@contember/engine-tenant-api 2.1.0-alpha.29 → 2.1.0-alpha.30
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/development/src/model/authorization/PermissionsFactory.cjs +2 -0
- package/dist/development/src/model/authorization/PermissionsFactory.cjs.map +1 -1
- package/dist/development/src/model/authorization/PermissionsFactory.js +2 -0
- package/dist/development/src/model/authorization/PermissionsFactory.js.map +1 -1
- package/dist/production/src/model/authorization/PermissionsFactory.cjs +2 -0
- package/dist/production/src/model/authorization/PermissionsFactory.cjs.map +1 -1
- package/dist/production/src/model/authorization/PermissionsFactory.js +2 -0
- package/dist/production/src/model/authorization/PermissionsFactory.js.map +1 -1
- package/dist/tests/tsconfig.tsbuildinfo +1 -1
- package/dist/types/model/authorization/PermissionsFactory.d.ts.map +1 -1
- package/dist/types/tsconfig.tsbuildinfo +1 -1
- package/package.json +12 -12
- package/src/model/authorization/PermissionsFactory.ts +3 -1
|
@@ -29,6 +29,8 @@ class PermissionsFactory {
|
|
|
29
29
|
permissions.allow(Roles.TenantRole.PERSON, PermissionActions.PermissionActions.PERSON_SETUP_OTP);
|
|
30
30
|
permissions.allow(Roles.TenantRole.PROJECT_MEMBER, PermissionActions.PermissionActions.PROJECT_VIEW);
|
|
31
31
|
permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PROJECT_VIEW);
|
|
32
|
+
permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDENTITY_VIEW_PERMISSIONS);
|
|
33
|
+
permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_VIEW);
|
|
32
34
|
permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.API_KEY_CREATE);
|
|
33
35
|
permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.API_KEY_DISABLE);
|
|
34
36
|
permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"PermissionsFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionsFactory.ts"],"sourcesContent":["import { Permissions } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions'\nimport { TenantRole } from './Roles'\n\nconst allowedRoles = new Set<string>([TenantRole.LOGIN, TenantRole.PROJECT_ADMIN, TenantRole.ENTRYPOINT_DEPLOYER])\n\nconst projectAdminAllowedInputRoles = ({ roles }: {roles?: readonly string[]}) => {\n\treturn roles === undefined || roles.every(it => allowedRoles.has(it))\n}\n\nconst forbiddenRoles = new Set<string>([TenantRole.SUPER_ADMIN, TenantRole.PROJECT_CREATOR])\n\nconst projectAdminUseRolesVerifier = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined || roles.every(it => !forbiddenRoles.has(it))\n}\n\nclass PermissionsFactory {\n\tpublic create(): Permissions {\n\t\tconst permissions = new Permissions()\n\n\t\tpermissions.allow(TenantRole.SUPER_ADMIN, { resource: Permissions.ALL, privilege: Permissions.ALL })\n\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_RESET_PASSWORD)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_CREATE_IDP_URL)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN_IDP)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_PASSWORDLESS_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN)\n\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PASSWORD)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PROFILE)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_TOGGLE_PASSWORDLESS)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SIGN_OUT)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP)\n\n\t\tpermissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CREATE_SESSION_KEY(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(), projectAdminUseRolesVerifier)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_ADD_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_UPDATE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_REMOVE_MEMBER([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE_UNMANAGED([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_UPDATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ENABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.ENTRYPOINT_DEPLOY)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIGURE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIG_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_CREATOR, PermissionActions.PROJECT_CREATE)\n\t\tpermissions.allow(TenantRole.ENTRYPOINT_DEPLOYER, PermissionActions.ENTRYPOINT_DEPLOY)\n\n\t\treturn permissions\n\t}\n}\n\nexport { PermissionsFactory }\n"],"names":["TenantRole","Permissions","PermissionActions"],"mappings":";;;;;AAIA,MAAM,eAAmB,oBAAA,IAAY,CAACA,iBAAW,OAAOA,MAAAA,WAAW,eAAeA,iBAAW,mBAAmB,CAAC;AAEjH,MAAM,gCAAgC,CAAC,EAAE,
|
|
1
|
+
{"version":3,"file":"PermissionsFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionsFactory.ts"],"sourcesContent":["import { Permissions } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions'\nimport { TenantRole } from './Roles'\n\nconst allowedRoles = new Set<string>([TenantRole.LOGIN, TenantRole.PROJECT_ADMIN, TenantRole.ENTRYPOINT_DEPLOYER])\n\nconst projectAdminAllowedInputRoles = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined || roles.every(it => allowedRoles.has(it))\n}\n\nconst forbiddenRoles = new Set<string>([TenantRole.SUPER_ADMIN, TenantRole.PROJECT_CREATOR])\n\nconst projectAdminUseRolesVerifier = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined || roles.every(it => !forbiddenRoles.has(it))\n}\n\nclass PermissionsFactory {\n\tpublic create(): Permissions {\n\t\tconst permissions = new Permissions()\n\n\t\tpermissions.allow(TenantRole.SUPER_ADMIN, { resource: Permissions.ALL, privilege: Permissions.ALL })\n\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_RESET_PASSWORD)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_CREATE_IDP_URL)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN_IDP)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_PASSWORDLESS_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN)\n\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PASSWORD)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PROFILE)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_TOGGLE_PASSWORDLESS)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SIGN_OUT)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP)\n\n\t\tpermissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_VIEW_PERMISSIONS)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CREATE_SESSION_KEY(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(), projectAdminUseRolesVerifier)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_ADD_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_UPDATE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_REMOVE_MEMBER([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE_UNMANAGED([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_UPDATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ENABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.ENTRYPOINT_DEPLOY)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIGURE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIG_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_CREATOR, PermissionActions.PROJECT_CREATE)\n\t\tpermissions.allow(TenantRole.ENTRYPOINT_DEPLOYER, PermissionActions.ENTRYPOINT_DEPLOY)\n\n\t\treturn permissions\n\t}\n}\n\nexport { PermissionsFactory }\n"],"names":["TenantRole","Permissions","PermissionActions"],"mappings":";;;;;AAIA,MAAM,eAAmB,oBAAA,IAAY,CAACA,iBAAW,OAAOA,MAAAA,WAAW,eAAeA,iBAAW,mBAAmB,CAAC;AAEjH,MAAM,gCAAgC,CAAC,EAAE,YAA2C;AAC5E,SAAA,UAAU,UAAa,MAAM,MAAM,QAAM,aAAa,IAAI,EAAE,CAAC;AACrE;AAEA,MAAM,qCAAqB,IAAY,CAACA,MAAAA,WAAW,aAAaA,MAAAA,WAAW,eAAe,CAAC;AAE3F,MAAM,+BAA+B,CAAC,EAAE,YAA2C;AAC3E,SAAA,UAAU,UAAa,MAAM,MAAM,QAAM,CAAC,eAAe,IAAI,EAAE,CAAC;AACxE;AAEA,MAAM,mBAAmB;AAAA,EACjB,SAAsB;AACtB,UAAA,cAAc,IAAIC,0BAAY;AAExB,gBAAA,MAAMD,iBAAW,aAAa,EAAE,UAAUC,0BAAY,KAAK,WAAWA,cAAY,YAAA,IAAA,CAAK;AAEnG,gBAAY,MAAMD,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,cAAc;AACpE,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,kBAAkB;AACxE,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,2BAA2B;AACjF,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,mCAAmC;AAEzF,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,WAAW;AAClE,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,yBAAyB;AAChF,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,wBAAwB;AAC/E,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,0BAA0B;AACjF,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,eAAe;AACtE,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,gBAAgB;AAEvE,gBAAY,MAAMF,MAAAA,WAAW,gBAAgBE,kBAAAA,kBAAkB,YAAY;AAE3E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,YAAY;AAC1E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,yBAAyB;AACvF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,WAAW;AACzE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,cAAc;AAC5E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,eAAe;AAC7E,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,yBAAyB,6BAA6B;AAEpH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,kBAAkB,6BAA6B;AAC7G,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,6BAA6B,6BAA6B;AACxH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,gCAAgC,6BAA6B;AAC3H,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,6BAA6B,4BAA4B;AACvH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,kBAAkB,4BAA4B;AAC5G,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,yBAAyB,4BAA4B;AACnH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,0BAA0B,4BAA4B;AAEpH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,CAAC;AACrF,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,mBAAmB,CAAA,CAAE,CAAC;AACpF,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AACvF,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AAEvF,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,cAAc,CAAA,CAAE,CAAC;AAC/E,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,wBAAwB,CAAA,CAAE,CAAC;AAEzF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,oBAAoB;AAClF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,kBAAkB;AAEhF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,OAAO;AACrE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,UAAU;AACxE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,WAAW;AACzE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,UAAU;AACxE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,QAAQ;AAEtE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,SAAS;AACvE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,WAAW;AAEzE,gBAAY,MAAMF,MAAAA,WAAW,iBAAiBE,kBAAAA,kBAAkB,cAAc;AAC9E,gBAAY,MAAMF,MAAAA,WAAW,qBAAqBE,kBAAAA,kBAAkB,iBAAiB;AAE9E,WAAA;AAAA,EAAA;AAET;;"}
|
|
@@ -27,6 +27,8 @@ class PermissionsFactory {
|
|
|
27
27
|
permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP);
|
|
28
28
|
permissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW);
|
|
29
29
|
permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW);
|
|
30
|
+
permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_VIEW_PERMISSIONS);
|
|
31
|
+
permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW);
|
|
30
32
|
permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE);
|
|
31
33
|
permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE);
|
|
32
34
|
permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"PermissionsFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionsFactory.ts"],"sourcesContent":["import { Permissions } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions'\nimport { TenantRole } from './Roles'\n\nconst allowedRoles = new Set<string>([TenantRole.LOGIN, TenantRole.PROJECT_ADMIN, TenantRole.ENTRYPOINT_DEPLOYER])\n\nconst projectAdminAllowedInputRoles = ({ roles }: {roles?: readonly string[]}) => {\n\treturn roles === undefined || roles.every(it => allowedRoles.has(it))\n}\n\nconst forbiddenRoles = new Set<string>([TenantRole.SUPER_ADMIN, TenantRole.PROJECT_CREATOR])\n\nconst projectAdminUseRolesVerifier = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined || roles.every(it => !forbiddenRoles.has(it))\n}\n\nclass PermissionsFactory {\n\tpublic create(): Permissions {\n\t\tconst permissions = new Permissions()\n\n\t\tpermissions.allow(TenantRole.SUPER_ADMIN, { resource: Permissions.ALL, privilege: Permissions.ALL })\n\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_RESET_PASSWORD)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_CREATE_IDP_URL)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN_IDP)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_PASSWORDLESS_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN)\n\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PASSWORD)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PROFILE)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_TOGGLE_PASSWORDLESS)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SIGN_OUT)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP)\n\n\t\tpermissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CREATE_SESSION_KEY(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(), projectAdminUseRolesVerifier)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_ADD_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_UPDATE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_REMOVE_MEMBER([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE_UNMANAGED([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_UPDATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ENABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.ENTRYPOINT_DEPLOY)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIGURE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIG_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_CREATOR, PermissionActions.PROJECT_CREATE)\n\t\tpermissions.allow(TenantRole.ENTRYPOINT_DEPLOYER, PermissionActions.ENTRYPOINT_DEPLOY)\n\n\t\treturn permissions\n\t}\n}\n\nexport { PermissionsFactory }\n"],"names":[],"mappings":";;;AAIA,MAAM,eAAmB,oBAAA,IAAY,CAAC,WAAW,OAAO,WAAW,eAAe,WAAW,mBAAmB,CAAC;AAEjH,MAAM,gCAAgC,CAAC,EAAE,
|
|
1
|
+
{"version":3,"file":"PermissionsFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionsFactory.ts"],"sourcesContent":["import { Permissions } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions'\nimport { TenantRole } from './Roles'\n\nconst allowedRoles = new Set<string>([TenantRole.LOGIN, TenantRole.PROJECT_ADMIN, TenantRole.ENTRYPOINT_DEPLOYER])\n\nconst projectAdminAllowedInputRoles = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined || roles.every(it => allowedRoles.has(it))\n}\n\nconst forbiddenRoles = new Set<string>([TenantRole.SUPER_ADMIN, TenantRole.PROJECT_CREATOR])\n\nconst projectAdminUseRolesVerifier = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined || roles.every(it => !forbiddenRoles.has(it))\n}\n\nclass PermissionsFactory {\n\tpublic create(): Permissions {\n\t\tconst permissions = new Permissions()\n\n\t\tpermissions.allow(TenantRole.SUPER_ADMIN, { resource: Permissions.ALL, privilege: Permissions.ALL })\n\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_RESET_PASSWORD)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_CREATE_IDP_URL)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN_IDP)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_PASSWORDLESS_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN)\n\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PASSWORD)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PROFILE)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_TOGGLE_PASSWORDLESS)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SIGN_OUT)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP)\n\n\t\tpermissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_VIEW_PERMISSIONS)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CREATE_SESSION_KEY(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(), projectAdminUseRolesVerifier)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_ADD_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_UPDATE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_REMOVE_MEMBER([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE_UNMANAGED([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_UPDATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ENABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.ENTRYPOINT_DEPLOY)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIGURE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIG_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_CREATOR, PermissionActions.PROJECT_CREATE)\n\t\tpermissions.allow(TenantRole.ENTRYPOINT_DEPLOYER, PermissionActions.ENTRYPOINT_DEPLOY)\n\n\t\treturn permissions\n\t}\n}\n\nexport { PermissionsFactory }\n"],"names":[],"mappings":";;;AAIA,MAAM,eAAmB,oBAAA,IAAY,CAAC,WAAW,OAAO,WAAW,eAAe,WAAW,mBAAmB,CAAC;AAEjH,MAAM,gCAAgC,CAAC,EAAE,YAA2C;AAC5E,SAAA,UAAU,UAAa,MAAM,MAAM,QAAM,aAAa,IAAI,EAAE,CAAC;AACrE;AAEA,MAAM,qCAAqB,IAAY,CAAC,WAAW,aAAa,WAAW,eAAe,CAAC;AAE3F,MAAM,+BAA+B,CAAC,EAAE,YAA2C;AAC3E,SAAA,UAAU,UAAa,MAAM,MAAM,QAAM,CAAC,eAAe,IAAI,EAAE,CAAC;AACxE;AAEA,MAAM,mBAAmB;AAAA,EACjB,SAAsB;AACtB,UAAA,cAAc,IAAI,YAAY;AAExB,gBAAA,MAAM,WAAW,aAAa,EAAE,UAAU,YAAY,KAAK,WAAW,YAAY,IAAA,CAAK;AAEnG,gBAAY,MAAM,WAAW,OAAO,kBAAkB,cAAc;AACpE,gBAAY,MAAM,WAAW,OAAO,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAM,WAAW,OAAO,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAM,WAAW,OAAO,kBAAkB,kBAAkB;AACxE,gBAAY,MAAM,WAAW,OAAO,kBAAkB,2BAA2B;AACjF,gBAAY,MAAM,WAAW,OAAO,kBAAkB,mCAAmC;AAEzF,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,WAAW;AAClE,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,yBAAyB;AAChF,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,wBAAwB;AAC/E,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,0BAA0B;AACjF,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,eAAe;AACtE,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,gBAAgB;AAEvE,gBAAY,MAAM,WAAW,gBAAgB,kBAAkB,YAAY;AAE3E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,YAAY;AAC1E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,yBAAyB;AACvF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,WAAW;AACzE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,cAAc;AAC5E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,eAAe;AAC7E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,yBAAyB,6BAA6B;AAEpH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,kBAAkB,6BAA6B;AAC7G,gBAAY,MAAM,WAAW,eAAe,kBAAkB,6BAA6B,6BAA6B;AACxH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,gCAAgC,6BAA6B;AAC3H,gBAAY,MAAM,WAAW,eAAe,kBAAkB,6BAA6B,4BAA4B;AACvH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,kBAAkB,4BAA4B;AAC5G,gBAAY,MAAM,WAAW,eAAe,kBAAkB,yBAAyB,4BAA4B;AACnH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,0BAA0B,4BAA4B;AAEpH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,oBAAoB,CAAA,CAAE,CAAC;AACrF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,mBAAmB,CAAA,CAAE,CAAC;AACpF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AACvF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AAEvF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,cAAc,CAAA,CAAE,CAAC;AAC/E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,wBAAwB,CAAA,CAAE,CAAC;AAEzF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,oBAAoB;AAClF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,kBAAkB;AAEhF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,OAAO;AACrE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,UAAU;AACxE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,WAAW;AACzE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,UAAU;AACxE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,QAAQ;AAEtE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,SAAS;AACvE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,WAAW;AAEzE,gBAAY,MAAM,WAAW,iBAAiB,kBAAkB,cAAc;AAC9E,gBAAY,MAAM,WAAW,qBAAqB,kBAAkB,iBAAiB;AAE9E,WAAA;AAAA,EAAA;AAET;"}
|
|
@@ -29,6 +29,8 @@ class PermissionsFactory {
|
|
|
29
29
|
permissions.allow(Roles.TenantRole.PERSON, PermissionActions.PermissionActions.PERSON_SETUP_OTP);
|
|
30
30
|
permissions.allow(Roles.TenantRole.PROJECT_MEMBER, PermissionActions.PermissionActions.PROJECT_VIEW);
|
|
31
31
|
permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PROJECT_VIEW);
|
|
32
|
+
permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDENTITY_VIEW_PERMISSIONS);
|
|
33
|
+
permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_VIEW);
|
|
32
34
|
permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.API_KEY_CREATE);
|
|
33
35
|
permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.API_KEY_DISABLE);
|
|
34
36
|
permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"PermissionsFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionsFactory.ts"],"sourcesContent":["import { Permissions } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions'\nimport { TenantRole } from './Roles'\n\nconst allowedRoles = new Set<string>([TenantRole.LOGIN, TenantRole.PROJECT_ADMIN, TenantRole.ENTRYPOINT_DEPLOYER])\n\nconst projectAdminAllowedInputRoles = ({ roles }: {roles?: readonly string[]}) => {\n\treturn roles === undefined || roles.every(it => allowedRoles.has(it))\n}\n\nconst forbiddenRoles = new Set<string>([TenantRole.SUPER_ADMIN, TenantRole.PROJECT_CREATOR])\n\nconst projectAdminUseRolesVerifier = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined || roles.every(it => !forbiddenRoles.has(it))\n}\n\nclass PermissionsFactory {\n\tpublic create(): Permissions {\n\t\tconst permissions = new Permissions()\n\n\t\tpermissions.allow(TenantRole.SUPER_ADMIN, { resource: Permissions.ALL, privilege: Permissions.ALL })\n\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_RESET_PASSWORD)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_CREATE_IDP_URL)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN_IDP)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_PASSWORDLESS_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN)\n\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PASSWORD)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PROFILE)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_TOGGLE_PASSWORDLESS)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SIGN_OUT)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP)\n\n\t\tpermissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CREATE_SESSION_KEY(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(), projectAdminUseRolesVerifier)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_ADD_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_UPDATE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_REMOVE_MEMBER([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE_UNMANAGED([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_UPDATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ENABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.ENTRYPOINT_DEPLOY)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIGURE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIG_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_CREATOR, PermissionActions.PROJECT_CREATE)\n\t\tpermissions.allow(TenantRole.ENTRYPOINT_DEPLOYER, PermissionActions.ENTRYPOINT_DEPLOY)\n\n\t\treturn permissions\n\t}\n}\n\nexport { PermissionsFactory }\n"],"names":["TenantRole","Permissions","PermissionActions"],"mappings":";;;;;AAIA,MAAM,eAAmB,oBAAA,IAAY,CAACA,iBAAW,OAAOA,MAAAA,WAAW,eAAeA,iBAAW,mBAAmB,CAAC;AAEjH,MAAM,gCAAgC,CAAC,EAAE,
|
|
1
|
+
{"version":3,"file":"PermissionsFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionsFactory.ts"],"sourcesContent":["import { Permissions } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions'\nimport { TenantRole } from './Roles'\n\nconst allowedRoles = new Set<string>([TenantRole.LOGIN, TenantRole.PROJECT_ADMIN, TenantRole.ENTRYPOINT_DEPLOYER])\n\nconst projectAdminAllowedInputRoles = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined || roles.every(it => allowedRoles.has(it))\n}\n\nconst forbiddenRoles = new Set<string>([TenantRole.SUPER_ADMIN, TenantRole.PROJECT_CREATOR])\n\nconst projectAdminUseRolesVerifier = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined || roles.every(it => !forbiddenRoles.has(it))\n}\n\nclass PermissionsFactory {\n\tpublic create(): Permissions {\n\t\tconst permissions = new Permissions()\n\n\t\tpermissions.allow(TenantRole.SUPER_ADMIN, { resource: Permissions.ALL, privilege: Permissions.ALL })\n\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_RESET_PASSWORD)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_CREATE_IDP_URL)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN_IDP)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_PASSWORDLESS_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN)\n\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PASSWORD)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PROFILE)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_TOGGLE_PASSWORDLESS)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SIGN_OUT)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP)\n\n\t\tpermissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_VIEW_PERMISSIONS)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CREATE_SESSION_KEY(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(), projectAdminUseRolesVerifier)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_ADD_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_UPDATE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_REMOVE_MEMBER([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE_UNMANAGED([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_UPDATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ENABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.ENTRYPOINT_DEPLOY)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIGURE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIG_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_CREATOR, PermissionActions.PROJECT_CREATE)\n\t\tpermissions.allow(TenantRole.ENTRYPOINT_DEPLOYER, PermissionActions.ENTRYPOINT_DEPLOY)\n\n\t\treturn permissions\n\t}\n}\n\nexport { PermissionsFactory }\n"],"names":["TenantRole","Permissions","PermissionActions"],"mappings":";;;;;AAIA,MAAM,eAAmB,oBAAA,IAAY,CAACA,iBAAW,OAAOA,MAAAA,WAAW,eAAeA,iBAAW,mBAAmB,CAAC;AAEjH,MAAM,gCAAgC,CAAC,EAAE,YAA2C;AAC5E,SAAA,UAAU,UAAa,MAAM,MAAM,QAAM,aAAa,IAAI,EAAE,CAAC;AACrE;AAEA,MAAM,qCAAqB,IAAY,CAACA,MAAAA,WAAW,aAAaA,MAAAA,WAAW,eAAe,CAAC;AAE3F,MAAM,+BAA+B,CAAC,EAAE,YAA2C;AAC3E,SAAA,UAAU,UAAa,MAAM,MAAM,QAAM,CAAC,eAAe,IAAI,EAAE,CAAC;AACxE;AAEA,MAAM,mBAAmB;AAAA,EACjB,SAAsB;AACtB,UAAA,cAAc,IAAIC,0BAAY;AAExB,gBAAA,MAAMD,iBAAW,aAAa,EAAE,UAAUC,0BAAY,KAAK,WAAWA,cAAY,YAAA,IAAA,CAAK;AAEnG,gBAAY,MAAMD,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,cAAc;AACpE,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,kBAAkB;AACxE,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,2BAA2B;AACjF,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,mCAAmC;AAEzF,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,WAAW;AAClE,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,yBAAyB;AAChF,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,wBAAwB;AAC/E,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,0BAA0B;AACjF,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,eAAe;AACtE,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,gBAAgB;AAEvE,gBAAY,MAAMF,MAAAA,WAAW,gBAAgBE,kBAAAA,kBAAkB,YAAY;AAE3E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,YAAY;AAC1E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,yBAAyB;AACvF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,WAAW;AACzE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,cAAc;AAC5E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,eAAe;AAC7E,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,yBAAyB,6BAA6B;AAEpH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,kBAAkB,6BAA6B;AAC7G,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,6BAA6B,6BAA6B;AACxH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,gCAAgC,6BAA6B;AAC3H,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,6BAA6B,4BAA4B;AACvH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,kBAAkB,4BAA4B;AAC5G,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,yBAAyB,4BAA4B;AACnH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,0BAA0B,4BAA4B;AAEpH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,CAAC;AACrF,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,mBAAmB,CAAA,CAAE,CAAC;AACpF,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AACvF,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AAEvF,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,cAAc,CAAA,CAAE,CAAC;AAC/E,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,wBAAwB,CAAA,CAAE,CAAC;AAEzF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,oBAAoB;AAClF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,kBAAkB;AAEhF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,OAAO;AACrE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,UAAU;AACxE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,WAAW;AACzE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,UAAU;AACxE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,QAAQ;AAEtE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,SAAS;AACvE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,WAAW;AAEzE,gBAAY,MAAMF,MAAAA,WAAW,iBAAiBE,kBAAAA,kBAAkB,cAAc;AAC9E,gBAAY,MAAMF,MAAAA,WAAW,qBAAqBE,kBAAAA,kBAAkB,iBAAiB;AAE9E,WAAA;AAAA,EAAA;AAET;;"}
|
|
@@ -27,6 +27,8 @@ class PermissionsFactory {
|
|
|
27
27
|
permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP);
|
|
28
28
|
permissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW);
|
|
29
29
|
permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW);
|
|
30
|
+
permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_VIEW_PERMISSIONS);
|
|
31
|
+
permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW);
|
|
30
32
|
permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE);
|
|
31
33
|
permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE);
|
|
32
34
|
permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"PermissionsFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionsFactory.ts"],"sourcesContent":["import { Permissions } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions'\nimport { TenantRole } from './Roles'\n\nconst allowedRoles = new Set<string>([TenantRole.LOGIN, TenantRole.PROJECT_ADMIN, TenantRole.ENTRYPOINT_DEPLOYER])\n\nconst projectAdminAllowedInputRoles = ({ roles }: {roles?: readonly string[]}) => {\n\treturn roles === undefined || roles.every(it => allowedRoles.has(it))\n}\n\nconst forbiddenRoles = new Set<string>([TenantRole.SUPER_ADMIN, TenantRole.PROJECT_CREATOR])\n\nconst projectAdminUseRolesVerifier = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined || roles.every(it => !forbiddenRoles.has(it))\n}\n\nclass PermissionsFactory {\n\tpublic create(): Permissions {\n\t\tconst permissions = new Permissions()\n\n\t\tpermissions.allow(TenantRole.SUPER_ADMIN, { resource: Permissions.ALL, privilege: Permissions.ALL })\n\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_RESET_PASSWORD)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_CREATE_IDP_URL)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN_IDP)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_PASSWORDLESS_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN)\n\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PASSWORD)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PROFILE)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_TOGGLE_PASSWORDLESS)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SIGN_OUT)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP)\n\n\t\tpermissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CREATE_SESSION_KEY(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(), projectAdminUseRolesVerifier)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_ADD_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_UPDATE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_REMOVE_MEMBER([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE_UNMANAGED([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_UPDATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ENABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.ENTRYPOINT_DEPLOY)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIGURE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIG_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_CREATOR, PermissionActions.PROJECT_CREATE)\n\t\tpermissions.allow(TenantRole.ENTRYPOINT_DEPLOYER, PermissionActions.ENTRYPOINT_DEPLOY)\n\n\t\treturn permissions\n\t}\n}\n\nexport { PermissionsFactory }\n"],"names":[],"mappings":";;;AAIA,MAAM,eAAmB,oBAAA,IAAY,CAAC,WAAW,OAAO,WAAW,eAAe,WAAW,mBAAmB,CAAC;AAEjH,MAAM,gCAAgC,CAAC,EAAE,
|
|
1
|
+
{"version":3,"file":"PermissionsFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionsFactory.ts"],"sourcesContent":["import { Permissions } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions'\nimport { TenantRole } from './Roles'\n\nconst allowedRoles = new Set<string>([TenantRole.LOGIN, TenantRole.PROJECT_ADMIN, TenantRole.ENTRYPOINT_DEPLOYER])\n\nconst projectAdminAllowedInputRoles = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined || roles.every(it => allowedRoles.has(it))\n}\n\nconst forbiddenRoles = new Set<string>([TenantRole.SUPER_ADMIN, TenantRole.PROJECT_CREATOR])\n\nconst projectAdminUseRolesVerifier = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined || roles.every(it => !forbiddenRoles.has(it))\n}\n\nclass PermissionsFactory {\n\tpublic create(): Permissions {\n\t\tconst permissions = new Permissions()\n\n\t\tpermissions.allow(TenantRole.SUPER_ADMIN, { resource: Permissions.ALL, privilege: Permissions.ALL })\n\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_RESET_PASSWORD)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_CREATE_IDP_URL)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN_IDP)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_PASSWORDLESS_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN)\n\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PASSWORD)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PROFILE)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_TOGGLE_PASSWORDLESS)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SIGN_OUT)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP)\n\n\t\tpermissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_VIEW_PERMISSIONS)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CREATE_SESSION_KEY(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(), projectAdminUseRolesVerifier)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_ADD_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_UPDATE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_REMOVE_MEMBER([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE_UNMANAGED([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_UPDATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ENABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.ENTRYPOINT_DEPLOY)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIGURE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIG_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_CREATOR, PermissionActions.PROJECT_CREATE)\n\t\tpermissions.allow(TenantRole.ENTRYPOINT_DEPLOYER, PermissionActions.ENTRYPOINT_DEPLOY)\n\n\t\treturn permissions\n\t}\n}\n\nexport { PermissionsFactory }\n"],"names":[],"mappings":";;;AAIA,MAAM,eAAmB,oBAAA,IAAY,CAAC,WAAW,OAAO,WAAW,eAAe,WAAW,mBAAmB,CAAC;AAEjH,MAAM,gCAAgC,CAAC,EAAE,YAA2C;AAC5E,SAAA,UAAU,UAAa,MAAM,MAAM,QAAM,aAAa,IAAI,EAAE,CAAC;AACrE;AAEA,MAAM,qCAAqB,IAAY,CAAC,WAAW,aAAa,WAAW,eAAe,CAAC;AAE3F,MAAM,+BAA+B,CAAC,EAAE,YAA2C;AAC3E,SAAA,UAAU,UAAa,MAAM,MAAM,QAAM,CAAC,eAAe,IAAI,EAAE,CAAC;AACxE;AAEA,MAAM,mBAAmB;AAAA,EACjB,SAAsB;AACtB,UAAA,cAAc,IAAI,YAAY;AAExB,gBAAA,MAAM,WAAW,aAAa,EAAE,UAAU,YAAY,KAAK,WAAW,YAAY,IAAA,CAAK;AAEnG,gBAAY,MAAM,WAAW,OAAO,kBAAkB,cAAc;AACpE,gBAAY,MAAM,WAAW,OAAO,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAM,WAAW,OAAO,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAM,WAAW,OAAO,kBAAkB,kBAAkB;AACxE,gBAAY,MAAM,WAAW,OAAO,kBAAkB,2BAA2B;AACjF,gBAAY,MAAM,WAAW,OAAO,kBAAkB,mCAAmC;AAEzF,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,WAAW;AAClE,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,yBAAyB;AAChF,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,wBAAwB;AAC/E,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,0BAA0B;AACjF,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,eAAe;AACtE,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,gBAAgB;AAEvE,gBAAY,MAAM,WAAW,gBAAgB,kBAAkB,YAAY;AAE3E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,YAAY;AAC1E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,yBAAyB;AACvF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,WAAW;AACzE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,cAAc;AAC5E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,eAAe;AAC7E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,yBAAyB,6BAA6B;AAEpH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,kBAAkB,6BAA6B;AAC7G,gBAAY,MAAM,WAAW,eAAe,kBAAkB,6BAA6B,6BAA6B;AACxH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,gCAAgC,6BAA6B;AAC3H,gBAAY,MAAM,WAAW,eAAe,kBAAkB,6BAA6B,4BAA4B;AACvH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,kBAAkB,4BAA4B;AAC5G,gBAAY,MAAM,WAAW,eAAe,kBAAkB,yBAAyB,4BAA4B;AACnH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,0BAA0B,4BAA4B;AAEpH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,oBAAoB,CAAA,CAAE,CAAC;AACrF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,mBAAmB,CAAA,CAAE,CAAC;AACpF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AACvF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AAEvF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,cAAc,CAAA,CAAE,CAAC;AAC/E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,wBAAwB,CAAA,CAAE,CAAC;AAEzF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,oBAAoB;AAClF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,kBAAkB;AAEhF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,OAAO;AACrE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,UAAU;AACxE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,WAAW;AACzE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,UAAU;AACxE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,QAAQ;AAEtE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,SAAS;AACvE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,WAAW;AAEzE,gBAAY,MAAM,WAAW,iBAAiB,kBAAkB,cAAc;AAC9E,gBAAY,MAAM,WAAW,qBAAqB,kBAAkB,iBAAiB;AAE9E,WAAA;AAAA,EAAA;AAET;"}
|