@contember/engine-tenant-api 1.4.0-rc.8 → 2.0.0-alpha.8

package/dist/production/src/model/authorization/AclSchemaAccessNodeFactory.cjs

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const PermissionActions = require("./PermissionActions.cjs");
+const MembershipMatcher = require("./MembershipMatcher.cjs");
+const DirectPermissionsAccessNode = require("./DirectPermissionsAccessNode.cjs");
+class AclSchemaAccessNodeFactory {
+  create(schema, memberships) {
+    const createVerifier = (getRule) => {
+      const membershipMatcher = new MembershipMatcher.MembershipMatcher(memberships.map((it) => ({
+        ...it,
+        matchRule: getRule(schema.roles[it.role]?.tenant ?? {})
+      })));
+      return ({ memberships: memberships2 }) => {
+        return memberships2.every((it) => membershipMatcher.matches(it));
+      };
+    };
+    const membershipRoles = memberships.map((it) => schema.roles[it.role]).filter((it) => !!it);
+    const node = new DirectPermissionsAccessNode.DirectPermissionsAccessNode();
+    if (membershipRoles.some((it) => it.tenant?.invite)) {
+      const verifier = createVerifier((it) => it.invite && it.invite !== true ? it.invite : it.manage ?? {});
+      node.allow(PermissionActions.PermissionActions.PERSON_INVITE([]), verifier);
+    }
+    if (membershipRoles.some((it) => it.tenant?.unmanagedInvite)) {
+      const verifier = createVerifier((it) => it.unmanagedInvite && it.unmanagedInvite !== true ? it.unmanagedInvite : it.manage ?? {});
+      node.allow(PermissionActions.PermissionActions.PERSON_INVITE_UNMANAGED([]), verifier);
+    }
+    if (membershipRoles.some((it) => it.tenant?.manage)) {
+      const verifier = createVerifier((it) => it.manage ?? {});
+      node.allow(PermissionActions.PermissionActions.PROJECT_ADD_MEMBER([]), verifier);
+      node.allow(PermissionActions.PermissionActions.PROJECT_VIEW_MEMBER([]), verifier);
+      node.allow(PermissionActions.PermissionActions.PROJECT_UPDATE_MEMBER([]), verifier);
+      node.allow(PermissionActions.PermissionActions.PROJECT_REMOVE_MEMBER([]), verifier);
+    }
+    if (membershipRoles.some((it) => it.tenant?.view)) {
+      const verifier = createVerifier((it) => it.view ?? {});
+      node.allow(PermissionActions.PermissionActions.PROJECT_VIEW_MEMBER([]), verifier);
+    }
+    return node;
+  }
+}
+exports.AclSchemaAccessNodeFactory = AclSchemaAccessNodeFactory;
+//# sourceMappingURL=AclSchemaAccessNodeFactory.cjs.map

package/dist/production/src/model/authorization/AclSchemaAccessNodeFactory.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AclSchemaAccessNodeFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/AclSchemaAccessNodeFactory.ts"],"sourcesContent":["import { AccessNode } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions'\nimport { Acl } from '@contember/schema'\nimport { MembershipMatcher } from './MembershipMatcher'\nimport { DirectPermissionsAccessNode } from './DirectPermissionsAccessNode'\n\nexport class AclSchemaAccessNodeFactory {\n\tcreate(schema: Acl.Schema, memberships: readonly Acl.Membership[]): AccessNode {\n\n\t\tconst createVerifier = (getRule: (permissions: Acl.TenantPermissions) => Acl.MembershipMatchRule) => {\n\t\t\tconst membershipMatcher = new MembershipMatcher(memberships.map(it => ({\n\t\t\t\t...it,\n\t\t\t\tmatchRule: getRule(schema.roles[it.role]?.tenant ?? {}),\n\t\t\t})))\n\n\t\t\treturn ({ memberships }: { memberships: readonly Acl.Membership[] }) => {\n\t\t\t\treturn memberships.every(it => membershipMatcher.matches(it))\n\t\t\t}\n\t\t}\n\n\t\tconst membershipRoles = memberships.map(it => schema.roles[it.role]).filter(it => !!it)\n\t\tconst node = new DirectPermissionsAccessNode()\n\n\t\tif (membershipRoles.some(it => it.tenant?.invite)) {\n\t\t\tconst verifier = createVerifier(it => it.invite && it.invite !== true ? it.invite : it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PERSON_INVITE([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.unmanagedInvite)) {\n\t\t\tconst verifier = createVerifier(it => it.unmanagedInvite && it.unmanagedInvite !== true ? it.unmanagedInvite : it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PERSON_INVITE_UNMANAGED([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.manage)) {\n\t\t\tconst verifier = createVerifier(it => it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PROJECT_ADD_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_UPDATE_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_REMOVE_MEMBER([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.view)) {\n\t\t\tconst verifier = createVerifier(it => it.view ?? {})\n\t\t\tnode.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)\n\t\t}\n\n\t\treturn node\n\t}\n}\n"],"names":["MembershipMatcher","memberships","DirectPermissionsAccessNode","PermissionActions"],"mappings":";;;;;AAMO,MAAM,2BAA2B;AAAA,EACvC,OAAO,QAAoB,aAAoD;AAExE,UAAA,iBAAiB,CAAC,YAA6E;AACpG,YAAM,oBAAoB,IAAIA,kBAAkB,kBAAA,YAAY,IAAI,CAAO,QAAA;AAAA,QACtE,GAAG;AAAA,QACH,WAAW,QAAQ,OAAO,MAAM,GAAG,IAAI,GAAG,UAAU,EAAE;AAAA,QACrD,CAAC;AAEH,aAAO,CAAC,EAAE,aAAAC,mBAA8D;AACvE,eAAOA,aAAY,MAAM,CAAA,OAAM,kBAAkB,QAAQ,EAAE,CAAC;AAAA,MAAA;AAAA,IAC7D;AAGD,UAAM,kBAAkB,YAAY,IAAI,CAAA,OAAM,OAAO,MAAM,GAAG,IAAI,CAAC,EAAE,OAAO,CAAM,OAAA,CAAC,CAAC,EAAE;AAChF,UAAA,OAAO,IAAIC,4BAAAA;AAEjB,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,MAAM,GAAG;AAClD,YAAM,WAAW,eAAe,CAAM,OAAA,GAAG,UAAU,GAAG,WAAW,OAAO,GAAG,SAAS,GAAG,UAAU,CAAE,CAAA;AACnG,WAAK,MAAMC,kBAAkB,kBAAA,cAAc,CAAE,CAAA,GAAG,QAAQ;AAAA,IACzD;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,eAAe,GAAG;AAC3D,YAAM,WAAW,eAAe,CAAM,OAAA,GAAG,mBAAmB,GAAG,oBAAoB,OAAO,GAAG,kBAAkB,GAAG,UAAU,CAAE,CAAA;AAC9H,WAAK,MAAMA,kBAAkB,kBAAA,wBAAwB,CAAE,CAAA,GAAG,QAAQ;AAAA,IACnE;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,MAAM,GAAG;AAClD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,UAAU,CAAA,CAAE;AACrD,WAAK,MAAMA,kBAAkB,kBAAA,mBAAmB,CAAE,CAAA,GAAG,QAAQ;AAC7D,WAAK,MAAMA,kBAAkB,kBAAA,oBAAoB,CAAE,CAAA,GAAG,QAAQ;AAC9D,WAAK,MAAMA,kBAAkB,kBAAA,sBAAsB,CAAE,CAAA,GAAG,QAAQ;AAChE,WAAK,MAAMA,kBAAkB,kBAAA,sBAAsB,CAAE,CAAA,GAAG,QAAQ;AAAA,IACjE;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,IAAI,GAAG;AAChD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,QAAQ,CAAA,CAAE;AACnD,WAAK,MAAMA,kBAAkB,kBAAA,oBAAoB,CAAE,CAAA,GAAG,QAAQ;AAAA,IAC/D;AAEO,WAAA;AAAA,EACR;AACD;;"}

package/dist/production/src/model/authorization/AclSchemaAccessNodeFactory.js

@@ -0,0 +1,42 @@
+import { PermissionActions } from "./PermissionActions.js";
+import { MembershipMatcher } from "./MembershipMatcher.js";
+import { DirectPermissionsAccessNode } from "./DirectPermissionsAccessNode.js";
+class AclSchemaAccessNodeFactory {
+  create(schema, memberships) {
+    const createVerifier = (getRule) => {
+      const membershipMatcher = new MembershipMatcher(memberships.map((it) => ({
+        ...it,
+        matchRule: getRule(schema.roles[it.role]?.tenant ?? {})
+      })));
+      return ({ memberships: memberships2 }) => {
+        return memberships2.every((it) => membershipMatcher.matches(it));
+      };
+    };
+    const membershipRoles = memberships.map((it) => schema.roles[it.role]).filter((it) => !!it);
+    const node = new DirectPermissionsAccessNode();
+    if (membershipRoles.some((it) => it.tenant?.invite)) {
+      const verifier = createVerifier((it) => it.invite && it.invite !== true ? it.invite : it.manage ?? {});
+      node.allow(PermissionActions.PERSON_INVITE([]), verifier);
+    }
+    if (membershipRoles.some((it) => it.tenant?.unmanagedInvite)) {
+      const verifier = createVerifier((it) => it.unmanagedInvite && it.unmanagedInvite !== true ? it.unmanagedInvite : it.manage ?? {});
+      node.allow(PermissionActions.PERSON_INVITE_UNMANAGED([]), verifier);
+    }
+    if (membershipRoles.some((it) => it.tenant?.manage)) {
+      const verifier = createVerifier((it) => it.manage ?? {});
+      node.allow(PermissionActions.PROJECT_ADD_MEMBER([]), verifier);
+      node.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier);
+      node.allow(PermissionActions.PROJECT_UPDATE_MEMBER([]), verifier);
+      node.allow(PermissionActions.PROJECT_REMOVE_MEMBER([]), verifier);
+    }
+    if (membershipRoles.some((it) => it.tenant?.view)) {
+      const verifier = createVerifier((it) => it.view ?? {});
+      node.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier);
+    }
+    return node;
+  }
+}
+export {
+  AclSchemaAccessNodeFactory
+};
+//# sourceMappingURL=AclSchemaAccessNodeFactory.js.map

package/dist/production/src/model/authorization/AclSchemaAccessNodeFactory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AclSchemaAccessNodeFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/AclSchemaAccessNodeFactory.ts"],"sourcesContent":["import { AccessNode } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions'\nimport { Acl } from '@contember/schema'\nimport { MembershipMatcher } from './MembershipMatcher'\nimport { DirectPermissionsAccessNode } from './DirectPermissionsAccessNode'\n\nexport class AclSchemaAccessNodeFactory {\n\tcreate(schema: Acl.Schema, memberships: readonly Acl.Membership[]): AccessNode {\n\n\t\tconst createVerifier = (getRule: (permissions: Acl.TenantPermissions) => Acl.MembershipMatchRule) => {\n\t\t\tconst membershipMatcher = new MembershipMatcher(memberships.map(it => ({\n\t\t\t\t...it,\n\t\t\t\tmatchRule: getRule(schema.roles[it.role]?.tenant ?? {}),\n\t\t\t})))\n\n\t\t\treturn ({ memberships }: { memberships: readonly Acl.Membership[] }) => {\n\t\t\t\treturn memberships.every(it => membershipMatcher.matches(it))\n\t\t\t}\n\t\t}\n\n\t\tconst membershipRoles = memberships.map(it => schema.roles[it.role]).filter(it => !!it)\n\t\tconst node = new DirectPermissionsAccessNode()\n\n\t\tif (membershipRoles.some(it => it.tenant?.invite)) {\n\t\t\tconst verifier = createVerifier(it => it.invite && it.invite !== true ? it.invite : it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PERSON_INVITE([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.unmanagedInvite)) {\n\t\t\tconst verifier = createVerifier(it => it.unmanagedInvite && it.unmanagedInvite !== true ? it.unmanagedInvite : it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PERSON_INVITE_UNMANAGED([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.manage)) {\n\t\t\tconst verifier = createVerifier(it => it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PROJECT_ADD_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_UPDATE_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_REMOVE_MEMBER([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.view)) {\n\t\t\tconst verifier = createVerifier(it => it.view ?? {})\n\t\t\tnode.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)\n\t\t}\n\n\t\treturn node\n\t}\n}\n"],"names":["memberships"],"mappings":";;;AAMO,MAAM,2BAA2B;AAAA,EACvC,OAAO,QAAoB,aAAoD;AAExE,UAAA,iBAAiB,CAAC,YAA6E;AACpG,YAAM,oBAAoB,IAAI,kBAAkB,YAAY,IAAI,CAAO,QAAA;AAAA,QACtE,GAAG;AAAA,QACH,WAAW,QAAQ,OAAO,MAAM,GAAG,IAAI,GAAG,UAAU,EAAE;AAAA,QACrD,CAAC;AAEH,aAAO,CAAC,EAAE,aAAAA,mBAA8D;AACvE,eAAOA,aAAY,MAAM,CAAA,OAAM,kBAAkB,QAAQ,EAAE,CAAC;AAAA,MAAA;AAAA,IAC7D;AAGD,UAAM,kBAAkB,YAAY,IAAI,CAAA,OAAM,OAAO,MAAM,GAAG,IAAI,CAAC,EAAE,OAAO,CAAM,OAAA,CAAC,CAAC,EAAE;AAChF,UAAA,OAAO,IAAI;AAEjB,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,MAAM,GAAG;AAClD,YAAM,WAAW,eAAe,CAAM,OAAA,GAAG,UAAU,GAAG,WAAW,OAAO,GAAG,SAAS,GAAG,UAAU,CAAE,CAAA;AACnG,WAAK,MAAM,kBAAkB,cAAc,CAAE,CAAA,GAAG,QAAQ;AAAA,IACzD;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,eAAe,GAAG;AAC3D,YAAM,WAAW,eAAe,CAAM,OAAA,GAAG,mBAAmB,GAAG,oBAAoB,OAAO,GAAG,kBAAkB,GAAG,UAAU,CAAE,CAAA;AAC9H,WAAK,MAAM,kBAAkB,wBAAwB,CAAE,CAAA,GAAG,QAAQ;AAAA,IACnE;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,MAAM,GAAG;AAClD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,UAAU,CAAA,CAAE;AACrD,WAAK,MAAM,kBAAkB,mBAAmB,CAAE,CAAA,GAAG,QAAQ;AAC7D,WAAK,MAAM,kBAAkB,oBAAoB,CAAE,CAAA,GAAG,QAAQ;AAC9D,WAAK,MAAM,kBAAkB,sBAAsB,CAAE,CAAA,GAAG,QAAQ;AAChE,WAAK,MAAM,kBAAkB,sBAAsB,CAAE,CAAA,GAAG,QAAQ;AAAA,IACjE;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,IAAI,GAAG;AAChD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,QAAQ,CAAA,CAAE;AACnD,WAAK,MAAM,kBAAkB,oBAAoB,CAAE,CAAA,GAAG,QAAQ;AAAA,IAC/D;AAEO,WAAA;AAAA,EACR;AACD;"}

package/dist/production/src/model/authorization/DirectPermissionsAccessNode.cjs

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+class DirectPermissionsAccessNode {
+  constructor() {
+    __publicField(this, "permissions", {});
+  }
+  allow({ resource, privilege }, verifier = () => true) {
+    var _a;
+    (_a = this.permissions)[resource] ?? (_a[resource] = {});
+    this.permissions[resource][privilege] = verifier;
+  }
+  isAllowed(accessEvaluator, { resource, meta, privilege }) {
+    return Promise.resolve(this.permissions[resource]?.[privilege]?.(meta) === true);
+  }
+}
+exports.DirectPermissionsAccessNode = DirectPermissionsAccessNode;
+//# sourceMappingURL=DirectPermissionsAccessNode.cjs.map

package/dist/production/src/model/authorization/DirectPermissionsAccessNode.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"DirectPermissionsAccessNode.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/DirectPermissionsAccessNode.ts"],"sourcesContent":["import { AccessEvaluator, AccessNode, Authorizator } from '@contember/authorization'\n\ntype PermissionsMap = {\n\t[resource: string]: {\n\t\t[privilege: string]: (meta: any) => boolean\n\t}\n}\n\nexport class DirectPermissionsAccessNode implements AccessNode {\n\tprivate permissions: PermissionsMap = {}\n\n\tpublic allow<Meta extends {} | undefined = undefined>(\n\t\t{ resource, privilege }: Authorizator.Action<Meta>,\n\t\tverifier: (meta: Meta) => boolean = () => true,\n\t) {\n\t\tthis.permissions[resource] ??= {}\n\t\tthis.permissions[resource][privilege] = verifier\n\t}\n\n\tisAllowed(accessEvaluator: AccessEvaluator, { resource, meta, privilege }: Authorizator.Action): Promise<boolean> {\n\t\treturn Promise.resolve(this.permissions[resource]?.[privilege]?.(meta) === true)\n\t}\n}\n"],"names":[],"mappings":";;;;;AAQO,MAAM,4BAAkD;AAAA,EAAxD,cAAA;AACN,kBAAA,MAAQ,eAA8B,CAAA,CAAC;AAAA,EAAA;AAAA,EAEhC,MACN,EAAE,UAAU,UACZ,GAAA,WAAoC,MAAM,MACzC;AAdH,QAAA;AAeO,KAAA,KAAA,KAAA,aAAL,6BAA+B,CAAA;AAC/B,SAAK,YAAY,QAAQ,EAAE,SAAS,IAAI;AAAA,EACzC;AAAA,EAEA,UAAU,iBAAkC,EAAE,UAAU,MAAM,aAAoD;AAC1G,WAAA,QAAQ,QAAQ,KAAK,YAAY,QAAQ,IAAI,SAAS,IAAI,IAAI,MAAM,IAAI;AAAA,EAChF;AACD;;"}

package/dist/production/src/model/authorization/DirectPermissionsAccessNode.js

@@ -0,0 +1,20 @@
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+class DirectPermissionsAccessNode {
+  constructor() {
+    __publicField(this, "permissions", {});
+  }
+  allow({ resource, privilege }, verifier = () => true) {
+    var _a;
+    (_a = this.permissions)[resource] ?? (_a[resource] = {});
+    this.permissions[resource][privilege] = verifier;
+  }
+  isAllowed(accessEvaluator, { resource, meta, privilege }) {
+    return Promise.resolve(this.permissions[resource]?.[privilege]?.(meta) === true);
+  }
+}
+export {
+  DirectPermissionsAccessNode
+};
+//# sourceMappingURL=DirectPermissionsAccessNode.js.map

package/dist/production/src/model/authorization/DirectPermissionsAccessNode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DirectPermissionsAccessNode.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/DirectPermissionsAccessNode.ts"],"sourcesContent":["import { AccessEvaluator, AccessNode, Authorizator } from '@contember/authorization'\n\ntype PermissionsMap = {\n\t[resource: string]: {\n\t\t[privilege: string]: (meta: any) => boolean\n\t}\n}\n\nexport class DirectPermissionsAccessNode implements AccessNode {\n\tprivate permissions: PermissionsMap = {}\n\n\tpublic allow<Meta extends {} | undefined = undefined>(\n\t\t{ resource, privilege }: Authorizator.Action<Meta>,\n\t\tverifier: (meta: Meta) => boolean = () => true,\n\t) {\n\t\tthis.permissions[resource] ??= {}\n\t\tthis.permissions[resource][privilege] = verifier\n\t}\n\n\tisAllowed(accessEvaluator: AccessEvaluator, { resource, meta, privilege }: Authorizator.Action): Promise<boolean> {\n\t\treturn Promise.resolve(this.permissions[resource]?.[privilege]?.(meta) === true)\n\t}\n}\n"],"names":[],"mappings":";;;AAQO,MAAM,4BAAkD;AAAA,EAAxD,cAAA;AACN,kBAAA,MAAQ,eAA8B,CAAA,CAAC;AAAA,EAAA;AAAA,EAEhC,MACN,EAAE,UAAU,UACZ,GAAA,WAAoC,MAAM,MACzC;AAdH,QAAA;AAeO,KAAA,KAAA,KAAA,aAAL,6BAA+B,CAAA;AAC/B,SAAK,YAAY,QAAQ,EAAE,SAAS,IAAI;AAAA,EACzC;AAAA,EAEA,UAAU,iBAAkC,EAAE,UAAU,MAAM,aAAoD;AAC1G,WAAA,QAAQ,QAAQ,KAAK,YAAY,QAAQ,IAAI,SAAS,IAAI,IAAI,MAAM,IAAI;AAAA,EAChF;AACD;"}

package/dist/production/src/model/authorization/Identity.cjs

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+class StaticIdentity {
+  constructor(id, roles, projectMemberships = {}) {
+    this.id = id;
+    this.roles = roles;
+    this.projectMemberships = projectMemberships;
+  }
+  getProjectMemberships(projectSlug) {
+    return Promise.resolve(this.projectMemberships[projectSlug] || {});
+  }
+}
+class ProjectAwareIdentity {
+  constructor(id, roles, dbContext, memberManager) {
+    this.id = id;
+    this.roles = roles;
+    this.dbContext = dbContext;
+    this.memberManager = memberManager;
+    __publicField(this, "projectMembershipCache", {});
+  }
+  async getProjectMemberships(projectSlug) {
+    var _a;
+    (_a = this.projectMembershipCache)[projectSlug] ?? (_a[projectSlug] = this.memberManager.getEffectiveProjectMemberships(this.dbContext, { slug: projectSlug }, this));
+    return await this.projectMembershipCache[projectSlug];
+  }
+}
+exports.ProjectAwareIdentity = ProjectAwareIdentity;
+exports.StaticIdentity = StaticIdentity;
+//# sourceMappingURL=Identity.cjs.map

package/dist/production/src/model/authorization/Identity.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Identity.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/Identity.ts"],"sourcesContent":["import { ProjectMemberManager } from '../service'\nimport { DatabaseContext } from '../utils'\nimport { Acl } from '@contember/schema'\n\nexport interface Identity {\n\treadonly id: string\n\treadonly roles: readonly string[]\n\n\tgetProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]>\n}\n\nexport class StaticIdentity implements Identity {\n\tconstructor(\n\t\tpublic readonly id: string,\n\t\tpublic readonly roles: string[],\n\t\tprivate projectMemberships: Record<string, readonly Acl.Membership[]> = {},\n\t) {}\n\n\tgetProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]> {\n\t\treturn Promise.resolve(this.projectMemberships[projectSlug] || {})\n\t}\n}\n\nexport class ProjectAwareIdentity implements Identity {\n\tprivate projectMembershipCache: Record<string, Promise<readonly Acl.Membership[]>> = {}\n\n\tconstructor(\n\t\tpublic readonly id: string,\n\t\tpublic readonly roles: readonly string[],\n\t\tprivate readonly dbContext: DatabaseContext,\n\t\tprivate readonly memberManager: ProjectMemberManager,\n\t) {}\n\n\tasync getProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]> {\n\t\tthis.projectMembershipCache[projectSlug] ??= this.memberManager.getEffectiveProjectMemberships(this.dbContext, { slug: projectSlug }, this)\n\t\treturn await this.projectMembershipCache[projectSlug]\n\t}\n}\n"],"names":[],"mappings":";;;;;AAWO,MAAM,eAAmC;AAAA,EAC/C,YACiB,IACA,OACR,qBAAgE,CAAA,GACvE;AAHe,SAAA,KAAA;AACA,SAAA,QAAA;AACR,SAAA,qBAAA;AAAA,EACN;AAAA,EAEH,sBAAsB,aAAyD;AAC9E,WAAO,QAAQ,QAAQ,KAAK,mBAAmB,WAAW,KAAK,CAAA,CAAE;AAAA,EAClE;AACD;AAEO,MAAM,qBAAyC;AAAA,EAGrD,YACiB,IACA,OACC,WACA,eAChB;AAJe,SAAA,KAAA;AACA,SAAA,QAAA;AACC,SAAA,YAAA;AACA,SAAA,gBAAA;AANlB,kBAAA,MAAQ,0BAA6E,CAAA,CAAC;AAAA,EAOnF;AAAA,EAEH,MAAM,sBAAsB,aAAyD;AAjCtF,QAAA;AAkCO,KAAA,KAAA,KAAA,wBAAL,WAA6C,MAAA,GAAA,WAAA,IAAA,KAAK,cAAc,+BAA+B,KAAK,WAAW,EAAE,MAAM,YAAY,GAAG,IAAI;AACnI,WAAA,MAAM,KAAK,uBAAuB,WAAW;AAAA,EACrD;AACD;;;"}

package/dist/production/src/model/authorization/Identity.js

@@ -0,0 +1,32 @@
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+class StaticIdentity {
+  constructor(id, roles, projectMemberships = {}) {
+    this.id = id;
+    this.roles = roles;
+    this.projectMemberships = projectMemberships;
+  }
+  getProjectMemberships(projectSlug) {
+    return Promise.resolve(this.projectMemberships[projectSlug] || {});
+  }
+}
+class ProjectAwareIdentity {
+  constructor(id, roles, dbContext, memberManager) {
+    this.id = id;
+    this.roles = roles;
+    this.dbContext = dbContext;
+    this.memberManager = memberManager;
+    __publicField(this, "projectMembershipCache", {});
+  }
+  async getProjectMemberships(projectSlug) {
+    var _a;
+    (_a = this.projectMembershipCache)[projectSlug] ?? (_a[projectSlug] = this.memberManager.getEffectiveProjectMemberships(this.dbContext, { slug: projectSlug }, this));
+    return await this.projectMembershipCache[projectSlug];
+  }
+}
+export {
+  ProjectAwareIdentity,
+  StaticIdentity
+};
+//# sourceMappingURL=Identity.js.map

package/dist/production/src/model/authorization/Identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Identity.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/Identity.ts"],"sourcesContent":["import { ProjectMemberManager } from '../service'\nimport { DatabaseContext } from '../utils'\nimport { Acl } from '@contember/schema'\n\nexport interface Identity {\n\treadonly id: string\n\treadonly roles: readonly string[]\n\n\tgetProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]>\n}\n\nexport class StaticIdentity implements Identity {\n\tconstructor(\n\t\tpublic readonly id: string,\n\t\tpublic readonly roles: string[],\n\t\tprivate projectMemberships: Record<string, readonly Acl.Membership[]> = {},\n\t) {}\n\n\tgetProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]> {\n\t\treturn Promise.resolve(this.projectMemberships[projectSlug] || {})\n\t}\n}\n\nexport class ProjectAwareIdentity implements Identity {\n\tprivate projectMembershipCache: Record<string, Promise<readonly Acl.Membership[]>> = {}\n\n\tconstructor(\n\t\tpublic readonly id: string,\n\t\tpublic readonly roles: readonly string[],\n\t\tprivate readonly dbContext: DatabaseContext,\n\t\tprivate readonly memberManager: ProjectMemberManager,\n\t) {}\n\n\tasync getProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]> {\n\t\tthis.projectMembershipCache[projectSlug] ??= this.memberManager.getEffectiveProjectMemberships(this.dbContext, { slug: projectSlug }, this)\n\t\treturn await this.projectMembershipCache[projectSlug]\n\t}\n}\n"],"names":[],"mappings":";;;AAWO,MAAM,eAAmC;AAAA,EAC/C,YACiB,IACA,OACR,qBAAgE,CAAA,GACvE;AAHe,SAAA,KAAA;AACA,SAAA,QAAA;AACR,SAAA,qBAAA;AAAA,EACN;AAAA,EAEH,sBAAsB,aAAyD;AAC9E,WAAO,QAAQ,QAAQ,KAAK,mBAAmB,WAAW,KAAK,CAAA,CAAE;AAAA,EAClE;AACD;AAEO,MAAM,qBAAyC;AAAA,EAGrD,YACiB,IACA,OACC,WACA,eAChB;AAJe,SAAA,KAAA;AACA,SAAA,QAAA;AACC,SAAA,YAAA;AACA,SAAA,gBAAA;AANlB,kBAAA,MAAQ,0BAA6E,CAAA,CAAC;AAAA,EAOnF;AAAA,EAEH,MAAM,sBAAsB,aAAyD;AAjCtF,QAAA;AAkCO,KAAA,KAAA,KAAA,wBAAL,WAA6C,MAAA,GAAA,WAAA,IAAA,KAAK,cAAc,+BAA+B,KAAK,WAAW,EAAE,MAAM,YAAY,GAAG,IAAI;AACnI,WAAA,MAAM,KAAK,uBAAuB,WAAW;AAAA,EACrD;AACD;"}

package/dist/production/src/model/authorization/IdentityFactory.cjs

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Identity = require("./Identity.cjs");
+class IdentityFactory {
+  constructor(projectMemberManager) {
+    this.projectMemberManager = projectMemberManager;
+  }
+  create(dbContext, args) {
+    return new Identity.ProjectAwareIdentity(args.id, args.roles, dbContext, this.projectMemberManager);
+  }
+}
+exports.IdentityFactory = IdentityFactory;
+//# sourceMappingURL=IdentityFactory.cjs.map

package/dist/production/src/model/authorization/IdentityFactory.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdentityFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/IdentityFactory.ts"],"sourcesContent":["import { ProjectMemberManager } from '../service'\nimport { Identity, ProjectAwareIdentity } from './Identity'\nimport { DatabaseContext } from '../utils'\n\nexport class IdentityFactory {\n\tconstructor(private readonly projectMemberManager: ProjectMemberManager) {}\n\n\tpublic create(dbContext: DatabaseContext, args: { id: string; roles: readonly string[] }): Identity {\n\t\treturn new ProjectAwareIdentity(args.id, args.roles, dbContext, this.projectMemberManager)\n\t}\n}\n"],"names":["ProjectAwareIdentity"],"mappings":";;;AAIO,MAAM,gBAAgB;AAAA,EAC5B,YAA6B,sBAA4C;AAA5C,SAAA,uBAAA;AAAA,EAA6C;AAAA,EAEnE,OAAO,WAA4B,MAA0D;AAC5F,WAAA,IAAIA,SAAAA,qBAAqB,KAAK,IAAI,KAAK,OAAO,WAAW,KAAK,oBAAoB;AAAA,EAC1F;AACD;;"}

package/dist/production/src/model/authorization/IdentityFactory.js

@@ -0,0 +1,13 @@
+import { ProjectAwareIdentity } from "./Identity.js";
+class IdentityFactory {
+  constructor(projectMemberManager) {
+    this.projectMemberManager = projectMemberManager;
+  }
+  create(dbContext, args) {
+    return new ProjectAwareIdentity(args.id, args.roles, dbContext, this.projectMemberManager);
+  }
+}
+export {
+  IdentityFactory
+};
+//# sourceMappingURL=IdentityFactory.js.map

package/dist/production/src/model/authorization/IdentityFactory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdentityFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/IdentityFactory.ts"],"sourcesContent":["import { ProjectMemberManager } from '../service'\nimport { Identity, ProjectAwareIdentity } from './Identity'\nimport { DatabaseContext } from '../utils'\n\nexport class IdentityFactory {\n\tconstructor(private readonly projectMemberManager: ProjectMemberManager) {}\n\n\tpublic create(dbContext: DatabaseContext, args: { id: string; roles: readonly string[] }): Identity {\n\t\treturn new ProjectAwareIdentity(args.id, args.roles, dbContext, this.projectMemberManager)\n\t}\n}\n"],"names":[],"mappings":";AAIO,MAAM,gBAAgB;AAAA,EAC5B,YAA6B,sBAA4C;AAA5C,SAAA,uBAAA;AAAA,EAA6C;AAAA,EAEnE,OAAO,WAA4B,MAA0D;AAC5F,WAAA,IAAI,qBAAqB,KAAK,IAAI,KAAK,OAAO,WAAW,KAAK,oBAAoB;AAAA,EAC1F;AACD;"}

package/dist/production/src/model/authorization/IdentityScope.cjs

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const authorization = require("@contember/authorization");
+const Roles = require("./Roles.cjs");
+class IdentityScope {
+  constructor(identityId) {
+    this.identityId = identityId;
+  }
+  async getIdentityAccess(identity) {
+    return new authorization.AccessNode.Roles(identity.id === this.identityId ? [Roles.TenantRole.SELF] : []);
+  }
+}
+exports.IdentityScope = IdentityScope;
+//# sourceMappingURL=IdentityScope.cjs.map

package/dist/production/src/model/authorization/IdentityScope.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdentityScope.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/IdentityScope.ts"],"sourcesContent":["import { AuthorizationScope, AccessNode } from '@contember/authorization'\nimport { TenantRole } from './Roles'\nimport { Identity } from './Identity'\n\nclass IdentityScope implements AuthorizationScope<Identity> {\n\tconstructor(private readonly identityId: string) {}\n\n\tasync getIdentityAccess(identity: Identity): Promise<AccessNode> {\n\t\treturn new AccessNode.Roles(identity.id === this.identityId ? [TenantRole.SELF] : [])\n\t}\n}\n\nexport { IdentityScope }\n"],"names":["AccessNode","TenantRole"],"mappings":";;;;AAIA,MAAM,cAAsD;AAAA,EAC3D,YAA6B,YAAoB;AAApB,SAAA,aAAA;AAAA,EAAqB;AAAA,EAElD,MAAM,kBAAkB,UAAyC;AAChE,WAAO,IAAIA,cAAA,WAAW,MAAM,SAAS,OAAO,KAAK,aAAa,CAACC,MAAW,WAAA,IAAI,IAAI,CAAE,CAAA;AAAA,EACrF;AACD;;"}

package/dist/production/src/model/authorization/IdentityScope.js

@@ -0,0 +1,14 @@
+import { AccessNode } from "@contember/authorization";
+import { TenantRole } from "./Roles.js";
+class IdentityScope {
+  constructor(identityId) {
+    this.identityId = identityId;
+  }
+  async getIdentityAccess(identity) {
+    return new AccessNode.Roles(identity.id === this.identityId ? [TenantRole.SELF] : []);
+  }
+}
+export {
+  IdentityScope
+};
+//# sourceMappingURL=IdentityScope.js.map

package/dist/production/src/model/authorization/IdentityScope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdentityScope.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/IdentityScope.ts"],"sourcesContent":["import { AuthorizationScope, AccessNode } from '@contember/authorization'\nimport { TenantRole } from './Roles'\nimport { Identity } from './Identity'\n\nclass IdentityScope implements AuthorizationScope<Identity> {\n\tconstructor(private readonly identityId: string) {}\n\n\tasync getIdentityAccess(identity: Identity): Promise<AccessNode> {\n\t\treturn new AccessNode.Roles(identity.id === this.identityId ? [TenantRole.SELF] : [])\n\t}\n}\n\nexport { IdentityScope }\n"],"names":[],"mappings":";;AAIA,MAAM,cAAsD;AAAA,EAC3D,YAA6B,YAAoB;AAApB,SAAA,aAAA;AAAA,EAAqB;AAAA,EAElD,MAAM,kBAAkB,UAAyC;AAChE,WAAO,IAAI,WAAW,MAAM,SAAS,OAAO,KAAK,aAAa,CAAC,WAAW,IAAI,IAAI,CAAE,CAAA;AAAA,EACrF;AACD;"}

package/dist/production/src/model/authorization/MembershipMatcher.cjs

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+class MembershipMatcher {
+  constructor(memberships) {
+    this.memberships = memberships;
+  }
+  matches(membership) {
+    return this.memberships.some((invokerMembership) => {
+      const matchRule = invokerMembership.matchRule[membership.role];
+      if (!matchRule) {
+        return false;
+      }
+      if (matchRule === true) {
+        return true;
+      }
+      const variables = matchRule?.variables;
+      if (variables === true) {
+        return true;
+      }
+      return membership.variables.every((variable) => {
+        const sourceVariableRule = variables?.[variable.name];
+        if (!sourceVariableRule) {
+          return false;
+        }
+        if (sourceVariableRule === true) {
+          return true;
+        }
+        const sourceVariable = invokerMembership.variables.find((it) => typeof sourceVariableRule === "string" && it.name === sourceVariableRule);
+        if (!sourceVariable) {
+          return false;
+        }
+        const sourceValues = new Set(sourceVariable.values);
+        return variable.values.every((it) => sourceValues.has(it));
+      });
+    });
+  }
+}
+exports.MembershipMatcher = MembershipMatcher;
+//# sourceMappingURL=MembershipMatcher.cjs.map

package/dist/production/src/model/authorization/MembershipMatcher.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"MembershipMatcher.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/MembershipMatcher.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\n\nexport type MembershipWithSubMembershipMatchRules =\n\t& Acl.Membership\n\t& {\n\t\tmatchRule: Acl.MembershipMatchRule\n\t}\n\nexport class MembershipMatcher {\n\tconstructor(private readonly memberships: readonly MembershipWithSubMembershipMatchRules[]) {\n\t}\n\n\tmatches(membership: Acl.Membership): boolean {\n\t\treturn this.memberships.some(invokerMembership => {\n\t\t\tconst matchRule = invokerMembership.matchRule[membership.role]\n\t\t\tif (!matchRule) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tif (matchRule === true) {\n\t\t\t\treturn true\n\t\t\t}\n\t\t\tconst variables = matchRule?.variables\n\t\t\tif (variables === true) {\n\t\t\t\treturn true\n\t\t\t}\n\t\t\treturn membership.variables.every(variable => {\n\t\t\t\tconst sourceVariableRule = variables?.[variable.name]\n\t\t\t\tif (!sourceVariableRule) {\n\t\t\t\t\treturn false\n\t\t\t\t}\n\t\t\t\tif (sourceVariableRule === true) {\n\t\t\t\t\treturn true\n\t\t\t\t}\n\t\t\t\tconst sourceVariable = invokerMembership.variables.find(it => typeof sourceVariableRule === 'string' && it.name === sourceVariableRule)\n\t\t\t\tif (!sourceVariable) {\n\t\t\t\t\treturn false\n\t\t\t\t}\n\t\t\t\tconst sourceValues = new Set(sourceVariable.values)\n\t\t\t\treturn variable.values.every(it => sourceValues.has(it))\n\t\t\t})\n\t\t})\n\t}\n}\n"],"names":[],"mappings":";;AAQO,MAAM,kBAAkB;AAAA,EAC9B,YAA6B,aAA+D;AAA/D,SAAA,cAAA;AAAA,EAC7B;AAAA,EAEA,QAAQ,YAAqC;AACrC,WAAA,KAAK,YAAY,KAAK,CAAqB,sBAAA;AACjD,YAAM,YAAY,kBAAkB,UAAU,WAAW,IAAI;AAC7D,UAAI,CAAC,WAAW;AACR,eAAA;AAAA,MACR;AACA,UAAI,cAAc,MAAM;AAChB,eAAA;AAAA,MACR;AACA,YAAM,YAAY,WAAW;AAC7B,UAAI,cAAc,MAAM;AAChB,eAAA;AAAA,MACR;AACO,aAAA,WAAW,UAAU,MAAM,CAAY,aAAA;AACvC,cAAA,qBAAqB,YAAY,SAAS,IAAI;AACpD,YAAI,CAAC,oBAAoB;AACjB,iBAAA;AAAA,QACR;AACA,YAAI,uBAAuB,MAAM;AACzB,iBAAA;AAAA,QACR;AACM,cAAA,iBAAiB,kBAAkB,UAAU,KAAK,CAAA,OAAM,OAAO,uBAAuB,YAAY,GAAG,SAAS,kBAAkB;AACtI,YAAI,CAAC,gBAAgB;AACb,iBAAA;AAAA,QACR;AACA,cAAM,eAAe,IAAI,IAAI,eAAe,MAAM;AAClD,eAAO,SAAS,OAAO,MAAM,QAAM,aAAa,IAAI,EAAE,CAAC;AAAA,MAAA,CACvD;AAAA,IAAA,CACD;AAAA,EACF;AACD;;"}

package/dist/production/src/model/authorization/MembershipMatcher.js

@@ -0,0 +1,39 @@
+class MembershipMatcher {
+  constructor(memberships) {
+    this.memberships = memberships;
+  }
+  matches(membership) {
+    return this.memberships.some((invokerMembership) => {
+      const matchRule = invokerMembership.matchRule[membership.role];
+      if (!matchRule) {
+        return false;
+      }
+      if (matchRule === true) {
+        return true;
+      }
+      const variables = matchRule?.variables;
+      if (variables === true) {
+        return true;
+      }
+      return membership.variables.every((variable) => {
+        const sourceVariableRule = variables?.[variable.name];
+        if (!sourceVariableRule) {
+          return false;
+        }
+        if (sourceVariableRule === true) {
+          return true;
+        }
+        const sourceVariable = invokerMembership.variables.find((it) => typeof sourceVariableRule === "string" && it.name === sourceVariableRule);
+        if (!sourceVariable) {
+          return false;
+        }
+        const sourceValues = new Set(sourceVariable.values);
+        return variable.values.every((it) => sourceValues.has(it));
+      });
+    });
+  }
+}
+export {
+  MembershipMatcher
+};
+//# sourceMappingURL=MembershipMatcher.js.map

package/dist/production/src/model/authorization/MembershipMatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MembershipMatcher.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/MembershipMatcher.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\n\nexport type MembershipWithSubMembershipMatchRules =\n\t& Acl.Membership\n\t& {\n\t\tmatchRule: Acl.MembershipMatchRule\n\t}\n\nexport class MembershipMatcher {\n\tconstructor(private readonly memberships: readonly MembershipWithSubMembershipMatchRules[]) {\n\t}\n\n\tmatches(membership: Acl.Membership): boolean {\n\t\treturn this.memberships.some(invokerMembership => {\n\t\t\tconst matchRule = invokerMembership.matchRule[membership.role]\n\t\t\tif (!matchRule) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tif (matchRule === true) {\n\t\t\t\treturn true\n\t\t\t}\n\t\t\tconst variables = matchRule?.variables\n\t\t\tif (variables === true) {\n\t\t\t\treturn true\n\t\t\t}\n\t\t\treturn membership.variables.every(variable => {\n\t\t\t\tconst sourceVariableRule = variables?.[variable.name]\n\t\t\t\tif (!sourceVariableRule) {\n\t\t\t\t\treturn false\n\t\t\t\t}\n\t\t\t\tif (sourceVariableRule === true) {\n\t\t\t\t\treturn true\n\t\t\t\t}\n\t\t\t\tconst sourceVariable = invokerMembership.variables.find(it => typeof sourceVariableRule === 'string' && it.name === sourceVariableRule)\n\t\t\t\tif (!sourceVariable) {\n\t\t\t\t\treturn false\n\t\t\t\t}\n\t\t\t\tconst sourceValues = new Set(sourceVariable.values)\n\t\t\t\treturn variable.values.every(it => sourceValues.has(it))\n\t\t\t})\n\t\t})\n\t}\n}\n"],"names":[],"mappings":"AAQO,MAAM,kBAAkB;AAAA,EAC9B,YAA6B,aAA+D;AAA/D,SAAA,cAAA;AAAA,EAC7B;AAAA,EAEA,QAAQ,YAAqC;AACrC,WAAA,KAAK,YAAY,KAAK,CAAqB,sBAAA;AACjD,YAAM,YAAY,kBAAkB,UAAU,WAAW,IAAI;AAC7D,UAAI,CAAC,WAAW;AACR,eAAA;AAAA,MACR;AACA,UAAI,cAAc,MAAM;AAChB,eAAA;AAAA,MACR;AACA,YAAM,YAAY,WAAW;AAC7B,UAAI,cAAc,MAAM;AAChB,eAAA;AAAA,MACR;AACO,aAAA,WAAW,UAAU,MAAM,CAAY,aAAA;AACvC,cAAA,qBAAqB,YAAY,SAAS,IAAI;AACpD,YAAI,CAAC,oBAAoB;AACjB,iBAAA;AAAA,QACR;AACA,YAAI,uBAAuB,MAAM;AACzB,iBAAA;AAAA,QACR;AACM,cAAA,iBAAiB,kBAAkB,UAAU,KAAK,CAAA,OAAM,OAAO,uBAAuB,YAAY,GAAG,SAAS,kBAAkB;AACtI,YAAI,CAAC,gBAAgB;AACb,iBAAA;AAAA,QACR;AACA,cAAM,eAAe,IAAI,IAAI,eAAe,MAAM;AAClD,eAAO,SAAS,OAAO,MAAM,QAAM,aAAa,IAAI,EAAE,CAAC;AAAA,MAAA,CACvD;AAAA,IAAA,CACD;AAAA,EACF;AACD;"}

package/dist/production/src/model/authorization/PermissionActions.cjs

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const authorization = require("@contember/authorization");
+exports.PermissionActions = void 0;
+((PermissionActions2) => {
+  ((Resources2) => {
+    Resources2["system"] = "system";
+    Resources2["entrypoint"] = "entrypoint";
+    Resources2["person"] = "person";
+    Resources2["identity"] = "identity";
+    Resources2["project"] = "project";
+    Resources2["apiKey"] = "apiKey";
+    Resources2["mailTemplate"] = "mailTemplate";
+    Resources2["idp"] = "idp";
+  })(PermissionActions2.Resources || (PermissionActions2.Resources = {}));
+  PermissionActions2.IDENTITY_VIEW_PERMISSIONS = authorization.Authorizator.createAction("identity", "viewPermissions");
+  PermissionActions2.IDENTITY_ADD_GLOBAL_ROLES = (roles) => authorization.Authorizator.createAction("identity", "addGlobalRoles", { roles });
+  PermissionActions2.IDENTITY_REMOVE_GLOBAL_ROLES = (roles) => authorization.Authorizator.createAction("identity", "removeGlobalRoles", { roles });
+  PermissionActions2.PERSON_DISABLE = (roles) => authorization.Authorizator.createAction("person", "disable", { roles });
+  PermissionActions2.PERSON_VIEW = authorization.Authorizator.createAction("person", "view");
+  PermissionActions2.PERSON_SIGN_IN = authorization.Authorizator.createAction("person", "signIn");
+  PermissionActions2.PERSON_SIGN_UP = (roles) => authorization.Authorizator.createAction("person", "signUp", { roles });
+  PermissionActions2.PERSON_SIGN_OUT = authorization.Authorizator.createAction("person", "signOut");
+  PermissionActions2.PERSON_SETUP_OTP = authorization.Authorizator.createAction("person", "setupOtp");
+  PermissionActions2.PERSON_CHANGE_PROFILE = (roles) => authorization.Authorizator.createAction("person", "changeProfile", { roles });
+  PermissionActions2.PERSON_CHANGE_MY_PROFILE = authorization.Authorizator.createAction("person", "changeMyProfile");
+  PermissionActions2.PERSON_CHANGE_PASSWORD = (roles) => authorization.Authorizator.createAction("person", "changePassword", { roles });
+  PermissionActions2.PERSON_CHANGE_MY_PASSWORD = authorization.Authorizator.createAction("person", "changeMyPassword");
+  PermissionActions2.PERSON_RESET_PASSWORD = authorization.Authorizator.createAction("person", "resetPassword");
+  PermissionActions2.PERSON_CREATE_IDP_URL = authorization.Authorizator.createAction("person", "createIdPUrl");
+  PermissionActions2.PERSON_SIGN_IN_IDP = authorization.Authorizator.createAction("person", "signInIdp");
+  PermissionActions2.PERSON_CREATE_SESSION_KEY = (roles) => authorization.Authorizator.createAction("person", "createSessionToken", { roles });
+  PermissionActions2.PERSON_INVITE = (memberships) => authorization.Authorizator.createAction("person", "invite", { memberships });
+  PermissionActions2.PERSON_INVITE_UNMANAGED = (memberships) => authorization.Authorizator.createAction("person", "invite_unmanaged", { memberships });
+  PermissionActions2.PROJECT_VIEW = authorization.Authorizator.createAction("project", "view");
+  PermissionActions2.PROJECT_SET_SECRET = authorization.Authorizator.createAction("project", "setSecret");
+  PermissionActions2.PROJECT_UPDATE = authorization.Authorizator.createAction("project", "update");
+  PermissionActions2.PROJECT_CREATE = authorization.Authorizator.createAction("project", "create");
+  PermissionActions2.ENTRYPOINT_DEPLOY = authorization.Authorizator.createAction("entrypoint", "deployEntrypoint");
+  PermissionActions2.PROJECT_VIEW_MEMBER = (memberships) => authorization.Authorizator.createAction("project", "viewMembers", { memberships });
+  PermissionActions2.PROJECT_ADD_MEMBER = (memberships) => authorization.Authorizator.createAction("project", "addMember", { memberships });
+  PermissionActions2.PROJECT_REMOVE_MEMBER = (memberships) => authorization.Authorizator.createAction("project", "removeMember", { memberships });
+  PermissionActions2.PROJECT_UPDATE_MEMBER = (memberships) => authorization.Authorizator.createAction("project", "updateMember", { memberships });
+  PermissionActions2.API_KEY_CREATE = authorization.Authorizator.createAction("apiKey", "create");
+  PermissionActions2.API_KEY_CREATE_GLOBAL = (roles) => authorization.Authorizator.createAction("apiKey", "createGlobal", { roles });
+  PermissionActions2.API_KEY_DISABLE = authorization.Authorizator.createAction("apiKey", "disable");
+  PermissionActions2.MAIL_TEMPLATE_ADD = authorization.Authorizator.createAction("mailTemplate", "add");
+  PermissionActions2.MAIL_TEMPLATE_REMOVE = authorization.Authorizator.createAction("mailTemplate", "remove");
+  PermissionActions2.MAIL_TEMPLATE_LIST = authorization.Authorizator.createAction("mailTemplate", "list");
+  PermissionActions2.IDP_ADD = authorization.Authorizator.createAction("idp", "add");
+  PermissionActions2.IDP_UPDATE = authorization.Authorizator.createAction("idp", "update");
+  PermissionActions2.IDP_DISABLE = authorization.Authorizator.createAction("idp", "disable");
+  PermissionActions2.IDP_ENABLE = authorization.Authorizator.createAction("idp", "enable");
+  PermissionActions2.IDP_LIST = authorization.Authorizator.createAction("idp", "list");
+})(exports.PermissionActions || (exports.PermissionActions = {}));
+//# sourceMappingURL=PermissionActions.cjs.map

package/dist/production/src/model/authorization/PermissionActions.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionActions.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionActions.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { Acl } from '@contember/schema'\n\nnamespace PermissionActions {\n\texport enum Resources {\n\t\tsystem = 'system',\n\t\tentrypoint = 'entrypoint',\n\t\tperson = 'person',\n\t\tidentity = 'identity',\n\t\tproject = 'project',\n\t\tapiKey = 'apiKey',\n\t\tmailTemplate = 'mailTemplate',\n\t\tidp = 'idp',\n\t}\n\n\texport const IDENTITY_VIEW_PERMISSIONS = Authorizator.createAction(Resources.identity, 'viewPermissions')\n\texport const IDENTITY_ADD_GLOBAL_ROLES = (roles?: readonly string[]) => Authorizator.createAction(Resources.identity, 'addGlobalRoles', { roles })\n\texport const IDENTITY_REMOVE_GLOBAL_ROLES = (roles?: readonly string[]) => Authorizator.createAction(Resources.identity, 'removeGlobalRoles', { roles })\n\n\texport const PERSON_DISABLE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'disable', { roles })\n\n\texport const PERSON_VIEW = Authorizator.createAction(Resources.person, 'view')\n\texport const PERSON_SIGN_IN = Authorizator.createAction(Resources.person, 'signIn')\n\texport const PERSON_SIGN_UP = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'signUp', { roles })\n\texport const PERSON_SIGN_OUT = Authorizator.createAction(Resources.person, 'signOut')\n\texport const PERSON_SETUP_OTP = Authorizator.createAction(Resources.person, 'setupOtp')\n\texport const PERSON_CHANGE_PROFILE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'changeProfile', { roles })\n\texport const PERSON_CHANGE_MY_PROFILE = Authorizator.createAction(Resources.person, 'changeMyProfile')\n\texport const PERSON_CHANGE_PASSWORD = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'changePassword', { roles })\n\texport const PERSON_CHANGE_MY_PASSWORD = Authorizator.createAction(Resources.person, 'changeMyPassword')\n\texport const PERSON_RESET_PASSWORD = Authorizator.createAction(Resources.person, 'resetPassword')\n\texport const PERSON_CREATE_IDP_URL = Authorizator.createAction(Resources.person, 'createIdPUrl')\n\texport const PERSON_SIGN_IN_IDP = Authorizator.createAction(Resources.person, 'signInIdp')\n\texport const PERSON_CREATE_SESSION_KEY = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'createSessionToken', { roles })\n\n\texport const PERSON_INVITE = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.person, 'invite', { memberships })\n\texport const PERSON_INVITE_UNMANAGED = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.person, 'invite_unmanaged', { memberships })\n\n\texport const PROJECT_VIEW = Authorizator.createAction(Resources.project, 'view')\n\texport const PROJECT_SET_SECRET = Authorizator.createAction(Resources.project, 'setSecret')\n\texport const PROJECT_UPDATE = Authorizator.createAction(Resources.project, 'update')\n\n\texport const PROJECT_CREATE = Authorizator.createAction(Resources.project, 'create')\n\texport const ENTRYPOINT_DEPLOY = Authorizator.createAction(Resources.entrypoint, 'deployEntrypoint')\n\n\texport const PROJECT_VIEW_MEMBER = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.project, 'viewMembers', { memberships })\n\texport const PROJECT_ADD_MEMBER = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.project, 'addMember', { memberships })\n\texport const PROJECT_REMOVE_MEMBER = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.project, 'removeMember', { memberships })\n\texport const PROJECT_UPDATE_MEMBER = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.project, 'updateMember', { memberships })\n\n\n\texport const API_KEY_CREATE = Authorizator.createAction(Resources.apiKey, 'create')\n\texport const API_KEY_CREATE_GLOBAL = (roles?: readonly string[]) => Authorizator.createAction(Resources.apiKey, 'createGlobal', { roles })\n\texport const API_KEY_DISABLE = Authorizator.createAction(Resources.apiKey, 'disable')\n\n\texport const MAIL_TEMPLATE_ADD = Authorizator.createAction(Resources.mailTemplate, 'add')\n\texport const MAIL_TEMPLATE_REMOVE = Authorizator.createAction(Resources.mailTemplate, 'remove')\n\texport const MAIL_TEMPLATE_LIST = Authorizator.createAction(Resources.mailTemplate, 'list')\n\n\texport const IDP_ADD = Authorizator.createAction(Resources.idp, 'add')\n\texport const IDP_UPDATE = Authorizator.createAction(Resources.idp, 'update')\n\texport const IDP_DISABLE = Authorizator.createAction(Resources.idp, 'disable')\n\texport const IDP_ENABLE = Authorizator.createAction(Resources.idp, 'enable')\n\texport const IDP_LIST = Authorizator.createAction(Resources.idp, 'list')\n}\n\nexport { PermissionActions }\n"],"names":["PermissionActions","Resources","Authorizator"],"mappings":";;;AAGUA,QAAA,oBAAA;AAAA,CAAV,CAAUA,uBAAV;AACQ,GAAA,CAAKC,eAAL;AACNA,eAAA,QAAS,IAAA;AACTA,eAAA,YAAa,IAAA;AACbA,eAAA,QAAS,IAAA;AACTA,eAAA,UAAW,IAAA;AACXA,eAAA,SAAU,IAAA;AACVA,eAAA,QAAS,IAAA;AACTA,eAAA,cAAe,IAAA;AACfA,eAAA,KAAM,IAAA;AAAA,EAAA,GARKD,mBAAA,cAAAA,mBAAA,YAAA,CAAA,EAAA;AAWCA,qBAAA,4BAA4BE,cAAa,aAAA,aAAa,YAAoB,iBAAiB;AAC3FF,qBAAA,4BAA4B,CAAC,UAA8BE,cAAA,aAAa,aAAa,YAAoB,kBAAkB,EAAE,MAAA,CAAO;AACpIF,qBAAA,+BAA+B,CAAC,UAA8BE,cAAA,aAAa,aAAa,YAAoB,qBAAqB,EAAE,MAAA,CAAO;AAE1IF,qBAAA,iBAAiB,CAAC,UAA8BE,cAAA,aAAa,aAAa,UAAkB,WAAW,EAAE,MAAA,CAAO;AAEhHF,qBAAA,cAAcE,cAAa,aAAA,aAAa,UAAkB,MAAM;AAChEF,qBAAA,iBAAiBE,cAAa,aAAA,aAAa,UAAkB,QAAQ;AACrEF,qBAAA,iBAAiB,CAAC,UAA8BE,cAAA,aAAa,aAAa,UAAkB,UAAU,EAAE,MAAA,CAAO;AAC/GF,qBAAA,kBAAkBE,cAAa,aAAA,aAAa,UAAkB,SAAS;AACvEF,qBAAA,mBAAmBE,cAAa,aAAA,aAAa,UAAkB,UAAU;AACzEF,qBAAA,wBAAwB,CAAC,UAA8BE,cAAA,aAAa,aAAa,UAAkB,iBAAiB,EAAE,MAAA,CAAO;AAC7HF,qBAAA,2BAA2BE,cAAa,aAAA,aAAa,UAAkB,iBAAiB;AACxFF,qBAAA,yBAAyB,CAAC,UAA8BE,cAAA,aAAa,aAAa,UAAkB,kBAAkB,EAAE,MAAA,CAAO;AAC/HF,qBAAA,4BAA4BE,cAAa,aAAA,aAAa,UAAkB,kBAAkB;AAC1FF,qBAAA,wBAAwBE,cAAa,aAAA,aAAa,UAAkB,eAAe;AACnFF,qBAAA,wBAAwBE,cAAa,aAAA,aAAa,UAAkB,cAAc;AAClFF,qBAAA,qBAAqBE,cAAa,aAAA,aAAa,UAAkB,WAAW;AAC5EF,qBAAA,4BAA4B,CAAC,UAA8BE,cAAA,aAAa,aAAa,UAAkB,sBAAsB,EAAE,MAAA,CAAO;AAEtIF,qBAAA,gBAAgB,CAAC,gBAA2CE,cAAA,aAAa,aAAa,UAAkB,UAAU,EAAE,YAAA,CAAa;AACjIF,qBAAA,0BAA0B,CAAC,gBAA2CE,cAAA,aAAa,aAAa,UAAkB,oBAAoB,EAAE,YAAA,CAAa;AAErJF,qBAAA,eAAeE,cAAa,aAAA,aAAa,WAAmB,MAAM;AAClEF,qBAAA,qBAAqBE,cAAa,aAAA,aAAa,WAAmB,WAAW;AAC7EF,qBAAA,iBAAiBE,cAAa,aAAA,aAAa,WAAmB,QAAQ;AAEtEF,qBAAA,iBAAiBE,cAAa,aAAA,aAAa,WAAmB,QAAQ;AACtEF,qBAAA,oBAAoBE,cAAa,aAAA,aAAa,cAAsB,kBAAkB;AAEtFF,qBAAA,sBAAsB,CAAC,gBAA2CE,cAAA,aAAa,aAAa,WAAmB,eAAe,EAAE,YAAA,CAAa;AAC7IF,qBAAA,qBAAqB,CAAC,gBAA2CE,cAAA,aAAa,aAAa,WAAmB,aAAa,EAAE,YAAA,CAAa;AAC1IF,qBAAA,wBAAwB,CAAC,gBAA2CE,cAAA,aAAa,aAAa,WAAmB,gBAAgB,EAAE,YAAA,CAAa;AAChJF,qBAAA,wBAAwB,CAAC,gBAA2CE,cAAA,aAAa,aAAa,WAAmB,gBAAgB,EAAE,YAAA,CAAa;AAGhJF,qBAAA,iBAAiBE,cAAa,aAAA,aAAa,UAAkB,QAAQ;AACrEF,qBAAA,wBAAwB,CAAC,UAA8BE,cAAA,aAAa,aAAa,UAAkB,gBAAgB,EAAE,MAAA,CAAO;AAC5HF,qBAAA,kBAAkBE,cAAa,aAAA,aAAa,UAAkB,SAAS;AAEvEF,qBAAA,oBAAoBE,cAAa,aAAA,aAAa,gBAAwB,KAAK;AAC3EF,qBAAA,uBAAuBE,cAAa,aAAA,aAAa,gBAAwB,QAAQ;AACjFF,qBAAA,qBAAqBE,cAAa,aAAA,aAAa,gBAAwB,MAAM;AAE7EF,qBAAA,UAAUE,cAAa,aAAA,aAAa,OAAe,KAAK;AACxDF,qBAAA,aAAaE,cAAa,aAAA,aAAa,OAAe,QAAQ;AAC9DF,qBAAA,cAAcE,cAAa,aAAA,aAAa,OAAe,SAAS;AAChEF,qBAAA,aAAaE,cAAa,aAAA,aAAa,OAAe,QAAQ;AAC9DF,qBAAA,WAAWE,cAAa,aAAA,aAAa,OAAe,MAAM;AAAA,GA5D9DF,QAAA,sBAAAA,4BAAA,CAAA,EAAA;"}

package/dist/production/src/model/authorization/PermissionActions.js

@@ -0,0 +1,57 @@
+import { Authorizator } from "@contember/authorization";
+var PermissionActions;
+((PermissionActions2) => {
+  ((Resources2) => {
+    Resources2["system"] = "system";
+    Resources2["entrypoint"] = "entrypoint";
+    Resources2["person"] = "person";
+    Resources2["identity"] = "identity";
+    Resources2["project"] = "project";
+    Resources2["apiKey"] = "apiKey";
+    Resources2["mailTemplate"] = "mailTemplate";
+    Resources2["idp"] = "idp";
+  })(PermissionActions2.Resources || (PermissionActions2.Resources = {}));
+  PermissionActions2.IDENTITY_VIEW_PERMISSIONS = Authorizator.createAction("identity", "viewPermissions");
+  PermissionActions2.IDENTITY_ADD_GLOBAL_ROLES = (roles) => Authorizator.createAction("identity", "addGlobalRoles", { roles });
+  PermissionActions2.IDENTITY_REMOVE_GLOBAL_ROLES = (roles) => Authorizator.createAction("identity", "removeGlobalRoles", { roles });
+  PermissionActions2.PERSON_DISABLE = (roles) => Authorizator.createAction("person", "disable", { roles });
+  PermissionActions2.PERSON_VIEW = Authorizator.createAction("person", "view");
+  PermissionActions2.PERSON_SIGN_IN = Authorizator.createAction("person", "signIn");
+  PermissionActions2.PERSON_SIGN_UP = (roles) => Authorizator.createAction("person", "signUp", { roles });
+  PermissionActions2.PERSON_SIGN_OUT = Authorizator.createAction("person", "signOut");
+  PermissionActions2.PERSON_SETUP_OTP = Authorizator.createAction("person", "setupOtp");
+  PermissionActions2.PERSON_CHANGE_PROFILE = (roles) => Authorizator.createAction("person", "changeProfile", { roles });
+  PermissionActions2.PERSON_CHANGE_MY_PROFILE = Authorizator.createAction("person", "changeMyProfile");
+  PermissionActions2.PERSON_CHANGE_PASSWORD = (roles) => Authorizator.createAction("person", "changePassword", { roles });
+  PermissionActions2.PERSON_CHANGE_MY_PASSWORD = Authorizator.createAction("person", "changeMyPassword");
+  PermissionActions2.PERSON_RESET_PASSWORD = Authorizator.createAction("person", "resetPassword");
+  PermissionActions2.PERSON_CREATE_IDP_URL = Authorizator.createAction("person", "createIdPUrl");
+  PermissionActions2.PERSON_SIGN_IN_IDP = Authorizator.createAction("person", "signInIdp");
+  PermissionActions2.PERSON_CREATE_SESSION_KEY = (roles) => Authorizator.createAction("person", "createSessionToken", { roles });
+  PermissionActions2.PERSON_INVITE = (memberships) => Authorizator.createAction("person", "invite", { memberships });
+  PermissionActions2.PERSON_INVITE_UNMANAGED = (memberships) => Authorizator.createAction("person", "invite_unmanaged", { memberships });
+  PermissionActions2.PROJECT_VIEW = Authorizator.createAction("project", "view");
+  PermissionActions2.PROJECT_SET_SECRET = Authorizator.createAction("project", "setSecret");
+  PermissionActions2.PROJECT_UPDATE = Authorizator.createAction("project", "update");
+  PermissionActions2.PROJECT_CREATE = Authorizator.createAction("project", "create");
+  PermissionActions2.ENTRYPOINT_DEPLOY = Authorizator.createAction("entrypoint", "deployEntrypoint");
+  PermissionActions2.PROJECT_VIEW_MEMBER = (memberships) => Authorizator.createAction("project", "viewMembers", { memberships });
+  PermissionActions2.PROJECT_ADD_MEMBER = (memberships) => Authorizator.createAction("project", "addMember", { memberships });
+  PermissionActions2.PROJECT_REMOVE_MEMBER = (memberships) => Authorizator.createAction("project", "removeMember", { memberships });
+  PermissionActions2.PROJECT_UPDATE_MEMBER = (memberships) => Authorizator.createAction("project", "updateMember", { memberships });
+  PermissionActions2.API_KEY_CREATE = Authorizator.createAction("apiKey", "create");
+  PermissionActions2.API_KEY_CREATE_GLOBAL = (roles) => Authorizator.createAction("apiKey", "createGlobal", { roles });
+  PermissionActions2.API_KEY_DISABLE = Authorizator.createAction("apiKey", "disable");
+  PermissionActions2.MAIL_TEMPLATE_ADD = Authorizator.createAction("mailTemplate", "add");
+  PermissionActions2.MAIL_TEMPLATE_REMOVE = Authorizator.createAction("mailTemplate", "remove");
+  PermissionActions2.MAIL_TEMPLATE_LIST = Authorizator.createAction("mailTemplate", "list");
+  PermissionActions2.IDP_ADD = Authorizator.createAction("idp", "add");
+  PermissionActions2.IDP_UPDATE = Authorizator.createAction("idp", "update");
+  PermissionActions2.IDP_DISABLE = Authorizator.createAction("idp", "disable");
+  PermissionActions2.IDP_ENABLE = Authorizator.createAction("idp", "enable");
+  PermissionActions2.IDP_LIST = Authorizator.createAction("idp", "list");
+})(PermissionActions || (PermissionActions = {}));
+export {
+  PermissionActions
+};
+//# sourceMappingURL=PermissionActions.js.map

package/dist/production/src/model/authorization/PermissionActions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionActions.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionActions.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { Acl } from '@contember/schema'\n\nnamespace PermissionActions {\n\texport enum Resources {\n\t\tsystem = 'system',\n\t\tentrypoint = 'entrypoint',\n\t\tperson = 'person',\n\t\tidentity = 'identity',\n\t\tproject = 'project',\n\t\tapiKey = 'apiKey',\n\t\tmailTemplate = 'mailTemplate',\n\t\tidp = 'idp',\n\t}\n\n\texport const IDENTITY_VIEW_PERMISSIONS = Authorizator.createAction(Resources.identity, 'viewPermissions')\n\texport const IDENTITY_ADD_GLOBAL_ROLES = (roles?: readonly string[]) => Authorizator.createAction(Resources.identity, 'addGlobalRoles', { roles })\n\texport const IDENTITY_REMOVE_GLOBAL_ROLES = (roles?: readonly string[]) => Authorizator.createAction(Resources.identity, 'removeGlobalRoles', { roles })\n\n\texport const PERSON_DISABLE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'disable', { roles })\n\n\texport const PERSON_VIEW = Authorizator.createAction(Resources.person, 'view')\n\texport const PERSON_SIGN_IN = Authorizator.createAction(Resources.person, 'signIn')\n\texport const PERSON_SIGN_UP = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'signUp', { roles })\n\texport const PERSON_SIGN_OUT = Authorizator.createAction(Resources.person, 'signOut')\n\texport const PERSON_SETUP_OTP = Authorizator.createAction(Resources.person, 'setupOtp')\n\texport const PERSON_CHANGE_PROFILE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'changeProfile', { roles })\n\texport const PERSON_CHANGE_MY_PROFILE = Authorizator.createAction(Resources.person, 'changeMyProfile')\n\texport const PERSON_CHANGE_PASSWORD = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'changePassword', { roles })\n\texport const PERSON_CHANGE_MY_PASSWORD = Authorizator.createAction(Resources.person, 'changeMyPassword')\n\texport const PERSON_RESET_PASSWORD = Authorizator.createAction(Resources.person, 'resetPassword')\n\texport const PERSON_CREATE_IDP_URL = Authorizator.createAction(Resources.person, 'createIdPUrl')\n\texport const PERSON_SIGN_IN_IDP = Authorizator.createAction(Resources.person, 'signInIdp')\n\texport const PERSON_CREATE_SESSION_KEY = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'createSessionToken', { roles })\n\n\texport const PERSON_INVITE = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.person, 'invite', { memberships })\n\texport const PERSON_INVITE_UNMANAGED = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.person, 'invite_unmanaged', { memberships })\n\n\texport const PROJECT_VIEW = Authorizator.createAction(Resources.project, 'view')\n\texport const PROJECT_SET_SECRET = Authorizator.createAction(Resources.project, 'setSecret')\n\texport const PROJECT_UPDATE = Authorizator.createAction(Resources.project, 'update')\n\n\texport const PROJECT_CREATE = Authorizator.createAction(Resources.project, 'create')\n\texport const ENTRYPOINT_DEPLOY = Authorizator.createAction(Resources.entrypoint, 'deployEntrypoint')\n\n\texport const PROJECT_VIEW_MEMBER = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.project, 'viewMembers', { memberships })\n\texport const PROJECT_ADD_MEMBER = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.project, 'addMember', { memberships })\n\texport const PROJECT_REMOVE_MEMBER = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.project, 'removeMember', { memberships })\n\texport const PROJECT_UPDATE_MEMBER = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.project, 'updateMember', { memberships })\n\n\n\texport const API_KEY_CREATE = Authorizator.createAction(Resources.apiKey, 'create')\n\texport const API_KEY_CREATE_GLOBAL = (roles?: readonly string[]) => Authorizator.createAction(Resources.apiKey, 'createGlobal', { roles })\n\texport const API_KEY_DISABLE = Authorizator.createAction(Resources.apiKey, 'disable')\n\n\texport const MAIL_TEMPLATE_ADD = Authorizator.createAction(Resources.mailTemplate, 'add')\n\texport const MAIL_TEMPLATE_REMOVE = Authorizator.createAction(Resources.mailTemplate, 'remove')\n\texport const MAIL_TEMPLATE_LIST = Authorizator.createAction(Resources.mailTemplate, 'list')\n\n\texport const IDP_ADD = Authorizator.createAction(Resources.idp, 'add')\n\texport const IDP_UPDATE = Authorizator.createAction(Resources.idp, 'update')\n\texport const IDP_DISABLE = Authorizator.createAction(Resources.idp, 'disable')\n\texport const IDP_ENABLE = Authorizator.createAction(Resources.idp, 'enable')\n\texport const IDP_LIST = Authorizator.createAction(Resources.idp, 'list')\n}\n\nexport { PermissionActions }\n"],"names":["PermissionActions","Resources"],"mappings":";AAGU,IAAA;AAAA,CAAV,CAAUA,uBAAV;AACQ,GAAA,CAAKC,eAAL;AACNA,eAAA,QAAS,IAAA;AACTA,eAAA,YAAa,IAAA;AACbA,eAAA,QAAS,IAAA;AACTA,eAAA,UAAW,IAAA;AACXA,eAAA,SAAU,IAAA;AACVA,eAAA,QAAS,IAAA;AACTA,eAAA,cAAe,IAAA;AACfA,eAAA,KAAM,IAAA;AAAA,EAAA,GARKD,mBAAA,cAAAA,mBAAA,YAAA,CAAA,EAAA;AAWCA,qBAAA,4BAA4B,aAAa,aAAa,YAAoB,iBAAiB;AAC3FA,qBAAA,4BAA4B,CAAC,UAA8B,aAAa,aAAa,YAAoB,kBAAkB,EAAE,MAAA,CAAO;AACpIA,qBAAA,+BAA+B,CAAC,UAA8B,aAAa,aAAa,YAAoB,qBAAqB,EAAE,MAAA,CAAO;AAE1IA,qBAAA,iBAAiB,CAAC,UAA8B,aAAa,aAAa,UAAkB,WAAW,EAAE,MAAA,CAAO;AAEhHA,qBAAA,cAAc,aAAa,aAAa,UAAkB,MAAM;AAChEA,qBAAA,iBAAiB,aAAa,aAAa,UAAkB,QAAQ;AACrEA,qBAAA,iBAAiB,CAAC,UAA8B,aAAa,aAAa,UAAkB,UAAU,EAAE,MAAA,CAAO;AAC/GA,qBAAA,kBAAkB,aAAa,aAAa,UAAkB,SAAS;AACvEA,qBAAA,mBAAmB,aAAa,aAAa,UAAkB,UAAU;AACzEA,qBAAA,wBAAwB,CAAC,UAA8B,aAAa,aAAa,UAAkB,iBAAiB,EAAE,MAAA,CAAO;AAC7HA,qBAAA,2BAA2B,aAAa,aAAa,UAAkB,iBAAiB;AACxFA,qBAAA,yBAAyB,CAAC,UAA8B,aAAa,aAAa,UAAkB,kBAAkB,EAAE,MAAA,CAAO;AAC/HA,qBAAA,4BAA4B,aAAa,aAAa,UAAkB,kBAAkB;AAC1FA,qBAAA,wBAAwB,aAAa,aAAa,UAAkB,eAAe;AACnFA,qBAAA,wBAAwB,aAAa,aAAa,UAAkB,cAAc;AAClFA,qBAAA,qBAAqB,aAAa,aAAa,UAAkB,WAAW;AAC5EA,qBAAA,4BAA4B,CAAC,UAA8B,aAAa,aAAa,UAAkB,sBAAsB,EAAE,MAAA,CAAO;AAEtIA,qBAAA,gBAAgB,CAAC,gBAA2C,aAAa,aAAa,UAAkB,UAAU,EAAE,YAAA,CAAa;AACjIA,qBAAA,0BAA0B,CAAC,gBAA2C,aAAa,aAAa,UAAkB,oBAAoB,EAAE,YAAA,CAAa;AAErJA,qBAAA,eAAe,aAAa,aAAa,WAAmB,MAAM;AAClEA,qBAAA,qBAAqB,aAAa,aAAa,WAAmB,WAAW;AAC7EA,qBAAA,iBAAiB,aAAa,aAAa,WAAmB,QAAQ;AAEtEA,qBAAA,iBAAiB,aAAa,aAAa,WAAmB,QAAQ;AACtEA,qBAAA,oBAAoB,aAAa,aAAa,cAAsB,kBAAkB;AAEtFA,qBAAA,sBAAsB,CAAC,gBAA2C,aAAa,aAAa,WAAmB,eAAe,EAAE,YAAA,CAAa;AAC7IA,qBAAA,qBAAqB,CAAC,gBAA2C,aAAa,aAAa,WAAmB,aAAa,EAAE,YAAA,CAAa;AAC1IA,qBAAA,wBAAwB,CAAC,gBAA2C,aAAa,aAAa,WAAmB,gBAAgB,EAAE,YAAA,CAAa;AAChJA,qBAAA,wBAAwB,CAAC,gBAA2C,aAAa,aAAa,WAAmB,gBAAgB,EAAE,YAAA,CAAa;AAGhJA,qBAAA,iBAAiB,aAAa,aAAa,UAAkB,QAAQ;AACrEA,qBAAA,wBAAwB,CAAC,UAA8B,aAAa,aAAa,UAAkB,gBAAgB,EAAE,MAAA,CAAO;AAC5HA,qBAAA,kBAAkB,aAAa,aAAa,UAAkB,SAAS;AAEvEA,qBAAA,oBAAoB,aAAa,aAAa,gBAAwB,KAAK;AAC3EA,qBAAA,uBAAuB,aAAa,aAAa,gBAAwB,QAAQ;AACjFA,qBAAA,qBAAqB,aAAa,aAAa,gBAAwB,MAAM;AAE7EA,qBAAA,UAAU,aAAa,aAAa,OAAe,KAAK;AACxDA,qBAAA,aAAa,aAAa,aAAa,OAAe,QAAQ;AAC9DA,qBAAA,cAAc,aAAa,aAAa,OAAe,SAAS;AAChEA,qBAAA,aAAa,aAAa,aAAa,OAAe,QAAQ;AAC9DA,qBAAA,WAAW,aAAa,aAAa,OAAe,MAAM;AAAA,GA5D9D,sBAAA,oBAAA,CAAA,EAAA;"}