@contember/engine-tenant-api 2.1.0-alpha.30 → 2.1.0-alpha.36

package/dist/development/src/migrations/snapshot.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"snapshot.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/snapshot.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types'\nimport { createCredentials } from './tenantCredentials'\n\nexport default async function (builder: MigrationBuilder, args: TenantMigrationArgs) {\n\tbuilder.sql(`\nCREATE TYPE \"auth_log_type\" AS ENUM (\n    'login',\n    'create_session_token',\n    'idp_login',\n    'password_reset_init',\n    'password_reset',\n    'password_change',\n    'email_change',\n    '2fa_disable',\n    '2fa_enable',\n    'passwordless_login_init',\n    'passwordless_login_exchange',\n    'passwordless_login',\n    'person_disable'\n);\nCREATE TYPE \"config_policy\" AS ENUM (\n    'always',\n    'never',\n    'optIn',\n    'optOut'\n);\nCREATE TYPE \"config_singleton\" AS ENUM (\n    'singleton'\n);\nCREATE TYPE \"person_token_type\" AS ENUM (\n    'password_reset',\n    'passwordless'\n);\nCREATE FUNCTION \"project_deleted\"() RETURNS \"trigger\"\n    LANGUAGE \"plpgsql\"\n    AS $$\nBEGIN\n\tPERFORM pg_notify('project_updated', old.id::text);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_secret_updated\"() RETURNS \"trigger\"\n    LANGUAGE \"plpgsql\"\n    AS $$\nBEGIN\n\tUPDATE project SET updated_at = 'now' WHERE id = COALESCE(new.project_id, old.project_id);\n\tPERFORM pg_notify('project_updated', COALESCE(new.project_id, old.project_id)::TEXT);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_updated\"() RETURNS \"trigger\"\n    LANGUAGE \"plpgsql\"\n    AS $$\nBEGIN\n\tNEW.updated_at = 'now';\n\tPERFORM pg_notify('project_updated', new.id::text);\n\tRETURN new;\nEND;\n$$;\nCREATE TABLE \"api_key\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"token_hash\" \"text\" NOT NULL,\n    \"type\" \"text\" NOT NULL,\n    \"identity_id\" \"uuid\" NOT NULL,\n    \"expires_at\" timestamp with time zone,\n    \"created_at\" timestamp with time zone NOT NULL,\n    \"expiration\" integer,\n    \"disabled_at\" timestamp with time zone\n);\nCREATE TABLE \"config\" (\n    \"id\" \"config_singleton\" DEFAULT 'singleton'::\"config_singleton\" NOT NULL,\n    \"passwordless_enabled\" \"config_policy\" DEFAULT 'never'::\"config_policy\" NOT NULL,\n    \"passwordless_url\" \"text\",\n    \"passwordless_expiration\" interval DEFAULT '00:05:00'::interval NOT NULL,\n    \"password_min_length\" integer DEFAULT 8 NOT NULL,\n    \"password_require_uppercase\" integer DEFAULT 1 NOT NULL,\n    \"password_require_lowercase\" integer DEFAULT 1 NOT NULL,\n    \"password_require_digit\" integer DEFAULT 1 NOT NULL,\n    \"password_require_special\" integer DEFAULT 0 NOT NULL,\n    \"password_pattern\" \"text\",\n    \"password_check_blacklist\" boolean DEFAULT true NOT NULL,\n    \"login_base_backoff\" interval DEFAULT '00:00:01'::interval NOT NULL,\n    \"login_max_backoff\" interval DEFAULT '00:01:00'::interval NOT NULL,\n    \"login_attempt_window\" interval DEFAULT '00:05:00'::interval NOT NULL,\n    \"login_reveal_user_exits\" boolean DEFAULT true NOT NULL,\n    \"login_default_token_expiration\" interval DEFAULT '00:30:00'::interval NOT NULL,\n    \"login_max_token_expiration\" interval DEFAULT '6 mons'::interval\n);\nCREATE TABLE \"identity\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"parent_id\" \"uuid\",\n    \"roles\" \"jsonb\" NOT NULL,\n    \"description\" \"text\",\n    \"created_at\" timestamp with time zone NOT NULL\n);\nCREATE TABLE \"identity_provider\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"slug\" \"text\" NOT NULL,\n    \"type\" \"text\" NOT NULL,\n    \"configuration\" \"jsonb\" NOT NULL,\n    \"disabled_at\" timestamp with time zone,\n    \"auto_sign_up\" boolean DEFAULT false NOT NULL,\n    \"exclusive\" boolean DEFAULT false,\n    \"init_returns_config\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"mail_template\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"project_id\" \"uuid\",\n    \"mail_type\" \"text\" NOT NULL,\n    \"variant\" \"text\" NOT NULL,\n    \"subject\" \"text\" NOT NULL,\n    \"content\" \"text\" NOT NULL,\n    \"use_layout\" boolean NOT NULL,\n    \"reply_to\" \"text\"\n);\nCREATE TABLE \"person\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"email\" \"text\",\n    \"password_hash\" \"text\",\n    \"identity_id\" \"uuid\" NOT NULL,\n    \"otp_uri\" \"text\",\n    \"otp_activated_at\" timestamp with time zone,\n    \"name\" \"text\",\n    \"idp_only\" boolean DEFAULT false NOT NULL,\n    \"disabled_at\" timestamp with time zone,\n    \"passwordless_enabled\" boolean,\n    CONSTRAINT \"idp_only_no_email\" CHECK (((\"idp_only\" = false) OR ((\"idp_only\" = true) AND (\"email\" IS NULL))))\n);\nCREATE TABLE \"person_auth_log\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n    \"invoked_by_id\" \"uuid\",\n    \"person_id\" \"uuid\",\n    \"person_token_id\" \"uuid\",\n    \"person_input_identifier\" \"text\",\n    \"type\" \"auth_log_type\" NOT NULL,\n    \"success\" boolean NOT NULL,\n    \"error_code\" \"text\",\n    \"error_message\" \"text\",\n    \"ip_address\" \"inet\",\n    \"user_agent\" \"text\",\n    \"identity_provider_id\" \"uuid\",\n    \"metadata\" \"jsonb\"\n);\nCREATE TABLE \"person_identity_provider\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"person_id\" \"uuid\" NOT NULL,\n    \"identity_provider_id\" \"uuid\" NOT NULL,\n    \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n    \"external_identifier\" \"text\" NOT NULL\n);\nCREATE TABLE \"person_token\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"token_hash\" \"text\" NOT NULL,\n    \"person_id\" \"uuid\" NOT NULL,\n    \"expires_at\" timestamp with time zone NOT NULL,\n    \"created_at\" timestamp with time zone NOT NULL,\n    \"used_at\" timestamp with time zone,\n    \"type\" \"person_token_type\" DEFAULT 'password_reset'::\"person_token_type\" NOT NULL,\n    \"otp_hash\" \"text\",\n    \"otp_attempts\" integer DEFAULT 0 NOT NULL\n);\nCREATE TABLE \"project\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"name\" \"text\" NOT NULL,\n    \"slug\" \"text\" NOT NULL,\n    \"config\" \"jsonb\" DEFAULT '{}'::\"jsonb\" NOT NULL,\n    \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"project_membership\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"project_id\" \"uuid\" NOT NULL,\n    \"identity_id\" \"uuid\" NOT NULL,\n    \"role\" \"text\" NOT NULL\n);\nCREATE TABLE \"project_membership_variable\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"membership_id\" \"uuid\" NOT NULL,\n    \"variable\" \"text\" NOT NULL,\n    \"value\" \"jsonb\" NOT NULL\n);\nCREATE TABLE \"project_secret\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"project_id\" \"uuid\" NOT NULL,\n    \"key\" \"text\" NOT NULL,\n    \"created_at\" timestamp with time zone NOT NULL,\n    \"updated_at\" timestamp with time zone NOT NULL,\n    \"value\" \"bytea\" NOT NULL,\n    \"version\" smallint NOT NULL\n);\nALTER TABLE ONLY \"api_key\"\n    ADD CONSTRAINT \"api_key_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"config\"\n    ADD CONSTRAINT \"config_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n    ADD CONSTRAINT \"email_unique\" UNIQUE (\"email\");\nALTER TABLE ONLY \"identity\"\n    ADD CONSTRAINT \"identity_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n    ADD CONSTRAINT \"identity_provider_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n    ADD CONSTRAINT \"identity_provider_slug_key\" UNIQUE (\"slug\");\nALTER TABLE ONLY \"mail_template\"\n    ADD CONSTRAINT \"mail_template_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_auth_log\"\n    ADD CONSTRAINT \"person_auth_log_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n    ADD CONSTRAINT \"person_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n    ADD CONSTRAINT \"person_identity_id_key\" UNIQUE (\"identity_id\");\nALTER TABLE ONLY \"person_identity_provider\"\n    ADD CONSTRAINT \"person_identity_provider_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_token\"\n    ADD CONSTRAINT \"person_password_reset_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project\"\n    ADD CONSTRAINT \"project_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership\"\n    ADD CONSTRAINT \"project_membership_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n    ADD CONSTRAINT \"project_membership_variable_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n    ADD CONSTRAINT \"project_membership_variable_unique\" UNIQUE (\"membership_id\", \"variable\");\nALTER TABLE ONLY \"project_secret\"\n    ADD CONSTRAINT \"project_secret_pkey\" PRIMARY KEY (\"id\");\nCREATE INDEX \"api_key_identity_id\" ON \"api_key\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"api_key_token_hash\" ON \"api_key\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"identity_parent_id\" ON \"identity\" USING \"btree\" (\"parent_id\");\nCREATE UNIQUE INDEX \"mail_template_identifier\" ON \"mail_template\" USING \"btree\" (\"project_id\", \"mail_type\", \"variant\") WHERE (\"project_id\" IS NOT NULL);\nCREATE UNIQUE INDEX \"mail_template_identifier_global\" ON \"mail_template\" USING \"btree\" (\"mail_type\", \"variant\") WHERE (\"project_id\" IS NULL);\nCREATE INDEX \"mail_template_project_index\" ON \"mail_template\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"person_auth_log_person_input_identifier_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_input_identifier\", \"created_at\" DESC);\nCREATE INDEX \"person_identity_id\" ON \"person\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"person_identity_provider_identifier\" ON \"person_identity_provider\" USING \"btree\" (\"identity_provider_id\", \"external_identifier\");\nCREATE INDEX \"person_identity_provider_person_id\" ON \"person_identity_provider\" USING \"btree\" (\"person_id\");\nCREATE UNIQUE INDEX \"person_password_reset_token\" ON \"person_token\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"project_alias\" ON \"project\" USING \"gin\" (((\"config\" -> 'alias'::\"text\")));\nCREATE INDEX \"project_membership_identity_index\" ON \"project_membership\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"project_membership_unique\" ON \"project_membership\" USING \"btree\" (\"project_id\", \"identity_id\", \"role\");\nCREATE INDEX \"project_secret_project_index\" ON \"project_secret\" USING \"btree\" (\"project_id\");\nCREATE UNIQUE INDEX \"project_secret_unique\" ON \"project_secret\" USING \"btree\" (\"project_id\", \"key\");\nCREATE UNIQUE INDEX \"project_slug\" ON \"project\" USING \"btree\" (\"slug\");\nCREATE TRIGGER \"project_deleted\" AFTER DELETE ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_deleted\"();\nCREATE TRIGGER \"project_secret_updated\" AFTER INSERT OR DELETE OR UPDATE ON \"project_secret\" FOR EACH ROW EXECUTE FUNCTION \"project_secret_updated\"();\nCREATE TRIGGER \"project_updated\" BEFORE INSERT OR UPDATE OF \"name\", \"slug\", \"config\" ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_updated\"();\nALTER TABLE ONLY \"api_key\"\n    ADD CONSTRAINT \"api_key_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"identity\"\n    ADD CONSTRAINT \"identity_parent_id_fkey\" FOREIGN KEY (\"parent_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"mail_template\"\n    ADD CONSTRAINT \"mail_template_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_auth_log\"\n    ADD CONSTRAINT \"person_auth_log_identity_provider_id_fkey\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n    ADD CONSTRAINT \"person_auth_log_invoked_by_id_fkey\" FOREIGN KEY (\"invoked_by_id\") REFERENCES \"identity\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n    ADD CONSTRAINT \"person_auth_log_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n    ADD CONSTRAINT \"person_auth_log_person_token_id_fkey\" FOREIGN KEY (\"person_token_id\") REFERENCES \"person_token\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person\"\n    ADD CONSTRAINT \"person_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"person_identity_provider\"\n    ADD CONSTRAINT \"person_identity_provider_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_identity_provider\"\n    ADD CONSTRAINT \"person_identity_provider_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_token\"\n    ADD CONSTRAINT \"person_password_reset_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n    ADD CONSTRAINT \"project_membership_identity\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n    ADD CONSTRAINT \"project_membership_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership_variable\"\n    ADD CONSTRAINT \"project_membership_variable_membership\" FOREIGN KEY (\"membership_id\") REFERENCES \"project_membership\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_secret\"\n    ADD CONSTRAINT \"project_secret_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nINSERT INTO \"config\" (id)\nVALUES (DEFAULT);\n\nDO LANGUAGE plpgsql\n$$\n\tBEGIN\n\t\tEXECUTE FORMAT('ALTER FUNCTION project_secret_updated() SET SEARCH_PATH = %s', QUOTE_IDENT(CURRENT_SCHEMA()));\n\tEND\n$$;\n`)\n\n\tawait createCredentials(builder, args)\n}\n"],"names":[],"mappings":";AAIA,eAAA,SAA+B,SAA2B,MAA2B;AACpF,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAuRZ;AAEM,QAAA,kBAAkB,SAAS,IAAI;AACtC;"}

package/dist/development/src/migrations/tenantCredentials.cjs

@@ -1,56 +0,0 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const databaseMigrations = require("@contember/database-migrations");
-const createCredentials = async (builder, args) => {
-  const credentials = await args.getCredentials();
-  if (credentials.loginTokenHash) {
-    const tokenHash = credentials.loginTokenHash;
-    builder.sql(`
-			WITH identity AS (
-			    INSERT INTO identity(id, parent_id, roles, description, created_at)
-				VALUES (${databaseMigrations.escapeValue(args.providers.uuid())}, NULL, '["login"]'::JSONB, 'Login key', now()) RETURNING id
-			)
-			INSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)
-			SELECT ${databaseMigrations.escapeValue(args.providers.uuid())}, ${databaseMigrations.escapeValue(tokenHash)}, 'permanent', identity.id, NULL, NULL, NULL, now()
-			FROM identity
-			`);
-  }
-  if (!credentials.rootTokenHash) {
-    throw "Please specify a root token using CONTEMBER_ROOT_TOKEN env variable.";
-  }
-  if (credentials.rootEmail && !credentials.rootPasswordBcrypted) {
-    throw "Please specify a root password using CONTEMBER_ROOT_PASSWORD env variable.";
-  }
-  const rootEmail = credentials.rootPasswordBcrypted ? credentials.rootEmail || "root@localhost" : null;
-  const rootPasswordHash = credentials.rootPasswordBcrypted || null;
-  const rootTokenHash = credentials.rootTokenHash;
-  builder.sql(`
-			WITH identity AS (
-				INSERT INTO identity(id, parent_id, roles, description, created_at)
-				VALUES (
-						${databaseMigrations.escapeValue(args.providers.uuid())},
-						NULL,
-						'["super_admin"]'::JSONB
-							|| (CASE WHEN ${databaseMigrations.escapeValue(rootEmail)} IS NOT NULL THEN '["person"]'::JSONB ELSE '[]'::JSONB END),
-						'Superadmin',
-						now()
-					) RETURNING id
-			),
-			person AS (
-				INSERT INTO person(id, email, password_hash, identity_id)
-				SELECT ${databaseMigrations.escapeValue(args.providers.uuid())}, ${databaseMigrations.escapeValue(rootEmail)}, ${databaseMigrations.escapeValue(rootPasswordHash)}, identity.id
-				FROM identity
-				WHERE ${databaseMigrations.escapeValue(rootEmail)} IS NOT NULL
-			    RETURNING id
-			),
-			api_key AS (
-				INSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)
-				SELECT ${databaseMigrations.escapeValue(args.providers.uuid())}, ${databaseMigrations.escapeValue(rootTokenHash)}, 'permanent', identity.id, NULL, NULL, NULL, now()
-				FROM identity WHERE ${databaseMigrations.escapeValue(rootTokenHash)} IS NOT NULL
-			    RETURNING id
-			)
-			SELECT * FROM person, api_key
-		`);
-};
-exports.createCredentials = createCredentials;
-//# sourceMappingURL=tenantCredentials.cjs.map

package/dist/development/src/migrations/tenantCredentials.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"tenantCredentials.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/tenantCredentials.ts"],"sourcesContent":["import { escapeValue, MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types'\n\nexport const createCredentials = async (builder: MigrationBuilder, args: TenantMigrationArgs) => {\n\tconst credentials = await args.getCredentials()\n\tif (credentials.loginTokenHash) {\n\t\tconst tokenHash = credentials.loginTokenHash\n\t\tbuilder.sql(`\n\t\t\tWITH identity AS (\n\t\t\t    INSERT INTO identity(id, parent_id, roles, description, created_at)\n\t\t\t\tVALUES (${escapeValue(args.providers.uuid())}, NULL, '[\"login\"]'::JSONB, 'Login key', now()) RETURNING id\n\t\t\t)\n\t\t\tINSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)\n\t\t\tSELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(tokenHash)}, 'permanent', identity.id, NULL, NULL, NULL, now()\n\t\t\tFROM identity\n\t\t\t`)\n\t}\n\n\tif (!credentials.rootTokenHash) {\n\t\tthrow 'Please specify a root token using CONTEMBER_ROOT_TOKEN env variable.'\n\t}\n\n\tif (credentials.rootEmail && !credentials.rootPasswordBcrypted) {\n\t\tthrow 'Please specify a root password using CONTEMBER_ROOT_PASSWORD env variable.'\n\t}\n\tconst rootEmail = credentials.rootPasswordBcrypted ? credentials.rootEmail || 'root@localhost' : null\n\tconst rootPasswordHash = credentials.rootPasswordBcrypted || null\n\n\tconst rootTokenHash = credentials.rootTokenHash\n\n\tbuilder.sql(`\n\t\t\tWITH identity AS (\n\t\t\t\tINSERT INTO identity(id, parent_id, roles, description, created_at)\n\t\t\t\tVALUES (\n\t\t\t\t\t\t${escapeValue(args.providers.uuid())},\n\t\t\t\t\t\tNULL,\n\t\t\t\t\t\t'[\"super_admin\"]'::JSONB\n\t\t\t\t\t\t\t|| (CASE WHEN ${escapeValue(rootEmail)} IS NOT NULL THEN '[\"person\"]'::JSONB ELSE '[]'::JSONB END),\n\t\t\t\t\t\t'Superadmin',\n\t\t\t\t\t\tnow()\n\t\t\t\t\t) RETURNING id\n\t\t\t),\n\t\t\tperson AS (\n\t\t\t\tINSERT INTO person(id, email, password_hash, identity_id)\n\t\t\t\tSELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(rootEmail)}, ${escapeValue(rootPasswordHash)}, identity.id\n\t\t\t\tFROM identity\n\t\t\t\tWHERE ${escapeValue(rootEmail)} IS NOT NULL\n\t\t\t    RETURNING id\n\t\t\t),\n\t\t\tapi_key AS (\n\t\t\t\tINSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)\n\t\t\t\tSELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(rootTokenHash)}, 'permanent', identity.id, NULL, NULL, NULL, now()\n\t\t\t\tFROM identity WHERE ${escapeValue(rootTokenHash)} IS NOT NULL\n\t\t\t    RETURNING id\n\t\t\t)\n\t\t\tSELECT * FROM person, api_key\n\t\t`)\n}\n"],"names":["escapeValue"],"mappings":";;;AAGa,MAAA,oBAAoB,OAAO,SAA2B,SAA8B;AAC1F,QAAA,cAAc,MAAM,KAAK,eAAe;AAC9C,MAAI,YAAY,gBAAgB;AAC/B,UAAM,YAAY,YAAY;AAC9B,YAAQ,IAAI;AAAA;AAAA;AAAA,cAGAA,mBAAY,YAAA,KAAK,UAAU,KAAM,CAAA,CAAC;AAAA;AAAA;AAAA,YAGpCA,mBAAA,YAAY,KAAK,UAAU,KAAM,CAAA,CAAC,KAAKA,+BAAY,SAAS,CAAC;AAAA;AAAA,IAErE;AAAA,EAAA;AAGC,MAAA,CAAC,YAAY,eAAe;AACzB,UAAA;AAAA,EAAA;AAGP,MAAI,YAAY,aAAa,CAAC,YAAY,sBAAsB;AACzD,UAAA;AAAA,EAAA;AAEP,QAAM,YAAY,YAAY,uBAAuB,YAAY,aAAa,mBAAmB;AAC3F,QAAA,mBAAmB,YAAY,wBAAwB;AAE7D,QAAM,gBAAgB,YAAY;AAElC,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,QAILA,mBAAY,YAAA,KAAK,UAAU,KAAM,CAAA,CAAC;AAAA;AAAA;AAAA,uBAGnBA,mBAAAA,YAAY,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,aAOhCA,mBAAY,YAAA,KAAK,UAAU,KAAM,CAAA,CAAC,KAAKA,mBAAA,YAAY,SAAS,CAAC,KAAKA,mBAAA,YAAY,gBAAgB,CAAC;AAAA;AAAA,YAEhGA,mBAAAA,YAAY,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,aAKrBA,mBAAA,YAAY,KAAK,UAAU,KAAM,CAAA,CAAC,KAAKA,+BAAY,aAAa,CAAC;AAAA,0BACpDA,mBAAAA,YAAY,aAAa,CAAC;AAAA;AAAA;AAAA;AAAA,GAIjD;AACH;;"}

package/dist/development/src/migrations/tenantCredentials.js

@@ -1,56 +0,0 @@
-import { escapeValue } from "@contember/database-migrations";
-const createCredentials = async (builder, args) => {
-  const credentials = await args.getCredentials();
-  if (credentials.loginTokenHash) {
-    const tokenHash = credentials.loginTokenHash;
-    builder.sql(`
-			WITH identity AS (
-			    INSERT INTO identity(id, parent_id, roles, description, created_at)
-				VALUES (${escapeValue(args.providers.uuid())}, NULL, '["login"]'::JSONB, 'Login key', now()) RETURNING id
-			)
-			INSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)
-			SELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(tokenHash)}, 'permanent', identity.id, NULL, NULL, NULL, now()
-			FROM identity
-			`);
-  }
-  if (!credentials.rootTokenHash) {
-    throw "Please specify a root token using CONTEMBER_ROOT_TOKEN env variable.";
-  }
-  if (credentials.rootEmail && !credentials.rootPasswordBcrypted) {
-    throw "Please specify a root password using CONTEMBER_ROOT_PASSWORD env variable.";
-  }
-  const rootEmail = credentials.rootPasswordBcrypted ? credentials.rootEmail || "root@localhost" : null;
-  const rootPasswordHash = credentials.rootPasswordBcrypted || null;
-  const rootTokenHash = credentials.rootTokenHash;
-  builder.sql(`
-			WITH identity AS (
-				INSERT INTO identity(id, parent_id, roles, description, created_at)
-				VALUES (
-						${escapeValue(args.providers.uuid())},
-						NULL,
-						'["super_admin"]'::JSONB
-							|| (CASE WHEN ${escapeValue(rootEmail)} IS NOT NULL THEN '["person"]'::JSONB ELSE '[]'::JSONB END),
-						'Superadmin',
-						now()
-					) RETURNING id
-			),
-			person AS (
-				INSERT INTO person(id, email, password_hash, identity_id)
-				SELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(rootEmail)}, ${escapeValue(rootPasswordHash)}, identity.id
-				FROM identity
-				WHERE ${escapeValue(rootEmail)} IS NOT NULL
-			    RETURNING id
-			),
-			api_key AS (
-				INSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)
-				SELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(rootTokenHash)}, 'permanent', identity.id, NULL, NULL, NULL, now()
-				FROM identity WHERE ${escapeValue(rootTokenHash)} IS NOT NULL
-			    RETURNING id
-			)
-			SELECT * FROM person, api_key
-		`);
-};
-export {
-  createCredentials
-};
-//# sourceMappingURL=tenantCredentials.js.map

package/dist/development/src/migrations/tenantCredentials.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tenantCredentials.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/tenantCredentials.ts"],"sourcesContent":["import { escapeValue, MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types'\n\nexport const createCredentials = async (builder: MigrationBuilder, args: TenantMigrationArgs) => {\n\tconst credentials = await args.getCredentials()\n\tif (credentials.loginTokenHash) {\n\t\tconst tokenHash = credentials.loginTokenHash\n\t\tbuilder.sql(`\n\t\t\tWITH identity AS (\n\t\t\t    INSERT INTO identity(id, parent_id, roles, description, created_at)\n\t\t\t\tVALUES (${escapeValue(args.providers.uuid())}, NULL, '[\"login\"]'::JSONB, 'Login key', now()) RETURNING id\n\t\t\t)\n\t\t\tINSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)\n\t\t\tSELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(tokenHash)}, 'permanent', identity.id, NULL, NULL, NULL, now()\n\t\t\tFROM identity\n\t\t\t`)\n\t}\n\n\tif (!credentials.rootTokenHash) {\n\t\tthrow 'Please specify a root token using CONTEMBER_ROOT_TOKEN env variable.'\n\t}\n\n\tif (credentials.rootEmail && !credentials.rootPasswordBcrypted) {\n\t\tthrow 'Please specify a root password using CONTEMBER_ROOT_PASSWORD env variable.'\n\t}\n\tconst rootEmail = credentials.rootPasswordBcrypted ? credentials.rootEmail || 'root@localhost' : null\n\tconst rootPasswordHash = credentials.rootPasswordBcrypted || null\n\n\tconst rootTokenHash = credentials.rootTokenHash\n\n\tbuilder.sql(`\n\t\t\tWITH identity AS (\n\t\t\t\tINSERT INTO identity(id, parent_id, roles, description, created_at)\n\t\t\t\tVALUES (\n\t\t\t\t\t\t${escapeValue(args.providers.uuid())},\n\t\t\t\t\t\tNULL,\n\t\t\t\t\t\t'[\"super_admin\"]'::JSONB\n\t\t\t\t\t\t\t|| (CASE WHEN ${escapeValue(rootEmail)} IS NOT NULL THEN '[\"person\"]'::JSONB ELSE '[]'::JSONB END),\n\t\t\t\t\t\t'Superadmin',\n\t\t\t\t\t\tnow()\n\t\t\t\t\t) RETURNING id\n\t\t\t),\n\t\t\tperson AS (\n\t\t\t\tINSERT INTO person(id, email, password_hash, identity_id)\n\t\t\t\tSELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(rootEmail)}, ${escapeValue(rootPasswordHash)}, identity.id\n\t\t\t\tFROM identity\n\t\t\t\tWHERE ${escapeValue(rootEmail)} IS NOT NULL\n\t\t\t    RETURNING id\n\t\t\t),\n\t\t\tapi_key AS (\n\t\t\t\tINSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)\n\t\t\t\tSELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(rootTokenHash)}, 'permanent', identity.id, NULL, NULL, NULL, now()\n\t\t\t\tFROM identity WHERE ${escapeValue(rootTokenHash)} IS NOT NULL\n\t\t\t    RETURNING id\n\t\t\t)\n\t\t\tSELECT * FROM person, api_key\n\t\t`)\n}\n"],"names":[],"mappings":";AAGa,MAAA,oBAAoB,OAAO,SAA2B,SAA8B;AAC1F,QAAA,cAAc,MAAM,KAAK,eAAe;AAC9C,MAAI,YAAY,gBAAgB;AAC/B,UAAM,YAAY,YAAY;AAC9B,YAAQ,IAAI;AAAA;AAAA;AAAA,cAGA,YAAY,KAAK,UAAU,KAAM,CAAA,CAAC;AAAA;AAAA;AAAA,YAGpC,YAAY,KAAK,UAAU,KAAM,CAAA,CAAC,KAAK,YAAY,SAAS,CAAC;AAAA;AAAA,IAErE;AAAA,EAAA;AAGC,MAAA,CAAC,YAAY,eAAe;AACzB,UAAA;AAAA,EAAA;AAGP,MAAI,YAAY,aAAa,CAAC,YAAY,sBAAsB;AACzD,UAAA;AAAA,EAAA;AAEP,QAAM,YAAY,YAAY,uBAAuB,YAAY,aAAa,mBAAmB;AAC3F,QAAA,mBAAmB,YAAY,wBAAwB;AAE7D,QAAM,gBAAgB,YAAY;AAElC,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,QAIL,YAAY,KAAK,UAAU,KAAM,CAAA,CAAC;AAAA;AAAA;AAAA,uBAGnB,YAAY,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,aAOhC,YAAY,KAAK,UAAU,KAAM,CAAA,CAAC,KAAK,YAAY,SAAS,CAAC,KAAK,YAAY,gBAAgB,CAAC;AAAA;AAAA,YAEhG,YAAY,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,aAKrB,YAAY,KAAK,UAAU,KAAM,CAAA,CAAC,KAAK,YAAY,aAAa,CAAC;AAAA,0BACpD,YAAY,aAAa,CAAC;AAAA;AAAA;AAAA;AAAA,GAIjD;AACH;"}

package/dist/development/src/model/authorization/AclSchemaAccessNodeFactory.cjs

@@ -1,42 +0,0 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const PermissionActions = require("./PermissionActions.cjs");
-const MembershipMatcher = require("./MembershipMatcher.cjs");
-const DirectPermissionsAccessNode = require("./DirectPermissionsAccessNode.cjs");
-class AclSchemaAccessNodeFactory {
-  create(schema, memberships) {
-    const createVerifier = (getRule) => {
-      const membershipMatcher = new MembershipMatcher.MembershipMatcher(memberships.map((it) => ({
-        ...it,
-        matchRule: getRule(schema.roles[it.role]?.tenant ?? {})
-      })));
-      return ({ memberships: memberships2 }) => {
-        return memberships2.every((it) => membershipMatcher.matches(it));
-      };
-    };
-    const membershipRoles = memberships.map((it) => schema.roles[it.role]).filter((it) => !!it);
-    const node = new DirectPermissionsAccessNode.DirectPermissionsAccessNode();
-    if (membershipRoles.some((it) => it.tenant?.invite)) {
-      const verifier = createVerifier((it) => it.invite && it.invite !== true ? it.invite : it.manage ?? {});
-      node.allow(PermissionActions.PermissionActions.PERSON_INVITE([]), verifier);
-    }
-    if (membershipRoles.some((it) => it.tenant?.unmanagedInvite)) {
-      const verifier = createVerifier((it) => it.unmanagedInvite && it.unmanagedInvite !== true ? it.unmanagedInvite : it.manage ?? {});
-      node.allow(PermissionActions.PermissionActions.PERSON_INVITE_UNMANAGED([]), verifier);
-    }
-    if (membershipRoles.some((it) => it.tenant?.manage)) {
-      const verifier = createVerifier((it) => it.manage ?? {});
-      node.allow(PermissionActions.PermissionActions.PROJECT_ADD_MEMBER([]), verifier);
-      node.allow(PermissionActions.PermissionActions.PROJECT_VIEW_MEMBER([]), verifier);
-      node.allow(PermissionActions.PermissionActions.PROJECT_UPDATE_MEMBER([]), verifier);
-      node.allow(PermissionActions.PermissionActions.PROJECT_REMOVE_MEMBER([]), verifier);
-    }
-    if (membershipRoles.some((it) => it.tenant?.view)) {
-      const verifier = createVerifier((it) => it.view ?? {});
-      node.allow(PermissionActions.PermissionActions.PROJECT_VIEW_MEMBER([]), verifier);
-    }
-    return node;
-  }
-}
-exports.AclSchemaAccessNodeFactory = AclSchemaAccessNodeFactory;
-//# sourceMappingURL=AclSchemaAccessNodeFactory.cjs.map

package/dist/development/src/model/authorization/AclSchemaAccessNodeFactory.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"AclSchemaAccessNodeFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/AclSchemaAccessNodeFactory.ts"],"sourcesContent":["import { AccessNode } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions'\nimport { Acl } from '@contember/schema'\nimport { MembershipMatcher } from './MembershipMatcher'\nimport { DirectPermissionsAccessNode } from './DirectPermissionsAccessNode'\n\nexport class AclSchemaAccessNodeFactory {\n\tcreate(schema: Acl.Schema, memberships: readonly Acl.Membership[]): AccessNode {\n\n\t\tconst createVerifier = (getRule: (permissions: Acl.TenantPermissions) => Acl.MembershipMatchRule) => {\n\t\t\tconst membershipMatcher = new MembershipMatcher(memberships.map(it => ({\n\t\t\t\t...it,\n\t\t\t\tmatchRule: getRule(schema.roles[it.role]?.tenant ?? {}),\n\t\t\t})))\n\n\t\t\treturn ({ memberships }: { memberships: readonly Acl.Membership[] }) => {\n\t\t\t\treturn memberships.every(it => membershipMatcher.matches(it))\n\t\t\t}\n\t\t}\n\n\t\tconst membershipRoles = memberships.map(it => schema.roles[it.role]).filter(it => !!it)\n\t\tconst node = new DirectPermissionsAccessNode()\n\n\t\tif (membershipRoles.some(it => it.tenant?.invite)) {\n\t\t\tconst verifier = createVerifier(it => it.invite && it.invite !== true ? it.invite : it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PERSON_INVITE([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.unmanagedInvite)) {\n\t\t\tconst verifier = createVerifier(it => it.unmanagedInvite && it.unmanagedInvite !== true ? it.unmanagedInvite : it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PERSON_INVITE_UNMANAGED([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.manage)) {\n\t\t\tconst verifier = createVerifier(it => it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PROJECT_ADD_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_UPDATE_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_REMOVE_MEMBER([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.view)) {\n\t\t\tconst verifier = createVerifier(it => it.view ?? {})\n\t\t\tnode.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)\n\t\t}\n\n\t\treturn node\n\t}\n}\n"],"names":["MembershipMatcher","memberships","DirectPermissionsAccessNode","PermissionActions"],"mappings":";;;;;AAMO,MAAM,2BAA2B;AAAA,EACvC,OAAO,QAAoB,aAAoD;AAExE,UAAA,iBAAiB,CAAC,YAA6E;AACpG,YAAM,oBAAoB,IAAIA,kBAAkB,kBAAA,YAAY,IAAI,CAAO,QAAA;AAAA,QACtE,GAAG;AAAA,QACH,WAAW,QAAQ,OAAO,MAAM,GAAG,IAAI,GAAG,UAAU,CAAE,CAAA;AAAA,QACrD,CAAC;AAEH,aAAO,CAAC,EAAE,aAAAC,mBAA8D;AACvE,eAAOA,aAAY,MAAM,CAAA,OAAM,kBAAkB,QAAQ,EAAE,CAAC;AAAA,MAC7D;AAAA,IACD;AAEA,UAAM,kBAAkB,YAAY,IAAI,CAAA,OAAM,OAAO,MAAM,GAAG,IAAI,CAAC,EAAE,OAAO,CAAM,OAAA,CAAC,CAAC,EAAE;AAChF,UAAA,OAAO,IAAIC,wDAA4B;AAE7C,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,MAAM,GAAG;AAClD,YAAM,WAAW,eAAe,CAAM,OAAA,GAAG,UAAU,GAAG,WAAW,OAAO,GAAG,SAAS,GAAG,UAAU,CAAA,CAAE;AACnG,WAAK,MAAMC,kBAAkB,kBAAA,cAAc,CAAE,CAAA,GAAG,QAAQ;AAAA,IAAA;AAGzD,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,eAAe,GAAG;AAC3D,YAAM,WAAW,eAAe,CAAM,OAAA,GAAG,mBAAmB,GAAG,oBAAoB,OAAO,GAAG,kBAAkB,GAAG,UAAU,CAAA,CAAE;AAC9H,WAAK,MAAMA,kBAAkB,kBAAA,wBAAwB,CAAE,CAAA,GAAG,QAAQ;AAAA,IAAA;AAGnE,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,MAAM,GAAG;AAClD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,UAAU,EAAE;AACrD,WAAK,MAAMA,kBAAkB,kBAAA,mBAAmB,CAAE,CAAA,GAAG,QAAQ;AAC7D,WAAK,MAAMA,kBAAkB,kBAAA,oBAAoB,CAAE,CAAA,GAAG,QAAQ;AAC9D,WAAK,MAAMA,kBAAkB,kBAAA,sBAAsB,CAAE,CAAA,GAAG,QAAQ;AAChE,WAAK,MAAMA,kBAAkB,kBAAA,sBAAsB,CAAE,CAAA,GAAG,QAAQ;AAAA,IAAA;AAGjE,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,IAAI,GAAG;AAChD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,QAAQ,EAAE;AACnD,WAAK,MAAMA,kBAAkB,kBAAA,oBAAoB,CAAE,CAAA,GAAG,QAAQ;AAAA,IAAA;AAGxD,WAAA;AAAA,EAAA;AAET;;"}

package/dist/development/src/model/authorization/AclSchemaAccessNodeFactory.js

@@ -1,42 +0,0 @@
-import { PermissionActions } from "./PermissionActions.js";
-import { MembershipMatcher } from "./MembershipMatcher.js";
-import { DirectPermissionsAccessNode } from "./DirectPermissionsAccessNode.js";
-class AclSchemaAccessNodeFactory {
-  create(schema, memberships) {
-    const createVerifier = (getRule) => {
-      const membershipMatcher = new MembershipMatcher(memberships.map((it) => ({
-        ...it,
-        matchRule: getRule(schema.roles[it.role]?.tenant ?? {})
-      })));
-      return ({ memberships: memberships2 }) => {
-        return memberships2.every((it) => membershipMatcher.matches(it));
-      };
-    };
-    const membershipRoles = memberships.map((it) => schema.roles[it.role]).filter((it) => !!it);
-    const node = new DirectPermissionsAccessNode();
-    if (membershipRoles.some((it) => it.tenant?.invite)) {
-      const verifier = createVerifier((it) => it.invite && it.invite !== true ? it.invite : it.manage ?? {});
-      node.allow(PermissionActions.PERSON_INVITE([]), verifier);
-    }
-    if (membershipRoles.some((it) => it.tenant?.unmanagedInvite)) {
-      const verifier = createVerifier((it) => it.unmanagedInvite && it.unmanagedInvite !== true ? it.unmanagedInvite : it.manage ?? {});
-      node.allow(PermissionActions.PERSON_INVITE_UNMANAGED([]), verifier);
-    }
-    if (membershipRoles.some((it) => it.tenant?.manage)) {
-      const verifier = createVerifier((it) => it.manage ?? {});
-      node.allow(PermissionActions.PROJECT_ADD_MEMBER([]), verifier);
-      node.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier);
-      node.allow(PermissionActions.PROJECT_UPDATE_MEMBER([]), verifier);
-      node.allow(PermissionActions.PROJECT_REMOVE_MEMBER([]), verifier);
-    }
-    if (membershipRoles.some((it) => it.tenant?.view)) {
-      const verifier = createVerifier((it) => it.view ?? {});
-      node.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier);
-    }
-    return node;
-  }
-}
-export {
-  AclSchemaAccessNodeFactory
-};
-//# sourceMappingURL=AclSchemaAccessNodeFactory.js.map

package/dist/development/src/model/authorization/AclSchemaAccessNodeFactory.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"AclSchemaAccessNodeFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/AclSchemaAccessNodeFactory.ts"],"sourcesContent":["import { AccessNode } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions'\nimport { Acl } from '@contember/schema'\nimport { MembershipMatcher } from './MembershipMatcher'\nimport { DirectPermissionsAccessNode } from './DirectPermissionsAccessNode'\n\nexport class AclSchemaAccessNodeFactory {\n\tcreate(schema: Acl.Schema, memberships: readonly Acl.Membership[]): AccessNode {\n\n\t\tconst createVerifier = (getRule: (permissions: Acl.TenantPermissions) => Acl.MembershipMatchRule) => {\n\t\t\tconst membershipMatcher = new MembershipMatcher(memberships.map(it => ({\n\t\t\t\t...it,\n\t\t\t\tmatchRule: getRule(schema.roles[it.role]?.tenant ?? {}),\n\t\t\t})))\n\n\t\t\treturn ({ memberships }: { memberships: readonly Acl.Membership[] }) => {\n\t\t\t\treturn memberships.every(it => membershipMatcher.matches(it))\n\t\t\t}\n\t\t}\n\n\t\tconst membershipRoles = memberships.map(it => schema.roles[it.role]).filter(it => !!it)\n\t\tconst node = new DirectPermissionsAccessNode()\n\n\t\tif (membershipRoles.some(it => it.tenant?.invite)) {\n\t\t\tconst verifier = createVerifier(it => it.invite && it.invite !== true ? it.invite : it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PERSON_INVITE([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.unmanagedInvite)) {\n\t\t\tconst verifier = createVerifier(it => it.unmanagedInvite && it.unmanagedInvite !== true ? it.unmanagedInvite : it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PERSON_INVITE_UNMANAGED([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.manage)) {\n\t\t\tconst verifier = createVerifier(it => it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PROJECT_ADD_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_UPDATE_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_REMOVE_MEMBER([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.view)) {\n\t\t\tconst verifier = createVerifier(it => it.view ?? {})\n\t\t\tnode.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)\n\t\t}\n\n\t\treturn node\n\t}\n}\n"],"names":["memberships"],"mappings":";;;AAMO,MAAM,2BAA2B;AAAA,EACvC,OAAO,QAAoB,aAAoD;AAExE,UAAA,iBAAiB,CAAC,YAA6E;AACpG,YAAM,oBAAoB,IAAI,kBAAkB,YAAY,IAAI,CAAO,QAAA;AAAA,QACtE,GAAG;AAAA,QACH,WAAW,QAAQ,OAAO,MAAM,GAAG,IAAI,GAAG,UAAU,CAAE,CAAA;AAAA,QACrD,CAAC;AAEH,aAAO,CAAC,EAAE,aAAAA,mBAA8D;AACvE,eAAOA,aAAY,MAAM,CAAA,OAAM,kBAAkB,QAAQ,EAAE,CAAC;AAAA,MAC7D;AAAA,IACD;AAEA,UAAM,kBAAkB,YAAY,IAAI,CAAA,OAAM,OAAO,MAAM,GAAG,IAAI,CAAC,EAAE,OAAO,CAAM,OAAA,CAAC,CAAC,EAAE;AAChF,UAAA,OAAO,IAAI,4BAA4B;AAE7C,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,MAAM,GAAG;AAClD,YAAM,WAAW,eAAe,CAAM,OAAA,GAAG,UAAU,GAAG,WAAW,OAAO,GAAG,SAAS,GAAG,UAAU,CAAA,CAAE;AACnG,WAAK,MAAM,kBAAkB,cAAc,CAAE,CAAA,GAAG,QAAQ;AAAA,IAAA;AAGzD,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,eAAe,GAAG;AAC3D,YAAM,WAAW,eAAe,CAAM,OAAA,GAAG,mBAAmB,GAAG,oBAAoB,OAAO,GAAG,kBAAkB,GAAG,UAAU,CAAA,CAAE;AAC9H,WAAK,MAAM,kBAAkB,wBAAwB,CAAE,CAAA,GAAG,QAAQ;AAAA,IAAA;AAGnE,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,MAAM,GAAG;AAClD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,UAAU,EAAE;AACrD,WAAK,MAAM,kBAAkB,mBAAmB,CAAE,CAAA,GAAG,QAAQ;AAC7D,WAAK,MAAM,kBAAkB,oBAAoB,CAAE,CAAA,GAAG,QAAQ;AAC9D,WAAK,MAAM,kBAAkB,sBAAsB,CAAE,CAAA,GAAG,QAAQ;AAChE,WAAK,MAAM,kBAAkB,sBAAsB,CAAE,CAAA,GAAG,QAAQ;AAAA,IAAA;AAGjE,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,IAAI,GAAG;AAChD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,QAAQ,EAAE;AACnD,WAAK,MAAM,kBAAkB,oBAAoB,CAAE,CAAA,GAAG,QAAQ;AAAA,IAAA;AAGxD,WAAA;AAAA,EAAA;AAET;"}

package/dist/development/src/model/authorization/DirectPermissionsAccessNode.cjs

@@ -1,20 +0,0 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-var __defProp = Object.defineProperty;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
-class DirectPermissionsAccessNode {
-  constructor() {
-    __publicField(this, "permissions", {});
-  }
-  allow({ resource, privilege }, verifier = () => true) {
-    var _a;
-    (_a = this.permissions)[resource] ?? (_a[resource] = {});
-    this.permissions[resource][privilege] = verifier;
-  }
-  isAllowed(accessEvaluator, { resource, meta, privilege }) {
-    return Promise.resolve(this.permissions[resource]?.[privilege]?.(meta) === true);
-  }
-}
-exports.DirectPermissionsAccessNode = DirectPermissionsAccessNode;
-//# sourceMappingURL=DirectPermissionsAccessNode.cjs.map

package/dist/development/src/model/authorization/DirectPermissionsAccessNode.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"DirectPermissionsAccessNode.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/DirectPermissionsAccessNode.ts"],"sourcesContent":["import { AccessEvaluator, AccessNode, Authorizator } from '@contember/authorization'\n\ntype PermissionsMap = {\n\t[resource: string]: {\n\t\t[privilege: string]: (meta: any) => boolean\n\t}\n}\n\nexport class DirectPermissionsAccessNode implements AccessNode {\n\tprivate permissions: PermissionsMap = {}\n\n\tpublic allow<Meta extends {} | undefined = undefined>(\n\t\t{ resource, privilege }: Authorizator.Action<Meta>,\n\t\tverifier: (meta: Meta) => boolean = () => true,\n\t) {\n\t\tthis.permissions[resource] ??= {}\n\t\tthis.permissions[resource][privilege] = verifier\n\t}\n\n\tisAllowed(accessEvaluator: AccessEvaluator, { resource, meta, privilege }: Authorizator.Action): Promise<boolean> {\n\t\treturn Promise.resolve(this.permissions[resource]?.[privilege]?.(meta) === true)\n\t}\n}\n"],"names":[],"mappings":";;;;;AAQO,MAAM,4BAAkD;AAAA,EAAxD,cAAA;AACN,kBAAA,MAAQ,eAA8B,EAAC;AAAA,EAAA;AAAA,EAEhC,MACN,EAAE,UAAU,UACZ,GAAA,WAAoC,MAAM,MACzC;AAdH,QAAA;AAeO,KAAA,KAAA,KAAA,aAAL,6BAA+B;AAC/B,SAAK,YAAY,QAAQ,EAAE,SAAS,IAAI;AAAA,EAAA;AAAA,EAGzC,UAAU,iBAAkC,EAAE,UAAU,MAAM,aAAoD;AAC1G,WAAA,QAAQ,QAAQ,KAAK,YAAY,QAAQ,IAAI,SAAS,IAAI,IAAI,MAAM,IAAI;AAAA,EAAA;AAEjF;;"}

package/dist/development/src/model/authorization/DirectPermissionsAccessNode.js

@@ -1,20 +0,0 @@
-var __defProp = Object.defineProperty;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
-class DirectPermissionsAccessNode {
-  constructor() {
-    __publicField(this, "permissions", {});
-  }
-  allow({ resource, privilege }, verifier = () => true) {
-    var _a;
-    (_a = this.permissions)[resource] ?? (_a[resource] = {});
-    this.permissions[resource][privilege] = verifier;
-  }
-  isAllowed(accessEvaluator, { resource, meta, privilege }) {
-    return Promise.resolve(this.permissions[resource]?.[privilege]?.(meta) === true);
-  }
-}
-export {
-  DirectPermissionsAccessNode
-};
-//# sourceMappingURL=DirectPermissionsAccessNode.js.map

package/dist/development/src/model/authorization/DirectPermissionsAccessNode.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"DirectPermissionsAccessNode.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/DirectPermissionsAccessNode.ts"],"sourcesContent":["import { AccessEvaluator, AccessNode, Authorizator } from '@contember/authorization'\n\ntype PermissionsMap = {\n\t[resource: string]: {\n\t\t[privilege: string]: (meta: any) => boolean\n\t}\n}\n\nexport class DirectPermissionsAccessNode implements AccessNode {\n\tprivate permissions: PermissionsMap = {}\n\n\tpublic allow<Meta extends {} | undefined = undefined>(\n\t\t{ resource, privilege }: Authorizator.Action<Meta>,\n\t\tverifier: (meta: Meta) => boolean = () => true,\n\t) {\n\t\tthis.permissions[resource] ??= {}\n\t\tthis.permissions[resource][privilege] = verifier\n\t}\n\n\tisAllowed(accessEvaluator: AccessEvaluator, { resource, meta, privilege }: Authorizator.Action): Promise<boolean> {\n\t\treturn Promise.resolve(this.permissions[resource]?.[privilege]?.(meta) === true)\n\t}\n}\n"],"names":[],"mappings":";;;AAQO,MAAM,4BAAkD;AAAA,EAAxD,cAAA;AACN,kBAAA,MAAQ,eAA8B,EAAC;AAAA,EAAA;AAAA,EAEhC,MACN,EAAE,UAAU,UACZ,GAAA,WAAoC,MAAM,MACzC;AAdH,QAAA;AAeO,KAAA,KAAA,KAAA,aAAL,6BAA+B;AAC/B,SAAK,YAAY,QAAQ,EAAE,SAAS,IAAI;AAAA,EAAA;AAAA,EAGzC,UAAU,iBAAkC,EAAE,UAAU,MAAM,aAAoD;AAC1G,WAAA,QAAQ,QAAQ,KAAK,YAAY,QAAQ,IAAI,SAAS,IAAI,IAAI,MAAM,IAAI;AAAA,EAAA;AAEjF;"}

package/dist/development/src/model/authorization/Identity.cjs

@@ -1,32 +0,0 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-var __defProp = Object.defineProperty;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
-class StaticIdentity {
-  constructor(id, roles, projectMemberships = {}) {
-    this.id = id;
-    this.roles = roles;
-    this.projectMemberships = projectMemberships;
-  }
-  getProjectMemberships(projectSlug) {
-    return Promise.resolve(this.projectMemberships[projectSlug] || {});
-  }
-}
-class ProjectAwareIdentity {
-  constructor(id, roles, dbContext, memberManager) {
-    this.id = id;
-    this.roles = roles;
-    this.dbContext = dbContext;
-    this.memberManager = memberManager;
-    __publicField(this, "projectMembershipCache", {});
-  }
-  async getProjectMemberships(projectSlug) {
-    var _a;
-    (_a = this.projectMembershipCache)[projectSlug] ?? (_a[projectSlug] = this.memberManager.getEffectiveProjectMemberships(this.dbContext, { slug: projectSlug }, this));
-    return await this.projectMembershipCache[projectSlug];
-  }
-}
-exports.ProjectAwareIdentity = ProjectAwareIdentity;
-exports.StaticIdentity = StaticIdentity;
-//# sourceMappingURL=Identity.cjs.map

package/dist/development/src/model/authorization/Identity.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"Identity.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/Identity.ts"],"sourcesContent":["import { ProjectMemberManager } from '../service'\nimport { DatabaseContext } from '../utils'\nimport { Acl } from '@contember/schema'\n\nexport interface Identity {\n\treadonly id: string\n\treadonly roles: readonly string[]\n\n\tgetProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]>\n}\n\nexport class StaticIdentity implements Identity {\n\tconstructor(\n\t\tpublic readonly id: string,\n\t\tpublic readonly roles: string[],\n\t\tprivate projectMemberships: Record<string, readonly Acl.Membership[]> = {},\n\t) {}\n\n\tgetProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]> {\n\t\treturn Promise.resolve(this.projectMemberships[projectSlug] || {})\n\t}\n}\n\nexport class ProjectAwareIdentity implements Identity {\n\tprivate projectMembershipCache: Record<string, Promise<readonly Acl.Membership[]>> = {}\n\n\tconstructor(\n\t\tpublic readonly id: string,\n\t\tpublic readonly roles: readonly string[],\n\t\tprivate readonly dbContext: DatabaseContext,\n\t\tprivate readonly memberManager: ProjectMemberManager,\n\t) {}\n\n\tasync getProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]> {\n\t\tthis.projectMembershipCache[projectSlug] ??= this.memberManager.getEffectiveProjectMemberships(this.dbContext, { slug: projectSlug }, this)\n\t\treturn await this.projectMembershipCache[projectSlug]\n\t}\n}\n"],"names":[],"mappings":";;;;;AAWO,MAAM,eAAmC;AAAA,EAC/C,YACiB,IACA,OACR,qBAAgE,CAAA,GACvE;AAHe,SAAA,KAAA;AACA,SAAA,QAAA;AACR,SAAA,qBAAA;AAAA,EAAA;AAAA,EAGT,sBAAsB,aAAyD;AAC9E,WAAO,QAAQ,QAAQ,KAAK,mBAAmB,WAAW,KAAK,EAAE;AAAA,EAAA;AAEnE;AAEO,MAAM,qBAAyC;AAAA,EAGrD,YACiB,IACA,OACC,WACA,eAChB;AAJe,SAAA,KAAA;AACA,SAAA,QAAA;AACC,SAAA,YAAA;AACA,SAAA,gBAAA;AANlB,kBAAA,MAAQ,0BAA6E,EAAC;AAAA,EAAA;AAAA,EAStF,MAAM,sBAAsB,aAAyD;AAjCtF,QAAA;AAkCO,KAAA,KAAA,KAAA,wBAAL,WAA6C,MAAA,GAAA,WAAA,IAAA,KAAK,cAAc,+BAA+B,KAAK,WAAW,EAAE,MAAM,YAAY,GAAG,IAAI;AACnI,WAAA,MAAM,KAAK,uBAAuB,WAAW;AAAA,EAAA;AAEtD;;;"}

package/dist/development/src/model/authorization/Identity.js

@@ -1,32 +0,0 @@
-var __defProp = Object.defineProperty;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
-class StaticIdentity {
-  constructor(id, roles, projectMemberships = {}) {
-    this.id = id;
-    this.roles = roles;
-    this.projectMemberships = projectMemberships;
-  }
-  getProjectMemberships(projectSlug) {
-    return Promise.resolve(this.projectMemberships[projectSlug] || {});
-  }
-}
-class ProjectAwareIdentity {
-  constructor(id, roles, dbContext, memberManager) {
-    this.id = id;
-    this.roles = roles;
-    this.dbContext = dbContext;
-    this.memberManager = memberManager;
-    __publicField(this, "projectMembershipCache", {});
-  }
-  async getProjectMemberships(projectSlug) {
-    var _a;
-    (_a = this.projectMembershipCache)[projectSlug] ?? (_a[projectSlug] = this.memberManager.getEffectiveProjectMemberships(this.dbContext, { slug: projectSlug }, this));
-    return await this.projectMembershipCache[projectSlug];
-  }
-}
-export {
-  ProjectAwareIdentity,
-  StaticIdentity
-};
-//# sourceMappingURL=Identity.js.map

package/dist/development/src/model/authorization/Identity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"Identity.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/Identity.ts"],"sourcesContent":["import { ProjectMemberManager } from '../service'\nimport { DatabaseContext } from '../utils'\nimport { Acl } from '@contember/schema'\n\nexport interface Identity {\n\treadonly id: string\n\treadonly roles: readonly string[]\n\n\tgetProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]>\n}\n\nexport class StaticIdentity implements Identity {\n\tconstructor(\n\t\tpublic readonly id: string,\n\t\tpublic readonly roles: string[],\n\t\tprivate projectMemberships: Record<string, readonly Acl.Membership[]> = {},\n\t) {}\n\n\tgetProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]> {\n\t\treturn Promise.resolve(this.projectMemberships[projectSlug] || {})\n\t}\n}\n\nexport class ProjectAwareIdentity implements Identity {\n\tprivate projectMembershipCache: Record<string, Promise<readonly Acl.Membership[]>> = {}\n\n\tconstructor(\n\t\tpublic readonly id: string,\n\t\tpublic readonly roles: readonly string[],\n\t\tprivate readonly dbContext: DatabaseContext,\n\t\tprivate readonly memberManager: ProjectMemberManager,\n\t) {}\n\n\tasync getProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]> {\n\t\tthis.projectMembershipCache[projectSlug] ??= this.memberManager.getEffectiveProjectMemberships(this.dbContext, { slug: projectSlug }, this)\n\t\treturn await this.projectMembershipCache[projectSlug]\n\t}\n}\n"],"names":[],"mappings":";;;AAWO,MAAM,eAAmC;AAAA,EAC/C,YACiB,IACA,OACR,qBAAgE,CAAA,GACvE;AAHe,SAAA,KAAA;AACA,SAAA,QAAA;AACR,SAAA,qBAAA;AAAA,EAAA;AAAA,EAGT,sBAAsB,aAAyD;AAC9E,WAAO,QAAQ,QAAQ,KAAK,mBAAmB,WAAW,KAAK,EAAE;AAAA,EAAA;AAEnE;AAEO,MAAM,qBAAyC;AAAA,EAGrD,YACiB,IACA,OACC,WACA,eAChB;AAJe,SAAA,KAAA;AACA,SAAA,QAAA;AACC,SAAA,YAAA;AACA,SAAA,gBAAA;AANlB,kBAAA,MAAQ,0BAA6E,EAAC;AAAA,EAAA;AAAA,EAStF,MAAM,sBAAsB,aAAyD;AAjCtF,QAAA;AAkCO,KAAA,KAAA,KAAA,wBAAL,WAA6C,MAAA,GAAA,WAAA,IAAA,KAAK,cAAc,+BAA+B,KAAK,WAAW,EAAE,MAAM,YAAY,GAAG,IAAI;AACnI,WAAA,MAAM,KAAK,uBAAuB,WAAW;AAAA,EAAA;AAEtD;"}

package/dist/development/src/model/authorization/IdentityFactory.cjs

@@ -1,13 +0,0 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const Identity = require("./Identity.cjs");
-class IdentityFactory {
-  constructor(projectMemberManager) {
-    this.projectMemberManager = projectMemberManager;
-  }
-  create(dbContext, args) {
-    return new Identity.ProjectAwareIdentity(args.id, args.roles, dbContext, this.projectMemberManager);
-  }
-}
-exports.IdentityFactory = IdentityFactory;
-//# sourceMappingURL=IdentityFactory.cjs.map

package/dist/development/src/model/authorization/IdentityFactory.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"IdentityFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/IdentityFactory.ts"],"sourcesContent":["import { ProjectMemberManager } from '../service'\nimport { Identity, ProjectAwareIdentity } from './Identity'\nimport { DatabaseContext } from '../utils'\n\nexport class IdentityFactory {\n\tconstructor(private readonly projectMemberManager: ProjectMemberManager) {}\n\n\tpublic create(dbContext: DatabaseContext, args: { id: string; roles: readonly string[] }): Identity {\n\t\treturn new ProjectAwareIdentity(args.id, args.roles, dbContext, this.projectMemberManager)\n\t}\n}\n"],"names":["ProjectAwareIdentity"],"mappings":";;;AAIO,MAAM,gBAAgB;AAAA,EAC5B,YAA6B,sBAA4C;AAA5C,SAAA,uBAAA;AAAA,EAAA;AAAA,EAEtB,OAAO,WAA4B,MAA0D;AAC5F,WAAA,IAAIA,SAAAA,qBAAqB,KAAK,IAAI,KAAK,OAAO,WAAW,KAAK,oBAAoB;AAAA,EAAA;AAE3F;;"}

package/dist/development/src/model/authorization/IdentityFactory.js

@@ -1,13 +0,0 @@
-import { ProjectAwareIdentity } from "./Identity.js";
-class IdentityFactory {
-  constructor(projectMemberManager) {
-    this.projectMemberManager = projectMemberManager;
-  }
-  create(dbContext, args) {
-    return new ProjectAwareIdentity(args.id, args.roles, dbContext, this.projectMemberManager);
-  }
-}
-export {
-  IdentityFactory
-};
-//# sourceMappingURL=IdentityFactory.js.map

package/dist/development/src/model/authorization/IdentityFactory.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"IdentityFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/IdentityFactory.ts"],"sourcesContent":["import { ProjectMemberManager } from '../service'\nimport { Identity, ProjectAwareIdentity } from './Identity'\nimport { DatabaseContext } from '../utils'\n\nexport class IdentityFactory {\n\tconstructor(private readonly projectMemberManager: ProjectMemberManager) {}\n\n\tpublic create(dbContext: DatabaseContext, args: { id: string; roles: readonly string[] }): Identity {\n\t\treturn new ProjectAwareIdentity(args.id, args.roles, dbContext, this.projectMemberManager)\n\t}\n}\n"],"names":[],"mappings":";AAIO,MAAM,gBAAgB;AAAA,EAC5B,YAA6B,sBAA4C;AAA5C,SAAA,uBAAA;AAAA,EAAA;AAAA,EAEtB,OAAO,WAA4B,MAA0D;AAC5F,WAAA,IAAI,qBAAqB,KAAK,IAAI,KAAK,OAAO,WAAW,KAAK,oBAAoB;AAAA,EAAA;AAE3F;"}

package/dist/development/src/model/authorization/IdentityScope.cjs

@@ -1,14 +0,0 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const authorization = require("@contember/authorization");
-const Roles = require("./Roles.cjs");
-class IdentityScope {
-  constructor(identityId) {
-    this.identityId = identityId;
-  }
-  async getIdentityAccess(identity) {
-    return new authorization.AccessNode.Roles(identity.id === this.identityId ? [Roles.TenantRole.SELF] : []);
-  }
-}
-exports.IdentityScope = IdentityScope;
-//# sourceMappingURL=IdentityScope.cjs.map

package/dist/development/src/model/authorization/IdentityScope.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"IdentityScope.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/IdentityScope.ts"],"sourcesContent":["import { AuthorizationScope, AccessNode } from '@contember/authorization'\nimport { TenantRole } from './Roles'\nimport { Identity } from './Identity'\n\nclass IdentityScope implements AuthorizationScope<Identity> {\n\tconstructor(private readonly identityId: string) {}\n\n\tasync getIdentityAccess(identity: Identity): Promise<AccessNode> {\n\t\treturn new AccessNode.Roles(identity.id === this.identityId ? [TenantRole.SELF] : [])\n\t}\n}\n\nexport { IdentityScope }\n"],"names":["AccessNode","TenantRole"],"mappings":";;;;AAIA,MAAM,cAAsD;AAAA,EAC3D,YAA6B,YAAoB;AAApB,SAAA,aAAA;AAAA,EAAA;AAAA,EAE7B,MAAM,kBAAkB,UAAyC;AAChE,WAAO,IAAIA,cAAA,WAAW,MAAM,SAAS,OAAO,KAAK,aAAa,CAACC,MAAAA,WAAW,IAAI,IAAI,CAAA,CAAE;AAAA,EAAA;AAEtF;;"}

package/dist/development/src/model/authorization/IdentityScope.js

@@ -1,14 +0,0 @@
-import { AccessNode } from "@contember/authorization";
-import { TenantRole } from "./Roles.js";
-class IdentityScope {
-  constructor(identityId) {
-    this.identityId = identityId;
-  }
-  async getIdentityAccess(identity) {
-    return new AccessNode.Roles(identity.id === this.identityId ? [TenantRole.SELF] : []);
-  }
-}
-export {
-  IdentityScope
-};
-//# sourceMappingURL=IdentityScope.js.map

package/dist/development/src/model/authorization/IdentityScope.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"IdentityScope.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/IdentityScope.ts"],"sourcesContent":["import { AuthorizationScope, AccessNode } from '@contember/authorization'\nimport { TenantRole } from './Roles'\nimport { Identity } from './Identity'\n\nclass IdentityScope implements AuthorizationScope<Identity> {\n\tconstructor(private readonly identityId: string) {}\n\n\tasync getIdentityAccess(identity: Identity): Promise<AccessNode> {\n\t\treturn new AccessNode.Roles(identity.id === this.identityId ? [TenantRole.SELF] : [])\n\t}\n}\n\nexport { IdentityScope }\n"],"names":[],"mappings":";;AAIA,MAAM,cAAsD;AAAA,EAC3D,YAA6B,YAAoB;AAApB,SAAA,aAAA;AAAA,EAAA;AAAA,EAE7B,MAAM,kBAAkB,UAAyC;AAChE,WAAO,IAAI,WAAW,MAAM,SAAS,OAAO,KAAK,aAAa,CAAC,WAAW,IAAI,IAAI,CAAA,CAAE;AAAA,EAAA;AAEtF;"}

package/dist/development/src/model/authorization/MembershipMatcher.cjs

@@ -1,45 +0,0 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-class MembershipMatcher {
-  constructor(memberships) {
-    this.memberships = memberships;
-  }
-  matches(membership) {
-    return this.memberships.some((invokerMembership) => {
-      if (invokerMembership.matchRule === true) {
-        return true;
-      }
-      if (!invokerMembership.matchRule) {
-        return false;
-      }
-      const matchRule = invokerMembership.matchRule[membership.role];
-      if (!matchRule) {
-        return false;
-      }
-      if (matchRule === true) {
-        return true;
-      }
-      const variables = matchRule?.variables;
-      if (variables === true) {
-        return true;
-      }
-      return membership.variables.every((variable) => {
-        const sourceVariableRule = variables?.[variable.name];
-        if (!sourceVariableRule) {
-          return false;
-        }
-        if (sourceVariableRule === true) {
-          return true;
-        }
-        const sourceVariable = invokerMembership.variables.find((it) => typeof sourceVariableRule === "string" && it.name === sourceVariableRule);
-        if (!sourceVariable) {
-          return false;
-        }
-        const sourceValues = new Set(sourceVariable.values);
-        return variable.values.every((it) => sourceValues.has(it));
-      });
-    });
-  }
-}
-exports.MembershipMatcher = MembershipMatcher;
-//# sourceMappingURL=MembershipMatcher.cjs.map

package/dist/development/src/model/authorization/MembershipMatcher.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"MembershipMatcher.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/MembershipMatcher.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\n\nexport type MembershipWithSubMembershipMatchRules =\n\t& Acl.Membership\n\t& {\n\t\tmatchRule: Acl.MembershipMatchRule\n\t}\n\nexport class MembershipMatcher {\n\tconstructor(private readonly memberships: readonly MembershipWithSubMembershipMatchRules[]) {\n\t}\n\n\tmatches(membership: Acl.Membership): boolean {\n\t\treturn this.memberships.some(invokerMembership => {\n\t\t\tif (invokerMembership.matchRule === true) {\n\t\t\t\treturn true\n\t\t\t}\n\t\t\tif (!invokerMembership.matchRule) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tconst matchRule = invokerMembership.matchRule[membership.role]\n\t\t\tif (!matchRule) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tif (matchRule === true) {\n\t\t\t\treturn true\n\t\t\t}\n\t\t\tconst variables = matchRule?.variables\n\t\t\tif (variables === true) {\n\t\t\t\treturn true\n\t\t\t}\n\t\t\treturn membership.variables.every(variable => {\n\t\t\t\tconst sourceVariableRule = variables?.[variable.name]\n\t\t\t\tif (!sourceVariableRule) {\n\t\t\t\t\treturn false\n\t\t\t\t}\n\t\t\t\tif (sourceVariableRule === true) {\n\t\t\t\t\treturn true\n\t\t\t\t}\n\t\t\t\tconst sourceVariable = invokerMembership.variables.find(it => typeof sourceVariableRule === 'string' && it.name === sourceVariableRule)\n\t\t\t\tif (!sourceVariable) {\n\t\t\t\t\treturn false\n\t\t\t\t}\n\t\t\t\tconst sourceValues = new Set(sourceVariable.values)\n\t\t\t\treturn variable.values.every(it => sourceValues.has(it))\n\t\t\t})\n\t\t})\n\t}\n}\n"],"names":[],"mappings":";;AAQO,MAAM,kBAAkB;AAAA,EAC9B,YAA6B,aAA+D;AAA/D,SAAA,cAAA;AAAA,EAAA;AAAA,EAG7B,QAAQ,YAAqC;AACrC,WAAA,KAAK,YAAY,KAAK,CAAqB,sBAAA;AAC7C,UAAA,kBAAkB,cAAc,MAAM;AAClC,eAAA;AAAA,MAAA;AAEJ,UAAA,CAAC,kBAAkB,WAAW;AAC1B,eAAA;AAAA,MAAA;AAER,YAAM,YAAY,kBAAkB,UAAU,WAAW,IAAI;AAC7D,UAAI,CAAC,WAAW;AACR,eAAA;AAAA,MAAA;AAER,UAAI,cAAc,MAAM;AAChB,eAAA;AAAA,MAAA;AAER,YAAM,YAAY,WAAW;AAC7B,UAAI,cAAc,MAAM;AAChB,eAAA;AAAA,MAAA;AAED,aAAA,WAAW,UAAU,MAAM,CAAY,aAAA;AACvC,cAAA,qBAAqB,YAAY,SAAS,IAAI;AACpD,YAAI,CAAC,oBAAoB;AACjB,iBAAA;AAAA,QAAA;AAER,YAAI,uBAAuB,MAAM;AACzB,iBAAA;AAAA,QAAA;AAEF,cAAA,iBAAiB,kBAAkB,UAAU,KAAK,CAAA,OAAM,OAAO,uBAAuB,YAAY,GAAG,SAAS,kBAAkB;AACtI,YAAI,CAAC,gBAAgB;AACb,iBAAA;AAAA,QAAA;AAER,cAAM,eAAe,IAAI,IAAI,eAAe,MAAM;AAClD,eAAO,SAAS,OAAO,MAAM,QAAM,aAAa,IAAI,EAAE,CAAC;AAAA,MAAA,CACvD;AAAA,IAAA,CACD;AAAA,EAAA;AAEH;;"}

package/dist/development/src/model/authorization/MembershipMatcher.js

@@ -1,45 +0,0 @@
-class MembershipMatcher {
-  constructor(memberships) {
-    this.memberships = memberships;
-  }
-  matches(membership) {
-    return this.memberships.some((invokerMembership) => {
-      if (invokerMembership.matchRule === true) {
-        return true;
-      }
-      if (!invokerMembership.matchRule) {
-        return false;
-      }
-      const matchRule = invokerMembership.matchRule[membership.role];
-      if (!matchRule) {
-        return false;
-      }
-      if (matchRule === true) {
-        return true;
-      }
-      const variables = matchRule?.variables;
-      if (variables === true) {
-        return true;
-      }
-      return membership.variables.every((variable) => {
-        const sourceVariableRule = variables?.[variable.name];
-        if (!sourceVariableRule) {
-          return false;
-        }
-        if (sourceVariableRule === true) {
-          return true;
-        }
-        const sourceVariable = invokerMembership.variables.find((it) => typeof sourceVariableRule === "string" && it.name === sourceVariableRule);
-        if (!sourceVariable) {
-          return false;
-        }
-        const sourceValues = new Set(sourceVariable.values);
-        return variable.values.every((it) => sourceValues.has(it));
-      });
-    });
-  }
-}
-export {
-  MembershipMatcher
-};
-//# sourceMappingURL=MembershipMatcher.js.map

package/dist/development/src/model/authorization/MembershipMatcher.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"MembershipMatcher.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/MembershipMatcher.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\n\nexport type MembershipWithSubMembershipMatchRules =\n\t& Acl.Membership\n\t& {\n\t\tmatchRule: Acl.MembershipMatchRule\n\t}\n\nexport class MembershipMatcher {\n\tconstructor(private readonly memberships: readonly MembershipWithSubMembershipMatchRules[]) {\n\t}\n\n\tmatches(membership: Acl.Membership): boolean {\n\t\treturn this.memberships.some(invokerMembership => {\n\t\t\tif (invokerMembership.matchRule === true) {\n\t\t\t\treturn true\n\t\t\t}\n\t\t\tif (!invokerMembership.matchRule) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tconst matchRule = invokerMembership.matchRule[membership.role]\n\t\t\tif (!matchRule) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tif (matchRule === true) {\n\t\t\t\treturn true\n\t\t\t}\n\t\t\tconst variables = matchRule?.variables\n\t\t\tif (variables === true) {\n\t\t\t\treturn true\n\t\t\t}\n\t\t\treturn membership.variables.every(variable => {\n\t\t\t\tconst sourceVariableRule = variables?.[variable.name]\n\t\t\t\tif (!sourceVariableRule) {\n\t\t\t\t\treturn false\n\t\t\t\t}\n\t\t\t\tif (sourceVariableRule === true) {\n\t\t\t\t\treturn true\n\t\t\t\t}\n\t\t\t\tconst sourceVariable = invokerMembership.variables.find(it => typeof sourceVariableRule === 'string' && it.name === sourceVariableRule)\n\t\t\t\tif (!sourceVariable) {\n\t\t\t\t\treturn false\n\t\t\t\t}\n\t\t\t\tconst sourceValues = new Set(sourceVariable.values)\n\t\t\t\treturn variable.values.every(it => sourceValues.has(it))\n\t\t\t})\n\t\t})\n\t}\n}\n"],"names":[],"mappings":"AAQO,MAAM,kBAAkB;AAAA,EAC9B,YAA6B,aAA+D;AAA/D,SAAA,cAAA;AAAA,EAAA;AAAA,EAG7B,QAAQ,YAAqC;AACrC,WAAA,KAAK,YAAY,KAAK,CAAqB,sBAAA;AAC7C,UAAA,kBAAkB,cAAc,MAAM;AAClC,eAAA;AAAA,MAAA;AAEJ,UAAA,CAAC,kBAAkB,WAAW;AAC1B,eAAA;AAAA,MAAA;AAER,YAAM,YAAY,kBAAkB,UAAU,WAAW,IAAI;AAC7D,UAAI,CAAC,WAAW;AACR,eAAA;AAAA,MAAA;AAER,UAAI,cAAc,MAAM;AAChB,eAAA;AAAA,MAAA;AAER,YAAM,YAAY,WAAW;AAC7B,UAAI,cAAc,MAAM;AAChB,eAAA;AAAA,MAAA;AAED,aAAA,WAAW,UAAU,MAAM,CAAY,aAAA;AACvC,cAAA,qBAAqB,YAAY,SAAS,IAAI;AACpD,YAAI,CAAC,oBAAoB;AACjB,iBAAA;AAAA,QAAA;AAER,YAAI,uBAAuB,MAAM;AACzB,iBAAA;AAAA,QAAA;AAEF,cAAA,iBAAiB,kBAAkB,UAAU,KAAK,CAAA,OAAM,OAAO,uBAAuB,YAAY,GAAG,SAAS,kBAAkB;AACtI,YAAI,CAAC,gBAAgB;AACb,iBAAA;AAAA,QAAA;AAER,cAAM,eAAe,IAAI,IAAI,eAAe,MAAM;AAClD,eAAO,SAAS,OAAO,MAAM,QAAM,aAAa,IAAI,EAAE,CAAC;AAAA,MAAA,CACvD;AAAA,IAAA,CACD;AAAA,EAAA;AAEH;"}