@contember/engine-content-api 2.0.0-rc.1 → 2.0.0-rc.2

package/dist/development/src/acl/PermissionFactory.cjs

@@ -61,7 +61,7 @@ class PermissionFactory {
         const predicateReferences = Object.entries(fieldPermissions).filter(([key]) => key !== entity.primary).map(([key, value]) => value).filter((value) => value !== false).filter((value, index, array) => array.indexOf(value) === index);
         let idPermissions = fieldPermissions[entity.primary] || false;
         for (let predicateReference of predicateReferences) {
-          const [predicateDefinition, predicate] = this.mergePredicates(
+          const { predicateDefinition, predicate } = this.mergePredicates(
             entityPredicates,
             idPermissions,
             entityPredicates,
@@ -100,36 +100,24 @@ class PermissionFactory {
       operations.customPrimary = true;
     }
     const noRoot = [];
-    const operationNames = [
+    for (let operation of [
       "create",
       "read",
       "update"
-    ];
-    for (let operation of operationNames) {
-      const leftNoRoot = left.operations.noRoot?.includes(operation) || false;
-      const rightNoRoot = right.operations.noRoot?.includes(operation) || false;
-      if (leftNoRoot && rightNoRoot) {
+    ]) {
+      const { predicates: opPredicates, permissions: fieldPermissions, noRoot: opNoRoot2 } = this.mergeOperationPermissions(left, right, operation);
+      if (opNoRoot2) {
         noRoot.push(operation);
       }
-      const leftFieldPermissions = leftNoRoot && !rightNoRoot ? {} : left.operations[operation] || {};
-      const rightFieldPermissions = rightNoRoot && !leftNoRoot ? {} : right.operations[operation] || {};
-      const [operationPredicates, fieldPermissions] = this.mergeFieldPermissions(
-        left.predicates,
-        leftFieldPermissions,
-        right.predicates,
-        rightFieldPermissions
-      );
-      predicates = { ...predicates, ...operationPredicates };
+      predicates = { ...predicates, ...opPredicates };
       if (Object.keys(fieldPermissions).length > 0) {
         operations[operation] = fieldPermissions;
       }
     }
-    const [predicateDefinition, predicate] = this.mergePredicates(
-      left.predicates,
-      left.operations.delete || false,
-      right.predicates,
-      right.operations.delete || false
-    );
+    const { predicateDefinition, predicate, noRoot: opNoRoot } = this.mergeDeletePermissions(left, right);
+    if (opNoRoot) {
+      noRoot.push("delete");
+    }
     if (predicate === true) {
       operations.delete = true;
     } else if (predicateDefinition !== void 0 && typeof predicate === "string") {
@@ -144,47 +132,94 @@ class PermissionFactory {
       operations
     };
   }
-  mergeFieldPermissions(leftPredicates, leftFieldPermissions, rightPredicates, rightFieldPermissions) {
-    const fields = {};
+  mergeOperationPermissions(left, right, operation) {
+    const { noRoot, leftPermissions, rightPermissions } = this.resolveNoRoot(left, right, operation);
+    return {
+      noRoot,
+      ...this.mergeFieldPermissions(
+        left.predicates,
+        leftPermissions,
+        right.predicates,
+        rightPermissions
+      )
+    };
+  }
+  mergeDeletePermissions(left, right) {
+    const { noRoot, leftPermissions, rightPermissions } = this.resolveNoRoot(left, right, "delete");
+    return {
+      noRoot,
+      ...this.mergePredicates(
+        left.predicates,
+        leftPermissions,
+        right.predicates,
+        rightPermissions
+      )
+    };
+  }
+  resolveNoRoot(left, right, operation) {
+    const leftRootForbidden = left.operations.noRoot?.includes(operation) || false;
+    const rightRootForbidden = right.operations.noRoot?.includes(operation) || false;
+    const leftPermissions = left.operations[operation];
+    const rightPermissions = right.operations[operation];
+    const rootForbidden = leftRootForbidden && rightRootForbidden || leftRootForbidden && !rightPermissions || rightRootForbidden && !leftPermissions;
+    const resolvedLeftPermissions = !rootForbidden && leftRootForbidden ? void 0 : leftPermissions;
+    const resolvedRightPermissions = !rootForbidden && rightRootForbidden ? void 0 : rightPermissions;
+    return {
+      noRoot: rootForbidden,
+      leftPermissions: resolvedLeftPermissions,
+      rightPermissions: resolvedRightPermissions
+    };
+  }
+  mergeFieldPermissions(leftPredicates, leftFieldPermissions = {}, rightPredicates, rightFieldPermissions = {}) {
+    const permissions = {};
     const predicates = {};
     for (let field in { ...leftFieldPermissions, ...rightFieldPermissions }) {
-      const [predicateDefinition, predicate] = this.mergePredicates(
+      const { predicateDefinition, predicate } = this.mergePredicates(
         leftPredicates,
         leftFieldPermissions[field] || false,
         rightPredicates,
         rightFieldPermissions[field] || false
       );
       if (predicate === true) {
-        fields[field] = true;
+        permissions[field] = true;
       } else if (predicateDefinition !== void 0 && typeof predicate === "string") {
-        fields[field] = predicate;
+        permissions[field] = predicate;
         predicates[predicate] = predicateDefinition;
       }
     }
-    return [predicates, fields];
+    return { predicates, permissions };
   }
-  mergePredicates(leftPredicates, leftReference, rightPredicates, rightReference) {
+  mergePredicates(leftPredicates, leftReference = false, rightPredicates, rightReference = false) {
     if (leftReference === true || rightReference === true) {
-      return [void 0, true];
+      return {
+        predicate: true,
+        predicateDefinition: void 0
+      };
     }
     if (leftReference !== false && rightReference !== false) {
       const leftPredicate = leftPredicates[leftReference];
       const rightPredicate = rightPredicates[rightReference];
       if (leftPredicate === rightPredicate) {
-        return [leftPredicate, leftReference];
+        return {
+          predicate: leftReference,
+          predicateDefinition: leftPredicate
+        };
       }
       let predicateName = "__merge__" + leftReference + "__" + rightReference;
       while (leftPredicates[predicateName]) {
         predicateName += "_";
       }
-      return [
-        {
+      return {
+        predicate: predicateName,
+        predicateDefinition: {
           or: [leftPredicate, rightPredicate]
-        },
-        predicateName
-      ];
+        }
+      };
     } else if (leftReference !== false) {
-      return [leftPredicates[leftReference], leftReference];
+      return {
+        predicate: leftReference,
+        predicateDefinition: leftPredicates[leftReference]
+      };
     } else if (rightReference !== false) {
       let predicateName = rightReference;
       if (rightPredicates !== leftPredicates) {
@@ -192,9 +227,15 @@ class PermissionFactory {
           predicateName += "_";
         }
       }
-      return [rightPredicates[rightReference], predicateName];
+      return {
+        predicate: predicateName,
+        predicateDefinition: rightPredicates[rightReference]
+      };
     } else {
-      return [void 0, false];
+      return {
+        predicate: false,
+        predicateDefinition: void 0
+      };
     }
   }
 }

package/dist/development/src/acl/PermissionFactory.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PermissionFactory.cjs","sources":["../../../../../packages/engine-content-api/src/acl/PermissionFactory.ts"],"sourcesContent":["import { Acl, Model, Schema, Writable } from '@contember/schema'\nimport { getEntity, PredicateDefinitionProcessor } from '@contember/schema-utils'\nimport { mapObject } from '../utils'\nimport { prefixVariable } from './VariableUtils'\n\nexport interface Identity {\n\tprojectRoles: readonly string[]\n}\n\nexport class PermissionFactory {\n\tpublic create(schema: Schema, roles: readonly string[], prefix?: string): Acl.Permissions {\n\t\tlet result: Acl.Permissions = {}\n\t\tfor (let role of roles) {\n\t\t\tconst roleDefinition = schema.acl.roles[role] || { entities: {} }\n\t\t\tlet rolePermissions: Acl.Permissions = this.prefixPredicatesWithRole(schema.model, roleDefinition.entities, prefix || role)\n\t\t\tif (roleDefinition.inherits) {\n\t\t\t\tconst inheritedPermissions = this.create(schema, roleDefinition.inherits, prefix || role)\n\t\t\t\trolePermissions = this.mergePermissions(inheritedPermissions, rolePermissions)\n\t\t\t}\n\t\t\tresult = this.mergePermissions(result, rolePermissions)\n\t\t}\n\t\tresult = this.makePrimaryPredicatesUnionOfAllFields(schema.model, result)\n\n\t\treturn result\n\t}\n\n\tprivate prefixPredicatesWithRole(model: Model.Schema, permissions: Acl.Permissions, role: string): Acl.Permissions {\n\t\treturn mapObject(permissions, ({ operations, predicates }, entityName) => ({\n\t\t\toperations,\n\t\t\tpredicates: mapObject(predicates, predicate => {\n\t\t\t\tconst predicateDefinitionProcessor = new PredicateDefinitionProcessor(model)\n\t\t\t\treturn predicateDefinitionProcessor.process(getEntity(model, entityName), predicate, {\n\t\t\t\t\thandleColumn: ({ value }) => {\n\t\t\t\t\t\tif (typeof value === 'string') {\n\t\t\t\t\t\t\treturn prefixVariable(role, value)\n\t\t\t\t\t\t}\n\t\t\t\t\t\treturn value\n\t\t\t\t\t},\n\t\t\t\t\thandleRelation: ({ value }) => {\n\t\t\t\t\t\tif (typeof value === 'string') {\n\t\t\t\t\t\t\treturn prefixVariable(role, value)\n\t\t\t\t\t\t}\n\t\t\t\t\t\treturn value\n\t\t\t\t\t},\n\t\t\t\t})\n\t\t\t}),\n\t\t}))\n\t}\n\n\tprivate makePrimaryPredicatesUnionOfAllFields(model: Model.Schema, permissions: Acl.Permissions): Acl.Permissions {\n\t\treturn mapObject(permissions, (permission, entityName): Acl.EntityPermissions => {\n\t\t\tconst entity = getEntity(model, entityName)\n\t\t\tconst entityPredicates: Writable<Acl.PredicateMap> = { ...permission.predicates }\n\t\t\tconst entityOperations: Writable<Acl.EntityOperations> = { ...permission.operations }\n\n\t\t\tconst operationNames = ['read', 'create', 'update'] as const\n\t\t\tfor (let operation of operationNames) {\n\t\t\t\tif (!entityOperations[operation]) {\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\t\t\t\tconst fieldPermissions: Writable<Acl.FieldPermissions> = { ...entityOperations[operation] }\n\t\t\t\tentityOperations[operation] = fieldPermissions\n\n\t\t\t\tif (Object.values(fieldPermissions).some(it => it === true)) {\n\t\t\t\t\tfieldPermissions[entity.primary] = true\n\t\t\t\t}\n\t\t\t\tif (fieldPermissions[entity.primary] === true) {\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\t\t\t\tconst predicateReferences: string[] = Object.entries(fieldPermissions)\n\t\t\t\t\t.filter(([key]) => key !== entity.primary)\n\t\t\t\t\t.map(([key, value]) => value)\n\t\t\t\t\t.filter(value => value !== false)\n\t\t\t\t\t.filter((value, index, array): value is string => array.indexOf(value) === index)\n\n\t\t\t\tlet idPermissions: Acl.Predicate = fieldPermissions[entity.primary] || false\n\n\t\t\t\tfor (let predicateReference of predicateReferences) {\n\t\t\t\t\tconst [predicateDefinition, predicate] = this.mergePredicates(\n\t\t\t\t\t\tentityPredicates,\n\t\t\t\t\t\tidPermissions,\n\t\t\t\t\t\tentityPredicates,\n\t\t\t\t\t\tpredicateReference,\n\t\t\t\t\t)\n\t\t\t\t\tif (typeof predicate !== 'string' || predicateDefinition === undefined) {\n\t\t\t\t\t\tthrow new Error('should not happen')\n\t\t\t\t\t}\n\t\t\t\t\tidPermissions = predicate\n\t\t\t\t\tentityPredicates[predicate] = predicateDefinition\n\t\t\t\t}\n\t\t\t\tfieldPermissions[entity.primary] = idPermissions\n\t\t\t\tentityPredicates[idPermissions as Acl.PredicateReference] = entityPredicates[idPermissions as Acl.PredicateReference]\n\t\t\t}\n\t\t\treturn {\n\t\t\t\toperations: entityOperations,\n\t\t\t\tpredicates: entityPredicates,\n\t\t\t}\n\t\t})\n\t}\n\n\tprivate mergePermissions(left: Acl.Permissions, right: Acl.Permissions): Acl.Permissions {\n\t\tconst result = { ...left }\n\t\tfor (let entityName in right) {\n\t\t\tif (result[entityName] !== undefined) {\n\t\t\t\tresult[entityName] = this.mergeEntityPermissions(result[entityName], right[entityName])\n\t\t\t} else {\n\t\t\t\tresult[entityName] = right[entityName]\n\t\t\t}\n\t\t}\n\t\treturn result\n\t}\n\n\tprivate mergeEntityPermissions(left: Acl.EntityPermissions, right: Acl.EntityPermissions): Acl.EntityPermissions {\n\t\tlet predicates: Writable<Acl.PredicateMap> = {}\n\t\tconst operations: Writable<Acl.EntityOperations> = {}\n\t\tif (left.operations.customPrimary || right.operations.customPrimary) {\n\t\t\toperations.customPrimary = true\n\t\t}\n\t\tconst noRoot: `${Acl.Operation}`[] = []\n\n\t\tconst operationNames: (keyof Pick<Acl.EntityOperations, 'create' | 'read' | 'update'>)[] = [\n\t\t\t'create',\n\t\t\t'read',\n\t\t\t'update',\n\t\t]\n\n\t\tfor (let operation of operationNames) {\n\t\t\tconst leftNoRoot = left.operations.noRoot?.includes(operation) || false\n\t\t\tconst rightNoRoot = right.operations.noRoot?.includes(operation) || false\n\t\t\tif (leftNoRoot && rightNoRoot) {\n\t\t\t\tnoRoot.push(operation)\n\t\t\t}\n\n\t\t\tconst leftFieldPermissions: Acl.FieldPermissions = leftNoRoot && !rightNoRoot ? {} : (left.operations[operation] || {})\n\t\t\tconst rightFieldPermissions: Acl.FieldPermissions = rightNoRoot && !leftNoRoot ? {} : (right.operations[operation] || {})\n\t\t\tconst [operationPredicates, fieldPermissions] = this.mergeFieldPermissions(\n\t\t\t\tleft.predicates,\n\t\t\t\tleftFieldPermissions,\n\t\t\t\tright.predicates,\n\t\t\t\trightFieldPermissions,\n\t\t\t)\n\t\t\tpredicates = { ...predicates, ...operationPredicates }\n\t\t\tif (Object.keys(fieldPermissions).length > 0) {\n\t\t\t\toperations[operation] = fieldPermissions\n\t\t\t}\n\t\t}\n\n\t\tconst [predicateDefinition, predicate] = this.mergePredicates(\n\t\t\tleft.predicates,\n\t\t\tleft.operations.delete || false,\n\t\t\tright.predicates,\n\t\t\tright.operations.delete || false,\n\t\t)\n\t\tif (predicate === true) {\n\t\t\toperations.delete = true\n\t\t} else if (predicateDefinition !== undefined && typeof predicate === 'string') {\n\t\t\tpredicates[predicate] = predicateDefinition\n\t\t\toperations.delete = predicate\n\t\t}\n\t\tif (noRoot.length > 0) {\n\t\t\toperations.noRoot = noRoot\n\t\t}\n\n\t\treturn {\n\t\t\tpredicates: predicates,\n\t\t\toperations: operations,\n\t\t}\n\t}\n\n\tprivate mergeFieldPermissions(\n\t\tleftPredicates: Acl.PredicateMap,\n\t\tleftFieldPermissions: Acl.FieldPermissions,\n\t\trightPredicates: Acl.PredicateMap,\n\t\trightFieldPermissions: Acl.FieldPermissions,\n\t): [Acl.PredicateMap, Acl.FieldPermissions] {\n\t\tconst fields: Writable<Acl.FieldPermissions> = {}\n\t\tconst predicates: Writable<Acl.PredicateMap> = {}\n\n\t\tfor (let field in { ...leftFieldPermissions, ...rightFieldPermissions }) {\n\t\t\tconst [predicateDefinition, predicate] = this.mergePredicates(\n\t\t\t\tleftPredicates,\n\t\t\t\tleftFieldPermissions[field] || false,\n\t\t\t\trightPredicates,\n\t\t\t\trightFieldPermissions[field] || false,\n\t\t\t)\n\t\t\tif (predicate === true) {\n\t\t\t\tfields[field] = true\n\t\t\t} else if (predicateDefinition !== undefined && typeof predicate === 'string') {\n\t\t\t\tfields[field] = predicate\n\t\t\t\tpredicates[predicate] = predicateDefinition\n\t\t\t}\n\t\t}\n\n\t\treturn [predicates, fields]\n\t}\n\n\tprivate mergePredicates(\n\t\tleftPredicates: Acl.PredicateMap,\n\t\tleftReference: Acl.Predicate,\n\t\trightPredicates: Acl.PredicateMap,\n\t\trightReference: Acl.Predicate,\n\t): [Acl.PredicateDefinition, Acl.PredicateReference] | [undefined, boolean] {\n\t\tif (leftReference === true || rightReference === true) {\n\t\t\treturn [undefined, true]\n\t\t}\n\n\t\tif (leftReference !== false && rightReference !== false) {\n\t\t\tconst leftPredicate: Acl.PredicateDefinition = leftPredicates[leftReference]\n\t\t\tconst rightPredicate: Acl.PredicateDefinition = rightPredicates[rightReference]\n\t\t\tif (leftPredicate === rightPredicate) {\n\t\t\t\treturn [leftPredicate, leftReference]\n\t\t\t}\n\n\t\t\tlet predicateName = '__merge__' + leftReference + '__' + rightReference\n\t\t\twhile (leftPredicates[predicateName]) {\n\t\t\t\tpredicateName += '_'\n\t\t\t}\n\t\t\treturn [\n\t\t\t\t{\n\t\t\t\t\tor: [leftPredicate, rightPredicate],\n\t\t\t\t} as Acl.PredicateDefinition,\n\t\t\t\tpredicateName,\n\t\t\t]\n\t\t} else if (leftReference !== false) {\n\t\t\treturn [leftPredicates[leftReference], leftReference]\n\t\t} else if (rightReference !== false) {\n\t\t\tlet predicateName = rightReference\n\t\t\tif (rightPredicates !== leftPredicates) {\n\t\t\t\twhile (leftPredicates[predicateName]) {\n\t\t\t\t\tpredicateName += '_'\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn [rightPredicates[rightReference], predicateName]\n\t\t} else {\n\t\t\treturn [undefined, false]\n\t\t}\n\t}\n}\n"],"names":["mapObject","PredicateDefinitionProcessor","getEntity","prefixVariable"],"mappings":";;;;;AASO,MAAM,kBAAkB;AAAA,EACvB,OAAO,QAAgB,OAA0B,QAAkC;AACzF,QAAI,SAA0B,CAAC;AAC/B,aAAS,QAAQ,OAAO;AACjB,YAAA,iBAAiB,OAAO,IAAI,MAAM,IAAI,KAAK,EAAE,UAAU,GAAG;AAC5D,UAAA,kBAAmC,KAAK,yBAAyB,OAAO,OAAO,eAAe,UAAU,UAAU,IAAI;AAC1H,UAAI,eAAe,UAAU;AAC5B,cAAM,uBAAuB,KAAK,OAAO,QAAQ,eAAe,UAAU,UAAU,IAAI;AACtE,0BAAA,KAAK,iBAAiB,sBAAsB,eAAe;AAAA,MAAA;AAErE,eAAA,KAAK,iBAAiB,QAAQ,eAAe;AAAA,IAAA;AAEvD,aAAS,KAAK,sCAAsC,OAAO,OAAO,MAAM;AAEjE,WAAA;AAAA,EAAA;AAAA,EAGA,yBAAyB,OAAqB,aAA8B,MAA+B;AAClH,WAAOA,OAAAA,UAAU,aAAa,CAAC,EAAE,YAAY,cAAc,gBAAgB;AAAA,MAC1E;AAAA,MACA,YAAYA,OAAU,UAAA,YAAY,CAAa,cAAA;AACxC,cAAA,+BAA+B,IAAIC,YAAA,6BAA6B,KAAK;AAC3E,eAAO,6BAA6B,QAAQC,YAAAA,UAAU,OAAO,UAAU,GAAG,WAAW;AAAA,UACpF,cAAc,CAAC,EAAE,YAAY;AACxB,gBAAA,OAAO,UAAU,UAAU;AACvB,qBAAAC,cAAA,eAAe,MAAM,KAAK;AAAA,YAAA;AAE3B,mBAAA;AAAA,UACR;AAAA,UACA,gBAAgB,CAAC,EAAE,YAAY;AAC1B,gBAAA,OAAO,UAAU,UAAU;AACvB,qBAAAA,cAAA,eAAe,MAAM,KAAK;AAAA,YAAA;AAE3B,mBAAA;AAAA,UAAA;AAAA,QACR,CACA;AAAA,MACD,CAAA;AAAA,IAAA,EACA;AAAA,EAAA;AAAA,EAGK,sCAAsC,OAAqB,aAA+C;AACjH,WAAOH,iBAAU,aAAa,CAAC,YAAY,eAAsC;AAC1E,YAAA,SAASE,YAAAA,UAAU,OAAO,UAAU;AAC1C,YAAM,mBAA+C,EAAE,GAAG,WAAW,WAAW;AAChF,YAAM,mBAAmD,EAAE,GAAG,WAAW,WAAW;AAEpF,YAAM,iBAAiB,CAAC,QAAQ,UAAU,QAAQ;AAClD,eAAS,aAAa,gBAAgB;AACjC,YAAA,CAAC,iBAAiB,SAAS,GAAG;AACjC;AAAA,QAAA;AAED,cAAM,mBAAmD,EAAE,GAAG,iBAAiB,SAAS,EAAE;AAC1F,yBAAiB,SAAS,IAAI;AAE1B,YAAA,OAAO,OAAO,gBAAgB,EAAE,KAAK,CAAM,OAAA,OAAO,IAAI,GAAG;AAC3C,2BAAA,OAAO,OAAO,IAAI;AAAA,QAAA;AAEpC,YAAI,iBAAiB,OAAO,OAAO,MAAM,MAAM;AAC9C;AAAA,QAAA;AAED,cAAM,sBAAgC,OAAO,QAAQ,gBAAgB,EACnE,OAAO,CAAC,CAAC,GAAG,MAAM,QAAQ,OAAO,OAAO,EACxC,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,KAAK,EAC3B,OAAO,CAAS,UAAA,UAAU,KAAK,EAC/B,OAAO,CAAC,OAAO,OAAO,UAA2B,MAAM,QAAQ,KAAK,MAAM,KAAK;AAEjF,YAAI,gBAA+B,iBAAiB,OAAO,OAAO,KAAK;AAEvE,iBAAS,sBAAsB,qBAAqB;AACnD,gBAAM,CAAC,qBAAqB,SAAS,IAAI,KAAK;AAAA,YAC7C;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACD;AACA,cAAI,OAAO,cAAc,YAAY,wBAAwB,QAAW;AACjE,kBAAA,IAAI,MAAM,mBAAmB;AAAA,UAAA;AAEpB,0BAAA;AAChB,2BAAiB,SAAS,IAAI;AAAA,QAAA;AAEd,yBAAA,OAAO,OAAO,IAAI;AAClB,yBAAA,aAAuC,IAAI,iBAAiB,aAAuC;AAAA,MAAA;AAE9G,aAAA;AAAA,QACN,YAAY;AAAA,QACZ,YAAY;AAAA,MACb;AAAA,IAAA,CACA;AAAA,EAAA;AAAA,EAGM,iBAAiB,MAAuB,OAAyC;AAClF,UAAA,SAAS,EAAE,GAAG,KAAK;AACzB,aAAS,cAAc,OAAO;AACzB,UAAA,OAAO,UAAU,MAAM,QAAW;AAC9B,eAAA,UAAU,IAAI,KAAK,uBAAuB,OAAO,UAAU,GAAG,MAAM,UAAU,CAAC;AAAA,MAAA,OAChF;AACC,eAAA,UAAU,IAAI,MAAM,UAAU;AAAA,MAAA;AAAA,IACtC;AAEM,WAAA;AAAA,EAAA;AAAA,EAGA,uBAAuB,MAA6B,OAAqD;AAChH,QAAI,aAAyC,CAAC;AAC9C,UAAM,aAA6C,CAAC;AACpD,QAAI,KAAK,WAAW,iBAAiB,MAAM,WAAW,eAAe;AACpE,iBAAW,gBAAgB;AAAA,IAAA;AAE5B,UAAM,SAA+B,CAAC;AAEtC,UAAM,iBAAqF;AAAA,MAC1F;AAAA,MACA;AAAA,MACA;AAAA,IACD;AAEA,aAAS,aAAa,gBAAgB;AACrC,YAAM,aAAa,KAAK,WAAW,QAAQ,SAAS,SAAS,KAAK;AAClE,YAAM,cAAc,MAAM,WAAW,QAAQ,SAAS,SAAS,KAAK;AACpE,UAAI,cAAc,aAAa;AAC9B,eAAO,KAAK,SAAS;AAAA,MAAA;AAGhB,YAAA,uBAA6C,cAAc,CAAC,cAAc,KAAM,KAAK,WAAW,SAAS,KAAK,CAAC;AAC/G,YAAA,wBAA8C,eAAe,CAAC,aAAa,KAAM,MAAM,WAAW,SAAS,KAAK,CAAC;AACvH,YAAM,CAAC,qBAAqB,gBAAgB,IAAI,KAAK;AAAA,QACpD,KAAK;AAAA,QACL;AAAA,QACA,MAAM;AAAA,QACN;AAAA,MACD;AACA,mBAAa,EAAE,GAAG,YAAY,GAAG,oBAAoB;AACrD,UAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,GAAG;AAC7C,mBAAW,SAAS,IAAI;AAAA,MAAA;AAAA,IACzB;AAGD,UAAM,CAAC,qBAAqB,SAAS,IAAI,KAAK;AAAA,MAC7C,KAAK;AAAA,MACL,KAAK,WAAW,UAAU;AAAA,MAC1B,MAAM;AAAA,MACN,MAAM,WAAW,UAAU;AAAA,IAC5B;AACA,QAAI,cAAc,MAAM;AACvB,iBAAW,SAAS;AAAA,IACV,WAAA,wBAAwB,UAAa,OAAO,cAAc,UAAU;AAC9E,iBAAW,SAAS,IAAI;AACxB,iBAAW,SAAS;AAAA,IAAA;AAEjB,QAAA,OAAO,SAAS,GAAG;AACtB,iBAAW,SAAS;AAAA,IAAA;AAGd,WAAA;AAAA,MACN;AAAA,MACA;AAAA,IACD;AAAA,EAAA;AAAA,EAGO,sBACP,gBACA,sBACA,iBACA,uBAC2C;AAC3C,UAAM,SAAyC,CAAC;AAChD,UAAM,aAAyC,CAAC;AAEhD,aAAS,SAAS,EAAE,GAAG,sBAAsB,GAAG,yBAAyB;AACxE,YAAM,CAAC,qBAAqB,SAAS,IAAI,KAAK;AAAA,QAC7C;AAAA,QACA,qBAAqB,KAAK,KAAK;AAAA,QAC/B;AAAA,QACA,sBAAsB,KAAK,KAAK;AAAA,MACjC;AACA,UAAI,cAAc,MAAM;AACvB,eAAO,KAAK,IAAI;AAAA,MACN,WAAA,wBAAwB,UAAa,OAAO,cAAc,UAAU;AAC9E,eAAO,KAAK,IAAI;AAChB,mBAAW,SAAS,IAAI;AAAA,MAAA;AAAA,IACzB;AAGM,WAAA,CAAC,YAAY,MAAM;AAAA,EAAA;AAAA,EAGnB,gBACP,gBACA,eACA,iBACA,gBAC2E;AACvE,QAAA,kBAAkB,QAAQ,mBAAmB,MAAM;AAC/C,aAAA,CAAC,QAAW,IAAI;AAAA,IAAA;AAGpB,QAAA,kBAAkB,SAAS,mBAAmB,OAAO;AAClD,YAAA,gBAAyC,eAAe,aAAa;AACrE,YAAA,iBAA0C,gBAAgB,cAAc;AAC9E,UAAI,kBAAkB,gBAAgB;AAC9B,eAAA,CAAC,eAAe,aAAa;AAAA,MAAA;AAGjC,UAAA,gBAAgB,cAAc,gBAAgB,OAAO;AAClD,aAAA,eAAe,aAAa,GAAG;AACpB,yBAAA;AAAA,MAAA;AAEX,aAAA;AAAA,QACN;AAAA,UACC,IAAI,CAAC,eAAe,cAAc;AAAA,QACnC;AAAA,QACA;AAAA,MACD;AAAA,IAAA,WACU,kBAAkB,OAAO;AACnC,aAAO,CAAC,eAAe,aAAa,GAAG,aAAa;AAAA,IAAA,WAC1C,mBAAmB,OAAO;AACpC,UAAI,gBAAgB;AACpB,UAAI,oBAAoB,gBAAgB;AAChC,eAAA,eAAe,aAAa,GAAG;AACpB,2BAAA;AAAA,QAAA;AAAA,MAClB;AAED,aAAO,CAAC,gBAAgB,cAAc,GAAG,aAAa;AAAA,IAAA,OAChD;AACC,aAAA,CAAC,QAAW,KAAK;AAAA,IAAA;AAAA,EACzB;AAEF;;"}
+{"version":3,"file":"PermissionFactory.cjs","sources":["../../../../../packages/engine-content-api/src/acl/PermissionFactory.ts"],"sourcesContent":["import { Acl, Model, Schema, Writable } from '@contember/schema'\nimport { getEntity, PredicateDefinitionProcessor } from '@contember/schema-utils'\nimport { mapObject } from '../utils'\nimport { prefixVariable } from './VariableUtils'\n\nexport interface Identity {\n\tprojectRoles: readonly string[]\n}\n\nexport class PermissionFactory {\n\tpublic create(schema: Schema, roles: readonly string[], prefix?: string): Acl.Permissions {\n\t\tlet result: Acl.Permissions = {}\n\t\tfor (let role of roles) {\n\t\t\tconst roleDefinition = schema.acl.roles[role] || { entities: {} }\n\t\t\tlet rolePermissions: Acl.Permissions = this.prefixPredicatesWithRole(schema.model, roleDefinition.entities, prefix || role)\n\t\t\tif (roleDefinition.inherits) {\n\t\t\t\tconst inheritedPermissions = this.create(schema, roleDefinition.inherits, prefix || role)\n\t\t\t\trolePermissions = this.mergePermissions(inheritedPermissions, rolePermissions)\n\t\t\t}\n\t\t\tresult = this.mergePermissions(result, rolePermissions)\n\t\t}\n\t\tresult = this.makePrimaryPredicatesUnionOfAllFields(schema.model, result)\n\n\t\treturn result\n\t}\n\n\tprivate prefixPredicatesWithRole(model: Model.Schema, permissions: Acl.Permissions, role: string): Acl.Permissions {\n\t\treturn mapObject(permissions, ({ operations, predicates }, entityName) => ({\n\t\t\toperations,\n\t\t\tpredicates: mapObject(predicates, predicate => {\n\t\t\t\tconst predicateDefinitionProcessor = new PredicateDefinitionProcessor(model)\n\t\t\t\treturn predicateDefinitionProcessor.process(getEntity(model, entityName), predicate, {\n\t\t\t\t\thandleColumn: ({ value }) => {\n\t\t\t\t\t\tif (typeof value === 'string') {\n\t\t\t\t\t\t\treturn prefixVariable(role, value)\n\t\t\t\t\t\t}\n\t\t\t\t\t\treturn value\n\t\t\t\t\t},\n\t\t\t\t\thandleRelation: ({ value }) => {\n\t\t\t\t\t\tif (typeof value === 'string') {\n\t\t\t\t\t\t\treturn prefixVariable(role, value)\n\t\t\t\t\t\t}\n\t\t\t\t\t\treturn value\n\t\t\t\t\t},\n\t\t\t\t})\n\t\t\t}),\n\t\t}))\n\t}\n\n\tprivate makePrimaryPredicatesUnionOfAllFields(model: Model.Schema, permissions: Acl.Permissions): Acl.Permissions {\n\t\treturn mapObject(permissions, (permission, entityName): Acl.EntityPermissions => {\n\t\t\tconst entity = getEntity(model, entityName)\n\t\t\tconst entityPredicates: Writable<Acl.PredicateMap> = { ...permission.predicates }\n\t\t\tconst entityOperations: Writable<Acl.EntityOperations> = { ...permission.operations }\n\n\t\t\tconst operationNames = ['read', 'create', 'update'] as const\n\t\t\tfor (let operation of operationNames) {\n\t\t\t\tif (!entityOperations[operation]) {\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\t\t\t\tconst fieldPermissions: Writable<Acl.FieldPermissions> = { ...entityOperations[operation] }\n\t\t\t\tentityOperations[operation] = fieldPermissions\n\n\t\t\t\tif (Object.values(fieldPermissions).some(it => it === true)) {\n\t\t\t\t\tfieldPermissions[entity.primary] = true\n\t\t\t\t}\n\t\t\t\tif (fieldPermissions[entity.primary] === true) {\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\t\t\t\tconst predicateReferences: string[] = Object.entries(fieldPermissions)\n\t\t\t\t\t.filter(([key]) => key !== entity.primary)\n\t\t\t\t\t.map(([key, value]) => value)\n\t\t\t\t\t.filter(value => value !== false)\n\t\t\t\t\t.filter((value, index, array): value is string => array.indexOf(value) === index)\n\n\t\t\t\tlet idPermissions: Acl.Predicate = fieldPermissions[entity.primary] || false\n\n\t\t\t\tfor (let predicateReference of predicateReferences) {\n\t\t\t\t\tconst { predicateDefinition, predicate } = this.mergePredicates(\n\t\t\t\t\t\tentityPredicates,\n\t\t\t\t\t\tidPermissions,\n\t\t\t\t\t\tentityPredicates,\n\t\t\t\t\t\tpredicateReference,\n\t\t\t\t\t)\n\t\t\t\t\tif (typeof predicate !== 'string' || predicateDefinition === undefined) {\n\t\t\t\t\t\tthrow new Error('should not happen')\n\t\t\t\t\t}\n\t\t\t\t\tidPermissions = predicate\n\t\t\t\t\tentityPredicates[predicate] = predicateDefinition\n\t\t\t\t}\n\t\t\t\tfieldPermissions[entity.primary] = idPermissions\n\t\t\t\tentityPredicates[idPermissions as Acl.PredicateReference] = entityPredicates[idPermissions as Acl.PredicateReference]\n\t\t\t}\n\t\t\treturn {\n\t\t\t\toperations: entityOperations,\n\t\t\t\tpredicates: entityPredicates,\n\t\t\t}\n\t\t})\n\t}\n\n\tprivate mergePermissions(left: Acl.Permissions, right: Acl.Permissions): Acl.Permissions {\n\t\tconst result = { ...left }\n\t\tfor (let entityName in right) {\n\t\t\tif (result[entityName] !== undefined) {\n\t\t\t\tresult[entityName] = this.mergeEntityPermissions(result[entityName], right[entityName])\n\t\t\t} else {\n\t\t\t\tresult[entityName] = right[entityName]\n\t\t\t}\n\t\t}\n\t\treturn result\n\t}\n\n\tprivate mergeEntityPermissions(left: Acl.EntityPermissions, right: Acl.EntityPermissions): Acl.EntityPermissions {\n\t\tlet predicates: Writable<Acl.PredicateMap> = {}\n\t\tconst operations: Writable<Acl.EntityOperations> = {}\n\t\tif (left.operations.customPrimary || right.operations.customPrimary) {\n\t\t\toperations.customPrimary = true\n\t\t}\n\t\tconst noRoot: `${Acl.Operation}`[] = []\n\n\t\tfor (let operation of [\n\t\t\t'create',\n\t\t\t'read',\n\t\t\t'update',\n\t\t] as const) {\n\n\t\t\tconst { predicates: opPredicates, permissions: fieldPermissions, noRoot: opNoRoot } = this.mergeOperationPermissions(left, right, operation)\n\n\t\t\tif (opNoRoot) {\n\t\t\t\tnoRoot.push(operation)\n\t\t\t}\n\n\t\t\tpredicates = { ...predicates, ...opPredicates }\n\t\t\tif (Object.keys(fieldPermissions).length > 0) {\n\t\t\t\toperations[operation] = fieldPermissions\n\t\t\t}\n\t\t}\n\n\t\tconst { predicateDefinition, predicate, noRoot: opNoRoot } = this.mergeDeletePermissions(left, right)\n\t\tif (opNoRoot) {\n\t\t\tnoRoot.push('delete')\n\t\t}\n\t\tif (predicate === true) {\n\t\t\toperations.delete = true\n\t\t} else if (predicateDefinition !== undefined && typeof predicate === 'string') {\n\t\t\tpredicates[predicate] = predicateDefinition\n\t\t\toperations.delete = predicate\n\t\t}\n\n\n\t\tif (noRoot.length > 0) {\n\t\t\toperations.noRoot = noRoot\n\t\t}\n\n\t\treturn {\n\t\t\tpredicates: predicates,\n\t\t\toperations: operations,\n\t\t}\n\t}\n\n\n\tprivate mergeOperationPermissions(left: Acl.EntityPermissions, right: Acl.EntityPermissions, operation: 'create' | 'read' | 'update'): {\n\t\tnoRoot: boolean\n\t\tpredicates: Acl.PredicateMap\n\t\tpermissions: Acl.FieldPermissions\n\t} {\n\t\tconst { noRoot, leftPermissions, rightPermissions } = this.resolveNoRoot(left, right, operation)\n\t\treturn {\n\t\t\tnoRoot,\n\t\t\t...this.mergeFieldPermissions(\n\t\t\t\tleft.predicates,\n\t\t\t\tleftPermissions,\n\t\t\t\tright.predicates,\n\t\t\t\trightPermissions,\n\t\t\t),\n\t\t}\n\t}\n\n\tprivate mergeDeletePermissions(left: Acl.EntityPermissions, right: Acl.EntityPermissions): {\n\t\tnoRoot: boolean\n\t\tpredicate: Acl.PredicateReference | boolean\n\t\tpredicateDefinition: Acl.PredicateDefinition | undefined\n\t} {\n\t\tconst { noRoot, leftPermissions, rightPermissions } = this.resolveNoRoot(left, right, 'delete')\n\n\t\treturn {\n\t\t\tnoRoot,\n\t\t\t...this.mergePredicates(\n\t\t\t\tleft.predicates,\n\t\t\t\tleftPermissions,\n\t\t\t\tright.predicates,\n\t\t\t\trightPermissions,\n\t\t\t),\n\t\t}\n\t}\n\n\tprivate resolveNoRoot<const Op extends`${Acl.Operation}`>(left: Acl.EntityPermissions, right: Acl.EntityPermissions, operation: Op): {\n\t\tnoRoot: boolean\n\t\tleftPermissions: Acl.EntityPermissions['operations'][Op] | undefined\n\t\trightPermissions: Acl.EntityPermissions['operations'][Op] | undefined\n\t} {\n\t\tconst leftRootForbidden = left.operations.noRoot?.includes(operation) || false\n\t\tconst rightRootForbidden = right.operations.noRoot?.includes(operation) || false\n\t\tconst leftPermissions = left.operations[operation]\n\t\tconst rightPermissions = right.operations[operation]\n\n\t\tconst rootForbidden = (leftRootForbidden && rightRootForbidden)\n\t\t\t|| (leftRootForbidden && !rightPermissions)\n\t\t\t|| (rightRootForbidden && !leftPermissions)\n\n\t\tconst resolvedLeftPermissions = !rootForbidden && leftRootForbidden ? undefined : leftPermissions\n\t\tconst resolvedRightPermissions = !rootForbidden && rightRootForbidden ? undefined : rightPermissions\n\n\t\treturn {\n\t\t\tnoRoot: rootForbidden,\n\t\t\tleftPermissions: resolvedLeftPermissions,\n\t\t\trightPermissions: resolvedRightPermissions,\n\t\t}\n\t}\n\n\tprivate mergeFieldPermissions(\n\t\tleftPredicates: Acl.PredicateMap,\n\t\tleftFieldPermissions: Acl.FieldPermissions | undefined = {},\n\t\trightPredicates: Acl.PredicateMap,\n\t\trightFieldPermissions: Acl.FieldPermissions | undefined = {},\n\t): {predicates: Acl.PredicateMap; permissions: Acl.FieldPermissions} {\n\t\tconst permissions: Writable<Acl.FieldPermissions> = {}\n\t\tconst predicates: Writable<Acl.PredicateMap> = {}\n\n\t\tfor (let field in { ...leftFieldPermissions, ...rightFieldPermissions }) {\n\t\t\tconst { predicateDefinition, predicate } = this.mergePredicates(\n\t\t\t\tleftPredicates,\n\t\t\t\tleftFieldPermissions[field] || false,\n\t\t\t\trightPredicates,\n\t\t\t\trightFieldPermissions[field] || false,\n\t\t\t)\n\t\t\tif (predicate === true) {\n\t\t\t\tpermissions[field] = true\n\t\t\t} else if (predicateDefinition !== undefined && typeof predicate === 'string') {\n\t\t\t\tpermissions[field] = predicate\n\t\t\t\tpredicates[predicate] = predicateDefinition\n\t\t\t}\n\t\t}\n\n\t\treturn { predicates, permissions }\n\t}\n\n\tprivate mergePredicates(\n\t\tleftPredicates: Acl.PredicateMap,\n\t\tleftReference: Acl.Predicate | undefined = false,\n\t\trightPredicates: Acl.PredicateMap,\n\t\trightReference: Acl.Predicate | undefined = false,\n\t): {\n\t\tpredicate: Acl.PredicateReference | boolean\n\t\tpredicateDefinition: Acl.PredicateDefinition | undefined\n\t} {\n\t\tif (leftReference === true || rightReference === true) {\n\t\t\treturn {\n\t\t\t\tpredicate: true,\n\t\t\t\tpredicateDefinition: undefined,\n\t\t\t}\n\t\t}\n\n\t\tif (leftReference !== false && rightReference !== false) {\n\t\t\tconst leftPredicate: Acl.PredicateDefinition = leftPredicates[leftReference]\n\t\t\tconst rightPredicate: Acl.PredicateDefinition = rightPredicates[rightReference]\n\t\t\tif (leftPredicate === rightPredicate) {\n\t\t\t\treturn {\n\t\t\t\t\tpredicate: leftReference,\n\t\t\t\t\tpredicateDefinition: leftPredicate,\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tlet predicateName = '__merge__' + leftReference + '__' + rightReference\n\t\t\twhile (leftPredicates[predicateName]) {\n\t\t\t\tpredicateName += '_'\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tpredicate: predicateName,\n\t\t\t\tpredicateDefinition: {\n\t\t\t\t\tor: [leftPredicate, rightPredicate],\n\t\t\t\t} as Acl.PredicateDefinition,\n\t\t\t}\n\t\t} else if (leftReference !== false) {\n\t\t\treturn {\n\t\t\t\tpredicate: leftReference,\n\t\t\t\tpredicateDefinition: leftPredicates[leftReference],\n\t\t\t}\n\t\t} else if (rightReference !== false) {\n\t\t\tlet predicateName = rightReference\n\t\t\tif (rightPredicates !== leftPredicates) {\n\t\t\t\twhile (leftPredicates[predicateName]) {\n\t\t\t\t\tpredicateName += '_'\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tpredicate: predicateName,\n\t\t\t\tpredicateDefinition: rightPredicates[rightReference],\n\t\t\t}\n\t\t} else {\n\t\t\treturn {\n\t\t\t\tpredicate: false,\n\t\t\t\tpredicateDefinition: undefined,\n\t\t\t}\n\t\t}\n\t}\n}\n"],"names":["mapObject","PredicateDefinitionProcessor","getEntity","prefixVariable","opNoRoot"],"mappings":";;;;;AASO,MAAM,kBAAkB;AAAA,EACvB,OAAO,QAAgB,OAA0B,QAAkC;AACzF,QAAI,SAA0B,CAAC;AAC/B,aAAS,QAAQ,OAAO;AACjB,YAAA,iBAAiB,OAAO,IAAI,MAAM,IAAI,KAAK,EAAE,UAAU,GAAG;AAC5D,UAAA,kBAAmC,KAAK,yBAAyB,OAAO,OAAO,eAAe,UAAU,UAAU,IAAI;AAC1H,UAAI,eAAe,UAAU;AAC5B,cAAM,uBAAuB,KAAK,OAAO,QAAQ,eAAe,UAAU,UAAU,IAAI;AACtE,0BAAA,KAAK,iBAAiB,sBAAsB,eAAe;AAAA,MAAA;AAErE,eAAA,KAAK,iBAAiB,QAAQ,eAAe;AAAA,IAAA;AAEvD,aAAS,KAAK,sCAAsC,OAAO,OAAO,MAAM;AAEjE,WAAA;AAAA,EAAA;AAAA,EAGA,yBAAyB,OAAqB,aAA8B,MAA+B;AAClH,WAAOA,OAAAA,UAAU,aAAa,CAAC,EAAE,YAAY,cAAc,gBAAgB;AAAA,MAC1E;AAAA,MACA,YAAYA,OAAU,UAAA,YAAY,CAAa,cAAA;AACxC,cAAA,+BAA+B,IAAIC,YAAA,6BAA6B,KAAK;AAC3E,eAAO,6BAA6B,QAAQC,YAAAA,UAAU,OAAO,UAAU,GAAG,WAAW;AAAA,UACpF,cAAc,CAAC,EAAE,YAAY;AACxB,gBAAA,OAAO,UAAU,UAAU;AACvB,qBAAAC,cAAA,eAAe,MAAM,KAAK;AAAA,YAAA;AAE3B,mBAAA;AAAA,UACR;AAAA,UACA,gBAAgB,CAAC,EAAE,YAAY;AAC1B,gBAAA,OAAO,UAAU,UAAU;AACvB,qBAAAA,cAAA,eAAe,MAAM,KAAK;AAAA,YAAA;AAE3B,mBAAA;AAAA,UAAA;AAAA,QACR,CACA;AAAA,MACD,CAAA;AAAA,IAAA,EACA;AAAA,EAAA;AAAA,EAGK,sCAAsC,OAAqB,aAA+C;AACjH,WAAOH,iBAAU,aAAa,CAAC,YAAY,eAAsC;AAC1E,YAAA,SAASE,YAAAA,UAAU,OAAO,UAAU;AAC1C,YAAM,mBAA+C,EAAE,GAAG,WAAW,WAAW;AAChF,YAAM,mBAAmD,EAAE,GAAG,WAAW,WAAW;AAEpF,YAAM,iBAAiB,CAAC,QAAQ,UAAU,QAAQ;AAClD,eAAS,aAAa,gBAAgB;AACjC,YAAA,CAAC,iBAAiB,SAAS,GAAG;AACjC;AAAA,QAAA;AAED,cAAM,mBAAmD,EAAE,GAAG,iBAAiB,SAAS,EAAE;AAC1F,yBAAiB,SAAS,IAAI;AAE1B,YAAA,OAAO,OAAO,gBAAgB,EAAE,KAAK,CAAM,OAAA,OAAO,IAAI,GAAG;AAC3C,2BAAA,OAAO,OAAO,IAAI;AAAA,QAAA;AAEpC,YAAI,iBAAiB,OAAO,OAAO,MAAM,MAAM;AAC9C;AAAA,QAAA;AAED,cAAM,sBAAgC,OAAO,QAAQ,gBAAgB,EACnE,OAAO,CAAC,CAAC,GAAG,MAAM,QAAQ,OAAO,OAAO,EACxC,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,KAAK,EAC3B,OAAO,CAAS,UAAA,UAAU,KAAK,EAC/B,OAAO,CAAC,OAAO,OAAO,UAA2B,MAAM,QAAQ,KAAK,MAAM,KAAK;AAEjF,YAAI,gBAA+B,iBAAiB,OAAO,OAAO,KAAK;AAEvE,iBAAS,sBAAsB,qBAAqB;AACnD,gBAAM,EAAE,qBAAqB,UAAU,IAAI,KAAK;AAAA,YAC/C;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACD;AACA,cAAI,OAAO,cAAc,YAAY,wBAAwB,QAAW;AACjE,kBAAA,IAAI,MAAM,mBAAmB;AAAA,UAAA;AAEpB,0BAAA;AAChB,2BAAiB,SAAS,IAAI;AAAA,QAAA;AAEd,yBAAA,OAAO,OAAO,IAAI;AAClB,yBAAA,aAAuC,IAAI,iBAAiB,aAAuC;AAAA,MAAA;AAE9G,aAAA;AAAA,QACN,YAAY;AAAA,QACZ,YAAY;AAAA,MACb;AAAA,IAAA,CACA;AAAA,EAAA;AAAA,EAGM,iBAAiB,MAAuB,OAAyC;AAClF,UAAA,SAAS,EAAE,GAAG,KAAK;AACzB,aAAS,cAAc,OAAO;AACzB,UAAA,OAAO,UAAU,MAAM,QAAW;AAC9B,eAAA,UAAU,IAAI,KAAK,uBAAuB,OAAO,UAAU,GAAG,MAAM,UAAU,CAAC;AAAA,MAAA,OAChF;AACC,eAAA,UAAU,IAAI,MAAM,UAAU;AAAA,MAAA;AAAA,IACtC;AAEM,WAAA;AAAA,EAAA;AAAA,EAGA,uBAAuB,MAA6B,OAAqD;AAChH,QAAI,aAAyC,CAAC;AAC9C,UAAM,aAA6C,CAAC;AACpD,QAAI,KAAK,WAAW,iBAAiB,MAAM,WAAW,eAAe;AACpE,iBAAW,gBAAgB;AAAA,IAAA;AAE5B,UAAM,SAA+B,CAAC;AAEtC,aAAS,aAAa;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA,IAAA,GACW;AAEX,YAAM,EAAE,YAAY,cAAc,aAAa,kBAAkB,QAAQE,UAAS,IAAI,KAAK,0BAA0B,MAAM,OAAO,SAAS;AAE3I,UAAIA,WAAU;AACb,eAAO,KAAK,SAAS;AAAA,MAAA;AAGtB,mBAAa,EAAE,GAAG,YAAY,GAAG,aAAa;AAC9C,UAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,GAAG;AAC7C,mBAAW,SAAS,IAAI;AAAA,MAAA;AAAA,IACzB;AAGK,UAAA,EAAE,qBAAqB,WAAW,QAAQ,SAAa,IAAA,KAAK,uBAAuB,MAAM,KAAK;AACpG,QAAI,UAAU;AACb,aAAO,KAAK,QAAQ;AAAA,IAAA;AAErB,QAAI,cAAc,MAAM;AACvB,iBAAW,SAAS;AAAA,IACV,WAAA,wBAAwB,UAAa,OAAO,cAAc,UAAU;AAC9E,iBAAW,SAAS,IAAI;AACxB,iBAAW,SAAS;AAAA,IAAA;AAIjB,QAAA,OAAO,SAAS,GAAG;AACtB,iBAAW,SAAS;AAAA,IAAA;AAGd,WAAA;AAAA,MACN;AAAA,MACA;AAAA,IACD;AAAA,EAAA;AAAA,EAIO,0BAA0B,MAA6B,OAA8B,WAI3F;AACK,UAAA,EAAE,QAAQ,iBAAiB,qBAAqB,KAAK,cAAc,MAAM,OAAO,SAAS;AACxF,WAAA;AAAA,MACN;AAAA,MACA,GAAG,KAAK;AAAA,QACP,KAAK;AAAA,QACL;AAAA,QACA,MAAM;AAAA,QACN;AAAA,MAAA;AAAA,IAEF;AAAA,EAAA;AAAA,EAGO,uBAAuB,MAA6B,OAI1D;AACK,UAAA,EAAE,QAAQ,iBAAiB,qBAAqB,KAAK,cAAc,MAAM,OAAO,QAAQ;AAEvF,WAAA;AAAA,MACN;AAAA,MACA,GAAG,KAAK;AAAA,QACP,KAAK;AAAA,QACL;AAAA,QACA,MAAM;AAAA,QACN;AAAA,MAAA;AAAA,IAEF;AAAA,EAAA;AAAA,EAGO,cAAkD,MAA6B,OAA8B,WAInH;AACD,UAAM,oBAAoB,KAAK,WAAW,QAAQ,SAAS,SAAS,KAAK;AACzE,UAAM,qBAAqB,MAAM,WAAW,QAAQ,SAAS,SAAS,KAAK;AACrE,UAAA,kBAAkB,KAAK,WAAW,SAAS;AAC3C,UAAA,mBAAmB,MAAM,WAAW,SAAS;AAEnD,UAAM,gBAAiB,qBAAqB,sBACvC,qBAAqB,CAAC,oBACtB,sBAAsB,CAAC;AAE5B,UAAM,0BAA0B,CAAC,iBAAiB,oBAAoB,SAAY;AAClF,UAAM,2BAA2B,CAAC,iBAAiB,qBAAqB,SAAY;AAE7E,WAAA;AAAA,MACN,QAAQ;AAAA,MACR,iBAAiB;AAAA,MACjB,kBAAkB;AAAA,IACnB;AAAA,EAAA;AAAA,EAGO,sBACP,gBACA,uBAAyD,IACzD,iBACA,wBAA0D,IACU;AACpE,UAAM,cAA8C,CAAC;AACrD,UAAM,aAAyC,CAAC;AAEhD,aAAS,SAAS,EAAE,GAAG,sBAAsB,GAAG,yBAAyB;AACxE,YAAM,EAAE,qBAAqB,UAAU,IAAI,KAAK;AAAA,QAC/C;AAAA,QACA,qBAAqB,KAAK,KAAK;AAAA,QAC/B;AAAA,QACA,sBAAsB,KAAK,KAAK;AAAA,MACjC;AACA,UAAI,cAAc,MAAM;AACvB,oBAAY,KAAK,IAAI;AAAA,MACX,WAAA,wBAAwB,UAAa,OAAO,cAAc,UAAU;AAC9E,oBAAY,KAAK,IAAI;AACrB,mBAAW,SAAS,IAAI;AAAA,MAAA;AAAA,IACzB;AAGM,WAAA,EAAE,YAAY,YAAY;AAAA,EAAA;AAAA,EAG1B,gBACP,gBACA,gBAA2C,OAC3C,iBACA,iBAA4C,OAI3C;AACG,QAAA,kBAAkB,QAAQ,mBAAmB,MAAM;AAC/C,aAAA;AAAA,QACN,WAAW;AAAA,QACX,qBAAqB;AAAA,MACtB;AAAA,IAAA;AAGG,QAAA,kBAAkB,SAAS,mBAAmB,OAAO;AAClD,YAAA,gBAAyC,eAAe,aAAa;AACrE,YAAA,iBAA0C,gBAAgB,cAAc;AAC9E,UAAI,kBAAkB,gBAAgB;AAC9B,eAAA;AAAA,UACN,WAAW;AAAA,UACX,qBAAqB;AAAA,QACtB;AAAA,MAAA;AAGG,UAAA,gBAAgB,cAAc,gBAAgB,OAAO;AAClD,aAAA,eAAe,aAAa,GAAG;AACpB,yBAAA;AAAA,MAAA;AAEX,aAAA;AAAA,QACN,WAAW;AAAA,QACX,qBAAqB;AAAA,UACpB,IAAI,CAAC,eAAe,cAAc;AAAA,QAAA;AAAA,MAEpC;AAAA,IAAA,WACU,kBAAkB,OAAO;AAC5B,aAAA;AAAA,QACN,WAAW;AAAA,QACX,qBAAqB,eAAe,aAAa;AAAA,MAClD;AAAA,IAAA,WACU,mBAAmB,OAAO;AACpC,UAAI,gBAAgB;AACpB,UAAI,oBAAoB,gBAAgB;AAChC,eAAA,eAAe,aAAa,GAAG;AACpB,2BAAA;AAAA,QAAA;AAAA,MAClB;AAEM,aAAA;AAAA,QACN,WAAW;AAAA,QACX,qBAAqB,gBAAgB,cAAc;AAAA,MACpD;AAAA,IAAA,OACM;AACC,aAAA;AAAA,QACN,WAAW;AAAA,QACX,qBAAqB;AAAA,MACtB;AAAA,IAAA;AAAA,EACD;AAEF;;"}

package/dist/development/src/acl/PermissionFactory.js

@@ -59,7 +59,7 @@ class PermissionFactory {
         const predicateReferences = Object.entries(fieldPermissions).filter(([key]) => key !== entity.primary).map(([key, value]) => value).filter((value) => value !== false).filter((value, index, array) => array.indexOf(value) === index);
         let idPermissions = fieldPermissions[entity.primary] || false;
         for (let predicateReference of predicateReferences) {
-          const [predicateDefinition, predicate] = this.mergePredicates(
+          const { predicateDefinition, predicate } = this.mergePredicates(
             entityPredicates,
             idPermissions,
             entityPredicates,
@@ -98,36 +98,24 @@ class PermissionFactory {
       operations.customPrimary = true;
     }
     const noRoot = [];
-    const operationNames = [
+    for (let operation of [
       "create",
       "read",
       "update"
-    ];
-    for (let operation of operationNames) {
-      const leftNoRoot = left.operations.noRoot?.includes(operation) || false;
-      const rightNoRoot = right.operations.noRoot?.includes(operation) || false;
-      if (leftNoRoot && rightNoRoot) {
+    ]) {
+      const { predicates: opPredicates, permissions: fieldPermissions, noRoot: opNoRoot2 } = this.mergeOperationPermissions(left, right, operation);
+      if (opNoRoot2) {
         noRoot.push(operation);
       }
-      const leftFieldPermissions = leftNoRoot && !rightNoRoot ? {} : left.operations[operation] || {};
-      const rightFieldPermissions = rightNoRoot && !leftNoRoot ? {} : right.operations[operation] || {};
-      const [operationPredicates, fieldPermissions] = this.mergeFieldPermissions(
-        left.predicates,
-        leftFieldPermissions,
-        right.predicates,
-        rightFieldPermissions
-      );
-      predicates = { ...predicates, ...operationPredicates };
+      predicates = { ...predicates, ...opPredicates };
       if (Object.keys(fieldPermissions).length > 0) {
         operations[operation] = fieldPermissions;
       }
     }
-    const [predicateDefinition, predicate] = this.mergePredicates(
-      left.predicates,
-      left.operations.delete || false,
-      right.predicates,
-      right.operations.delete || false
-    );
+    const { predicateDefinition, predicate, noRoot: opNoRoot } = this.mergeDeletePermissions(left, right);
+    if (opNoRoot) {
+      noRoot.push("delete");
+    }
     if (predicate === true) {
       operations.delete = true;
     } else if (predicateDefinition !== void 0 && typeof predicate === "string") {
@@ -142,47 +130,94 @@ class PermissionFactory {
       operations
     };
   }
-  mergeFieldPermissions(leftPredicates, leftFieldPermissions, rightPredicates, rightFieldPermissions) {
-    const fields = {};
+  mergeOperationPermissions(left, right, operation) {
+    const { noRoot, leftPermissions, rightPermissions } = this.resolveNoRoot(left, right, operation);
+    return {
+      noRoot,
+      ...this.mergeFieldPermissions(
+        left.predicates,
+        leftPermissions,
+        right.predicates,
+        rightPermissions
+      )
+    };
+  }
+  mergeDeletePermissions(left, right) {
+    const { noRoot, leftPermissions, rightPermissions } = this.resolveNoRoot(left, right, "delete");
+    return {
+      noRoot,
+      ...this.mergePredicates(
+        left.predicates,
+        leftPermissions,
+        right.predicates,
+        rightPermissions
+      )
+    };
+  }
+  resolveNoRoot(left, right, operation) {
+    const leftRootForbidden = left.operations.noRoot?.includes(operation) || false;
+    const rightRootForbidden = right.operations.noRoot?.includes(operation) || false;
+    const leftPermissions = left.operations[operation];
+    const rightPermissions = right.operations[operation];
+    const rootForbidden = leftRootForbidden && rightRootForbidden || leftRootForbidden && !rightPermissions || rightRootForbidden && !leftPermissions;
+    const resolvedLeftPermissions = !rootForbidden && leftRootForbidden ? void 0 : leftPermissions;
+    const resolvedRightPermissions = !rootForbidden && rightRootForbidden ? void 0 : rightPermissions;
+    return {
+      noRoot: rootForbidden,
+      leftPermissions: resolvedLeftPermissions,
+      rightPermissions: resolvedRightPermissions
+    };
+  }
+  mergeFieldPermissions(leftPredicates, leftFieldPermissions = {}, rightPredicates, rightFieldPermissions = {}) {
+    const permissions = {};
     const predicates = {};
     for (let field in { ...leftFieldPermissions, ...rightFieldPermissions }) {
-      const [predicateDefinition, predicate] = this.mergePredicates(
+      const { predicateDefinition, predicate } = this.mergePredicates(
         leftPredicates,
         leftFieldPermissions[field] || false,
         rightPredicates,
         rightFieldPermissions[field] || false
       );
       if (predicate === true) {
-        fields[field] = true;
+        permissions[field] = true;
       } else if (predicateDefinition !== void 0 && typeof predicate === "string") {
-        fields[field] = predicate;
+        permissions[field] = predicate;
         predicates[predicate] = predicateDefinition;
       }
     }
-    return [predicates, fields];
+    return { predicates, permissions };
   }
-  mergePredicates(leftPredicates, leftReference, rightPredicates, rightReference) {
+  mergePredicates(leftPredicates, leftReference = false, rightPredicates, rightReference = false) {
     if (leftReference === true || rightReference === true) {
-      return [void 0, true];
+      return {
+        predicate: true,
+        predicateDefinition: void 0
+      };
     }
     if (leftReference !== false && rightReference !== false) {
       const leftPredicate = leftPredicates[leftReference];
       const rightPredicate = rightPredicates[rightReference];
       if (leftPredicate === rightPredicate) {
-        return [leftPredicate, leftReference];
+        return {
+          predicate: leftReference,
+          predicateDefinition: leftPredicate
+        };
       }
       let predicateName = "__merge__" + leftReference + "__" + rightReference;
       while (leftPredicates[predicateName]) {
         predicateName += "_";
       }
-      return [
-        {
+      return {
+        predicate: predicateName,
+        predicateDefinition: {
           or: [leftPredicate, rightPredicate]
-        },
-        predicateName
-      ];
+        }
+      };
     } else if (leftReference !== false) {
-      return [leftPredicates[leftReference], leftReference];
+      return {
+        predicate: leftReference,
+        predicateDefinition: leftPredicates[leftReference]
+      };
     } else if (rightReference !== false) {
       let predicateName = rightReference;
       if (rightPredicates !== leftPredicates) {
@@ -190,9 +225,15 @@ class PermissionFactory {
           predicateName += "_";
         }
       }
-      return [rightPredicates[rightReference], predicateName];
+      return {
+        predicate: predicateName,
+        predicateDefinition: rightPredicates[rightReference]
+      };
     } else {
-      return [void 0, false];
+      return {
+        predicate: false,
+        predicateDefinition: void 0
+      };
     }
   }
 }

package/dist/development/src/acl/PermissionFactory.js.map

@@ -1 +1 @@
-{"version":3,"file":"PermissionFactory.js","sources":["../../../../../packages/engine-content-api/src/acl/PermissionFactory.ts"],"sourcesContent":["import { Acl, Model, Schema, Writable } from '@contember/schema'\nimport { getEntity, PredicateDefinitionProcessor } from '@contember/schema-utils'\nimport { mapObject } from '../utils'\nimport { prefixVariable } from './VariableUtils'\n\nexport interface Identity {\n\tprojectRoles: readonly string[]\n}\n\nexport class PermissionFactory {\n\tpublic create(schema: Schema, roles: readonly string[], prefix?: string): Acl.Permissions {\n\t\tlet result: Acl.Permissions = {}\n\t\tfor (let role of roles) {\n\t\t\tconst roleDefinition = schema.acl.roles[role] || { entities: {} }\n\t\t\tlet rolePermissions: Acl.Permissions = this.prefixPredicatesWithRole(schema.model, roleDefinition.entities, prefix || role)\n\t\t\tif (roleDefinition.inherits) {\n\t\t\t\tconst inheritedPermissions = this.create(schema, roleDefinition.inherits, prefix || role)\n\t\t\t\trolePermissions = this.mergePermissions(inheritedPermissions, rolePermissions)\n\t\t\t}\n\t\t\tresult = this.mergePermissions(result, rolePermissions)\n\t\t}\n\t\tresult = this.makePrimaryPredicatesUnionOfAllFields(schema.model, result)\n\n\t\treturn result\n\t}\n\n\tprivate prefixPredicatesWithRole(model: Model.Schema, permissions: Acl.Permissions, role: string): Acl.Permissions {\n\t\treturn mapObject(permissions, ({ operations, predicates }, entityName) => ({\n\t\t\toperations,\n\t\t\tpredicates: mapObject(predicates, predicate => {\n\t\t\t\tconst predicateDefinitionProcessor = new PredicateDefinitionProcessor(model)\n\t\t\t\treturn predicateDefinitionProcessor.process(getEntity(model, entityName), predicate, {\n\t\t\t\t\thandleColumn: ({ value }) => {\n\t\t\t\t\t\tif (typeof value === 'string') {\n\t\t\t\t\t\t\treturn prefixVariable(role, value)\n\t\t\t\t\t\t}\n\t\t\t\t\t\treturn value\n\t\t\t\t\t},\n\t\t\t\t\thandleRelation: ({ value }) => {\n\t\t\t\t\t\tif (typeof value === 'string') {\n\t\t\t\t\t\t\treturn prefixVariable(role, value)\n\t\t\t\t\t\t}\n\t\t\t\t\t\treturn value\n\t\t\t\t\t},\n\t\t\t\t})\n\t\t\t}),\n\t\t}))\n\t}\n\n\tprivate makePrimaryPredicatesUnionOfAllFields(model: Model.Schema, permissions: Acl.Permissions): Acl.Permissions {\n\t\treturn mapObject(permissions, (permission, entityName): Acl.EntityPermissions => {\n\t\t\tconst entity = getEntity(model, entityName)\n\t\t\tconst entityPredicates: Writable<Acl.PredicateMap> = { ...permission.predicates }\n\t\t\tconst entityOperations: Writable<Acl.EntityOperations> = { ...permission.operations }\n\n\t\t\tconst operationNames = ['read', 'create', 'update'] as const\n\t\t\tfor (let operation of operationNames) {\n\t\t\t\tif (!entityOperations[operation]) {\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\t\t\t\tconst fieldPermissions: Writable<Acl.FieldPermissions> = { ...entityOperations[operation] }\n\t\t\t\tentityOperations[operation] = fieldPermissions\n\n\t\t\t\tif (Object.values(fieldPermissions).some(it => it === true)) {\n\t\t\t\t\tfieldPermissions[entity.primary] = true\n\t\t\t\t}\n\t\t\t\tif (fieldPermissions[entity.primary] === true) {\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\t\t\t\tconst predicateReferences: string[] = Object.entries(fieldPermissions)\n\t\t\t\t\t.filter(([key]) => key !== entity.primary)\n\t\t\t\t\t.map(([key, value]) => value)\n\t\t\t\t\t.filter(value => value !== false)\n\t\t\t\t\t.filter((value, index, array): value is string => array.indexOf(value) === index)\n\n\t\t\t\tlet idPermissions: Acl.Predicate = fieldPermissions[entity.primary] || false\n\n\t\t\t\tfor (let predicateReference of predicateReferences) {\n\t\t\t\t\tconst [predicateDefinition, predicate] = this.mergePredicates(\n\t\t\t\t\t\tentityPredicates,\n\t\t\t\t\t\tidPermissions,\n\t\t\t\t\t\tentityPredicates,\n\t\t\t\t\t\tpredicateReference,\n\t\t\t\t\t)\n\t\t\t\t\tif (typeof predicate !== 'string' || predicateDefinition === undefined) {\n\t\t\t\t\t\tthrow new Error('should not happen')\n\t\t\t\t\t}\n\t\t\t\t\tidPermissions = predicate\n\t\t\t\t\tentityPredicates[predicate] = predicateDefinition\n\t\t\t\t}\n\t\t\t\tfieldPermissions[entity.primary] = idPermissions\n\t\t\t\tentityPredicates[idPermissions as Acl.PredicateReference] = entityPredicates[idPermissions as Acl.PredicateReference]\n\t\t\t}\n\t\t\treturn {\n\t\t\t\toperations: entityOperations,\n\t\t\t\tpredicates: entityPredicates,\n\t\t\t}\n\t\t})\n\t}\n\n\tprivate mergePermissions(left: Acl.Permissions, right: Acl.Permissions): Acl.Permissions {\n\t\tconst result = { ...left }\n\t\tfor (let entityName in right) {\n\t\t\tif (result[entityName] !== undefined) {\n\t\t\t\tresult[entityName] = this.mergeEntityPermissions(result[entityName], right[entityName])\n\t\t\t} else {\n\t\t\t\tresult[entityName] = right[entityName]\n\t\t\t}\n\t\t}\n\t\treturn result\n\t}\n\n\tprivate mergeEntityPermissions(left: Acl.EntityPermissions, right: Acl.EntityPermissions): Acl.EntityPermissions {\n\t\tlet predicates: Writable<Acl.PredicateMap> = {}\n\t\tconst operations: Writable<Acl.EntityOperations> = {}\n\t\tif (left.operations.customPrimary || right.operations.customPrimary) {\n\t\t\toperations.customPrimary = true\n\t\t}\n\t\tconst noRoot: `${Acl.Operation}`[] = []\n\n\t\tconst operationNames: (keyof Pick<Acl.EntityOperations, 'create' | 'read' | 'update'>)[] = [\n\t\t\t'create',\n\t\t\t'read',\n\t\t\t'update',\n\t\t]\n\n\t\tfor (let operation of operationNames) {\n\t\t\tconst leftNoRoot = left.operations.noRoot?.includes(operation) || false\n\t\t\tconst rightNoRoot = right.operations.noRoot?.includes(operation) || false\n\t\t\tif (leftNoRoot && rightNoRoot) {\n\t\t\t\tnoRoot.push(operation)\n\t\t\t}\n\n\t\t\tconst leftFieldPermissions: Acl.FieldPermissions = leftNoRoot && !rightNoRoot ? {} : (left.operations[operation] || {})\n\t\t\tconst rightFieldPermissions: Acl.FieldPermissions = rightNoRoot && !leftNoRoot ? {} : (right.operations[operation] || {})\n\t\t\tconst [operationPredicates, fieldPermissions] = this.mergeFieldPermissions(\n\t\t\t\tleft.predicates,\n\t\t\t\tleftFieldPermissions,\n\t\t\t\tright.predicates,\n\t\t\t\trightFieldPermissions,\n\t\t\t)\n\t\t\tpredicates = { ...predicates, ...operationPredicates }\n\t\t\tif (Object.keys(fieldPermissions).length > 0) {\n\t\t\t\toperations[operation] = fieldPermissions\n\t\t\t}\n\t\t}\n\n\t\tconst [predicateDefinition, predicate] = this.mergePredicates(\n\t\t\tleft.predicates,\n\t\t\tleft.operations.delete || false,\n\t\t\tright.predicates,\n\t\t\tright.operations.delete || false,\n\t\t)\n\t\tif (predicate === true) {\n\t\t\toperations.delete = true\n\t\t} else if (predicateDefinition !== undefined && typeof predicate === 'string') {\n\t\t\tpredicates[predicate] = predicateDefinition\n\t\t\toperations.delete = predicate\n\t\t}\n\t\tif (noRoot.length > 0) {\n\t\t\toperations.noRoot = noRoot\n\t\t}\n\n\t\treturn {\n\t\t\tpredicates: predicates,\n\t\t\toperations: operations,\n\t\t}\n\t}\n\n\tprivate mergeFieldPermissions(\n\t\tleftPredicates: Acl.PredicateMap,\n\t\tleftFieldPermissions: Acl.FieldPermissions,\n\t\trightPredicates: Acl.PredicateMap,\n\t\trightFieldPermissions: Acl.FieldPermissions,\n\t): [Acl.PredicateMap, Acl.FieldPermissions] {\n\t\tconst fields: Writable<Acl.FieldPermissions> = {}\n\t\tconst predicates: Writable<Acl.PredicateMap> = {}\n\n\t\tfor (let field in { ...leftFieldPermissions, ...rightFieldPermissions }) {\n\t\t\tconst [predicateDefinition, predicate] = this.mergePredicates(\n\t\t\t\tleftPredicates,\n\t\t\t\tleftFieldPermissions[field] || false,\n\t\t\t\trightPredicates,\n\t\t\t\trightFieldPermissions[field] || false,\n\t\t\t)\n\t\t\tif (predicate === true) {\n\t\t\t\tfields[field] = true\n\t\t\t} else if (predicateDefinition !== undefined && typeof predicate === 'string') {\n\t\t\t\tfields[field] = predicate\n\t\t\t\tpredicates[predicate] = predicateDefinition\n\t\t\t}\n\t\t}\n\n\t\treturn [predicates, fields]\n\t}\n\n\tprivate mergePredicates(\n\t\tleftPredicates: Acl.PredicateMap,\n\t\tleftReference: Acl.Predicate,\n\t\trightPredicates: Acl.PredicateMap,\n\t\trightReference: Acl.Predicate,\n\t): [Acl.PredicateDefinition, Acl.PredicateReference] | [undefined, boolean] {\n\t\tif (leftReference === true || rightReference === true) {\n\t\t\treturn [undefined, true]\n\t\t}\n\n\t\tif (leftReference !== false && rightReference !== false) {\n\t\t\tconst leftPredicate: Acl.PredicateDefinition = leftPredicates[leftReference]\n\t\t\tconst rightPredicate: Acl.PredicateDefinition = rightPredicates[rightReference]\n\t\t\tif (leftPredicate === rightPredicate) {\n\t\t\t\treturn [leftPredicate, leftReference]\n\t\t\t}\n\n\t\t\tlet predicateName = '__merge__' + leftReference + '__' + rightReference\n\t\t\twhile (leftPredicates[predicateName]) {\n\t\t\t\tpredicateName += '_'\n\t\t\t}\n\t\t\treturn [\n\t\t\t\t{\n\t\t\t\t\tor: [leftPredicate, rightPredicate],\n\t\t\t\t} as Acl.PredicateDefinition,\n\t\t\t\tpredicateName,\n\t\t\t]\n\t\t} else if (leftReference !== false) {\n\t\t\treturn [leftPredicates[leftReference], leftReference]\n\t\t} else if (rightReference !== false) {\n\t\t\tlet predicateName = rightReference\n\t\t\tif (rightPredicates !== leftPredicates) {\n\t\t\t\twhile (leftPredicates[predicateName]) {\n\t\t\t\t\tpredicateName += '_'\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn [rightPredicates[rightReference], predicateName]\n\t\t} else {\n\t\t\treturn [undefined, false]\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;AASO,MAAM,kBAAkB;AAAA,EACvB,OAAO,QAAgB,OAA0B,QAAkC;AACzF,QAAI,SAA0B,CAAC;AAC/B,aAAS,QAAQ,OAAO;AACjB,YAAA,iBAAiB,OAAO,IAAI,MAAM,IAAI,KAAK,EAAE,UAAU,GAAG;AAC5D,UAAA,kBAAmC,KAAK,yBAAyB,OAAO,OAAO,eAAe,UAAU,UAAU,IAAI;AAC1H,UAAI,eAAe,UAAU;AAC5B,cAAM,uBAAuB,KAAK,OAAO,QAAQ,eAAe,UAAU,UAAU,IAAI;AACtE,0BAAA,KAAK,iBAAiB,sBAAsB,eAAe;AAAA,MAAA;AAErE,eAAA,KAAK,iBAAiB,QAAQ,eAAe;AAAA,IAAA;AAEvD,aAAS,KAAK,sCAAsC,OAAO,OAAO,MAAM;AAEjE,WAAA;AAAA,EAAA;AAAA,EAGA,yBAAyB,OAAqB,aAA8B,MAA+B;AAClH,WAAO,UAAU,aAAa,CAAC,EAAE,YAAY,cAAc,gBAAgB;AAAA,MAC1E;AAAA,MACA,YAAY,UAAU,YAAY,CAAa,cAAA;AACxC,cAAA,+BAA+B,IAAI,6BAA6B,KAAK;AAC3E,eAAO,6BAA6B,QAAQ,UAAU,OAAO,UAAU,GAAG,WAAW;AAAA,UACpF,cAAc,CAAC,EAAE,YAAY;AACxB,gBAAA,OAAO,UAAU,UAAU;AACvB,qBAAA,eAAe,MAAM,KAAK;AAAA,YAAA;AAE3B,mBAAA;AAAA,UACR;AAAA,UACA,gBAAgB,CAAC,EAAE,YAAY;AAC1B,gBAAA,OAAO,UAAU,UAAU;AACvB,qBAAA,eAAe,MAAM,KAAK;AAAA,YAAA;AAE3B,mBAAA;AAAA,UAAA;AAAA,QACR,CACA;AAAA,MACD,CAAA;AAAA,IAAA,EACA;AAAA,EAAA;AAAA,EAGK,sCAAsC,OAAqB,aAA+C;AACjH,WAAO,UAAU,aAAa,CAAC,YAAY,eAAsC;AAC1E,YAAA,SAAS,UAAU,OAAO,UAAU;AAC1C,YAAM,mBAA+C,EAAE,GAAG,WAAW,WAAW;AAChF,YAAM,mBAAmD,EAAE,GAAG,WAAW,WAAW;AAEpF,YAAM,iBAAiB,CAAC,QAAQ,UAAU,QAAQ;AAClD,eAAS,aAAa,gBAAgB;AACjC,YAAA,CAAC,iBAAiB,SAAS,GAAG;AACjC;AAAA,QAAA;AAED,cAAM,mBAAmD,EAAE,GAAG,iBAAiB,SAAS,EAAE;AAC1F,yBAAiB,SAAS,IAAI;AAE1B,YAAA,OAAO,OAAO,gBAAgB,EAAE,KAAK,CAAM,OAAA,OAAO,IAAI,GAAG;AAC3C,2BAAA,OAAO,OAAO,IAAI;AAAA,QAAA;AAEpC,YAAI,iBAAiB,OAAO,OAAO,MAAM,MAAM;AAC9C;AAAA,QAAA;AAED,cAAM,sBAAgC,OAAO,QAAQ,gBAAgB,EACnE,OAAO,CAAC,CAAC,GAAG,MAAM,QAAQ,OAAO,OAAO,EACxC,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,KAAK,EAC3B,OAAO,CAAS,UAAA,UAAU,KAAK,EAC/B,OAAO,CAAC,OAAO,OAAO,UAA2B,MAAM,QAAQ,KAAK,MAAM,KAAK;AAEjF,YAAI,gBAA+B,iBAAiB,OAAO,OAAO,KAAK;AAEvE,iBAAS,sBAAsB,qBAAqB;AACnD,gBAAM,CAAC,qBAAqB,SAAS,IAAI,KAAK;AAAA,YAC7C;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACD;AACA,cAAI,OAAO,cAAc,YAAY,wBAAwB,QAAW;AACjE,kBAAA,IAAI,MAAM,mBAAmB;AAAA,UAAA;AAEpB,0BAAA;AAChB,2BAAiB,SAAS,IAAI;AAAA,QAAA;AAEd,yBAAA,OAAO,OAAO,IAAI;AAClB,yBAAA,aAAuC,IAAI,iBAAiB,aAAuC;AAAA,MAAA;AAE9G,aAAA;AAAA,QACN,YAAY;AAAA,QACZ,YAAY;AAAA,MACb;AAAA,IAAA,CACA;AAAA,EAAA;AAAA,EAGM,iBAAiB,MAAuB,OAAyC;AAClF,UAAA,SAAS,EAAE,GAAG,KAAK;AACzB,aAAS,cAAc,OAAO;AACzB,UAAA,OAAO,UAAU,MAAM,QAAW;AAC9B,eAAA,UAAU,IAAI,KAAK,uBAAuB,OAAO,UAAU,GAAG,MAAM,UAAU,CAAC;AAAA,MAAA,OAChF;AACC,eAAA,UAAU,IAAI,MAAM,UAAU;AAAA,MAAA;AAAA,IACtC;AAEM,WAAA;AAAA,EAAA;AAAA,EAGA,uBAAuB,MAA6B,OAAqD;AAChH,QAAI,aAAyC,CAAC;AAC9C,UAAM,aAA6C,CAAC;AACpD,QAAI,KAAK,WAAW,iBAAiB,MAAM,WAAW,eAAe;AACpE,iBAAW,gBAAgB;AAAA,IAAA;AAE5B,UAAM,SAA+B,CAAC;AAEtC,UAAM,iBAAqF;AAAA,MAC1F;AAAA,MACA;AAAA,MACA;AAAA,IACD;AAEA,aAAS,aAAa,gBAAgB;AACrC,YAAM,aAAa,KAAK,WAAW,QAAQ,SAAS,SAAS,KAAK;AAClE,YAAM,cAAc,MAAM,WAAW,QAAQ,SAAS,SAAS,KAAK;AACpE,UAAI,cAAc,aAAa;AAC9B,eAAO,KAAK,SAAS;AAAA,MAAA;AAGhB,YAAA,uBAA6C,cAAc,CAAC,cAAc,KAAM,KAAK,WAAW,SAAS,KAAK,CAAC;AAC/G,YAAA,wBAA8C,eAAe,CAAC,aAAa,KAAM,MAAM,WAAW,SAAS,KAAK,CAAC;AACvH,YAAM,CAAC,qBAAqB,gBAAgB,IAAI,KAAK;AAAA,QACpD,KAAK;AAAA,QACL;AAAA,QACA,MAAM;AAAA,QACN;AAAA,MACD;AACA,mBAAa,EAAE,GAAG,YAAY,GAAG,oBAAoB;AACrD,UAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,GAAG;AAC7C,mBAAW,SAAS,IAAI;AAAA,MAAA;AAAA,IACzB;AAGD,UAAM,CAAC,qBAAqB,SAAS,IAAI,KAAK;AAAA,MAC7C,KAAK;AAAA,MACL,KAAK,WAAW,UAAU;AAAA,MAC1B,MAAM;AAAA,MACN,MAAM,WAAW,UAAU;AAAA,IAC5B;AACA,QAAI,cAAc,MAAM;AACvB,iBAAW,SAAS;AAAA,IACV,WAAA,wBAAwB,UAAa,OAAO,cAAc,UAAU;AAC9E,iBAAW,SAAS,IAAI;AACxB,iBAAW,SAAS;AAAA,IAAA;AAEjB,QAAA,OAAO,SAAS,GAAG;AACtB,iBAAW,SAAS;AAAA,IAAA;AAGd,WAAA;AAAA,MACN;AAAA,MACA;AAAA,IACD;AAAA,EAAA;AAAA,EAGO,sBACP,gBACA,sBACA,iBACA,uBAC2C;AAC3C,UAAM,SAAyC,CAAC;AAChD,UAAM,aAAyC,CAAC;AAEhD,aAAS,SAAS,EAAE,GAAG,sBAAsB,GAAG,yBAAyB;AACxE,YAAM,CAAC,qBAAqB,SAAS,IAAI,KAAK;AAAA,QAC7C;AAAA,QACA,qBAAqB,KAAK,KAAK;AAAA,QAC/B;AAAA,QACA,sBAAsB,KAAK,KAAK;AAAA,MACjC;AACA,UAAI,cAAc,MAAM;AACvB,eAAO,KAAK,IAAI;AAAA,MACN,WAAA,wBAAwB,UAAa,OAAO,cAAc,UAAU;AAC9E,eAAO,KAAK,IAAI;AAChB,mBAAW,SAAS,IAAI;AAAA,MAAA;AAAA,IACzB;AAGM,WAAA,CAAC,YAAY,MAAM;AAAA,EAAA;AAAA,EAGnB,gBACP,gBACA,eACA,iBACA,gBAC2E;AACvE,QAAA,kBAAkB,QAAQ,mBAAmB,MAAM;AAC/C,aAAA,CAAC,QAAW,IAAI;AAAA,IAAA;AAGpB,QAAA,kBAAkB,SAAS,mBAAmB,OAAO;AAClD,YAAA,gBAAyC,eAAe,aAAa;AACrE,YAAA,iBAA0C,gBAAgB,cAAc;AAC9E,UAAI,kBAAkB,gBAAgB;AAC9B,eAAA,CAAC,eAAe,aAAa;AAAA,MAAA;AAGjC,UAAA,gBAAgB,cAAc,gBAAgB,OAAO;AAClD,aAAA,eAAe,aAAa,GAAG;AACpB,yBAAA;AAAA,MAAA;AAEX,aAAA;AAAA,QACN;AAAA,UACC,IAAI,CAAC,eAAe,cAAc;AAAA,QACnC;AAAA,QACA;AAAA,MACD;AAAA,IAAA,WACU,kBAAkB,OAAO;AACnC,aAAO,CAAC,eAAe,aAAa,GAAG,aAAa;AAAA,IAAA,WAC1C,mBAAmB,OAAO;AACpC,UAAI,gBAAgB;AACpB,UAAI,oBAAoB,gBAAgB;AAChC,eAAA,eAAe,aAAa,GAAG;AACpB,2BAAA;AAAA,QAAA;AAAA,MAClB;AAED,aAAO,CAAC,gBAAgB,cAAc,GAAG,aAAa;AAAA,IAAA,OAChD;AACC,aAAA,CAAC,QAAW,KAAK;AAAA,IAAA;AAAA,EACzB;AAEF;"}
+{"version":3,"file":"PermissionFactory.js","sources":["../../../../../packages/engine-content-api/src/acl/PermissionFactory.ts"],"sourcesContent":["import { Acl, Model, Schema, Writable } from '@contember/schema'\nimport { getEntity, PredicateDefinitionProcessor } from '@contember/schema-utils'\nimport { mapObject } from '../utils'\nimport { prefixVariable } from './VariableUtils'\n\nexport interface Identity {\n\tprojectRoles: readonly string[]\n}\n\nexport class PermissionFactory {\n\tpublic create(schema: Schema, roles: readonly string[], prefix?: string): Acl.Permissions {\n\t\tlet result: Acl.Permissions = {}\n\t\tfor (let role of roles) {\n\t\t\tconst roleDefinition = schema.acl.roles[role] || { entities: {} }\n\t\t\tlet rolePermissions: Acl.Permissions = this.prefixPredicatesWithRole(schema.model, roleDefinition.entities, prefix || role)\n\t\t\tif (roleDefinition.inherits) {\n\t\t\t\tconst inheritedPermissions = this.create(schema, roleDefinition.inherits, prefix || role)\n\t\t\t\trolePermissions = this.mergePermissions(inheritedPermissions, rolePermissions)\n\t\t\t}\n\t\t\tresult = this.mergePermissions(result, rolePermissions)\n\t\t}\n\t\tresult = this.makePrimaryPredicatesUnionOfAllFields(schema.model, result)\n\n\t\treturn result\n\t}\n\n\tprivate prefixPredicatesWithRole(model: Model.Schema, permissions: Acl.Permissions, role: string): Acl.Permissions {\n\t\treturn mapObject(permissions, ({ operations, predicates }, entityName) => ({\n\t\t\toperations,\n\t\t\tpredicates: mapObject(predicates, predicate => {\n\t\t\t\tconst predicateDefinitionProcessor = new PredicateDefinitionProcessor(model)\n\t\t\t\treturn predicateDefinitionProcessor.process(getEntity(model, entityName), predicate, {\n\t\t\t\t\thandleColumn: ({ value }) => {\n\t\t\t\t\t\tif (typeof value === 'string') {\n\t\t\t\t\t\t\treturn prefixVariable(role, value)\n\t\t\t\t\t\t}\n\t\t\t\t\t\treturn value\n\t\t\t\t\t},\n\t\t\t\t\thandleRelation: ({ value }) => {\n\t\t\t\t\t\tif (typeof value === 'string') {\n\t\t\t\t\t\t\treturn prefixVariable(role, value)\n\t\t\t\t\t\t}\n\t\t\t\t\t\treturn value\n\t\t\t\t\t},\n\t\t\t\t})\n\t\t\t}),\n\t\t}))\n\t}\n\n\tprivate makePrimaryPredicatesUnionOfAllFields(model: Model.Schema, permissions: Acl.Permissions): Acl.Permissions {\n\t\treturn mapObject(permissions, (permission, entityName): Acl.EntityPermissions => {\n\t\t\tconst entity = getEntity(model, entityName)\n\t\t\tconst entityPredicates: Writable<Acl.PredicateMap> = { ...permission.predicates }\n\t\t\tconst entityOperations: Writable<Acl.EntityOperations> = { ...permission.operations }\n\n\t\t\tconst operationNames = ['read', 'create', 'update'] as const\n\t\t\tfor (let operation of operationNames) {\n\t\t\t\tif (!entityOperations[operation]) {\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\t\t\t\tconst fieldPermissions: Writable<Acl.FieldPermissions> = { ...entityOperations[operation] }\n\t\t\t\tentityOperations[operation] = fieldPermissions\n\n\t\t\t\tif (Object.values(fieldPermissions).some(it => it === true)) {\n\t\t\t\t\tfieldPermissions[entity.primary] = true\n\t\t\t\t}\n\t\t\t\tif (fieldPermissions[entity.primary] === true) {\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\t\t\t\tconst predicateReferences: string[] = Object.entries(fieldPermissions)\n\t\t\t\t\t.filter(([key]) => key !== entity.primary)\n\t\t\t\t\t.map(([key, value]) => value)\n\t\t\t\t\t.filter(value => value !== false)\n\t\t\t\t\t.filter((value, index, array): value is string => array.indexOf(value) === index)\n\n\t\t\t\tlet idPermissions: Acl.Predicate = fieldPermissions[entity.primary] || false\n\n\t\t\t\tfor (let predicateReference of predicateReferences) {\n\t\t\t\t\tconst { predicateDefinition, predicate } = this.mergePredicates(\n\t\t\t\t\t\tentityPredicates,\n\t\t\t\t\t\tidPermissions,\n\t\t\t\t\t\tentityPredicates,\n\t\t\t\t\t\tpredicateReference,\n\t\t\t\t\t)\n\t\t\t\t\tif (typeof predicate !== 'string' || predicateDefinition === undefined) {\n\t\t\t\t\t\tthrow new Error('should not happen')\n\t\t\t\t\t}\n\t\t\t\t\tidPermissions = predicate\n\t\t\t\t\tentityPredicates[predicate] = predicateDefinition\n\t\t\t\t}\n\t\t\t\tfieldPermissions[entity.primary] = idPermissions\n\t\t\t\tentityPredicates[idPermissions as Acl.PredicateReference] = entityPredicates[idPermissions as Acl.PredicateReference]\n\t\t\t}\n\t\t\treturn {\n\t\t\t\toperations: entityOperations,\n\t\t\t\tpredicates: entityPredicates,\n\t\t\t}\n\t\t})\n\t}\n\n\tprivate mergePermissions(left: Acl.Permissions, right: Acl.Permissions): Acl.Permissions {\n\t\tconst result = { ...left }\n\t\tfor (let entityName in right) {\n\t\t\tif (result[entityName] !== undefined) {\n\t\t\t\tresult[entityName] = this.mergeEntityPermissions(result[entityName], right[entityName])\n\t\t\t} else {\n\t\t\t\tresult[entityName] = right[entityName]\n\t\t\t}\n\t\t}\n\t\treturn result\n\t}\n\n\tprivate mergeEntityPermissions(left: Acl.EntityPermissions, right: Acl.EntityPermissions): Acl.EntityPermissions {\n\t\tlet predicates: Writable<Acl.PredicateMap> = {}\n\t\tconst operations: Writable<Acl.EntityOperations> = {}\n\t\tif (left.operations.customPrimary || right.operations.customPrimary) {\n\t\t\toperations.customPrimary = true\n\t\t}\n\t\tconst noRoot: `${Acl.Operation}`[] = []\n\n\t\tfor (let operation of [\n\t\t\t'create',\n\t\t\t'read',\n\t\t\t'update',\n\t\t] as const) {\n\n\t\t\tconst { predicates: opPredicates, permissions: fieldPermissions, noRoot: opNoRoot } = this.mergeOperationPermissions(left, right, operation)\n\n\t\t\tif (opNoRoot) {\n\t\t\t\tnoRoot.push(operation)\n\t\t\t}\n\n\t\t\tpredicates = { ...predicates, ...opPredicates }\n\t\t\tif (Object.keys(fieldPermissions).length > 0) {\n\t\t\t\toperations[operation] = fieldPermissions\n\t\t\t}\n\t\t}\n\n\t\tconst { predicateDefinition, predicate, noRoot: opNoRoot } = this.mergeDeletePermissions(left, right)\n\t\tif (opNoRoot) {\n\t\t\tnoRoot.push('delete')\n\t\t}\n\t\tif (predicate === true) {\n\t\t\toperations.delete = true\n\t\t} else if (predicateDefinition !== undefined && typeof predicate === 'string') {\n\t\t\tpredicates[predicate] = predicateDefinition\n\t\t\toperations.delete = predicate\n\t\t}\n\n\n\t\tif (noRoot.length > 0) {\n\t\t\toperations.noRoot = noRoot\n\t\t}\n\n\t\treturn {\n\t\t\tpredicates: predicates,\n\t\t\toperations: operations,\n\t\t}\n\t}\n\n\n\tprivate mergeOperationPermissions(left: Acl.EntityPermissions, right: Acl.EntityPermissions, operation: 'create' | 'read' | 'update'): {\n\t\tnoRoot: boolean\n\t\tpredicates: Acl.PredicateMap\n\t\tpermissions: Acl.FieldPermissions\n\t} {\n\t\tconst { noRoot, leftPermissions, rightPermissions } = this.resolveNoRoot(left, right, operation)\n\t\treturn {\n\t\t\tnoRoot,\n\t\t\t...this.mergeFieldPermissions(\n\t\t\t\tleft.predicates,\n\t\t\t\tleftPermissions,\n\t\t\t\tright.predicates,\n\t\t\t\trightPermissions,\n\t\t\t),\n\t\t}\n\t}\n\n\tprivate mergeDeletePermissions(left: Acl.EntityPermissions, right: Acl.EntityPermissions): {\n\t\tnoRoot: boolean\n\t\tpredicate: Acl.PredicateReference | boolean\n\t\tpredicateDefinition: Acl.PredicateDefinition | undefined\n\t} {\n\t\tconst { noRoot, leftPermissions, rightPermissions } = this.resolveNoRoot(left, right, 'delete')\n\n\t\treturn {\n\t\t\tnoRoot,\n\t\t\t...this.mergePredicates(\n\t\t\t\tleft.predicates,\n\t\t\t\tleftPermissions,\n\t\t\t\tright.predicates,\n\t\t\t\trightPermissions,\n\t\t\t),\n\t\t}\n\t}\n\n\tprivate resolveNoRoot<const Op extends`${Acl.Operation}`>(left: Acl.EntityPermissions, right: Acl.EntityPermissions, operation: Op): {\n\t\tnoRoot: boolean\n\t\tleftPermissions: Acl.EntityPermissions['operations'][Op] | undefined\n\t\trightPermissions: Acl.EntityPermissions['operations'][Op] | undefined\n\t} {\n\t\tconst leftRootForbidden = left.operations.noRoot?.includes(operation) || false\n\t\tconst rightRootForbidden = right.operations.noRoot?.includes(operation) || false\n\t\tconst leftPermissions = left.operations[operation]\n\t\tconst rightPermissions = right.operations[operation]\n\n\t\tconst rootForbidden = (leftRootForbidden && rightRootForbidden)\n\t\t\t|| (leftRootForbidden && !rightPermissions)\n\t\t\t|| (rightRootForbidden && !leftPermissions)\n\n\t\tconst resolvedLeftPermissions = !rootForbidden && leftRootForbidden ? undefined : leftPermissions\n\t\tconst resolvedRightPermissions = !rootForbidden && rightRootForbidden ? undefined : rightPermissions\n\n\t\treturn {\n\t\t\tnoRoot: rootForbidden,\n\t\t\tleftPermissions: resolvedLeftPermissions,\n\t\t\trightPermissions: resolvedRightPermissions,\n\t\t}\n\t}\n\n\tprivate mergeFieldPermissions(\n\t\tleftPredicates: Acl.PredicateMap,\n\t\tleftFieldPermissions: Acl.FieldPermissions | undefined = {},\n\t\trightPredicates: Acl.PredicateMap,\n\t\trightFieldPermissions: Acl.FieldPermissions | undefined = {},\n\t): {predicates: Acl.PredicateMap; permissions: Acl.FieldPermissions} {\n\t\tconst permissions: Writable<Acl.FieldPermissions> = {}\n\t\tconst predicates: Writable<Acl.PredicateMap> = {}\n\n\t\tfor (let field in { ...leftFieldPermissions, ...rightFieldPermissions }) {\n\t\t\tconst { predicateDefinition, predicate } = this.mergePredicates(\n\t\t\t\tleftPredicates,\n\t\t\t\tleftFieldPermissions[field] || false,\n\t\t\t\trightPredicates,\n\t\t\t\trightFieldPermissions[field] || false,\n\t\t\t)\n\t\t\tif (predicate === true) {\n\t\t\t\tpermissions[field] = true\n\t\t\t} else if (predicateDefinition !== undefined && typeof predicate === 'string') {\n\t\t\t\tpermissions[field] = predicate\n\t\t\t\tpredicates[predicate] = predicateDefinition\n\t\t\t}\n\t\t}\n\n\t\treturn { predicates, permissions }\n\t}\n\n\tprivate mergePredicates(\n\t\tleftPredicates: Acl.PredicateMap,\n\t\tleftReference: Acl.Predicate | undefined = false,\n\t\trightPredicates: Acl.PredicateMap,\n\t\trightReference: Acl.Predicate | undefined = false,\n\t): {\n\t\tpredicate: Acl.PredicateReference | boolean\n\t\tpredicateDefinition: Acl.PredicateDefinition | undefined\n\t} {\n\t\tif (leftReference === true || rightReference === true) {\n\t\t\treturn {\n\t\t\t\tpredicate: true,\n\t\t\t\tpredicateDefinition: undefined,\n\t\t\t}\n\t\t}\n\n\t\tif (leftReference !== false && rightReference !== false) {\n\t\t\tconst leftPredicate: Acl.PredicateDefinition = leftPredicates[leftReference]\n\t\t\tconst rightPredicate: Acl.PredicateDefinition = rightPredicates[rightReference]\n\t\t\tif (leftPredicate === rightPredicate) {\n\t\t\t\treturn {\n\t\t\t\t\tpredicate: leftReference,\n\t\t\t\t\tpredicateDefinition: leftPredicate,\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tlet predicateName = '__merge__' + leftReference + '__' + rightReference\n\t\t\twhile (leftPredicates[predicateName]) {\n\t\t\t\tpredicateName += '_'\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tpredicate: predicateName,\n\t\t\t\tpredicateDefinition: {\n\t\t\t\t\tor: [leftPredicate, rightPredicate],\n\t\t\t\t} as Acl.PredicateDefinition,\n\t\t\t}\n\t\t} else if (leftReference !== false) {\n\t\t\treturn {\n\t\t\t\tpredicate: leftReference,\n\t\t\t\tpredicateDefinition: leftPredicates[leftReference],\n\t\t\t}\n\t\t} else if (rightReference !== false) {\n\t\t\tlet predicateName = rightReference\n\t\t\tif (rightPredicates !== leftPredicates) {\n\t\t\t\twhile (leftPredicates[predicateName]) {\n\t\t\t\t\tpredicateName += '_'\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tpredicate: predicateName,\n\t\t\t\tpredicateDefinition: rightPredicates[rightReference],\n\t\t\t}\n\t\t} else {\n\t\t\treturn {\n\t\t\t\tpredicate: false,\n\t\t\t\tpredicateDefinition: undefined,\n\t\t\t}\n\t\t}\n\t}\n}\n"],"names":["opNoRoot"],"mappings":";;;AASO,MAAM,kBAAkB;AAAA,EACvB,OAAO,QAAgB,OAA0B,QAAkC;AACzF,QAAI,SAA0B,CAAC;AAC/B,aAAS,QAAQ,OAAO;AACjB,YAAA,iBAAiB,OAAO,IAAI,MAAM,IAAI,KAAK,EAAE,UAAU,GAAG;AAC5D,UAAA,kBAAmC,KAAK,yBAAyB,OAAO,OAAO,eAAe,UAAU,UAAU,IAAI;AAC1H,UAAI,eAAe,UAAU;AAC5B,cAAM,uBAAuB,KAAK,OAAO,QAAQ,eAAe,UAAU,UAAU,IAAI;AACtE,0BAAA,KAAK,iBAAiB,sBAAsB,eAAe;AAAA,MAAA;AAErE,eAAA,KAAK,iBAAiB,QAAQ,eAAe;AAAA,IAAA;AAEvD,aAAS,KAAK,sCAAsC,OAAO,OAAO,MAAM;AAEjE,WAAA;AAAA,EAAA;AAAA,EAGA,yBAAyB,OAAqB,aAA8B,MAA+B;AAClH,WAAO,UAAU,aAAa,CAAC,EAAE,YAAY,cAAc,gBAAgB;AAAA,MAC1E;AAAA,MACA,YAAY,UAAU,YAAY,CAAa,cAAA;AACxC,cAAA,+BAA+B,IAAI,6BAA6B,KAAK;AAC3E,eAAO,6BAA6B,QAAQ,UAAU,OAAO,UAAU,GAAG,WAAW;AAAA,UACpF,cAAc,CAAC,EAAE,YAAY;AACxB,gBAAA,OAAO,UAAU,UAAU;AACvB,qBAAA,eAAe,MAAM,KAAK;AAAA,YAAA;AAE3B,mBAAA;AAAA,UACR;AAAA,UACA,gBAAgB,CAAC,EAAE,YAAY;AAC1B,gBAAA,OAAO,UAAU,UAAU;AACvB,qBAAA,eAAe,MAAM,KAAK;AAAA,YAAA;AAE3B,mBAAA;AAAA,UAAA;AAAA,QACR,CACA;AAAA,MACD,CAAA;AAAA,IAAA,EACA;AAAA,EAAA;AAAA,EAGK,sCAAsC,OAAqB,aAA+C;AACjH,WAAO,UAAU,aAAa,CAAC,YAAY,eAAsC;AAC1E,YAAA,SAAS,UAAU,OAAO,UAAU;AAC1C,YAAM,mBAA+C,EAAE,GAAG,WAAW,WAAW;AAChF,YAAM,mBAAmD,EAAE,GAAG,WAAW,WAAW;AAEpF,YAAM,iBAAiB,CAAC,QAAQ,UAAU,QAAQ;AAClD,eAAS,aAAa,gBAAgB;AACjC,YAAA,CAAC,iBAAiB,SAAS,GAAG;AACjC;AAAA,QAAA;AAED,cAAM,mBAAmD,EAAE,GAAG,iBAAiB,SAAS,EAAE;AAC1F,yBAAiB,SAAS,IAAI;AAE1B,YAAA,OAAO,OAAO,gBAAgB,EAAE,KAAK,CAAM,OAAA,OAAO,IAAI,GAAG;AAC3C,2BAAA,OAAO,OAAO,IAAI;AAAA,QAAA;AAEpC,YAAI,iBAAiB,OAAO,OAAO,MAAM,MAAM;AAC9C;AAAA,QAAA;AAED,cAAM,sBAAgC,OAAO,QAAQ,gBAAgB,EACnE,OAAO,CAAC,CAAC,GAAG,MAAM,QAAQ,OAAO,OAAO,EACxC,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,KAAK,EAC3B,OAAO,CAAS,UAAA,UAAU,KAAK,EAC/B,OAAO,CAAC,OAAO,OAAO,UAA2B,MAAM,QAAQ,KAAK,MAAM,KAAK;AAEjF,YAAI,gBAA+B,iBAAiB,OAAO,OAAO,KAAK;AAEvE,iBAAS,sBAAsB,qBAAqB;AACnD,gBAAM,EAAE,qBAAqB,UAAU,IAAI,KAAK;AAAA,YAC/C;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACD;AACA,cAAI,OAAO,cAAc,YAAY,wBAAwB,QAAW;AACjE,kBAAA,IAAI,MAAM,mBAAmB;AAAA,UAAA;AAEpB,0BAAA;AAChB,2BAAiB,SAAS,IAAI;AAAA,QAAA;AAEd,yBAAA,OAAO,OAAO,IAAI;AAClB,yBAAA,aAAuC,IAAI,iBAAiB,aAAuC;AAAA,MAAA;AAE9G,aAAA;AAAA,QACN,YAAY;AAAA,QACZ,YAAY;AAAA,MACb;AAAA,IAAA,CACA;AAAA,EAAA;AAAA,EAGM,iBAAiB,MAAuB,OAAyC;AAClF,UAAA,SAAS,EAAE,GAAG,KAAK;AACzB,aAAS,cAAc,OAAO;AACzB,UAAA,OAAO,UAAU,MAAM,QAAW;AAC9B,eAAA,UAAU,IAAI,KAAK,uBAAuB,OAAO,UAAU,GAAG,MAAM,UAAU,CAAC;AAAA,MAAA,OAChF;AACC,eAAA,UAAU,IAAI,MAAM,UAAU;AAAA,MAAA;AAAA,IACtC;AAEM,WAAA;AAAA,EAAA;AAAA,EAGA,uBAAuB,MAA6B,OAAqD;AAChH,QAAI,aAAyC,CAAC;AAC9C,UAAM,aAA6C,CAAC;AACpD,QAAI,KAAK,WAAW,iBAAiB,MAAM,WAAW,eAAe;AACpE,iBAAW,gBAAgB;AAAA,IAAA;AAE5B,UAAM,SAA+B,CAAC;AAEtC,aAAS,aAAa;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA,IAAA,GACW;AAEX,YAAM,EAAE,YAAY,cAAc,aAAa,kBAAkB,QAAQA,UAAS,IAAI,KAAK,0BAA0B,MAAM,OAAO,SAAS;AAE3I,UAAIA,WAAU;AACb,eAAO,KAAK,SAAS;AAAA,MAAA;AAGtB,mBAAa,EAAE,GAAG,YAAY,GAAG,aAAa;AAC9C,UAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,GAAG;AAC7C,mBAAW,SAAS,IAAI;AAAA,MAAA;AAAA,IACzB;AAGK,UAAA,EAAE,qBAAqB,WAAW,QAAQ,SAAa,IAAA,KAAK,uBAAuB,MAAM,KAAK;AACpG,QAAI,UAAU;AACb,aAAO,KAAK,QAAQ;AAAA,IAAA;AAErB,QAAI,cAAc,MAAM;AACvB,iBAAW,SAAS;AAAA,IACV,WAAA,wBAAwB,UAAa,OAAO,cAAc,UAAU;AAC9E,iBAAW,SAAS,IAAI;AACxB,iBAAW,SAAS;AAAA,IAAA;AAIjB,QAAA,OAAO,SAAS,GAAG;AACtB,iBAAW,SAAS;AAAA,IAAA;AAGd,WAAA;AAAA,MACN;AAAA,MACA;AAAA,IACD;AAAA,EAAA;AAAA,EAIO,0BAA0B,MAA6B,OAA8B,WAI3F;AACK,UAAA,EAAE,QAAQ,iBAAiB,qBAAqB,KAAK,cAAc,MAAM,OAAO,SAAS;AACxF,WAAA;AAAA,MACN;AAAA,MACA,GAAG,KAAK;AAAA,QACP,KAAK;AAAA,QACL;AAAA,QACA,MAAM;AAAA,QACN;AAAA,MAAA;AAAA,IAEF;AAAA,EAAA;AAAA,EAGO,uBAAuB,MAA6B,OAI1D;AACK,UAAA,EAAE,QAAQ,iBAAiB,qBAAqB,KAAK,cAAc,MAAM,OAAO,QAAQ;AAEvF,WAAA;AAAA,MACN;AAAA,MACA,GAAG,KAAK;AAAA,QACP,KAAK;AAAA,QACL;AAAA,QACA,MAAM;AAAA,QACN;AAAA,MAAA;AAAA,IAEF;AAAA,EAAA;AAAA,EAGO,cAAkD,MAA6B,OAA8B,WAInH;AACD,UAAM,oBAAoB,KAAK,WAAW,QAAQ,SAAS,SAAS,KAAK;AACzE,UAAM,qBAAqB,MAAM,WAAW,QAAQ,SAAS,SAAS,KAAK;AACrE,UAAA,kBAAkB,KAAK,WAAW,SAAS;AAC3C,UAAA,mBAAmB,MAAM,WAAW,SAAS;AAEnD,UAAM,gBAAiB,qBAAqB,sBACvC,qBAAqB,CAAC,oBACtB,sBAAsB,CAAC;AAE5B,UAAM,0BAA0B,CAAC,iBAAiB,oBAAoB,SAAY;AAClF,UAAM,2BAA2B,CAAC,iBAAiB,qBAAqB,SAAY;AAE7E,WAAA;AAAA,MACN,QAAQ;AAAA,MACR,iBAAiB;AAAA,MACjB,kBAAkB;AAAA,IACnB;AAAA,EAAA;AAAA,EAGO,sBACP,gBACA,uBAAyD,IACzD,iBACA,wBAA0D,IACU;AACpE,UAAM,cAA8C,CAAC;AACrD,UAAM,aAAyC,CAAC;AAEhD,aAAS,SAAS,EAAE,GAAG,sBAAsB,GAAG,yBAAyB;AACxE,YAAM,EAAE,qBAAqB,UAAU,IAAI,KAAK;AAAA,QAC/C;AAAA,QACA,qBAAqB,KAAK,KAAK;AAAA,QAC/B;AAAA,QACA,sBAAsB,KAAK,KAAK;AAAA,MACjC;AACA,UAAI,cAAc,MAAM;AACvB,oBAAY,KAAK,IAAI;AAAA,MACX,WAAA,wBAAwB,UAAa,OAAO,cAAc,UAAU;AAC9E,oBAAY,KAAK,IAAI;AACrB,mBAAW,SAAS,IAAI;AAAA,MAAA;AAAA,IACzB;AAGM,WAAA,EAAE,YAAY,YAAY;AAAA,EAAA;AAAA,EAG1B,gBACP,gBACA,gBAA2C,OAC3C,iBACA,iBAA4C,OAI3C;AACG,QAAA,kBAAkB,QAAQ,mBAAmB,MAAM;AAC/C,aAAA;AAAA,QACN,WAAW;AAAA,QACX,qBAAqB;AAAA,MACtB;AAAA,IAAA;AAGG,QAAA,kBAAkB,SAAS,mBAAmB,OAAO;AAClD,YAAA,gBAAyC,eAAe,aAAa;AACrE,YAAA,iBAA0C,gBAAgB,cAAc;AAC9E,UAAI,kBAAkB,gBAAgB;AAC9B,eAAA;AAAA,UACN,WAAW;AAAA,UACX,qBAAqB;AAAA,QACtB;AAAA,MAAA;AAGG,UAAA,gBAAgB,cAAc,gBAAgB,OAAO;AAClD,aAAA,eAAe,aAAa,GAAG;AACpB,yBAAA;AAAA,MAAA;AAEX,aAAA;AAAA,QACN,WAAW;AAAA,QACX,qBAAqB;AAAA,UACpB,IAAI,CAAC,eAAe,cAAc;AAAA,QAAA;AAAA,MAEpC;AAAA,IAAA,WACU,kBAAkB,OAAO;AAC5B,aAAA;AAAA,QACN,WAAW;AAAA,QACX,qBAAqB,eAAe,aAAa;AAAA,MAClD;AAAA,IAAA,WACU,mBAAmB,OAAO;AACpC,UAAI,gBAAgB;AACpB,UAAI,oBAAoB,gBAAgB;AAChC,eAAA,eAAe,aAAa,GAAG;AACpB,2BAAA;AAAA,QAAA;AAAA,MAClB;AAEM,aAAA;AAAA,QACN,WAAW;AAAA,QACX,qBAAqB,gBAAgB,cAAc;AAAA,MACpD;AAAA,IAAA,OACM;AACC,aAAA;AAAA,QACN,WAAW;AAAA,QACX,qBAAqB;AAAA,MACtB;AAAA,IAAA;AAAA,EACD;AAEF;"}