('Root', e =>
 		e

package/tests/cases/integration/graphQlSchema/schema-acl-predicate.gql

@@ -0,0 +1,110 @@
+type Query {
+  getTest(by: TestUniqueWhere!, filter: TestWhere): Test
+  listTest(filter: TestWhere, orderBy: [TestOrderBy!], offset: Int, limit: Int): [Test!]!
+  paginateTest(filter: TestWhere, orderBy: [TestOrderBy!], skip: Int, first: Int): TestConnection!
+  transaction: QueryTransaction
+  _info: Info
+}
+
+type Test {
+  _meta: TestMeta
+  id: UUID!
+  a: String
+}
+
+type TestMeta {
+  id: FieldMeta
+  a: FieldMeta
+}
+
+type FieldMeta {
+  readable: Boolean
+  updatable: Boolean
+}
+
+scalar UUID
+
+input TestUniqueWhere {
+  id: UUID
+}
+
+input TestWhere {
+  id: UUIDCondition
+  a: StringCondition
+  and: [TestWhere]
+  or: [TestWhere]
+  not: TestWhere
+}
+
+input UUIDCondition {
+  and: [UUIDCondition!]
+  or: [UUIDCondition!]
+  not: UUIDCondition
+  null: Boolean
+  isNull: Boolean
+  eq: UUID
+  notEq: UUID
+  in: [UUID!]
+  notIn: [UUID!]
+  lt: UUID
+  lte: UUID
+  gt: UUID
+  gte: UUID
+}
+
+input StringCondition {
+  and: [StringCondition!]
+  or: [StringCondition!]
+  not: StringCondition
+  null: Boolean
+  isNull: Boolean
+  eq: String
+  notEq: String
+  in: [String!]
+  notIn: [String!]
+  lt: String
+  lte: String
+  gt: String
+  gte: String
+  contains: String
+  startsWith: String
+  endsWith: String
+  containsCI: String
+  startsWithCI: String
+  endsWithCI: String
+}
+
+input TestOrderBy {
+  _random: Boolean
+  _randomSeeded: Int
+  id: OrderDirection
+  a: OrderDirection
+}
+
+enum OrderDirection {
+  asc
+  desc
+}
+
+type TestConnection {
+  pageInfo: PageInfo!
+  edges: [TestEdge!]!
+}
+
+type PageInfo {
+  totalCount: Int!
+}
+
+type TestEdge {
+  node: Test!
+}
+
+type QueryTransaction {
+  getTest(by: TestUniqueWhere!, filter: TestWhere): Test
+  listTest(filter: TestWhere, orderBy: [TestOrderBy!], offset: Int, limit: Int): [Test!]!
+  paginateTest(filter: TestWhere, orderBy: [TestOrderBy!], skip: Int, first: Int): TestConnection!
+}
+
+type Info {
+  description: String
+}

package/tests/src/test.ts

@@ -1,5 +1,5 @@
 import { Acl, Model, Schema, Validation } from '@contember/schema'
-import { ExecutionContainerFactory, GraphQlSchemaBuilderFactory, StaticAuthorizator } from '../../src'
+import { ExecutionContainerFactory, GraphQlSchemaBuilderFactory, Authorizator } from '../../src'
 import { AllowAllPermissionFactory, emptySchema } from '@contember/schema-utils'
 import { executeGraphQlTest } from './testGraphql'
 import { Client } from '@contember/database'
@@ -89,7 +89,7 @@ export const failedTransaction = (executes: SqlQuery[]): SqlQuery[] => {
 
 export const execute = async (test: Test) => {
 	const permissions: Acl.Permissions = test.permissions || new AllowAllPermissionFactory().create(test.schema)
-	const authorizator = new StaticAuthorizator(permissions)
+	const authorizator = new Authorizator(permissions)
 	const builder = new GraphQlSchemaBuilderFactory().create(test.schema, authorizator)
 	const graphQLSchema = builder.build()
 

package/dist/src/acl/StaticAuthorizator.d.ts

@@ -1,9 +0,0 @@
-import { Acl } from '@contember/schema';
-import { Authorizator } from './Authorizator';
-export declare class StaticAuthorizator implements Authorizator {
-    private readonly permissions;
-    constructor(permissions: Acl.Permissions);
-    isAllowed(operation: Acl.Operation, entity: string, field?: string): boolean;
-    isCustomPrimaryAllowed(entity: string): boolean;
-}
-//# sourceMappingURL=StaticAuthorizator.d.ts.map

package/dist/src/acl/StaticAuthorizator.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"StaticAuthorizator.d.ts","sourceRoot":"","sources":["../../../src/acl/StaticAuthorizator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAE7C,qBAAa,kBAAmB,YAAW,YAAY;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAAX,WAAW,EAAE,GAAG,CAAC,WAAW;IAEzD,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO;IAmB5E,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;CAG/C"}

package/dist/src/acl/StaticAuthorizator.js

@@ -1,32 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.StaticAuthorizator = void 0;
-const schema_1 = require("@contember/schema");
-class StaticAuthorizator {
-    constructor(permissions) {
-        this.permissions = permissions;
-    }
-    isAllowed(operation, entity, field) {
-        if (!this.permissions[entity]) {
-            return false;
-        }
-        const entityPermissions = this.permissions[entity];
-        if (operation === schema_1.Acl.Operation.delete) {
-            return !!entityPermissions.operations.delete;
-        }
-        const fieldPermissions = entityPermissions.operations[operation];
-        if (!fieldPermissions) {
-            return false;
-        }
-        if (field) {
-            return !!fieldPermissions[field];
-        }
-        return Object.values(fieldPermissions).filter(it => !!it).length > 0;
-    }
-    isCustomPrimaryAllowed(entity) {
-        var _a, _b, _c;
-        return ((_c = (_b = (_a = this.permissions) === null || _a === void 0 ? void 0 : _a[entity]) === null || _b === void 0 ? void 0 : _b.operations) === null || _c === void 0 ? void 0 : _c.customPrimary) || false;
-    }
-}
-exports.StaticAuthorizator = StaticAuthorizator;
-//# sourceMappingURL=StaticAuthorizator.js.map

package/dist/src/acl/StaticAuthorizator.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"StaticAuthorizator.js","sourceRoot":"","sources":["../../../src/acl/StaticAuthorizator.ts"],"names":[],"mappings":";;;AAAA,8CAAuC;AAGvC,MAAa,kBAAkB;IAC9B,YAA6B,WAA4B;QAA5B,gBAAW,GAAX,WAAW,CAAiB;IAAG,CAAC;IAE7D,SAAS,CAAC,SAAwB,EAAE,MAAc,EAAE,KAAc;QACjE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE;YAC9B,OAAO,KAAK,CAAA;SACZ;QACD,MAAM,iBAAiB,GAA0B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QAEzE,IAAI,SAAS,KAAK,YAAG,CAAC,SAAS,CAAC,MAAM,EAAE;YACvC,OAAO,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,MAAM,CAAA;SAC5C;QACD,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;QAChE,IAAI,CAAC,gBAAgB,EAAE;YACtB,OAAO,KAAK,CAAA;SACZ;QACD,IAAI,KAAK,EAAE;YACV,OAAO,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAA;SAChC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;IACrE,CAAC;IAED,sBAAsB,CAAC,MAAc;;QACpC,OAAO,CAAA,MAAA,MAAA,MAAA,IAAI,CAAC,WAAW,0CAAG,MAAM,CAAC,0CAAE,UAAU,0CAAE,aAAa,KAAI,KAAK,CAAA;IACtE,CAAC;CACD;AAzBD,gDAyBC"}

package/src/acl/StaticAuthorizator.ts

@@ -1,29 +0,0 @@
-import { Acl } from '@contember/schema'
-import { Authorizator } from './Authorizator'
-
-export class StaticAuthorizator implements Authorizator {
-	constructor(private readonly permissions: Acl.Permissions) {}
-
-	isAllowed(operation: Acl.Operation, entity: string, field?: string): boolean {
-		if (!this.permissions[entity]) {
-			return false
-		}
-		const entityPermissions: Acl.EntityPermissions = this.permissions[entity]
-
-		if (operation === Acl.Operation.delete) {
-			return !!entityPermissions.operations.delete
-		}
-		const fieldPermissions = entityPermissions.operations[operation]
-		if (!fieldPermissions) {
-			return false
-		}
-		if (field) {
-			return !!fieldPermissions[field]
-		}
-		return Object.values(fieldPermissions).filter(it => !!it).length > 0
-	}
-
-	isCustomPrimaryAllowed(entity: string): boolean {
-		return this.permissions?.[entity]?.operations?.customPrimary || false
-	}
-}