@contember/engine-tenant-api 1.4.0-rc.8 → 2.0.0-alpha.8

package/dist/src/migrations/snapshot.js

@@ -1,205 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const tenantCredentials_1 = require("./tenantCredentials");
-async function default_1(builder, args) {
-    builder.sql(`
-CREATE FUNCTION "project_deleted"() RETURNS "trigger"
-    LANGUAGE "plpgsql"
-    AS $$
-BEGIN
-	PERFORM pg_notify('project_updated', old.id::text);
-	RETURN NULL;
-END;
-$$;
-CREATE FUNCTION "project_secret_updated"() RETURNS "trigger"
-    LANGUAGE "plpgsql"
-    AS $$
-BEGIN
-	UPDATE project SET updated_at = 'now' WHERE id = COALESCE(new.project_id, old.project_id);
-	PERFORM pg_notify('project_updated', COALESCE(new.project_id, old.project_id)::TEXT);
-	RETURN NULL;
-END;
-$$;
-CREATE FUNCTION "project_updated"() RETURNS "trigger"
-    LANGUAGE "plpgsql"
-    AS $$
-BEGIN
-	NEW.updated_at = 'now';
-	PERFORM pg_notify('project_updated', new.id::text);
-	RETURN new;
-END;
-$$;
-CREATE TABLE "api_key" (
-    "id" "uuid" NOT NULL,
-    "token_hash" "text" NOT NULL,
-    "type" "text" NOT NULL,
-    "identity_id" "uuid" NOT NULL,
-    "expires_at" timestamp with time zone,
-    "created_at" timestamp with time zone NOT NULL,
-    "expiration" integer,
-    "disabled_at" timestamp with time zone
-);
-CREATE TABLE "identity" (
-    "id" "uuid" NOT NULL,
-    "parent_id" "uuid",
-    "roles" "jsonb" NOT NULL,
-    "description" "text",
-    "created_at" timestamp with time zone NOT NULL
-);
-CREATE TABLE "identity_provider" (
-    "id" "uuid" NOT NULL,
-    "slug" "text" NOT NULL,
-    "type" "text" NOT NULL,
-    "configuration" "jsonb" NOT NULL,
-    "disabled_at" timestamp with time zone,
-    "auto_sign_up" boolean DEFAULT false NOT NULL,
-    "exclusive" boolean DEFAULT false,
-    "init_returns_config" boolean DEFAULT false NOT NULL
-);
-CREATE TABLE "mail_template" (
-    "id" "uuid" NOT NULL,
-    "project_id" "uuid",
-    "mail_type" "text" NOT NULL,
-    "variant" "text" NOT NULL,
-    "subject" "text" NOT NULL,
-    "content" "text" NOT NULL,
-    "use_layout" boolean NOT NULL,
-    "reply_to" "text"
-);
-CREATE TABLE "person" (
-    "id" "uuid" NOT NULL,
-    "email" "text",
-    "password_hash" "text",
-    "identity_id" "uuid" NOT NULL,
-    "otp_uri" "text",
-    "otp_activated_at" timestamp with time zone,
-    "name" "text",
-    "idp_only" boolean DEFAULT false NOT NULL,
-    "disabled_at" timestamp with time zone,
-    CONSTRAINT "idp_only_no_email" CHECK ((("idp_only" = false) OR (("idp_only" = true) AND ("email" IS NULL))))
-);
-CREATE TABLE "person_identity_provider" (
-    "id" "uuid" NOT NULL,
-    "person_id" "uuid" NOT NULL,
-    "identity_provider_id" "uuid" NOT NULL,
-    "created_at" timestamp with time zone DEFAULT "now"() NOT NULL,
-    "external_identifier" "text" NOT NULL
-);
-CREATE TABLE "person_password_reset" (
-    "id" "uuid" NOT NULL,
-    "token_hash" "text" NOT NULL,
-    "person_id" "uuid" NOT NULL,
-    "expires_at" timestamp with time zone NOT NULL,
-    "created_at" timestamp with time zone NOT NULL,
-    "used_at" timestamp with time zone
-);
-CREATE TABLE "project" (
-    "id" "uuid" NOT NULL,
-    "name" "text" NOT NULL,
-    "slug" "text" NOT NULL,
-    "config" "jsonb" DEFAULT '{}'::"jsonb" NOT NULL,
-    "updated_at" timestamp with time zone DEFAULT "now"() NOT NULL
-);
-CREATE TABLE "project_membership" (
-    "id" "uuid" NOT NULL,
-    "project_id" "uuid" NOT NULL,
-    "identity_id" "uuid" NOT NULL,
-    "role" "text" NOT NULL
-);
-CREATE TABLE "project_membership_variable" (
-    "id" "uuid" NOT NULL,
-    "membership_id" "uuid" NOT NULL,
-    "variable" "text" NOT NULL,
-    "value" "jsonb" NOT NULL
-);
-CREATE TABLE "project_secret" (
-    "id" "uuid" NOT NULL,
-    "project_id" "uuid" NOT NULL,
-    "key" "text" NOT NULL,
-    "created_at" timestamp with time zone NOT NULL,
-    "updated_at" timestamp with time zone NOT NULL,
-    "value" "bytea" NOT NULL,
-    "version" smallint NOT NULL
-);
-ALTER TABLE ONLY "api_key"
-    ADD CONSTRAINT "api_key_id" PRIMARY KEY ("id");
-ALTER TABLE ONLY "person"
-    ADD CONSTRAINT "email_unique" UNIQUE ("email");
-ALTER TABLE ONLY "identity"
-    ADD CONSTRAINT "identity_id" PRIMARY KEY ("id");
-ALTER TABLE ONLY "identity_provider"
-    ADD CONSTRAINT "identity_provider_id" PRIMARY KEY ("id");
-ALTER TABLE ONLY "identity_provider"
-    ADD CONSTRAINT "identity_provider_slug_key" UNIQUE ("slug");
-ALTER TABLE ONLY "mail_template"
-    ADD CONSTRAINT "mail_template_pkey" PRIMARY KEY ("id");
-ALTER TABLE ONLY "person"
-    ADD CONSTRAINT "person_id" PRIMARY KEY ("id");
-ALTER TABLE ONLY "person"
-    ADD CONSTRAINT "person_identity_id_key" UNIQUE ("identity_id");
-ALTER TABLE ONLY "person_identity_provider"
-    ADD CONSTRAINT "person_identity_provider_pkey" PRIMARY KEY ("id");
-ALTER TABLE ONLY "person_password_reset"
-    ADD CONSTRAINT "person_password_reset_id" PRIMARY KEY ("id");
-ALTER TABLE ONLY "project"
-    ADD CONSTRAINT "project_id" PRIMARY KEY ("id");
-ALTER TABLE ONLY "project_membership"
-    ADD CONSTRAINT "project_membership_pkey" PRIMARY KEY ("id");
-ALTER TABLE ONLY "project_membership_variable"
-    ADD CONSTRAINT "project_membership_variable_pkey" PRIMARY KEY ("id");
-ALTER TABLE ONLY "project_membership_variable"
-    ADD CONSTRAINT "project_membership_variable_unique" UNIQUE ("membership_id", "variable");
-ALTER TABLE ONLY "project_secret"
-    ADD CONSTRAINT "project_secret_pkey" PRIMARY KEY ("id");
-CREATE INDEX "api_key_identity_id" ON "api_key" USING "btree" ("identity_id");
-CREATE UNIQUE INDEX "api_key_token_hash" ON "api_key" USING "btree" ("token_hash");
-CREATE INDEX "identity_parent_id" ON "identity" USING "btree" ("parent_id");
-CREATE UNIQUE INDEX "mail_template_identifier" ON "mail_template" USING "btree" ("project_id", "mail_type", "variant") WHERE ("project_id" IS NOT NULL);
-CREATE UNIQUE INDEX "mail_template_identifier_global" ON "mail_template" USING "btree" ("mail_type", "variant") WHERE ("project_id" IS NULL);
-CREATE INDEX "mail_template_project_index" ON "mail_template" USING "btree" ("project_id");
-CREATE INDEX "person_identity_id" ON "person" USING "btree" ("identity_id");
-CREATE UNIQUE INDEX "person_identity_provider_identifier" ON "person_identity_provider" USING "btree" ("identity_provider_id", "external_identifier");
-CREATE INDEX "person_identity_provider_person_id" ON "person_identity_provider" USING "btree" ("person_id");
-CREATE UNIQUE INDEX "person_password_reset_token" ON "person_password_reset" USING "btree" ("token_hash");
-CREATE INDEX "project_alias" ON "project" USING "gin" ((("config" -> 'alias'::"text")));
-CREATE INDEX "project_membership_identity_index" ON "project_membership" USING "btree" ("identity_id");
-CREATE UNIQUE INDEX "project_membership_unique" ON "project_membership" USING "btree" ("project_id", "identity_id", "role");
-CREATE INDEX "project_secret_project_index" ON "project_secret" USING "btree" ("project_id");
-CREATE UNIQUE INDEX "project_secret_unique" ON "project_secret" USING "btree" ("project_id", "key");
-CREATE UNIQUE INDEX "project_slug" ON "project" USING "btree" ("slug");
-CREATE TRIGGER "project_deleted" AFTER DELETE ON "project" FOR EACH ROW EXECUTE FUNCTION "project_deleted"();
-CREATE TRIGGER "project_secret_updated" AFTER INSERT OR DELETE OR UPDATE ON "project_secret" FOR EACH ROW EXECUTE FUNCTION "project_secret_updated"();
-CREATE TRIGGER "project_updated" BEFORE INSERT OR UPDATE OF "name", "slug", "config" ON "project" FOR EACH ROW EXECUTE FUNCTION "project_updated"();
-ALTER TABLE ONLY "api_key"
-    ADD CONSTRAINT "api_key_identity_id_fkey" FOREIGN KEY ("identity_id") REFERENCES "identity"("id");
-ALTER TABLE ONLY "identity"
-    ADD CONSTRAINT "identity_parent_id_fkey" FOREIGN KEY ("parent_id") REFERENCES "identity"("id");
-ALTER TABLE ONLY "mail_template"
-    ADD CONSTRAINT "mail_template_project" FOREIGN KEY ("project_id") REFERENCES "project"("id") ON DELETE CASCADE;
-ALTER TABLE ONLY "person"
-    ADD CONSTRAINT "person_identity_id_fkey" FOREIGN KEY ("identity_id") REFERENCES "identity"("id");
-ALTER TABLE ONLY "person_identity_provider"
-    ADD CONSTRAINT "person_identity_provider_idp" FOREIGN KEY ("identity_provider_id") REFERENCES "identity_provider"("id") ON DELETE CASCADE;
-ALTER TABLE ONLY "person_identity_provider"
-    ADD CONSTRAINT "person_identity_provider_person" FOREIGN KEY ("person_id") REFERENCES "person"("id") ON DELETE CASCADE;
-ALTER TABLE ONLY "person_password_reset"
-    ADD CONSTRAINT "person_password_reset_person" FOREIGN KEY ("person_id") REFERENCES "person"("id") ON DELETE CASCADE;
-ALTER TABLE ONLY "project_membership"
-    ADD CONSTRAINT "project_membership_identity" FOREIGN KEY ("identity_id") REFERENCES "identity"("id") ON DELETE CASCADE;
-ALTER TABLE ONLY "project_membership"
-    ADD CONSTRAINT "project_membership_project" FOREIGN KEY ("project_id") REFERENCES "project"("id") ON DELETE CASCADE;
-ALTER TABLE ONLY "project_membership_variable"
-    ADD CONSTRAINT "project_membership_variable_membership" FOREIGN KEY ("membership_id") REFERENCES "project_membership"("id") ON DELETE CASCADE;
-ALTER TABLE ONLY "project_secret"
-    ADD CONSTRAINT "project_secret_project" FOREIGN KEY ("project_id") REFERENCES "project"("id") ON DELETE CASCADE;
-DO LANGUAGE plpgsql
-$$
-	BEGIN
-		EXECUTE FORMAT('ALTER FUNCTION project_secret_updated() SET SEARCH_PATH = %s', QUOTE_IDENT(CURRENT_SCHEMA()));
-	END
-$$;
-`);
-    await (0, tenantCredentials_1.createCredentials)(builder, args);
-}
-exports.default = default_1;
-//# sourceMappingURL=snapshot.js.map

package/dist/src/migrations/snapshot.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"snapshot.js","sourceRoot":"","sources":["../../../src/migrations/snapshot.ts"],"names":[],"mappings":";;AAEA,2DAAuD;AAExC,KAAK,oBAAW,OAAyB,EAAE,IAAyB;IAClF,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoMZ,CAAC,CAAA;IAED,MAAM,IAAA,qCAAiB,EAAC,OAAO,EAAE,IAAI,CAAC,CAAA;AACvC,CAAC;AAxMD,4BAwMC"}

package/dist/src/migrations/tenantCredentials.js

@@ -1,57 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createCredentials = void 0;
-const database_migrations_1 = require("@contember/database-migrations");
-const createCredentials = async (builder, args) => {
-    const credentials = await args.getCredentials();
-    if (credentials.loginTokenHash) {
-        const tokenHash = credentials.loginTokenHash;
-        builder.sql(`
-			WITH identity AS (
-			    INSERT INTO identity(id, parent_id, roles, description, created_at)
-				VALUES (${(0, database_migrations_1.escapeValue)(args.providers.uuid())}, NULL, '["login"]'::JSONB, 'Login key', now()) RETURNING id
-			)
-			INSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)
-			SELECT ${(0, database_migrations_1.escapeValue)(args.providers.uuid())}, ${(0, database_migrations_1.escapeValue)(tokenHash)}, 'permanent', identity.id, NULL, NULL, NULL, now()
-			FROM identity
-			`);
-    }
-    if (!credentials.rootTokenHash) {
-        throw 'Please specify a root token using CONTEMBER_ROOT_TOKEN env variable.';
-    }
-    if (credentials.rootEmail && !credentials.rootPasswordBcrypted) {
-        throw 'Please specify a root password using CONTEMBER_ROOT_PASSWORD env variable.';
-    }
-    const rootEmail = credentials.rootPasswordBcrypted ? credentials.rootEmail || 'root@localhost' : null;
-    const rootPasswordHash = credentials.rootPasswordBcrypted || null;
-    const rootTokenHash = credentials.rootTokenHash;
-    builder.sql(`
-			WITH identity AS (
-				INSERT INTO identity(id, parent_id, roles, description, created_at)
-				VALUES (
-						${(0, database_migrations_1.escapeValue)(args.providers.uuid())},
-						NULL,
-						'["super_admin"]'::JSONB
-							|| (CASE WHEN ${(0, database_migrations_1.escapeValue)(rootEmail)} IS NOT NULL THEN '["person"]'::JSONB ELSE '[]'::JSONB END),
-						'Superadmin',
-						now()
-					) RETURNING id
-			),
-			person AS (
-				INSERT INTO person(id, email, password_hash, identity_id)
-				SELECT ${(0, database_migrations_1.escapeValue)(args.providers.uuid())}, ${(0, database_migrations_1.escapeValue)(rootEmail)}, ${(0, database_migrations_1.escapeValue)(rootPasswordHash)}, identity.id
-				FROM identity
-				WHERE ${(0, database_migrations_1.escapeValue)(rootEmail)} IS NOT NULL
-			    RETURNING id
-			),
-			api_key AS (
-				INSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)
-				SELECT ${(0, database_migrations_1.escapeValue)(args.providers.uuid())}, ${(0, database_migrations_1.escapeValue)(rootTokenHash)}, 'permanent', identity.id, NULL, NULL, NULL, now()
-				FROM identity WHERE ${(0, database_migrations_1.escapeValue)(rootTokenHash)} IS NOT NULL
-			    RETURNING id
-			)
-			SELECT * FROM person, api_key
-		`);
-};
-exports.createCredentials = createCredentials;
-//# sourceMappingURL=tenantCredentials.js.map

package/dist/src/migrations/tenantCredentials.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tenantCredentials.js","sourceRoot":"","sources":["../../../src/migrations/tenantCredentials.ts"],"names":[],"mappings":";;;AAAA,wEAA8E;AAGvE,MAAM,iBAAiB,GAAG,KAAK,EAAE,OAAyB,EAAE,IAAyB,EAAE,EAAE;IAC/F,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAA;IAC/C,IAAI,WAAW,CAAC,cAAc,EAAE;QAC/B,MAAM,SAAS,GAAG,WAAW,CAAC,cAAc,CAAA;QAC5C,OAAO,CAAC,GAAG,CAAC;;;cAGA,IAAA,iCAAW,EAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;;;YAGpC,IAAA,iCAAW,EAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,IAAA,iCAAW,EAAC,SAAS,CAAC;;IAErE,CAAC,CAAA;KACH;IAED,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE;QAC/B,MAAM,sEAAsE,CAAA;KAC5E;IAED,IAAI,WAAW,CAAC,SAAS,IAAI,CAAC,WAAW,CAAC,oBAAoB,EAAE;QAC/D,MAAM,4EAA4E,CAAA;KAClF;IACD,MAAM,SAAS,GAAG,WAAW,CAAC,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,IAAI,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAA;IACrG,MAAM,gBAAgB,GAAG,WAAW,CAAC,oBAAoB,IAAI,IAAI,CAAA;IAEjE,MAAM,aAAa,GAAG,WAAW,CAAC,aAAa,CAAA;IAE/C,OAAO,CAAC,GAAG,CAAC;;;;QAIL,IAAA,iCAAW,EAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;;;uBAGnB,IAAA,iCAAW,EAAC,SAAS,CAAC;;;;;;;aAOhC,IAAA,iCAAW,EAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,IAAA,iCAAW,EAAC,SAAS,CAAC,KAAK,IAAA,iCAAW,EAAC,gBAAgB,CAAC;;YAEhG,IAAA,iCAAW,EAAC,SAAS,CAAC;;;;;aAKrB,IAAA,iCAAW,EAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,IAAA,iCAAW,EAAC,aAAa,CAAC;0BACpD,IAAA,iCAAW,EAAC,aAAa,CAAC;;;;GAIjD,CAAC,CAAA;AACJ,CAAC,CAAA;AAtDY,QAAA,iBAAiB,qBAsD7B"}

package/dist/src/migrations/types.js

@@ -1,3 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=types.js.map

package/dist/src/migrations/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/migrations/types.ts"],"names":[],"mappings":""}

package/dist/src/model/authorization/AclSchemaAccessNodeFactory.js

@@ -1,46 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AclSchemaAccessNodeFactory = void 0;
-const PermissionActions_1 = require("./PermissionActions");
-const MembershipMatcher_1 = require("./MembershipMatcher");
-const DirectPermissionsAccessNode_1 = require("./DirectPermissionsAccessNode");
-class AclSchemaAccessNodeFactory {
-    create(schema, memberships) {
-        const createVerifier = (getRule) => {
-            const membershipMatcher = new MembershipMatcher_1.MembershipMatcher(memberships.map(it => {
-                var _a, _b;
-                return ({
-                    ...it,
-                    matchRule: getRule((_b = (_a = schema.roles[it.role]) === null || _a === void 0 ? void 0 : _a.tenant) !== null && _b !== void 0 ? _b : {}),
-                });
-            }));
-            return ({ memberships }) => {
-                return memberships.every(it => membershipMatcher.matches(it));
-            };
-        };
-        const membershipRoles = memberships.map(it => schema.roles[it.role]).filter(it => !!it);
-        const node = new DirectPermissionsAccessNode_1.DirectPermissionsAccessNode();
-        if (membershipRoles.some(it => { var _a; return (_a = it.tenant) === null || _a === void 0 ? void 0 : _a.invite; })) {
-            const verifier = createVerifier(it => { var _a; return it.invite && it.invite !== true ? it.invite : (_a = it.manage) !== null && _a !== void 0 ? _a : {}; });
-            node.allow(PermissionActions_1.PermissionActions.PERSON_INVITE([]), verifier);
-        }
-        if (membershipRoles.some(it => { var _a; return (_a = it.tenant) === null || _a === void 0 ? void 0 : _a.unmanagedInvite; })) {
-            const verifier = createVerifier(it => { var _a; return it.unmanagedInvite && it.unmanagedInvite !== true ? it.unmanagedInvite : (_a = it.manage) !== null && _a !== void 0 ? _a : {}; });
-            node.allow(PermissionActions_1.PermissionActions.PERSON_INVITE_UNMANAGED([]), verifier);
-        }
-        if (membershipRoles.some(it => { var _a; return (_a = it.tenant) === null || _a === void 0 ? void 0 : _a.manage; })) {
-            const verifier = createVerifier(it => { var _a; return (_a = it.manage) !== null && _a !== void 0 ? _a : {}; });
-            node.allow(PermissionActions_1.PermissionActions.PROJECT_ADD_MEMBER([]), verifier);
-            node.allow(PermissionActions_1.PermissionActions.PROJECT_VIEW_MEMBER([]), verifier);
-            node.allow(PermissionActions_1.PermissionActions.PROJECT_UPDATE_MEMBER([]), verifier);
-            node.allow(PermissionActions_1.PermissionActions.PROJECT_REMOVE_MEMBER([]), verifier);
-        }
-        if (membershipRoles.some(it => { var _a; return (_a = it.tenant) === null || _a === void 0 ? void 0 : _a.view; })) {
-            const verifier = createVerifier(it => { var _a; return (_a = it.view) !== null && _a !== void 0 ? _a : {}; });
-            node.allow(PermissionActions_1.PermissionActions.PROJECT_VIEW_MEMBER([]), verifier);
-        }
-        return node;
-    }
-}
-exports.AclSchemaAccessNodeFactory = AclSchemaAccessNodeFactory;
-//# sourceMappingURL=AclSchemaAccessNodeFactory.js.map

package/dist/src/model/authorization/AclSchemaAccessNodeFactory.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"AclSchemaAccessNodeFactory.js","sourceRoot":"","sources":["../../../../src/model/authorization/AclSchemaAccessNodeFactory.ts"],"names":[],"mappings":";;;AACA,2DAAuD;AAEvD,2DAAuD;AACvD,+EAA2E;AAE3E,MAAa,0BAA0B;IACtC,MAAM,CAAC,MAAkB,EAAE,WAAsC;QAEhE,MAAM,cAAc,GAAG,CAAC,OAAwE,EAAE,EAAE;YACnG,MAAM,iBAAiB,GAAG,IAAI,qCAAiB,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;;gBAAC,OAAA,CAAC;oBACtE,GAAG,EAAE;oBACL,SAAS,EAAE,OAAO,CAAC,MAAA,MAAA,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,0CAAE,MAAM,mCAAI,EAAE,CAAC;iBACvD,CAAC,CAAA;aAAA,CAAC,CAAC,CAAA;YAEJ,OAAO,CAAC,EAAE,WAAW,EAA8C,EAAE,EAAE;gBACtE,OAAO,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAA;YAC9D,CAAC,CAAA;QACF,CAAC,CAAA;QAED,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACvF,MAAM,IAAI,GAAG,IAAI,yDAA2B,EAAE,CAAA;QAE9C,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,WAAC,OAAA,MAAA,EAAE,CAAC,MAAM,0CAAE,MAAM,CAAA,EAAA,CAAC,EAAE;YAClD,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,CAAC,EAAE,WAAC,OAAA,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAA,EAAE,CAAC,MAAM,mCAAI,EAAE,CAAA,EAAA,CAAC,CAAA;YACpG,IAAI,CAAC,KAAK,CAAC,qCAAiB,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAA;SACzD;QAED,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,WAAC,OAAA,MAAA,EAAE,CAAC,MAAM,0CAAE,eAAe,CAAA,EAAA,CAAC,EAAE;YAC3D,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,CAAC,EAAE,WAAC,OAAA,EAAE,CAAC,eAAe,IAAI,EAAE,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,MAAA,EAAE,CAAC,MAAM,mCAAI,EAAE,CAAA,EAAA,CAAC,CAAA;YAC/H,IAAI,CAAC,KAAK,CAAC,qCAAiB,CAAC,uBAAuB,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAA;SACnE;QAED,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,WAAC,OAAA,MAAA,EAAE,CAAC,MAAM,0CAAE,MAAM,CAAA,EAAA,CAAC,EAAE;YAClD,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,CAAC,EAAE,WAAC,OAAA,MAAA,EAAE,CAAC,MAAM,mCAAI,EAAE,CAAA,EAAA,CAAC,CAAA;YACtD,IAAI,CAAC,KAAK,CAAC,qCAAiB,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAA;YAC9D,IAAI,CAAC,KAAK,CAAC,qCAAiB,CAAC,mBAAmB,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAA;YAC/D,IAAI,CAAC,KAAK,CAAC,qCAAiB,CAAC,qBAAqB,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAA;YACjE,IAAI,CAAC,KAAK,CAAC,qCAAiB,CAAC,qBAAqB,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAA;SACjE;QAED,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,WAAC,OAAA,MAAA,EAAE,CAAC,MAAM,0CAAE,IAAI,CAAA,EAAA,CAAC,EAAE;YAChD,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,CAAC,EAAE,WAAC,OAAA,MAAA,EAAE,CAAC,IAAI,mCAAI,EAAE,CAAA,EAAA,CAAC,CAAA;YACpD,IAAI,CAAC,KAAK,CAAC,qCAAiB,CAAC,mBAAmB,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAA;SAC/D;QAED,OAAO,IAAI,CAAA;IACZ,CAAC;CACD;AA1CD,gEA0CC"}

package/dist/src/model/authorization/DirectPermissionsAccessNode.js

@@ -1,20 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DirectPermissionsAccessNode = void 0;
-class DirectPermissionsAccessNode {
-    constructor() {
-        this.permissions = {};
-    }
-    allow({ resource, privilege }, verifier = () => true) {
-        var _a;
-        var _b;
-        (_a = (_b = this.permissions)[resource]) !== null && _a !== void 0 ? _a : (_b[resource] = {});
-        this.permissions[resource][privilege] = verifier;
-    }
-    isAllowed(accessEvaluator, { resource, meta, privilege }) {
-        var _a, _b;
-        return Promise.resolve(((_b = (_a = this.permissions[resource]) === null || _a === void 0 ? void 0 : _a[privilege]) === null || _b === void 0 ? void 0 : _b.call(_a, meta)) === true);
-    }
-}
-exports.DirectPermissionsAccessNode = DirectPermissionsAccessNode;
-//# sourceMappingURL=DirectPermissionsAccessNode.js.map

package/dist/src/model/authorization/DirectPermissionsAccessNode.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"DirectPermissionsAccessNode.js","sourceRoot":"","sources":["../../../../src/model/authorization/DirectPermissionsAccessNode.ts"],"names":[],"mappings":";;;AAQA,MAAa,2BAA2B;IAAxC;QACS,gBAAW,GAAmB,EAAE,CAAA;IAazC,CAAC;IAXO,KAAK,CACX,EAAE,QAAQ,EAAE,SAAS,EAA6B,EAClD,WAAoC,GAAG,EAAE,CAAC,IAAI;;;QAE9C,YAAA,IAAI,CAAC,WAAW,EAAC,QAAQ,wCAAR,QAAQ,IAAM,EAAE,EAAA;QACjC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAA;IACjD,CAAC;IAED,SAAS,CAAC,eAAgC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAuB;;QAC7F,OAAO,OAAO,CAAC,OAAO,CAAC,CAAA,MAAA,MAAA,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,0CAAG,SAAS,CAAC,mDAAG,IAAI,CAAC,MAAK,IAAI,CAAC,CAAA;IACjF,CAAC;CACD;AAdD,kEAcC"}

package/dist/src/model/authorization/Identity.js

@@ -1,31 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ProjectAwareIdentity = exports.StaticIdentity = void 0;
-class StaticIdentity {
-    constructor(id, roles, projectMemberships = {}) {
-        this.id = id;
-        this.roles = roles;
-        this.projectMemberships = projectMemberships;
-    }
-    getProjectMemberships(projectSlug) {
-        return Promise.resolve(this.projectMemberships[projectSlug] || {});
-    }
-}
-exports.StaticIdentity = StaticIdentity;
-class ProjectAwareIdentity {
-    constructor(id, roles, dbContext, memberManager) {
-        this.id = id;
-        this.roles = roles;
-        this.dbContext = dbContext;
-        this.memberManager = memberManager;
-        this.projectMembershipCache = {};
-    }
-    async getProjectMemberships(projectSlug) {
-        var _a;
-        var _b;
-        (_a = (_b = this.projectMembershipCache)[projectSlug]) !== null && _a !== void 0 ? _a : (_b[projectSlug] = this.memberManager.getEffectiveProjectMemberships(this.dbContext, { slug: projectSlug }, this));
-        return await this.projectMembershipCache[projectSlug];
-    }
-}
-exports.ProjectAwareIdentity = ProjectAwareIdentity;
-//# sourceMappingURL=Identity.js.map

package/dist/src/model/authorization/Identity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"Identity.js","sourceRoot":"","sources":["../../../../src/model/authorization/Identity.ts"],"names":[],"mappings":";;;AAWA,MAAa,cAAc;IAC1B,YACiB,EAAU,EACV,KAAe,EACvB,qBAAgE,EAAE;QAF1D,OAAE,GAAF,EAAE,CAAQ;QACV,UAAK,GAAL,KAAK,CAAU;QACvB,uBAAkB,GAAlB,kBAAkB,CAAgD;IACxE,CAAC;IAEJ,qBAAqB,CAAC,WAAmB;QACxC,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAA;IACnE,CAAC;CACD;AAVD,wCAUC;AAED,MAAa,oBAAoB;IAGhC,YACiB,EAAU,EACV,KAAwB,EACvB,SAA0B,EAC1B,aAAmC;QAHpC,OAAE,GAAF,EAAE,CAAQ;QACV,UAAK,GAAL,KAAK,CAAmB;QACvB,cAAS,GAAT,SAAS,CAAiB;QAC1B,kBAAa,GAAb,aAAa,CAAsB;QAN7C,2BAAsB,GAAuD,EAAE,CAAA;IAOpF,CAAC;IAEJ,KAAK,CAAC,qBAAqB,CAAC,WAAmB;;;QAC9C,YAAA,IAAI,CAAC,sBAAsB,EAAC,WAAW,wCAAX,WAAW,IAAM,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,IAAI,CAAC,EAAA;QAC3I,OAAO,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAA;IACtD,CAAC;CACD;AAdD,oDAcC"}

package/dist/src/model/authorization/IdentityFactory.js

@@ -1,14 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.IdentityFactory = void 0;
-const Identity_1 = require("./Identity");
-class IdentityFactory {
-    constructor(projectMemberManager) {
-        this.projectMemberManager = projectMemberManager;
-    }
-    create(dbContext, args) {
-        return new Identity_1.ProjectAwareIdentity(args.id, args.roles, dbContext, this.projectMemberManager);
-    }
-}
-exports.IdentityFactory = IdentityFactory;
-//# sourceMappingURL=IdentityFactory.js.map

package/dist/src/model/authorization/IdentityFactory.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"IdentityFactory.js","sourceRoot":"","sources":["../../../../src/model/authorization/IdentityFactory.ts"],"names":[],"mappings":";;;AACA,yCAA2D;AAG3D,MAAa,eAAe;IAC3B,YAA6B,oBAA0C;QAA1C,yBAAoB,GAApB,oBAAoB,CAAsB;IAAG,CAAC;IAEpE,MAAM,CAAC,SAA0B,EAAE,IAA8C;QACvF,OAAO,IAAI,+BAAoB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAA;IAC3F,CAAC;CACD;AAND,0CAMC"}

package/dist/src/model/authorization/IdentityScope.js

@@ -1,15 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.IdentityScope = void 0;
-const authorization_1 = require("@contember/authorization");
-const Roles_1 = require("./Roles");
-class IdentityScope {
-    constructor(identityId) {
-        this.identityId = identityId;
-    }
-    async getIdentityAccess(identity) {
-        return new authorization_1.AccessNode.Roles(identity.id === this.identityId ? [Roles_1.TenantRole.SELF] : []);
-    }
-}
-exports.IdentityScope = IdentityScope;
-//# sourceMappingURL=IdentityScope.js.map

package/dist/src/model/authorization/IdentityScope.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"IdentityScope.js","sourceRoot":"","sources":["../../../../src/model/authorization/IdentityScope.ts"],"names":[],"mappings":";;;AAAA,4DAAyE;AACzE,mCAAoC;AAGpC,MAAM,aAAa;IAClB,YAA6B,UAAkB;QAAlB,eAAU,GAAV,UAAU,CAAQ;IAAG,CAAC;IAEnD,KAAK,CAAC,iBAAiB,CAAC,QAAkB;QACzC,OAAO,IAAI,0BAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,kBAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACtF,CAAC;CACD;AAEQ,sCAAa"}

package/dist/src/model/authorization/MembershipMatcher.js

@@ -1,40 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.MembershipMatcher = void 0;
-class MembershipMatcher {
-    constructor(memberships) {
-        this.memberships = memberships;
-    }
-    matches(membership) {
-        return this.memberships.some(invokerMembership => {
-            const matchRule = invokerMembership.matchRule[membership.role];
-            if (!matchRule) {
-                return false;
-            }
-            if (matchRule === true) {
-                return true;
-            }
-            const variables = matchRule === null || matchRule === void 0 ? void 0 : matchRule.variables;
-            if (variables === true) {
-                return true;
-            }
-            return membership.variables.every(variable => {
-                const sourceVariableRule = variables === null || variables === void 0 ? void 0 : variables[variable.name];
-                if (!sourceVariableRule) {
-                    return false;
-                }
-                if (sourceVariableRule === true) {
-                    return true;
-                }
-                const sourceVariable = invokerMembership.variables.find(it => typeof sourceVariableRule === 'string' && it.name === sourceVariableRule);
-                if (!sourceVariable) {
-                    return false;
-                }
-                const sourceValues = new Set(sourceVariable.values);
-                return variable.values.every(it => sourceValues.has(it));
-            });
-        });
-    }
-}
-exports.MembershipMatcher = MembershipMatcher;
-//# sourceMappingURL=MembershipMatcher.js.map

package/dist/src/model/authorization/MembershipMatcher.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"MembershipMatcher.js","sourceRoot":"","sources":["../../../../src/model/authorization/MembershipMatcher.ts"],"names":[],"mappings":";;;AAQA,MAAa,iBAAiB;IAC7B,YAA6B,WAA6D;QAA7D,gBAAW,GAAX,WAAW,CAAkD;IAC1F,CAAC;IAED,OAAO,CAAC,UAA0B;QACjC,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE;YAChD,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;YAC9D,IAAI,CAAC,SAAS,EAAE;gBACf,OAAO,KAAK,CAAA;aACZ;YACD,IAAI,SAAS,KAAK,IAAI,EAAE;gBACvB,OAAO,IAAI,CAAA;aACX;YACD,MAAM,SAAS,GAAG,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,SAAS,CAAA;YACtC,IAAI,SAAS,KAAK,IAAI,EAAE;gBACvB,OAAO,IAAI,CAAA;aACX;YACD,OAAO,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;gBAC5C,MAAM,kBAAkB,GAAG,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;gBACrD,IAAI,CAAC,kBAAkB,EAAE;oBACxB,OAAO,KAAK,CAAA;iBACZ;gBACD,IAAI,kBAAkB,KAAK,IAAI,EAAE;oBAChC,OAAO,IAAI,CAAA;iBACX;gBACD,MAAM,cAAc,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,kBAAkB,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAA;gBACvI,IAAI,CAAC,cAAc,EAAE;oBACpB,OAAO,KAAK,CAAA;iBACZ;gBACD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;gBACnD,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;YACzD,CAAC,CAAC,CAAA;QACH,CAAC,CAAC,CAAA;IACH,CAAC;CACD;AAlCD,8CAkCC"}