@contember/engine-content-api 2.1.0-alpha.37 → 2.1.0-alpha.39

package/dist/development/src/acl/PredicatesInjector.cjs

@@ -0,0 +1,147 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const schema = require("@contember/schema");
+const schemaUtils = require("@contember/schema-utils");
+class PredicatesInjector {
+  constructor(schema2, predicateFactory) {
+    this.schema = schema2;
+    this.predicateFactory = predicateFactory;
+  }
+  inject(entity, where, relationContext, ancestorPath) {
+    const restrictedWhere = this.injectToWhere(where, entity, true, relationContext, false, ancestorPath ?? []);
+    return this.createWhere(entity, void 0, restrictedWhere, relationContext, false, ancestorPath ?? []);
+  }
+  /**
+   * Finds an ancestor in the path that matches the given relation as a back-reference.
+   * A match occurs when:
+   * 1. The relation we're traversing has the same name as the inverse (targetRelation) of a relation in the ancestor path
+   * 2. AND the entity where our relation is defined matches the targetEntity in the path
+   *    (to prevent false positives when different entities have relations with the same name)
+   */
+  findBackReferencedAncestor(ancestorPath, relationName, relationSourceEntityName) {
+    return ancestorPath.find(
+      (ctx) => ctx.targetRelation?.name === relationName && ctx.targetEntity.name === relationSourceEntityName
+    );
+  }
+  createWhere(entity, fieldNames, where, relationContext, isBackReferenceContext, ancestorPath) {
+    const shouldSimplify = isBackReferenceContext === true && ancestorPath !== void 0 && relationContext !== void 0 && this.findBackReferencedAncestor(ancestorPath, relationContext.relation.name, relationContext.entity.name) !== void 0;
+    let predicatesWhere;
+    if (shouldSimplify) {
+      predicatesWhere = { [entity.primary]: { always: true } };
+    } else {
+      const rawPredicate = this.predicateFactory.create(entity, schema.Acl.Operation.read, fieldNames, relationContext);
+      predicatesWhere = this.injectPredicatesToPredicate(
+        rawPredicate,
+        entity,
+        isBackReferenceContext ?? false,
+        ancestorPath ?? []
+      );
+    }
+    const and = [where, predicatesWhere].filter((it) => Object.keys(it).length > 0);
+    if (and.length === 0) {
+      return {};
+    }
+    if (and.length === 1) {
+      return and[0];
+    }
+    return { and };
+  }
+  /**
+   * Processes a predicate and injects nested entity predicates for any relation traversals.
+   * This ensures that when a predicate like { department: { company: { name: 'Acme' } } }
+   * is used, the predicates of Department and Company are also applied.
+   */
+  injectPredicatesToPredicate(where, entity, isBackReferenceContext, ancestorPath) {
+    const resultWhere = {};
+    if (where.and) {
+      resultWhere.and = where.and.filter((it) => !!it).map((it) => this.injectPredicatesToPredicate(it, entity, isBackReferenceContext, ancestorPath));
+    }
+    if (where.or) {
+      resultWhere.or = where.or.filter((it) => !!it).map((it) => this.injectPredicatesToPredicate(it, entity, isBackReferenceContext, ancestorPath));
+    }
+    if (where.not) {
+      resultWhere.not = this.injectPredicatesToPredicate(where.not, entity, isBackReferenceContext, ancestorPath);
+    }
+    const fields = Object.keys(where).filter((it) => !["and", "or", "not"].includes(it));
+    for (const field of fields) {
+      resultWhere[field] = schemaUtils.acceptFieldVisitor(this.schema, entity, field, {
+        visitColumn: () => where[field],
+        visitRelation: (context) => {
+          const relationWhere = where[field];
+          if (relationWhere === null) {
+            return null;
+          }
+          const isBackReference = this.findBackReferencedAncestor(
+            ancestorPath,
+            context.relation.name,
+            context.entity.name
+          ) !== void 0;
+          const nestedIsBackReferenceContext = isBackReference || isBackReferenceContext;
+          const nestedAncestorPath = [...ancestorPath, context];
+          const processedNestedWhere = this.injectPredicatesToPredicate(
+            relationWhere,
+            context.targetEntity,
+            nestedIsBackReferenceContext,
+            nestedAncestorPath
+          );
+          const shouldSimplifyNested = nestedIsBackReferenceContext && this.findBackReferencedAncestor(nestedAncestorPath, context.relation.name, context.entity.name) !== void 0;
+          const targetPredicate = shouldSimplifyNested ? { [context.targetEntity.primary]: { always: true } } : this.predicateFactory.create(context.targetEntity, schema.Acl.Operation.read, void 0, context);
+          const primaryKey = context.targetEntity.primary;
+          const nestedIsAlwaysTrue = Object.keys(processedNestedWhere).length === 1 && processedNestedWhere[primaryKey] !== void 0 && processedNestedWhere[primaryKey]?.always === true;
+          const targetIsAlwaysTrue = Object.keys(targetPredicate).length === 1 && targetPredicate[primaryKey] !== void 0 && targetPredicate[primaryKey]?.always === true;
+          if (nestedIsAlwaysTrue && targetIsAlwaysTrue) {
+            return processedNestedWhere;
+          }
+          const parts = [processedNestedWhere, targetPredicate].filter((it) => Object.keys(it).length > 0);
+          if (parts.length === 0) {
+            return {};
+          }
+          if (parts.length === 1) {
+            return parts[0];
+          }
+          return { and: parts };
+        }
+      });
+    }
+    return resultWhere;
+  }
+  injectToWhere(where, entity, isRoot, relationContext, isBackReferenceContext, ancestorPath) {
+    const resultWhere = {};
+    if (where.and) {
+      resultWhere.and = where.and.filter((it) => !!it).map(
+        (it) => this.injectToWhere(it, entity, isRoot, relationContext, isBackReferenceContext, ancestorPath)
+      );
+    }
+    if (where.or) {
+      resultWhere.or = where.or.filter((it) => !!it).map(
+        (it) => this.injectToWhere(it, entity, isRoot, relationContext, isBackReferenceContext, ancestorPath)
+      );
+    }
+    if (where.not) {
+      resultWhere.not = this.injectToWhere(where.not, entity, isRoot, relationContext, isBackReferenceContext, ancestorPath);
+    }
+    const fields = Object.keys(where).filter((it) => !["and", "or", "not"].includes(it));
+    if (fields.length === 0) {
+      return resultWhere;
+    }
+    for (let field of fields) {
+      resultWhere[field] = schemaUtils.acceptFieldVisitor(this.schema, entity, field, {
+        visitColumn: () => where[field],
+        visitRelation: (context) => {
+          const relationWhere = where[field];
+          if (relationWhere === null) {
+            return null;
+          }
+          const isBackReference = this.findBackReferencedAncestor(ancestorPath, context.relation.name, context.entity.name) !== void 0;
+          const nestedIsBackReferenceContext = isBackReference || isBackReferenceContext;
+          const nestedAncestorPath = [...ancestorPath, context];
+          return this.injectToWhere(relationWhere, context.targetEntity, false, context, nestedIsBackReferenceContext, nestedAncestorPath);
+        }
+      });
+    }
+    const fieldsForPredicate = !isRoot ? fields : fields.filter((it) => this.predicateFactory.shouldApplyCellLevelPredicate(entity, schema.Acl.Operation.read, it));
+    return this.createWhere(entity, fieldsForPredicate, resultWhere, relationContext, isBackReferenceContext, ancestorPath);
+  }
+}
+exports.PredicatesInjector = PredicatesInjector;
+//# sourceMappingURL=PredicatesInjector.cjs.map

package/dist/development/src/acl/PredicatesInjector.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PredicatesInjector.cjs","sources":["../../../../../packages/engine-content-api/src/acl/PredicatesInjector.ts"],"sourcesContent":["import { Acl, Input, Model, Writable } from '@contember/schema'\nimport { acceptFieldVisitor } from '@contember/schema-utils'\nimport { PredicateFactory } from './PredicateFactory'\n\nexport class PredicatesInjector {\n\tconstructor(private readonly schema: Model.Schema, private readonly predicateFactory: PredicateFactory) {}\n\n\tpublic inject(\n\t\tentity: Model.Entity,\n\t\twhere: Input.OptionalWhere,\n\t\trelationContext?: Model.AnyRelationContext,\n\t\tancestorPath?: readonly Model.AnyRelationContext[],\n\t): Input.OptionalWhere {\n\t\tconst restrictedWhere = this.injectToWhere(where, entity, true, relationContext, false, ancestorPath ?? [])\n\t\treturn this.createWhere(entity, undefined, restrictedWhere, relationContext, false, ancestorPath ?? [])\n\t}\n\n\t/**\n\t * Finds an ancestor in the path that matches the given relation as a back-reference.\n\t * A match occurs when:\n\t * 1. The relation we're traversing has the same name as the inverse (targetRelation) of a relation in the ancestor path\n\t * 2. AND the entity where our relation is defined matches the targetEntity in the path\n\t *    (to prevent false positives when different entities have relations with the same name)\n\t */\n\tprivate findBackReferencedAncestor(\n\t\tancestorPath: readonly Model.AnyRelationContext[],\n\t\trelationName: string,\n\t\trelationSourceEntityName: string,\n\t): Model.AnyRelationContext | undefined {\n\t\treturn ancestorPath.find(ctx =>\n\t\t\tctx.targetRelation?.name === relationName\n\t\t\t&& ctx.targetEntity.name === relationSourceEntityName\n\t\t)\n\t}\n\n\tprivate createWhere(\n\t\tentity: Model.Entity,\n\t\tfieldNames: string[] | undefined,\n\t\twhere: Input.OptionalWhere,\n\t\trelationContext?: Model.AnyRelationContext,\n\t\tisBackReferenceContext?: boolean,\n\t\tancestorPath?: readonly Model.AnyRelationContext[],\n\t): Input.OptionalWhere {\n\t\t// Simplify predicates when:\n\t\t// 1. We're in a back-reference context (inside a filter that traverses back)\n\t\t// 2. AND the relation we traversed to get here corresponds to a relation in our query path\n\t\t// This ensures we only simplify when the traversed relation actually corresponds\n\t\t// to a relation in our query path (not just any relation to the same entity type)\n\t\tconst shouldSimplify = isBackReferenceContext === true\n\t\t\t&& ancestorPath !== undefined\n\t\t\t&& relationContext !== undefined\n\t\t\t&& this.findBackReferencedAncestor(ancestorPath, relationContext.relation.name, relationContext.entity.name) !== undefined\n\n\t\tlet predicatesWhere: Input.OptionalWhere\n\t\tif (shouldSimplify) {\n\t\t\tpredicatesWhere = { [entity.primary]: { always: true } }\n\t\t} else {\n\t\t\tconst rawPredicate = this.predicateFactory.create(entity, Acl.Operation.read, fieldNames, relationContext)\n\t\t\t// Process the predicate to inject nested entity predicates\n\t\t\tpredicatesWhere = this.injectPredicatesToPredicate(\n\t\t\t\trawPredicate,\n\t\t\t\tentity,\n\t\t\t\tisBackReferenceContext ?? false,\n\t\t\t\tancestorPath ?? [],\n\t\t\t)\n\t\t}\n\n\t\tconst and = [where, predicatesWhere].filter(it => Object.keys(it).length > 0)\n\t\tif (and.length === 0) {\n\t\t\treturn {}\n\t\t}\n\t\tif (and.length === 1) {\n\t\t\treturn and[0]\n\t\t}\n\t\treturn { and: and }\n\t}\n\n\t/**\n\t * Processes a predicate and injects nested entity predicates for any relation traversals.\n\t * This ensures that when a predicate like { department: { company: { name: 'Acme' } } }\n\t * is used, the predicates of Department and Company are also applied.\n\t */\n\tprivate injectPredicatesToPredicate(\n\t\twhere: Input.OptionalWhere,\n\t\tentity: Model.Entity,\n\t\tisBackReferenceContext: boolean,\n\t\tancestorPath: readonly Model.AnyRelationContext[],\n\t): Input.OptionalWhere {\n\t\tconst resultWhere: Writable<Input.OptionalWhere> = {}\n\n\t\tif (where.and) {\n\t\t\tresultWhere.and = where.and\n\t\t\t\t.filter((it): it is Input.Where => !!it)\n\t\t\t\t.map(it => this.injectPredicatesToPredicate(it, entity, isBackReferenceContext, ancestorPath))\n\t\t}\n\t\tif (where.or) {\n\t\t\tresultWhere.or = where.or\n\t\t\t\t.filter((it): it is Input.Where => !!it)\n\t\t\t\t.map(it => this.injectPredicatesToPredicate(it, entity, isBackReferenceContext, ancestorPath))\n\t\t}\n\t\tif (where.not) {\n\t\t\tresultWhere.not = this.injectPredicatesToPredicate(where.not, entity, isBackReferenceContext, ancestorPath)\n\t\t}\n\n\t\tconst fields = Object.keys(where).filter(it => !['and', 'or', 'not'].includes(it))\n\n\t\tfor (const field of fields) {\n\t\t\tresultWhere[field] = acceptFieldVisitor(this.schema, entity, field, {\n\t\t\t\tvisitColumn: () => where[field],\n\t\t\t\tvisitRelation: context => {\n\t\t\t\t\tconst relationWhere = where[field] as Input.OptionalWhere | null\n\t\t\t\t\tif (relationWhere === null) {\n\t\t\t\t\t\treturn null\n\t\t\t\t\t}\n\n\t\t\t\t\t// Check if this relation is a back-reference to somewhere in our ancestor path\n\t\t\t\t\tconst isBackReference = this.findBackReferencedAncestor(\n\t\t\t\t\t\tancestorPath,\n\t\t\t\t\t\tcontext.relation.name,\n\t\t\t\t\t\tcontext.entity.name,\n\t\t\t\t\t) !== undefined\n\t\t\t\t\tconst nestedIsBackReferenceContext = isBackReference || isBackReferenceContext\n\t\t\t\t\tconst nestedAncestorPath: readonly Model.AnyRelationContext[] = [...ancestorPath, context]\n\n\t\t\t\t\t// Recursively process the nested where (always do this to handle deeper nesting)\n\t\t\t\t\tconst processedNestedWhere = this.injectPredicatesToPredicate(\n\t\t\t\t\t\trelationWhere,\n\t\t\t\t\t\tcontext.targetEntity,\n\t\t\t\t\t\tnestedIsBackReferenceContext,\n\t\t\t\t\t\tnestedAncestorPath,\n\t\t\t\t\t)\n\n\t\t\t\t\t// Check if we should simplify the target entity's predicate\n\t\t\t\t\tconst shouldSimplifyNested = nestedIsBackReferenceContext\n\t\t\t\t\t\t&& this.findBackReferencedAncestor(nestedAncestorPath, context.relation.name, context.entity.name) !== undefined\n\n\t\t\t\t\t// Get target entity's predicate (simplified if back-reference)\n\t\t\t\t\tconst targetPredicate = shouldSimplifyNested\n\t\t\t\t\t\t? { [context.targetEntity.primary]: { always: true } }\n\t\t\t\t\t\t: this.predicateFactory.create(context.targetEntity, Acl.Operation.read, undefined, context)\n\n\t\t\t\t\t// Optimization: avoid duplicate { id: always } when both are simplified\n\t\t\t\t\tconst primaryKey = context.targetEntity.primary\n\t\t\t\t\tconst nestedIsAlwaysTrue = Object.keys(processedNestedWhere).length === 1\n\t\t\t\t\t\t&& (processedNestedWhere as Record<string, unknown>)[primaryKey] !== undefined\n\t\t\t\t\t\t&& (processedNestedWhere as Record<string, Record<string, unknown>>)[primaryKey]?.always === true\n\t\t\t\t\tconst targetIsAlwaysTrue = Object.keys(targetPredicate).length === 1\n\t\t\t\t\t\t&& (targetPredicate as Record<string, unknown>)[primaryKey] !== undefined\n\t\t\t\t\t\t&& (targetPredicate as Record<string, Record<string, unknown>>)[primaryKey]?.always === true\n\n\t\t\t\t\tif (nestedIsAlwaysTrue && targetIsAlwaysTrue) {\n\t\t\t\t\t\treturn processedNestedWhere\n\t\t\t\t\t}\n\n\t\t\t\t\t// Combine the processed nested where with target entity's predicate\n\t\t\t\t\tconst parts = [processedNestedWhere, targetPredicate].filter(it => Object.keys(it).length > 0)\n\t\t\t\t\tif (parts.length === 0) {\n\t\t\t\t\t\treturn {}\n\t\t\t\t\t}\n\t\t\t\t\tif (parts.length === 1) {\n\t\t\t\t\t\treturn parts[0]\n\t\t\t\t\t}\n\t\t\t\t\treturn { and: parts }\n\t\t\t\t},\n\t\t\t})\n\t\t}\n\n\t\treturn resultWhere\n\t}\n\n\tprivate injectToWhere(\n\t\twhere: Input.OptionalWhere,\n\t\tentity: Model.Entity,\n\t\tisRoot: boolean,\n\t\trelationContext: Model.AnyRelationContext | undefined,\n\t\tisBackReferenceContext: boolean,\n\t\tancestorPath: readonly Model.AnyRelationContext[],\n\t): Input.OptionalWhere {\n\t\tconst resultWhere: Writable<Input.OptionalWhere> = {}\n\t\tif (where.and) {\n\t\t\tresultWhere.and = where.and.filter((it): it is Input.Where => !!it).map(it =>\n\t\t\t\tthis.injectToWhere(it, entity, isRoot, relationContext, isBackReferenceContext, ancestorPath)\n\t\t\t)\n\t\t}\n\t\tif (where.or) {\n\t\t\tresultWhere.or = where.or.filter((it): it is Input.Where => !!it).map(it =>\n\t\t\t\tthis.injectToWhere(it, entity, isRoot, relationContext, isBackReferenceContext, ancestorPath)\n\t\t\t)\n\t\t}\n\t\tif (where.not) {\n\t\t\tresultWhere.not = this.injectToWhere(where.not, entity, isRoot, relationContext, isBackReferenceContext, ancestorPath)\n\t\t}\n\n\t\tconst fields = Object.keys(where).filter(it => !['and', 'or', 'not'].includes(it))\n\n\t\tif (fields.length === 0) {\n\t\t\treturn resultWhere\n\t\t}\n\t\tfor (let field of fields) {\n\t\t\tresultWhere[field] = acceptFieldVisitor(this.schema, entity, field, {\n\t\t\t\tvisitColumn: () => where[field],\n\t\t\t\tvisitRelation: context => {\n\t\t\t\t\tconst relationWhere = where[field] as Input.OptionalWhere | null\n\t\t\t\t\tif (relationWhere === null) {\n\t\t\t\t\t\treturn null\n\t\t\t\t\t}\n\t\t\t\t\t// Check if this relation is a back-reference to somewhere in our ancestor path\n\t\t\t\t\tconst isBackReference = this.findBackReferencedAncestor(ancestorPath, context.relation.name, context.entity.name) !== undefined\n\t\t\t\t\t// Once we enter a back-reference context, stay in it for nested relations\n\t\t\t\t\tconst nestedIsBackReferenceContext = isBackReference || isBackReferenceContext\n\t\t\t\t\t// Build extended ancestor path for nested traversal\n\t\t\t\t\tconst nestedAncestorPath: Model.AnyRelationContext[] = [...ancestorPath, context]\n\t\t\t\t\treturn this.injectToWhere(relationWhere, context.targetEntity, false, context, nestedIsBackReferenceContext, nestedAncestorPath)\n\t\t\t\t},\n\t\t\t})\n\t\t}\n\t\tconst fieldsForPredicate = !isRoot\n\t\t\t? fields\n\t\t\t: fields.filter(it => this.predicateFactory.shouldApplyCellLevelPredicate(entity, Acl.Operation.read, it))\n\n\t\treturn this.createWhere(entity, fieldsForPredicate, resultWhere, relationContext, isBackReferenceContext, ancestorPath)\n\t}\n}\n"],"names":["schema","Acl","acceptFieldVisitor"],"mappings":";;;;AAIO,MAAM,mBAAmB;AAAA,EAC/B,YAA6BA,SAAuC,kBAAoC;AAA3E,SAAA,SAAAA;AAAuC,SAAA,mBAAA;AAAA,EAAqC;AAAA,EAElG,OACN,QACA,OACA,iBACA,cACsB;AACtB,UAAM,kBAAkB,KAAK,cAAc,OAAO,QAAQ,MAAM,iBAAiB,OAAO,gBAAgB,EAAE;AAC1G,WAAO,KAAK,YAAY,QAAQ,QAAW,iBAAiB,iBAAiB,OAAO,gBAAgB,EAAE;AAAA,EACvG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,2BACP,cACA,cACA,0BACuC;AACvC,WAAO,aAAa;AAAA,MAAK,SACxB,IAAI,gBAAgB,SAAS,gBAC1B,IAAI,aAAa,SAAS;AAAA,IAAA;AAAA,EAE/B;AAAA,EAEQ,YACP,QACA,YACA,OACA,iBACA,wBACA,cACsB;AAMtB,UAAM,iBAAiB,2BAA2B,QAC9C,iBAAiB,UACjB,oBAAoB,UACpB,KAAK,2BAA2B,cAAc,gBAAgB,SAAS,MAAM,gBAAgB,OAAO,IAAI,MAAM;AAElH,QAAI;AACJ,QAAI,gBAAgB;AACnB,wBAAkB,EAAE,CAAC,OAAO,OAAO,GAAG,EAAE,QAAQ,OAAK;AAAA,IACtD,OAAO;AACN,YAAM,eAAe,KAAK,iBAAiB,OAAO,QAAQC,OAAAA,IAAI,UAAU,MAAM,YAAY,eAAe;AAEzG,wBAAkB,KAAK;AAAA,QACtB;AAAA,QACA;AAAA,QACA,0BAA0B;AAAA,QAC1B,gBAAgB,CAAA;AAAA,MAAC;AAAA,IAEnB;AAEA,UAAM,MAAM,CAAC,OAAO,eAAe,EAAE,OAAO,CAAA,OAAM,OAAO,KAAK,EAAE,EAAE,SAAS,CAAC;AAC5E,QAAI,IAAI,WAAW,GAAG;AACrB,aAAO,CAAA;AAAA,IACR;AACA,QAAI,IAAI,WAAW,GAAG;AACrB,aAAO,IAAI,CAAC;AAAA,IACb;AACA,WAAO,EAAE,IAAA;AAAA,EACV;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,4BACP,OACA,QACA,wBACA,cACsB;AACtB,UAAM,cAA6C,CAAA;AAEnD,QAAI,MAAM,KAAK;AACd,kBAAY,MAAM,MAAM,IACtB,OAAO,CAAC,OAA0B,CAAC,CAAC,EAAE,EACtC,IAAI,QAAM,KAAK,4BAA4B,IAAI,QAAQ,wBAAwB,YAAY,CAAC;AAAA,IAC/F;AACA,QAAI,MAAM,IAAI;AACb,kBAAY,KAAK,MAAM,GACrB,OAAO,CAAC,OAA0B,CAAC,CAAC,EAAE,EACtC,IAAI,QAAM,KAAK,4BAA4B,IAAI,QAAQ,wBAAwB,YAAY,CAAC;AAAA,IAC/F;AACA,QAAI,MAAM,KAAK;AACd,kBAAY,MAAM,KAAK,4BAA4B,MAAM,KAAK,QAAQ,wBAAwB,YAAY;AAAA,IAC3G;AAEA,UAAM,SAAS,OAAO,KAAK,KAAK,EAAE,OAAO,CAAA,OAAM,CAAC,CAAC,OAAO,MAAM,KAAK,EAAE,SAAS,EAAE,CAAC;AAEjF,eAAW,SAAS,QAAQ;AAC3B,kBAAY,KAAK,IAAIC,YAAAA,mBAAmB,KAAK,QAAQ,QAAQ,OAAO;AAAA,QACnE,aAAa,MAAM,MAAM,KAAK;AAAA,QAC9B,eAAe,CAAA,YAAW;AACzB,gBAAM,gBAAgB,MAAM,KAAK;AACjC,cAAI,kBAAkB,MAAM;AAC3B,mBAAO;AAAA,UACR;AAGA,gBAAM,kBAAkB,KAAK;AAAA,YAC5B;AAAA,YACA,QAAQ,SAAS;AAAA,YACjB,QAAQ,OAAO;AAAA,UAAA,MACV;AACN,gBAAM,+BAA+B,mBAAmB;AACxD,gBAAM,qBAA0D,CAAC,GAAG,cAAc,OAAO;AAGzF,gBAAM,uBAAuB,KAAK;AAAA,YACjC;AAAA,YACA,QAAQ;AAAA,YACR;AAAA,YACA;AAAA,UAAA;AAID,gBAAM,uBAAuB,gCACzB,KAAK,2BAA2B,oBAAoB,QAAQ,SAAS,MAAM,QAAQ,OAAO,IAAI,MAAM;AAGxG,gBAAM,kBAAkB,uBACrB,EAAE,CAAC,QAAQ,aAAa,OAAO,GAAG,EAAE,QAAQ,KAAA,MAC5C,KAAK,iBAAiB,OAAO,QAAQ,cAAcD,OAAAA,IAAI,UAAU,MAAM,QAAW,OAAO;AAG5F,gBAAM,aAAa,QAAQ,aAAa;AACxC,gBAAM,qBAAqB,OAAO,KAAK,oBAAoB,EAAE,WAAW,KACnE,qBAAiD,UAAU,MAAM,UACjE,qBAAiE,UAAU,GAAG,WAAW;AAC9F,gBAAM,qBAAqB,OAAO,KAAK,eAAe,EAAE,WAAW,KAC9D,gBAA4C,UAAU,MAAM,UAC5D,gBAA4D,UAAU,GAAG,WAAW;AAEzF,cAAI,sBAAsB,oBAAoB;AAC7C,mBAAO;AAAA,UACR;AAGA,gBAAM,QAAQ,CAAC,sBAAsB,eAAe,EAAE,OAAO,CAAA,OAAM,OAAO,KAAK,EAAE,EAAE,SAAS,CAAC;AAC7F,cAAI,MAAM,WAAW,GAAG;AACvB,mBAAO,CAAA;AAAA,UACR;AACA,cAAI,MAAM,WAAW,GAAG;AACvB,mBAAO,MAAM,CAAC;AAAA,UACf;AACA,iBAAO,EAAE,KAAK,MAAA;AAAA,QACf;AAAA,MAAA,CACA;AAAA,IACF;AAEA,WAAO;AAAA,EACR;AAAA,EAEQ,cACP,OACA,QACA,QACA,iBACA,wBACA,cACsB;AACtB,UAAM,cAA6C,CAAA;AACnD,QAAI,MAAM,KAAK;AACd,kBAAY,MAAM,MAAM,IAAI,OAAO,CAAC,OAA0B,CAAC,CAAC,EAAE,EAAE;AAAA,QAAI,CAAA,OACvE,KAAK,cAAc,IAAI,QAAQ,QAAQ,iBAAiB,wBAAwB,YAAY;AAAA,MAAA;AAAA,IAE9F;AACA,QAAI,MAAM,IAAI;AACb,kBAAY,KAAK,MAAM,GAAG,OAAO,CAAC,OAA0B,CAAC,CAAC,EAAE,EAAE;AAAA,QAAI,CAAA,OACrE,KAAK,cAAc,IAAI,QAAQ,QAAQ,iBAAiB,wBAAwB,YAAY;AAAA,MAAA;AAAA,IAE9F;AACA,QAAI,MAAM,KAAK;AACd,kBAAY,MAAM,KAAK,cAAc,MAAM,KAAK,QAAQ,QAAQ,iBAAiB,wBAAwB,YAAY;AAAA,IACtH;AAEA,UAAM,SAAS,OAAO,KAAK,KAAK,EAAE,OAAO,CAAA,OAAM,CAAC,CAAC,OAAO,MAAM,KAAK,EAAE,SAAS,EAAE,CAAC;AAEjF,QAAI,OAAO,WAAW,GAAG;AACxB,aAAO;AAAA,IACR;AACA,aAAS,SAAS,QAAQ;AACzB,kBAAY,KAAK,IAAIC,YAAAA,mBAAmB,KAAK,QAAQ,QAAQ,OAAO;AAAA,QACnE,aAAa,MAAM,MAAM,KAAK;AAAA,QAC9B,eAAe,CAAA,YAAW;AACzB,gBAAM,gBAAgB,MAAM,KAAK;AACjC,cAAI,kBAAkB,MAAM;AAC3B,mBAAO;AAAA,UACR;AAEA,gBAAM,kBAAkB,KAAK,2BAA2B,cAAc,QAAQ,SAAS,MAAM,QAAQ,OAAO,IAAI,MAAM;AAEtH,gBAAM,+BAA+B,mBAAmB;AAExD,gBAAM,qBAAiD,CAAC,GAAG,cAAc,OAAO;AAChF,iBAAO,KAAK,cAAc,eAAe,QAAQ,cAAc,OAAO,SAAS,8BAA8B,kBAAkB;AAAA,QAChI;AAAA,MAAA,CACA;AAAA,IACF;AACA,UAAM,qBAAqB,CAAC,SACzB,SACA,OAAO,OAAO,CAAA,OAAM,KAAK,iBAAiB,8BAA8B,QAAQD,OAAAA,IAAI,UAAU,MAAM,EAAE,CAAC;AAE1G,WAAO,KAAK,YAAY,QAAQ,oBAAoB,aAAa,iBAAiB,wBAAwB,YAAY;AAAA,EACvH;AACD;;"}

package/dist/development/src/acl/PredicatesInjector.js

@@ -0,0 +1,147 @@
+import { Acl } from "@contember/schema";
+import { acceptFieldVisitor } from "@contember/schema-utils";
+class PredicatesInjector {
+  constructor(schema, predicateFactory) {
+    this.schema = schema;
+    this.predicateFactory = predicateFactory;
+  }
+  inject(entity, where, relationContext, ancestorPath) {
+    const restrictedWhere = this.injectToWhere(where, entity, true, relationContext, false, ancestorPath ?? []);
+    return this.createWhere(entity, void 0, restrictedWhere, relationContext, false, ancestorPath ?? []);
+  }
+  /**
+   * Finds an ancestor in the path that matches the given relation as a back-reference.
+   * A match occurs when:
+   * 1. The relation we're traversing has the same name as the inverse (targetRelation) of a relation in the ancestor path
+   * 2. AND the entity where our relation is defined matches the targetEntity in the path
+   *    (to prevent false positives when different entities have relations with the same name)
+   */
+  findBackReferencedAncestor(ancestorPath, relationName, relationSourceEntityName) {
+    return ancestorPath.find(
+      (ctx) => ctx.targetRelation?.name === relationName && ctx.targetEntity.name === relationSourceEntityName
+    );
+  }
+  createWhere(entity, fieldNames, where, relationContext, isBackReferenceContext, ancestorPath) {
+    const shouldSimplify = isBackReferenceContext === true && ancestorPath !== void 0 && relationContext !== void 0 && this.findBackReferencedAncestor(ancestorPath, relationContext.relation.name, relationContext.entity.name) !== void 0;
+    let predicatesWhere;
+    if (shouldSimplify) {
+      predicatesWhere = { [entity.primary]: { always: true } };
+    } else {
+      const rawPredicate = this.predicateFactory.create(entity, Acl.Operation.read, fieldNames, relationContext);
+      predicatesWhere = this.injectPredicatesToPredicate(
+        rawPredicate,
+        entity,
+        isBackReferenceContext ?? false,
+        ancestorPath ?? []
+      );
+    }
+    const and = [where, predicatesWhere].filter((it) => Object.keys(it).length > 0);
+    if (and.length === 0) {
+      return {};
+    }
+    if (and.length === 1) {
+      return and[0];
+    }
+    return { and };
+  }
+  /**
+   * Processes a predicate and injects nested entity predicates for any relation traversals.
+   * This ensures that when a predicate like { department: { company: { name: 'Acme' } } }
+   * is used, the predicates of Department and Company are also applied.
+   */
+  injectPredicatesToPredicate(where, entity, isBackReferenceContext, ancestorPath) {
+    const resultWhere = {};
+    if (where.and) {
+      resultWhere.and = where.and.filter((it) => !!it).map((it) => this.injectPredicatesToPredicate(it, entity, isBackReferenceContext, ancestorPath));
+    }
+    if (where.or) {
+      resultWhere.or = where.or.filter((it) => !!it).map((it) => this.injectPredicatesToPredicate(it, entity, isBackReferenceContext, ancestorPath));
+    }
+    if (where.not) {
+      resultWhere.not = this.injectPredicatesToPredicate(where.not, entity, isBackReferenceContext, ancestorPath);
+    }
+    const fields = Object.keys(where).filter((it) => !["and", "or", "not"].includes(it));
+    for (const field of fields) {
+      resultWhere[field] = acceptFieldVisitor(this.schema, entity, field, {
+        visitColumn: () => where[field],
+        visitRelation: (context) => {
+          const relationWhere = where[field];
+          if (relationWhere === null) {
+            return null;
+          }
+          const isBackReference = this.findBackReferencedAncestor(
+            ancestorPath,
+            context.relation.name,
+            context.entity.name
+          ) !== void 0;
+          const nestedIsBackReferenceContext = isBackReference || isBackReferenceContext;
+          const nestedAncestorPath = [...ancestorPath, context];
+          const processedNestedWhere = this.injectPredicatesToPredicate(
+            relationWhere,
+            context.targetEntity,
+            nestedIsBackReferenceContext,
+            nestedAncestorPath
+          );
+          const shouldSimplifyNested = nestedIsBackReferenceContext && this.findBackReferencedAncestor(nestedAncestorPath, context.relation.name, context.entity.name) !== void 0;
+          const targetPredicate = shouldSimplifyNested ? { [context.targetEntity.primary]: { always: true } } : this.predicateFactory.create(context.targetEntity, Acl.Operation.read, void 0, context);
+          const primaryKey = context.targetEntity.primary;
+          const nestedIsAlwaysTrue = Object.keys(processedNestedWhere).length === 1 && processedNestedWhere[primaryKey] !== void 0 && processedNestedWhere[primaryKey]?.always === true;
+          const targetIsAlwaysTrue = Object.keys(targetPredicate).length === 1 && targetPredicate[primaryKey] !== void 0 && targetPredicate[primaryKey]?.always === true;
+          if (nestedIsAlwaysTrue && targetIsAlwaysTrue) {
+            return processedNestedWhere;
+          }
+          const parts = [processedNestedWhere, targetPredicate].filter((it) => Object.keys(it).length > 0);
+          if (parts.length === 0) {
+            return {};
+          }
+          if (parts.length === 1) {
+            return parts[0];
+          }
+          return { and: parts };
+        }
+      });
+    }
+    return resultWhere;
+  }
+  injectToWhere(where, entity, isRoot, relationContext, isBackReferenceContext, ancestorPath) {
+    const resultWhere = {};
+    if (where.and) {
+      resultWhere.and = where.and.filter((it) => !!it).map(
+        (it) => this.injectToWhere(it, entity, isRoot, relationContext, isBackReferenceContext, ancestorPath)
+      );
+    }
+    if (where.or) {
+      resultWhere.or = where.or.filter((it) => !!it).map(
+        (it) => this.injectToWhere(it, entity, isRoot, relationContext, isBackReferenceContext, ancestorPath)
+      );
+    }
+    if (where.not) {
+      resultWhere.not = this.injectToWhere(where.not, entity, isRoot, relationContext, isBackReferenceContext, ancestorPath);
+    }
+    const fields = Object.keys(where).filter((it) => !["and", "or", "not"].includes(it));
+    if (fields.length === 0) {
+      return resultWhere;
+    }
+    for (let field of fields) {
+      resultWhere[field] = acceptFieldVisitor(this.schema, entity, field, {
+        visitColumn: () => where[field],
+        visitRelation: (context) => {
+          const relationWhere = where[field];
+          if (relationWhere === null) {
+            return null;
+          }
+          const isBackReference = this.findBackReferencedAncestor(ancestorPath, context.relation.name, context.entity.name) !== void 0;
+          const nestedIsBackReferenceContext = isBackReference || isBackReferenceContext;
+          const nestedAncestorPath = [...ancestorPath, context];
+          return this.injectToWhere(relationWhere, context.targetEntity, false, context, nestedIsBackReferenceContext, nestedAncestorPath);
+        }
+      });
+    }
+    const fieldsForPredicate = !isRoot ? fields : fields.filter((it) => this.predicateFactory.shouldApplyCellLevelPredicate(entity, Acl.Operation.read, it));
+    return this.createWhere(entity, fieldsForPredicate, resultWhere, relationContext, isBackReferenceContext, ancestorPath);
+  }
+}
+export {
+  PredicatesInjector
+};
+//# sourceMappingURL=PredicatesInjector.js.map

package/dist/development/src/acl/PredicatesInjector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PredicatesInjector.js","sources":["../../../../../packages/engine-content-api/src/acl/PredicatesInjector.ts"],"sourcesContent":["import { Acl, Input, Model, Writable } from '@contember/schema'\nimport { acceptFieldVisitor } from '@contember/schema-utils'\nimport { PredicateFactory } from './PredicateFactory'\n\nexport class PredicatesInjector {\n\tconstructor(private readonly schema: Model.Schema, private readonly predicateFactory: PredicateFactory) {}\n\n\tpublic inject(\n\t\tentity: Model.Entity,\n\t\twhere: Input.OptionalWhere,\n\t\trelationContext?: Model.AnyRelationContext,\n\t\tancestorPath?: readonly Model.AnyRelationContext[],\n\t): Input.OptionalWhere {\n\t\tconst restrictedWhere = this.injectToWhere(where, entity, true, relationContext, false, ancestorPath ?? [])\n\t\treturn this.createWhere(entity, undefined, restrictedWhere, relationContext, false, ancestorPath ?? [])\n\t}\n\n\t/**\n\t * Finds an ancestor in the path that matches the given relation as a back-reference.\n\t * A match occurs when:\n\t * 1. The relation we're traversing has the same name as the inverse (targetRelation) of a relation in the ancestor path\n\t * 2. AND the entity where our relation is defined matches the targetEntity in the path\n\t *    (to prevent false positives when different entities have relations with the same name)\n\t */\n\tprivate findBackReferencedAncestor(\n\t\tancestorPath: readonly Model.AnyRelationContext[],\n\t\trelationName: string,\n\t\trelationSourceEntityName: string,\n\t): Model.AnyRelationContext | undefined {\n\t\treturn ancestorPath.find(ctx =>\n\t\t\tctx.targetRelation?.name === relationName\n\t\t\t&& ctx.targetEntity.name === relationSourceEntityName\n\t\t)\n\t}\n\n\tprivate createWhere(\n\t\tentity: Model.Entity,\n\t\tfieldNames: string[] | undefined,\n\t\twhere: Input.OptionalWhere,\n\t\trelationContext?: Model.AnyRelationContext,\n\t\tisBackReferenceContext?: boolean,\n\t\tancestorPath?: readonly Model.AnyRelationContext[],\n\t): Input.OptionalWhere {\n\t\t// Simplify predicates when:\n\t\t// 1. We're in a back-reference context (inside a filter that traverses back)\n\t\t// 2. AND the relation we traversed to get here corresponds to a relation in our query path\n\t\t// This ensures we only simplify when the traversed relation actually corresponds\n\t\t// to a relation in our query path (not just any relation to the same entity type)\n\t\tconst shouldSimplify = isBackReferenceContext === true\n\t\t\t&& ancestorPath !== undefined\n\t\t\t&& relationContext !== undefined\n\t\t\t&& this.findBackReferencedAncestor(ancestorPath, relationContext.relation.name, relationContext.entity.name) !== undefined\n\n\t\tlet predicatesWhere: Input.OptionalWhere\n\t\tif (shouldSimplify) {\n\t\t\tpredicatesWhere = { [entity.primary]: { always: true } }\n\t\t} else {\n\t\t\tconst rawPredicate = this.predicateFactory.create(entity, Acl.Operation.read, fieldNames, relationContext)\n\t\t\t// Process the predicate to inject nested entity predicates\n\t\t\tpredicatesWhere = this.injectPredicatesToPredicate(\n\t\t\t\trawPredicate,\n\t\t\t\tentity,\n\t\t\t\tisBackReferenceContext ?? false,\n\t\t\t\tancestorPath ?? [],\n\t\t\t)\n\t\t}\n\n\t\tconst and = [where, predicatesWhere].filter(it => Object.keys(it).length > 0)\n\t\tif (and.length === 0) {\n\t\t\treturn {}\n\t\t}\n\t\tif (and.length === 1) {\n\t\t\treturn and[0]\n\t\t}\n\t\treturn { and: and }\n\t}\n\n\t/**\n\t * Processes a predicate and injects nested entity predicates for any relation traversals.\n\t * This ensures that when a predicate like { department: { company: { name: 'Acme' } } }\n\t * is used, the predicates of Department and Company are also applied.\n\t */\n\tprivate injectPredicatesToPredicate(\n\t\twhere: Input.OptionalWhere,\n\t\tentity: Model.Entity,\n\t\tisBackReferenceContext: boolean,\n\t\tancestorPath: readonly Model.AnyRelationContext[],\n\t): Input.OptionalWhere {\n\t\tconst resultWhere: Writable<Input.OptionalWhere> = {}\n\n\t\tif (where.and) {\n\t\t\tresultWhere.and = where.and\n\t\t\t\t.filter((it): it is Input.Where => !!it)\n\t\t\t\t.map(it => this.injectPredicatesToPredicate(it, entity, isBackReferenceContext, ancestorPath))\n\t\t}\n\t\tif (where.or) {\n\t\t\tresultWhere.or = where.or\n\t\t\t\t.filter((it): it is Input.Where => !!it)\n\t\t\t\t.map(it => this.injectPredicatesToPredicate(it, entity, isBackReferenceContext, ancestorPath))\n\t\t}\n\t\tif (where.not) {\n\t\t\tresultWhere.not = this.injectPredicatesToPredicate(where.not, entity, isBackReferenceContext, ancestorPath)\n\t\t}\n\n\t\tconst fields = Object.keys(where).filter(it => !['and', 'or', 'not'].includes(it))\n\n\t\tfor (const field of fields) {\n\t\t\tresultWhere[field] = acceptFieldVisitor(this.schema, entity, field, {\n\t\t\t\tvisitColumn: () => where[field],\n\t\t\t\tvisitRelation: context => {\n\t\t\t\t\tconst relationWhere = where[field] as Input.OptionalWhere | null\n\t\t\t\t\tif (relationWhere === null) {\n\t\t\t\t\t\treturn null\n\t\t\t\t\t}\n\n\t\t\t\t\t// Check if this relation is a back-reference to somewhere in our ancestor path\n\t\t\t\t\tconst isBackReference = this.findBackReferencedAncestor(\n\t\t\t\t\t\tancestorPath,\n\t\t\t\t\t\tcontext.relation.name,\n\t\t\t\t\t\tcontext.entity.name,\n\t\t\t\t\t) !== undefined\n\t\t\t\t\tconst nestedIsBackReferenceContext = isBackReference || isBackReferenceContext\n\t\t\t\t\tconst nestedAncestorPath: readonly Model.AnyRelationContext[] = [...ancestorPath, context]\n\n\t\t\t\t\t// Recursively process the nested where (always do this to handle deeper nesting)\n\t\t\t\t\tconst processedNestedWhere = this.injectPredicatesToPredicate(\n\t\t\t\t\t\trelationWhere,\n\t\t\t\t\t\tcontext.targetEntity,\n\t\t\t\t\t\tnestedIsBackReferenceContext,\n\t\t\t\t\t\tnestedAncestorPath,\n\t\t\t\t\t)\n\n\t\t\t\t\t// Check if we should simplify the target entity's predicate\n\t\t\t\t\tconst shouldSimplifyNested = nestedIsBackReferenceContext\n\t\t\t\t\t\t&& this.findBackReferencedAncestor(nestedAncestorPath, context.relation.name, context.entity.name) !== undefined\n\n\t\t\t\t\t// Get target entity's predicate (simplified if back-reference)\n\t\t\t\t\tconst targetPredicate = shouldSimplifyNested\n\t\t\t\t\t\t? { [context.targetEntity.primary]: { always: true } }\n\t\t\t\t\t\t: this.predicateFactory.create(context.targetEntity, Acl.Operation.read, undefined, context)\n\n\t\t\t\t\t// Optimization: avoid duplicate { id: always } when both are simplified\n\t\t\t\t\tconst primaryKey = context.targetEntity.primary\n\t\t\t\t\tconst nestedIsAlwaysTrue = Object.keys(processedNestedWhere).length === 1\n\t\t\t\t\t\t&& (processedNestedWhere as Record<string, unknown>)[primaryKey] !== undefined\n\t\t\t\t\t\t&& (processedNestedWhere as Record<string, Record<string, unknown>>)[primaryKey]?.always === true\n\t\t\t\t\tconst targetIsAlwaysTrue = Object.keys(targetPredicate).length === 1\n\t\t\t\t\t\t&& (targetPredicate as Record<string, unknown>)[primaryKey] !== undefined\n\t\t\t\t\t\t&& (targetPredicate as Record<string, Record<string, unknown>>)[primaryKey]?.always === true\n\n\t\t\t\t\tif (nestedIsAlwaysTrue && targetIsAlwaysTrue) {\n\t\t\t\t\t\treturn processedNestedWhere\n\t\t\t\t\t}\n\n\t\t\t\t\t// Combine the processed nested where with target entity's predicate\n\t\t\t\t\tconst parts = [processedNestedWhere, targetPredicate].filter(it => Object.keys(it).length > 0)\n\t\t\t\t\tif (parts.length === 0) {\n\t\t\t\t\t\treturn {}\n\t\t\t\t\t}\n\t\t\t\t\tif (parts.length === 1) {\n\t\t\t\t\t\treturn parts[0]\n\t\t\t\t\t}\n\t\t\t\t\treturn { and: parts }\n\t\t\t\t},\n\t\t\t})\n\t\t}\n\n\t\treturn resultWhere\n\t}\n\n\tprivate injectToWhere(\n\t\twhere: Input.OptionalWhere,\n\t\tentity: Model.Entity,\n\t\tisRoot: boolean,\n\t\trelationContext: Model.AnyRelationContext | undefined,\n\t\tisBackReferenceContext: boolean,\n\t\tancestorPath: readonly Model.AnyRelationContext[],\n\t): Input.OptionalWhere {\n\t\tconst resultWhere: Writable<Input.OptionalWhere> = {}\n\t\tif (where.and) {\n\t\t\tresultWhere.and = where.and.filter((it): it is Input.Where => !!it).map(it =>\n\t\t\t\tthis.injectToWhere(it, entity, isRoot, relationContext, isBackReferenceContext, ancestorPath)\n\t\t\t)\n\t\t}\n\t\tif (where.or) {\n\t\t\tresultWhere.or = where.or.filter((it): it is Input.Where => !!it).map(it =>\n\t\t\t\tthis.injectToWhere(it, entity, isRoot, relationContext, isBackReferenceContext, ancestorPath)\n\t\t\t)\n\t\t}\n\t\tif (where.not) {\n\t\t\tresultWhere.not = this.injectToWhere(where.not, entity, isRoot, relationContext, isBackReferenceContext, ancestorPath)\n\t\t}\n\n\t\tconst fields = Object.keys(where).filter(it => !['and', 'or', 'not'].includes(it))\n\n\t\tif (fields.length === 0) {\n\t\t\treturn resultWhere\n\t\t}\n\t\tfor (let field of fields) {\n\t\t\tresultWhere[field] = acceptFieldVisitor(this.schema, entity, field, {\n\t\t\t\tvisitColumn: () => where[field],\n\t\t\t\tvisitRelation: context => {\n\t\t\t\t\tconst relationWhere = where[field] as Input.OptionalWhere | null\n\t\t\t\t\tif (relationWhere === null) {\n\t\t\t\t\t\treturn null\n\t\t\t\t\t}\n\t\t\t\t\t// Check if this relation is a back-reference to somewhere in our ancestor path\n\t\t\t\t\tconst isBackReference = this.findBackReferencedAncestor(ancestorPath, context.relation.name, context.entity.name) !== undefined\n\t\t\t\t\t// Once we enter a back-reference context, stay in it for nested relations\n\t\t\t\t\tconst nestedIsBackReferenceContext = isBackReference || isBackReferenceContext\n\t\t\t\t\t// Build extended ancestor path for nested traversal\n\t\t\t\t\tconst nestedAncestorPath: Model.AnyRelationContext[] = [...ancestorPath, context]\n\t\t\t\t\treturn this.injectToWhere(relationWhere, context.targetEntity, false, context, nestedIsBackReferenceContext, nestedAncestorPath)\n\t\t\t\t},\n\t\t\t})\n\t\t}\n\t\tconst fieldsForPredicate = !isRoot\n\t\t\t? fields\n\t\t\t: fields.filter(it => this.predicateFactory.shouldApplyCellLevelPredicate(entity, Acl.Operation.read, it))\n\n\t\treturn this.createWhere(entity, fieldsForPredicate, resultWhere, relationContext, isBackReferenceContext, ancestorPath)\n\t}\n}\n"],"names":[],"mappings":";;AAIO,MAAM,mBAAmB;AAAA,EAC/B,YAA6B,QAAuC,kBAAoC;AAA3E,SAAA,SAAA;AAAuC,SAAA,mBAAA;AAAA,EAAqC;AAAA,EAElG,OACN,QACA,OACA,iBACA,cACsB;AACtB,UAAM,kBAAkB,KAAK,cAAc,OAAO,QAAQ,MAAM,iBAAiB,OAAO,gBAAgB,EAAE;AAC1G,WAAO,KAAK,YAAY,QAAQ,QAAW,iBAAiB,iBAAiB,OAAO,gBAAgB,EAAE;AAAA,EACvG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,2BACP,cACA,cACA,0BACuC;AACvC,WAAO,aAAa;AAAA,MAAK,SACxB,IAAI,gBAAgB,SAAS,gBAC1B,IAAI,aAAa,SAAS;AAAA,IAAA;AAAA,EAE/B;AAAA,EAEQ,YACP,QACA,YACA,OACA,iBACA,wBACA,cACsB;AAMtB,UAAM,iBAAiB,2BAA2B,QAC9C,iBAAiB,UACjB,oBAAoB,UACpB,KAAK,2BAA2B,cAAc,gBAAgB,SAAS,MAAM,gBAAgB,OAAO,IAAI,MAAM;AAElH,QAAI;AACJ,QAAI,gBAAgB;AACnB,wBAAkB,EAAE,CAAC,OAAO,OAAO,GAAG,EAAE,QAAQ,OAAK;AAAA,IACtD,OAAO;AACN,YAAM,eAAe,KAAK,iBAAiB,OAAO,QAAQ,IAAI,UAAU,MAAM,YAAY,eAAe;AAEzG,wBAAkB,KAAK;AAAA,QACtB;AAAA,QACA;AAAA,QACA,0BAA0B;AAAA,QAC1B,gBAAgB,CAAA;AAAA,MAAC;AAAA,IAEnB;AAEA,UAAM,MAAM,CAAC,OAAO,eAAe,EAAE,OAAO,CAAA,OAAM,OAAO,KAAK,EAAE,EAAE,SAAS,CAAC;AAC5E,QAAI,IAAI,WAAW,GAAG;AACrB,aAAO,CAAA;AAAA,IACR;AACA,QAAI,IAAI,WAAW,GAAG;AACrB,aAAO,IAAI,CAAC;AAAA,IACb;AACA,WAAO,EAAE,IAAA;AAAA,EACV;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,4BACP,OACA,QACA,wBACA,cACsB;AACtB,UAAM,cAA6C,CAAA;AAEnD,QAAI,MAAM,KAAK;AACd,kBAAY,MAAM,MAAM,IACtB,OAAO,CAAC,OAA0B,CAAC,CAAC,EAAE,EACtC,IAAI,QAAM,KAAK,4BAA4B,IAAI,QAAQ,wBAAwB,YAAY,CAAC;AAAA,IAC/F;AACA,QAAI,MAAM,IAAI;AACb,kBAAY,KAAK,MAAM,GACrB,OAAO,CAAC,OAA0B,CAAC,CAAC,EAAE,EACtC,IAAI,QAAM,KAAK,4BAA4B,IAAI,QAAQ,wBAAwB,YAAY,CAAC;AAAA,IAC/F;AACA,QAAI,MAAM,KAAK;AACd,kBAAY,MAAM,KAAK,4BAA4B,MAAM,KAAK,QAAQ,wBAAwB,YAAY;AAAA,IAC3G;AAEA,UAAM,SAAS,OAAO,KAAK,KAAK,EAAE,OAAO,CAAA,OAAM,CAAC,CAAC,OAAO,MAAM,KAAK,EAAE,SAAS,EAAE,CAAC;AAEjF,eAAW,SAAS,QAAQ;AAC3B,kBAAY,KAAK,IAAI,mBAAmB,KAAK,QAAQ,QAAQ,OAAO;AAAA,QACnE,aAAa,MAAM,MAAM,KAAK;AAAA,QAC9B,eAAe,CAAA,YAAW;AACzB,gBAAM,gBAAgB,MAAM,KAAK;AACjC,cAAI,kBAAkB,MAAM;AAC3B,mBAAO;AAAA,UACR;AAGA,gBAAM,kBAAkB,KAAK;AAAA,YAC5B;AAAA,YACA,QAAQ,SAAS;AAAA,YACjB,QAAQ,OAAO;AAAA,UAAA,MACV;AACN,gBAAM,+BAA+B,mBAAmB;AACxD,gBAAM,qBAA0D,CAAC,GAAG,cAAc,OAAO;AAGzF,gBAAM,uBAAuB,KAAK;AAAA,YACjC;AAAA,YACA,QAAQ;AAAA,YACR;AAAA,YACA;AAAA,UAAA;AAID,gBAAM,uBAAuB,gCACzB,KAAK,2BAA2B,oBAAoB,QAAQ,SAAS,MAAM,QAAQ,OAAO,IAAI,MAAM;AAGxG,gBAAM,kBAAkB,uBACrB,EAAE,CAAC,QAAQ,aAAa,OAAO,GAAG,EAAE,QAAQ,KAAA,MAC5C,KAAK,iBAAiB,OAAO,QAAQ,cAAc,IAAI,UAAU,MAAM,QAAW,OAAO;AAG5F,gBAAM,aAAa,QAAQ,aAAa;AACxC,gBAAM,qBAAqB,OAAO,KAAK,oBAAoB,EAAE,WAAW,KACnE,qBAAiD,UAAU,MAAM,UACjE,qBAAiE,UAAU,GAAG,WAAW;AAC9F,gBAAM,qBAAqB,OAAO,KAAK,eAAe,EAAE,WAAW,KAC9D,gBAA4C,UAAU,MAAM,UAC5D,gBAA4D,UAAU,GAAG,WAAW;AAEzF,cAAI,sBAAsB,oBAAoB;AAC7C,mBAAO;AAAA,UACR;AAGA,gBAAM,QAAQ,CAAC,sBAAsB,eAAe,EAAE,OAAO,CAAA,OAAM,OAAO,KAAK,EAAE,EAAE,SAAS,CAAC;AAC7F,cAAI,MAAM,WAAW,GAAG;AACvB,mBAAO,CAAA;AAAA,UACR;AACA,cAAI,MAAM,WAAW,GAAG;AACvB,mBAAO,MAAM,CAAC;AAAA,UACf;AACA,iBAAO,EAAE,KAAK,MAAA;AAAA,QACf;AAAA,MAAA,CACA;AAAA,IACF;AAEA,WAAO;AAAA,EACR;AAAA,EAEQ,cACP,OACA,QACA,QACA,iBACA,wBACA,cACsB;AACtB,UAAM,cAA6C,CAAA;AACnD,QAAI,MAAM,KAAK;AACd,kBAAY,MAAM,MAAM,IAAI,OAAO,CAAC,OAA0B,CAAC,CAAC,EAAE,EAAE;AAAA,QAAI,CAAA,OACvE,KAAK,cAAc,IAAI,QAAQ,QAAQ,iBAAiB,wBAAwB,YAAY;AAAA,MAAA;AAAA,IAE9F;AACA,QAAI,MAAM,IAAI;AACb,kBAAY,KAAK,MAAM,GAAG,OAAO,CAAC,OAA0B,CAAC,CAAC,EAAE,EAAE;AAAA,QAAI,CAAA,OACrE,KAAK,cAAc,IAAI,QAAQ,QAAQ,iBAAiB,wBAAwB,YAAY;AAAA,MAAA;AAAA,IAE9F;AACA,QAAI,MAAM,KAAK;AACd,kBAAY,MAAM,KAAK,cAAc,MAAM,KAAK,QAAQ,QAAQ,iBAAiB,wBAAwB,YAAY;AAAA,IACtH;AAEA,UAAM,SAAS,OAAO,KAAK,KAAK,EAAE,OAAO,CAAA,OAAM,CAAC,CAAC,OAAO,MAAM,KAAK,EAAE,SAAS,EAAE,CAAC;AAEjF,QAAI,OAAO,WAAW,GAAG;AACxB,aAAO;AAAA,IACR;AACA,aAAS,SAAS,QAAQ;AACzB,kBAAY,KAAK,IAAI,mBAAmB,KAAK,QAAQ,QAAQ,OAAO;AAAA,QACnE,aAAa,MAAM,MAAM,KAAK;AAAA,QAC9B,eAAe,CAAA,YAAW;AACzB,gBAAM,gBAAgB,MAAM,KAAK;AACjC,cAAI,kBAAkB,MAAM;AAC3B,mBAAO;AAAA,UACR;AAEA,gBAAM,kBAAkB,KAAK,2BAA2B,cAAc,QAAQ,SAAS,MAAM,QAAQ,OAAO,IAAI,MAAM;AAEtH,gBAAM,+BAA+B,mBAAmB;AAExD,gBAAM,qBAAiD,CAAC,GAAG,cAAc,OAAO;AAChF,iBAAO,KAAK,cAAc,eAAe,QAAQ,cAAc,OAAO,SAAS,8BAA8B,kBAAkB;AAAA,QAChI;AAAA,MAAA,CACA;AAAA,IACF;AACA,UAAM,qBAAqB,CAAC,SACzB,SACA,OAAO,OAAO,CAAA,OAAM,KAAK,iBAAiB,8BAA8B,QAAQ,IAAI,UAAU,MAAM,EAAE,CAAC;AAE1G,WAAO,KAAK,YAAY,QAAQ,oBAAoB,aAAa,iBAAiB,wBAAwB,YAAY;AAAA,EACvH;AACD;"}

package/dist/development/src/acl/VariableInjector.cjs

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const schemaUtils = require("@contember/schema-utils");
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+class VariableInjector {
+  constructor(schema, variables) {
+    this.schema = schema;
+    this.variables = variables;
+    __publicField(this, "injectorCache", /* @__PURE__ */ new WeakMap());
+  }
+  inject(entity, where) {
+    const cacheEntry = this.injectorCache.get(where);
+    if (cacheEntry !== void 0) {
+      return cacheEntry;
+    }
+    const predicateDefinitionProcessor = new schemaUtils.PredicateDefinitionProcessor(this.schema);
+    const resultWhere = predicateDefinitionProcessor.process(entity, where, {
+      handleColumn: ({ value }) => {
+        if (typeof value === "string") {
+          return this.variables[value] ?? { never: true };
+        }
+        return value;
+      },
+      handleRelation: ({ value, targetEntity }) => {
+        if (typeof value === "string") {
+          return { [targetEntity.primary]: this.variables[value] ?? { never: true } };
+        }
+        return value;
+      }
+    });
+    this.injectorCache.set(where, resultWhere);
+    return resultWhere;
+  }
+}
+exports.VariableInjector = VariableInjector;
+//# sourceMappingURL=VariableInjector.cjs.map

package/dist/development/src/acl/VariableInjector.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"VariableInjector.cjs","sources":["../../../../../packages/engine-content-api/src/acl/VariableInjector.ts"],"sourcesContent":["import { Acl, Input, Model } from '@contember/schema'\nimport { PredicateDefinitionProcessor } from '@contember/schema-utils'\n\nexport class VariableInjector {\n\tprivate injectorCache = new WeakMap<Acl.PredicateDefinition, Input.Where>()\n\n\tconstructor(private readonly schema: Model.Schema, private readonly variables: Acl.VariablesMap) {}\n\n\tpublic inject(entity: Model.Entity, where: Acl.PredicateDefinition): Input.Where {\n\t\tconst cacheEntry = this.injectorCache.get(where)\n\t\tif (cacheEntry !== undefined) {\n\t\t\treturn cacheEntry\n\t\t}\n\t\tconst predicateDefinitionProcessor = new PredicateDefinitionProcessor(this.schema)\n\n\t\tconst resultWhere = predicateDefinitionProcessor.process(entity, where, {\n\t\t\thandleColumn: ({ value }) => {\n\t\t\t\tif (typeof value === 'string') {\n\t\t\t\t\treturn this.variables[value] ?? { never: true }\n\t\t\t\t}\n\t\t\t\treturn value as Input.Condition\n\t\t\t},\n\t\t\thandleRelation: ({ value, targetEntity }) => {\n\t\t\t\tif (typeof value === 'string') {\n\t\t\t\t\treturn { [targetEntity.primary]: this.variables[value] ?? { never: true } }\n\t\t\t\t}\n\t\t\t\treturn value\n\t\t\t},\n\t\t})\n\t\tthis.injectorCache.set(where, resultWhere)\n\t\treturn resultWhere\n\t}\n}\n"],"names":["PredicateDefinitionProcessor"],"mappings":";;;;;;AAGO,MAAM,iBAAiB;AAAA,EAG7B,YAA6B,QAAuC,WAA6B;AAApE,SAAA,SAAA;AAAuC,SAAA,YAAA;AAFpE,kBAAA,MAAQ,qCAAoB,QAAA,CAA8C;AAAA,EAEwB;AAAA,EAE3F,OAAO,QAAsB,OAA6C;AAChF,UAAM,aAAa,KAAK,cAAc,IAAI,KAAK;AAC/C,QAAI,eAAe,QAAW;AAC7B,aAAO;AAAA,IACR;AACA,UAAM,+BAA+B,IAAIA,yCAA6B,KAAK,MAAM;AAEjF,UAAM,cAAc,6BAA6B,QAAQ,QAAQ,OAAO;AAAA,MACvE,cAAc,CAAC,EAAE,YAAY;AAC5B,YAAI,OAAO,UAAU,UAAU;AAC9B,iBAAO,KAAK,UAAU,KAAK,KAAK,EAAE,OAAO,KAAA;AAAA,QAC1C;AACA,eAAO;AAAA,MACR;AAAA,MACA,gBAAgB,CAAC,EAAE,OAAO,mBAAmB;AAC5C,YAAI,OAAO,UAAU,UAAU;AAC9B,iBAAO,EAAE,CAAC,aAAa,OAAO,GAAG,KAAK,UAAU,KAAK,KAAK,EAAE,OAAO,OAAK;AAAA,QACzE;AACA,eAAO;AAAA,MACR;AAAA,IAAA,CACA;AACD,SAAK,cAAc,IAAI,OAAO,WAAW;AACzC,WAAO;AAAA,EACR;AACD;;"}

package/dist/development/src/acl/VariableInjector.js

@@ -0,0 +1,38 @@
+import { PredicateDefinitionProcessor } from "@contember/schema-utils";
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+class VariableInjector {
+  constructor(schema, variables) {
+    this.schema = schema;
+    this.variables = variables;
+    __publicField(this, "injectorCache", /* @__PURE__ */ new WeakMap());
+  }
+  inject(entity, where) {
+    const cacheEntry = this.injectorCache.get(where);
+    if (cacheEntry !== void 0) {
+      return cacheEntry;
+    }
+    const predicateDefinitionProcessor = new PredicateDefinitionProcessor(this.schema);
+    const resultWhere = predicateDefinitionProcessor.process(entity, where, {
+      handleColumn: ({ value }) => {
+        if (typeof value === "string") {
+          return this.variables[value] ?? { never: true };
+        }
+        return value;
+      },
+      handleRelation: ({ value, targetEntity }) => {
+        if (typeof value === "string") {
+          return { [targetEntity.primary]: this.variables[value] ?? { never: true } };
+        }
+        return value;
+      }
+    });
+    this.injectorCache.set(where, resultWhere);
+    return resultWhere;
+  }
+}
+export {
+  VariableInjector
+};
+//# sourceMappingURL=VariableInjector.js.map

package/dist/development/src/acl/VariableInjector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"VariableInjector.js","sources":["../../../../../packages/engine-content-api/src/acl/VariableInjector.ts"],"sourcesContent":["import { Acl, Input, Model } from '@contember/schema'\nimport { PredicateDefinitionProcessor } from '@contember/schema-utils'\n\nexport class VariableInjector {\n\tprivate injectorCache = new WeakMap<Acl.PredicateDefinition, Input.Where>()\n\n\tconstructor(private readonly schema: Model.Schema, private readonly variables: Acl.VariablesMap) {}\n\n\tpublic inject(entity: Model.Entity, where: Acl.PredicateDefinition): Input.Where {\n\t\tconst cacheEntry = this.injectorCache.get(where)\n\t\tif (cacheEntry !== undefined) {\n\t\t\treturn cacheEntry\n\t\t}\n\t\tconst predicateDefinitionProcessor = new PredicateDefinitionProcessor(this.schema)\n\n\t\tconst resultWhere = predicateDefinitionProcessor.process(entity, where, {\n\t\t\thandleColumn: ({ value }) => {\n\t\t\t\tif (typeof value === 'string') {\n\t\t\t\t\treturn this.variables[value] ?? { never: true }\n\t\t\t\t}\n\t\t\t\treturn value as Input.Condition\n\t\t\t},\n\t\t\thandleRelation: ({ value, targetEntity }) => {\n\t\t\t\tif (typeof value === 'string') {\n\t\t\t\t\treturn { [targetEntity.primary]: this.variables[value] ?? { never: true } }\n\t\t\t\t}\n\t\t\t\treturn value\n\t\t\t},\n\t\t})\n\t\tthis.injectorCache.set(where, resultWhere)\n\t\treturn resultWhere\n\t}\n}\n"],"names":[],"mappings":";;;;AAGO,MAAM,iBAAiB;AAAA,EAG7B,YAA6B,QAAuC,WAA6B;AAApE,SAAA,SAAA;AAAuC,SAAA,YAAA;AAFpE,kBAAA,MAAQ,qCAAoB,QAAA,CAA8C;AAAA,EAEwB;AAAA,EAE3F,OAAO,QAAsB,OAA6C;AAChF,UAAM,aAAa,KAAK,cAAc,IAAI,KAAK;AAC/C,QAAI,eAAe,QAAW;AAC7B,aAAO;AAAA,IACR;AACA,UAAM,+BAA+B,IAAI,6BAA6B,KAAK,MAAM;AAEjF,UAAM,cAAc,6BAA6B,QAAQ,QAAQ,OAAO;AAAA,MACvE,cAAc,CAAC,EAAE,YAAY;AAC5B,YAAI,OAAO,UAAU,UAAU;AAC9B,iBAAO,KAAK,UAAU,KAAK,KAAK,EAAE,OAAO,KAAA;AAAA,QAC1C;AACA,eAAO;AAAA,MACR;AAAA,MACA,gBAAgB,CAAC,EAAE,OAAO,mBAAmB;AAC5C,YAAI,OAAO,UAAU,UAAU;AAC9B,iBAAO,EAAE,CAAC,aAAa,OAAO,GAAG,KAAK,UAAU,KAAK,KAAK,EAAE,OAAO,OAAK;AAAA,QACzE;AACA,eAAO;AAAA,MACR;AAAA,IAAA,CACA;AACD,SAAK,cAAc,IAAI,OAAO,WAAW;AACzC,WAAO;AAAA,EACR;AACD;"}

package/dist/development/src/acl/VariableUtils.cjs

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const schemaUtils = require("@contember/schema-utils");
+const createAclVariables = (aclSchema, memberships) => {
+  const variablesEntries = memberships.flatMap(
+    (membership) => {
+      const roleVariables = schemaUtils.getRoleVariables(membership.role, aclSchema);
+      const membershipVariablesMap = Object.fromEntries(membership.variables.map((it) => [it.name, it.condition]));
+      return Object.keys(roleVariables).map((name) => {
+        const prefixed = prefixVariable(membership.role, name);
+        return [prefixed, membershipVariablesMap[name] ?? { never: true }];
+      });
+    }
+  );
+  return Object.fromEntries(variablesEntries);
+};
+const prefixVariable = (role, variableName) => `${role}__${variableName}`;
+exports.createAclVariables = createAclVariables;
+exports.prefixVariable = prefixVariable;
+//# sourceMappingURL=VariableUtils.cjs.map

package/dist/development/src/acl/VariableUtils.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"VariableUtils.cjs","sources":["../../../../../packages/engine-content-api/src/acl/VariableUtils.ts"],"sourcesContent":["import { Acl, Input } from '@contember/schema'\nimport { getRoleVariables, ParsedMembership } from '@contember/schema-utils'\n\nexport const createAclVariables = (\n\taclSchema: Acl.Schema,\n\tmemberships: readonly ParsedMembership[],\n): Acl.VariablesMap => {\n\tconst variablesEntries = memberships.flatMap(\n\t\tmembership => {\n\t\t\tconst roleVariables = getRoleVariables(membership.role, aclSchema)\n\t\t\tconst membershipVariablesMap = Object.fromEntries(membership.variables.map(it => [it.name, it.condition]))\n\n\t\t\treturn Object.keys(roleVariables).map((name): [string, Input.Condition] => {\n\t\t\t\tconst prefixed = prefixVariable(membership.role, name)\n\t\t\t\treturn [prefixed, membershipVariablesMap[name] ?? { never: true }]\n\t\t\t})\n\t\t},\n\t)\n\n\treturn Object.fromEntries(variablesEntries)\n}\n\nexport const prefixVariable = (role: string, variableName: string) => `${role}__${variableName}`\n"],"names":["getRoleVariables"],"mappings":";;;AAGO,MAAM,qBAAqB,CACjC,WACA,gBACsB;AACtB,QAAM,mBAAmB,YAAY;AAAA,IACpC,CAAA,eAAc;AACb,YAAM,gBAAgBA,YAAAA,iBAAiB,WAAW,MAAM,SAAS;AACjE,YAAM,yBAAyB,OAAO,YAAY,WAAW,UAAU,IAAI,CAAA,OAAM,CAAC,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;AAEzG,aAAO,OAAO,KAAK,aAAa,EAAE,IAAI,CAAC,SAAoC;AAC1E,cAAM,WAAW,eAAe,WAAW,MAAM,IAAI;AACrD,eAAO,CAAC,UAAU,uBAAuB,IAAI,KAAK,EAAE,OAAO,MAAM;AAAA,MAClE,CAAC;AAAA,IACF;AAAA,EAAA;AAGD,SAAO,OAAO,YAAY,gBAAgB;AAC3C;AAEO,MAAM,iBAAiB,CAAC,MAAc,iBAAyB,GAAG,IAAI,KAAK,YAAY;;;"}

package/dist/development/src/acl/VariableUtils.js

@@ -0,0 +1,20 @@
+import { getRoleVariables } from "@contember/schema-utils";
+const createAclVariables = (aclSchema, memberships) => {
+  const variablesEntries = memberships.flatMap(
+    (membership) => {
+      const roleVariables = getRoleVariables(membership.role, aclSchema);
+      const membershipVariablesMap = Object.fromEntries(membership.variables.map((it) => [it.name, it.condition]));
+      return Object.keys(roleVariables).map((name) => {
+        const prefixed = prefixVariable(membership.role, name);
+        return [prefixed, membershipVariablesMap[name] ?? { never: true }];
+      });
+    }
+  );
+  return Object.fromEntries(variablesEntries);
+};
+const prefixVariable = (role, variableName) => `${role}__${variableName}`;
+export {
+  createAclVariables,
+  prefixVariable
+};
+//# sourceMappingURL=VariableUtils.js.map

package/dist/development/src/acl/VariableUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"VariableUtils.js","sources":["../../../../../packages/engine-content-api/src/acl/VariableUtils.ts"],"sourcesContent":["import { Acl, Input } from '@contember/schema'\nimport { getRoleVariables, ParsedMembership } from '@contember/schema-utils'\n\nexport const createAclVariables = (\n\taclSchema: Acl.Schema,\n\tmemberships: readonly ParsedMembership[],\n): Acl.VariablesMap => {\n\tconst variablesEntries = memberships.flatMap(\n\t\tmembership => {\n\t\t\tconst roleVariables = getRoleVariables(membership.role, aclSchema)\n\t\t\tconst membershipVariablesMap = Object.fromEntries(membership.variables.map(it => [it.name, it.condition]))\n\n\t\t\treturn Object.keys(roleVariables).map((name): [string, Input.Condition] => {\n\t\t\t\tconst prefixed = prefixVariable(membership.role, name)\n\t\t\t\treturn [prefixed, membershipVariablesMap[name] ?? { never: true }]\n\t\t\t})\n\t\t},\n\t)\n\n\treturn Object.fromEntries(variablesEntries)\n}\n\nexport const prefixVariable = (role: string, variableName: string) => `${role}__${variableName}`\n"],"names":[],"mappings":";AAGO,MAAM,qBAAqB,CACjC,WACA,gBACsB;AACtB,QAAM,mBAAmB,YAAY;AAAA,IACpC,CAAA,eAAc;AACb,YAAM,gBAAgB,iBAAiB,WAAW,MAAM,SAAS;AACjE,YAAM,yBAAyB,OAAO,YAAY,WAAW,UAAU,IAAI,CAAA,OAAM,CAAC,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;AAEzG,aAAO,OAAO,KAAK,aAAa,EAAE,IAAI,CAAC,SAAoC;AAC1E,cAAM,WAAW,eAAe,WAAW,MAAM,IAAI;AACrD,eAAO,CAAC,UAAU,uBAAuB,IAAI,KAAK,EAAE,OAAO,MAAM;AAAA,MAClE,CAAC;AAAA,IACF;AAAA,EAAA;AAGD,SAAO,OAAO,YAAY,gBAAgB;AAC3C;AAEO,MAAM,iBAAiB,CAAC,MAAc,iBAAyB,GAAG,IAAI,KAAK,YAAY;"}

package/dist/development/src/exception.cjs

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+class ImplementationException extends Error {
+  constructor(message = "") {
+    super(message);
+  }
+}
+class UserError extends Error {
+  constructor() {
+    super(...arguments);
+    __publicField(this, "path", []);
+  }
+  // otherwise graphql converts it to GraphqlError
+}
+exports.ImplementationException = ImplementationException;
+exports.UserError = UserError;
+//# sourceMappingURL=exception.cjs.map

package/dist/development/src/exception.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"exception.cjs","sources":["../../../../packages/engine-content-api/src/exception.ts"],"sourcesContent":["export class ImplementationException extends Error {\n\tconstructor(message: string = '') {\n\t\tsuper(message)\n\t}\n}\n\nexport class UserError extends Error {\n\tpublic path = [] // otherwise graphql converts it to GraphqlError\n}\n"],"names":[],"mappings":";;;;;AAAO,MAAM,gCAAgC,MAAM;AAAA,EAClD,YAAY,UAAkB,IAAI;AACjC,UAAM,OAAO;AAAA,EACd;AACD;AAEO,MAAM,kBAAkB,MAAM;AAAA,EAA9B,cAAA;AAAA,UAAA,GAAA,SAAA;AACN,kBAAA,MAAO,QAAO,EAAC;AAAA,EAAA;AAAA;AAChB;;;"}

package/dist/development/src/exception.js

@@ -0,0 +1,20 @@
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+class ImplementationException extends Error {
+  constructor(message = "") {
+    super(message);
+  }
+}
+class UserError extends Error {
+  constructor() {
+    super(...arguments);
+    __publicField(this, "path", []);
+  }
+  // otherwise graphql converts it to GraphqlError
+}
+export {
+  ImplementationException,
+  UserError
+};
+//# sourceMappingURL=exception.js.map

package/dist/development/src/exception.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exception.js","sources":["../../../../packages/engine-content-api/src/exception.ts"],"sourcesContent":["export class ImplementationException extends Error {\n\tconstructor(message: string = '') {\n\t\tsuper(message)\n\t}\n}\n\nexport class UserError extends Error {\n\tpublic path = [] // otherwise graphql converts it to GraphqlError\n}\n"],"names":[],"mappings":";;;AAAO,MAAM,gCAAgC,MAAM;AAAA,EAClD,YAAY,UAAkB,IAAI;AACjC,UAAM,OAAO;AAAA,EACd;AACD;AAEO,MAAM,kBAAkB,MAAM;AAAA,EAA9B,cAAA;AAAA,UAAA,GAAA,SAAA;AACN,kBAAA,MAAO,QAAO,EAAC;AAAA,EAAA;AAAA;AAChB;"}

package/dist/development/src/extensions/hasManyToHasOneReducer/HasManyToHasOneReducer.cjs

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const schemaUtils = require("@contember/schema-utils");
+const schema = require("@contember/schema");
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+class HasManyToHasOneReducer {
+  constructor(schema2, visitor) {
+    this.schema = schema2;
+    this.visitor = visitor;
+  }
+  getFields(entity, accessibleFields) {
+    const fieldMap = {};
+    for (const field of accessibleFields) {
+      if (field.type !== schema.Model.RelationType.OneHasMany) {
+        continue;
+      }
+      for (const [name, resultField] of schemaUtils.acceptFieldVisitor(this.schema, entity, field, this.visitor)) {
+        fieldMap[name] = resultField;
+      }
+    }
+    return fieldMap;
+  }
+}
+__publicField(HasManyToHasOneReducer, "extensionName", "HasManyToHasOneReducer");
+exports.HasManyToHasOneReducer = HasManyToHasOneReducer;
+//# sourceMappingURL=HasManyToHasOneReducer.cjs.map

package/dist/development/src/extensions/hasManyToHasOneReducer/HasManyToHasOneReducer.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"HasManyToHasOneReducer.cjs","sources":["../../../../../../packages/engine-content-api/src/extensions/hasManyToHasOneReducer/HasManyToHasOneReducer.ts"],"sourcesContent":["import { EntityFieldsProvider, FieldMap } from '../EntityFieldsProvider'\nimport { acceptFieldVisitor } from '@contember/schema-utils'\nimport { Model } from '@contember/schema'\nimport { HasManyToHasOneRelationReducerFieldVisitor } from './HasManyToHasOneRelationReducerVisitor'\n\nexport class HasManyToHasOneReducer implements EntityFieldsProvider<HasManyToHasOneReducerExtension> {\n\tstatic extensionName: string = 'HasManyToHasOneReducer'\n\n\tconstructor(\n\t\tprivate readonly schema: Model.Schema,\n\t\tprivate readonly visitor: HasManyToHasOneRelationReducerFieldVisitor,\n\t) {}\n\n\tgetFields(entity: Model.Entity, accessibleFields: Model.AnyField[]): FieldMap<HasManyToHasOneReducerExtension> {\n\t\tconst fieldMap: FieldMap<HasManyToHasOneReducerExtension> = {}\n\t\tfor (const field of accessibleFields) {\n\t\t\tif (field.type !== Model.RelationType.OneHasMany) {\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tfor (const [name, resultField] of acceptFieldVisitor(this.schema, entity, field, this.visitor)) {\n\t\t\t\tfieldMap[name] = resultField\n\t\t\t}\n\t\t}\n\t\treturn fieldMap\n\t}\n}\n\nexport interface HasManyToHasOneReducerExtension {\n\trelationName: string\n}\n"],"names":["schema","Model","acceptFieldVisitor"],"mappings":";;;;;;;AAKO,MAAM,uBAAwF;AAAA,EAGpG,YACkBA,SACA,SAChB;AAFgB,SAAA,SAAAA;AACA,SAAA,UAAA;AAAA,EACf;AAAA,EAEH,UAAU,QAAsB,kBAA+E;AAC9G,UAAM,WAAsD,CAAA;AAC5D,eAAW,SAAS,kBAAkB;AACrC,UAAI,MAAM,SAASC,aAAM,aAAa,YAAY;AACjD;AAAA,MACD;AAEA,iBAAW,CAAC,MAAM,WAAW,KAAKC,YAAAA,mBAAmB,KAAK,QAAQ,QAAQ,OAAO,KAAK,OAAO,GAAG;AAC/F,iBAAS,IAAI,IAAI;AAAA,MAClB;AAAA,IACD;AACA,WAAO;AAAA,EACR;AACD;AApBC,cADY,wBACL,iBAAwB,wBAAA;;"}

package/dist/development/src/extensions/hasManyToHasOneReducer/HasManyToHasOneReducer.js

@@ -0,0 +1,28 @@
+import { acceptFieldVisitor } from "@contember/schema-utils";
+import { Model } from "@contember/schema";
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+class HasManyToHasOneReducer {
+  constructor(schema, visitor) {
+    this.schema = schema;
+    this.visitor = visitor;
+  }
+  getFields(entity, accessibleFields) {
+    const fieldMap = {};
+    for (const field of accessibleFields) {
+      if (field.type !== Model.RelationType.OneHasMany) {
+        continue;
+      }
+      for (const [name, resultField] of acceptFieldVisitor(this.schema, entity, field, this.visitor)) {
+        fieldMap[name] = resultField;
+      }
+    }
+    return fieldMap;
+  }
+}
+__publicField(HasManyToHasOneReducer, "extensionName", "HasManyToHasOneReducer");
+export {
+  HasManyToHasOneReducer
+};
+//# sourceMappingURL=HasManyToHasOneReducer.js.map

package/dist/development/src/extensions/hasManyToHasOneReducer/HasManyToHasOneReducer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HasManyToHasOneReducer.js","sources":["../../../../../../packages/engine-content-api/src/extensions/hasManyToHasOneReducer/HasManyToHasOneReducer.ts"],"sourcesContent":["import { EntityFieldsProvider, FieldMap } from '../EntityFieldsProvider'\nimport { acceptFieldVisitor } from '@contember/schema-utils'\nimport { Model } from '@contember/schema'\nimport { HasManyToHasOneRelationReducerFieldVisitor } from './HasManyToHasOneRelationReducerVisitor'\n\nexport class HasManyToHasOneReducer implements EntityFieldsProvider<HasManyToHasOneReducerExtension> {\n\tstatic extensionName: string = 'HasManyToHasOneReducer'\n\n\tconstructor(\n\t\tprivate readonly schema: Model.Schema,\n\t\tprivate readonly visitor: HasManyToHasOneRelationReducerFieldVisitor,\n\t) {}\n\n\tgetFields(entity: Model.Entity, accessibleFields: Model.AnyField[]): FieldMap<HasManyToHasOneReducerExtension> {\n\t\tconst fieldMap: FieldMap<HasManyToHasOneReducerExtension> = {}\n\t\tfor (const field of accessibleFields) {\n\t\t\tif (field.type !== Model.RelationType.OneHasMany) {\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tfor (const [name, resultField] of acceptFieldVisitor(this.schema, entity, field, this.visitor)) {\n\t\t\t\tfieldMap[name] = resultField\n\t\t\t}\n\t\t}\n\t\treturn fieldMap\n\t}\n}\n\nexport interface HasManyToHasOneReducerExtension {\n\trelationName: string\n}\n"],"names":[],"mappings":";;;;;AAKO,MAAM,uBAAwF;AAAA,EAGpG,YACkB,QACA,SAChB;AAFgB,SAAA,SAAA;AACA,SAAA,UAAA;AAAA,EACf;AAAA,EAEH,UAAU,QAAsB,kBAA+E;AAC9G,UAAM,WAAsD,CAAA;AAC5D,eAAW,SAAS,kBAAkB;AACrC,UAAI,MAAM,SAAS,MAAM,aAAa,YAAY;AACjD;AAAA,MACD;AAEA,iBAAW,CAAC,MAAM,WAAW,KAAK,mBAAmB,KAAK,QAAQ,QAAQ,OAAO,KAAK,OAAO,GAAG;AAC/F,iBAAS,IAAI,IAAI;AAAA,MAClB;AAAA,IACD;AACA,WAAO;AAAA,EACR;AACD;AApBC,cADY,wBACL,iBAAwB,wBAAA;"}