@contember/engine-tenant-api 2.1.0-alpha.36 → 2.1.0-alpha.39

package/dist/production/src/model/authorization/Identity.cjs

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+class StaticIdentity {
+  constructor(id, roles, projectMemberships = {}) {
+    this.id = id;
+    this.roles = roles;
+    this.projectMemberships = projectMemberships;
+  }
+  getProjectMemberships(projectSlug) {
+    return Promise.resolve(this.projectMemberships[projectSlug] || {});
+  }
+}
+class ProjectAwareIdentity {
+  constructor(id, roles, dbContext, memberManager) {
+    this.id = id;
+    this.roles = roles;
+    this.dbContext = dbContext;
+    this.memberManager = memberManager;
+    __publicField(this, "projectMembershipCache", {});
+  }
+  async getProjectMemberships(projectSlug) {
+    var _a;
+    (_a = this.projectMembershipCache)[projectSlug] ?? (_a[projectSlug] = this.memberManager.getEffectiveProjectMemberships(this.dbContext, { slug: projectSlug }, this));
+    return await this.projectMembershipCache[projectSlug];
+  }
+}
+exports.ProjectAwareIdentity = ProjectAwareIdentity;
+exports.StaticIdentity = StaticIdentity;
+//# sourceMappingURL=Identity.cjs.map

package/dist/production/src/model/authorization/Identity.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Identity.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/Identity.ts"],"sourcesContent":["import { ProjectMemberManager } from '../service'\nimport { DatabaseContext } from '../utils'\nimport { Acl } from '@contember/schema'\n\nexport interface Identity {\n\treadonly id: string\n\treadonly roles: readonly string[]\n\n\tgetProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]>\n}\n\nexport class StaticIdentity implements Identity {\n\tconstructor(\n\t\tpublic readonly id: string,\n\t\tpublic readonly roles: string[],\n\t\tprivate projectMemberships: Record<string, readonly Acl.Membership[]> = {},\n\t) {}\n\n\tgetProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]> {\n\t\treturn Promise.resolve(this.projectMemberships[projectSlug] || {})\n\t}\n}\n\nexport class ProjectAwareIdentity implements Identity {\n\tprivate projectMembershipCache: Record<string, Promise<readonly Acl.Membership[]>> = {}\n\n\tconstructor(\n\t\tpublic readonly id: string,\n\t\tpublic readonly roles: readonly string[],\n\t\tprivate readonly dbContext: DatabaseContext,\n\t\tprivate readonly memberManager: ProjectMemberManager,\n\t) {}\n\n\tasync getProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]> {\n\t\tthis.projectMembershipCache[projectSlug] ??= this.memberManager.getEffectiveProjectMemberships(this.dbContext, { slug: projectSlug }, this)\n\t\treturn await this.projectMembershipCache[projectSlug]\n\t}\n}\n"],"names":[],"mappings":";;;;;AAWO,MAAM,eAAmC;AAAA,EAC/C,YACiB,IACA,OACR,qBAAgE,CAAA,GACvE;AAHe,SAAA,KAAA;AACA,SAAA,QAAA;AACR,SAAA,qBAAA;AAAA,EACN;AAAA,EAEH,sBAAsB,aAAyD;AAC9E,WAAO,QAAQ,QAAQ,KAAK,mBAAmB,WAAW,KAAK,EAAE;AAAA,EAClE;AACD;AAEO,MAAM,qBAAyC;AAAA,EAGrD,YACiB,IACA,OACC,WACA,eAChB;AAJe,SAAA,KAAA;AACA,SAAA,QAAA;AACC,SAAA,YAAA;AACA,SAAA,gBAAA;AANlB,kBAAA,MAAQ,0BAA6E,EAAC;AAAA,EAOnF;AAAA,EAEH,MAAM,sBAAsB,aAAyD;AAjCtF,QAAA;AAkCE,KAAA,KAAA,KAAK,wBAAL,WAAA,MAAA,GAAA,WAAA,IAA6C,KAAK,cAAc,+BAA+B,KAAK,WAAW,EAAE,MAAM,YAAA,GAAe,IAAI;AAC1I,WAAO,MAAM,KAAK,uBAAuB,WAAW;AAAA,EACrD;AACD;;;"}

package/dist/production/src/model/authorization/Identity.js

@@ -0,0 +1,32 @@
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+class StaticIdentity {
+  constructor(id, roles, projectMemberships = {}) {
+    this.id = id;
+    this.roles = roles;
+    this.projectMemberships = projectMemberships;
+  }
+  getProjectMemberships(projectSlug) {
+    return Promise.resolve(this.projectMemberships[projectSlug] || {});
+  }
+}
+class ProjectAwareIdentity {
+  constructor(id, roles, dbContext, memberManager) {
+    this.id = id;
+    this.roles = roles;
+    this.dbContext = dbContext;
+    this.memberManager = memberManager;
+    __publicField(this, "projectMembershipCache", {});
+  }
+  async getProjectMemberships(projectSlug) {
+    var _a;
+    (_a = this.projectMembershipCache)[projectSlug] ?? (_a[projectSlug] = this.memberManager.getEffectiveProjectMemberships(this.dbContext, { slug: projectSlug }, this));
+    return await this.projectMembershipCache[projectSlug];
+  }
+}
+export {
+  ProjectAwareIdentity,
+  StaticIdentity
+};
+//# sourceMappingURL=Identity.js.map

package/dist/production/src/model/authorization/Identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Identity.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/Identity.ts"],"sourcesContent":["import { ProjectMemberManager } from '../service'\nimport { DatabaseContext } from '../utils'\nimport { Acl } from '@contember/schema'\n\nexport interface Identity {\n\treadonly id: string\n\treadonly roles: readonly string[]\n\n\tgetProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]>\n}\n\nexport class StaticIdentity implements Identity {\n\tconstructor(\n\t\tpublic readonly id: string,\n\t\tpublic readonly roles: string[],\n\t\tprivate projectMemberships: Record<string, readonly Acl.Membership[]> = {},\n\t) {}\n\n\tgetProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]> {\n\t\treturn Promise.resolve(this.projectMemberships[projectSlug] || {})\n\t}\n}\n\nexport class ProjectAwareIdentity implements Identity {\n\tprivate projectMembershipCache: Record<string, Promise<readonly Acl.Membership[]>> = {}\n\n\tconstructor(\n\t\tpublic readonly id: string,\n\t\tpublic readonly roles: readonly string[],\n\t\tprivate readonly dbContext: DatabaseContext,\n\t\tprivate readonly memberManager: ProjectMemberManager,\n\t) {}\n\n\tasync getProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]> {\n\t\tthis.projectMembershipCache[projectSlug] ??= this.memberManager.getEffectiveProjectMemberships(this.dbContext, { slug: projectSlug }, this)\n\t\treturn await this.projectMembershipCache[projectSlug]\n\t}\n}\n"],"names":[],"mappings":";;;AAWO,MAAM,eAAmC;AAAA,EAC/C,YACiB,IACA,OACR,qBAAgE,CAAA,GACvE;AAHe,SAAA,KAAA;AACA,SAAA,QAAA;AACR,SAAA,qBAAA;AAAA,EACN;AAAA,EAEH,sBAAsB,aAAyD;AAC9E,WAAO,QAAQ,QAAQ,KAAK,mBAAmB,WAAW,KAAK,EAAE;AAAA,EAClE;AACD;AAEO,MAAM,qBAAyC;AAAA,EAGrD,YACiB,IACA,OACC,WACA,eAChB;AAJe,SAAA,KAAA;AACA,SAAA,QAAA;AACC,SAAA,YAAA;AACA,SAAA,gBAAA;AANlB,kBAAA,MAAQ,0BAA6E,EAAC;AAAA,EAOnF;AAAA,EAEH,MAAM,sBAAsB,aAAyD;AAjCtF,QAAA;AAkCE,KAAA,KAAA,KAAK,wBAAL,WAAA,MAAA,GAAA,WAAA,IAA6C,KAAK,cAAc,+BAA+B,KAAK,WAAW,EAAE,MAAM,YAAA,GAAe,IAAI;AAC1I,WAAO,MAAM,KAAK,uBAAuB,WAAW;AAAA,EACrD;AACD;"}

package/dist/production/src/model/authorization/IdentityFactory.cjs

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Identity = require("./Identity.cjs");
+class IdentityFactory {
+  constructor(projectMemberManager) {
+    this.projectMemberManager = projectMemberManager;
+  }
+  create(dbContext, args) {
+    return new Identity.ProjectAwareIdentity(args.id, args.roles, dbContext, this.projectMemberManager);
+  }
+}
+exports.IdentityFactory = IdentityFactory;
+//# sourceMappingURL=IdentityFactory.cjs.map

package/dist/production/src/model/authorization/IdentityFactory.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdentityFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/IdentityFactory.ts"],"sourcesContent":["import { ProjectMemberManager } from '../service'\nimport { Identity, ProjectAwareIdentity } from './Identity'\nimport { DatabaseContext } from '../utils'\n\nexport class IdentityFactory {\n\tconstructor(private readonly projectMemberManager: ProjectMemberManager) {}\n\n\tpublic create(dbContext: DatabaseContext, args: { id: string; roles: readonly string[] }): Identity {\n\t\treturn new ProjectAwareIdentity(args.id, args.roles, dbContext, this.projectMemberManager)\n\t}\n}\n"],"names":["ProjectAwareIdentity"],"mappings":";;;AAIO,MAAM,gBAAgB;AAAA,EAC5B,YAA6B,sBAA4C;AAA5C,SAAA,uBAAA;AAAA,EAA6C;AAAA,EAEnE,OAAO,WAA4B,MAA0D;AACnG,WAAO,IAAIA,SAAAA,qBAAqB,KAAK,IAAI,KAAK,OAAO,WAAW,KAAK,oBAAoB;AAAA,EAC1F;AACD;;"}

package/dist/production/src/model/authorization/IdentityFactory.js

@@ -0,0 +1,13 @@
+import { ProjectAwareIdentity } from "./Identity.js";
+class IdentityFactory {
+  constructor(projectMemberManager) {
+    this.projectMemberManager = projectMemberManager;
+  }
+  create(dbContext, args) {
+    return new ProjectAwareIdentity(args.id, args.roles, dbContext, this.projectMemberManager);
+  }
+}
+export {
+  IdentityFactory
+};
+//# sourceMappingURL=IdentityFactory.js.map

package/dist/production/src/model/authorization/IdentityFactory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdentityFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/IdentityFactory.ts"],"sourcesContent":["import { ProjectMemberManager } from '../service'\nimport { Identity, ProjectAwareIdentity } from './Identity'\nimport { DatabaseContext } from '../utils'\n\nexport class IdentityFactory {\n\tconstructor(private readonly projectMemberManager: ProjectMemberManager) {}\n\n\tpublic create(dbContext: DatabaseContext, args: { id: string; roles: readonly string[] }): Identity {\n\t\treturn new ProjectAwareIdentity(args.id, args.roles, dbContext, this.projectMemberManager)\n\t}\n}\n"],"names":[],"mappings":";AAIO,MAAM,gBAAgB;AAAA,EAC5B,YAA6B,sBAA4C;AAA5C,SAAA,uBAAA;AAAA,EAA6C;AAAA,EAEnE,OAAO,WAA4B,MAA0D;AACnG,WAAO,IAAI,qBAAqB,KAAK,IAAI,KAAK,OAAO,WAAW,KAAK,oBAAoB;AAAA,EAC1F;AACD;"}

package/dist/production/src/model/authorization/IdentityScope.cjs

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const authorization = require("@contember/authorization");
+const Roles = require("./Roles.cjs");
+class IdentityScope {
+  constructor(identityId) {
+    this.identityId = identityId;
+  }
+  async getIdentityAccess(identity) {
+    return new authorization.AccessNode.Roles(identity.id === this.identityId ? [Roles.TenantRole.SELF] : []);
+  }
+}
+exports.IdentityScope = IdentityScope;
+//# sourceMappingURL=IdentityScope.cjs.map

package/dist/production/src/model/authorization/IdentityScope.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdentityScope.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/IdentityScope.ts"],"sourcesContent":["import { AccessNode, AuthorizationScope } from '@contember/authorization'\nimport { TenantRole } from './Roles'\nimport { Identity } from './Identity'\n\nclass IdentityScope implements AuthorizationScope<Identity> {\n\tconstructor(private readonly identityId: string) {}\n\n\tasync getIdentityAccess(identity: Identity): Promise<AccessNode> {\n\t\treturn new AccessNode.Roles(identity.id === this.identityId ? [TenantRole.SELF] : [])\n\t}\n}\n\nexport { IdentityScope }\n"],"names":["AccessNode","TenantRole"],"mappings":";;;;AAIA,MAAM,cAAsD;AAAA,EAC3D,YAA6B,YAAoB;AAApB,SAAA,aAAA;AAAA,EAAqB;AAAA,EAElD,MAAM,kBAAkB,UAAyC;AAChE,WAAO,IAAIA,cAAAA,WAAW,MAAM,SAAS,OAAO,KAAK,aAAa,CAACC,MAAAA,WAAW,IAAI,IAAI,CAAA,CAAE;AAAA,EACrF;AACD;;"}

package/dist/production/src/model/authorization/IdentityScope.js

@@ -0,0 +1,14 @@
+import { AccessNode } from "@contember/authorization";
+import { TenantRole } from "./Roles.js";
+class IdentityScope {
+  constructor(identityId) {
+    this.identityId = identityId;
+  }
+  async getIdentityAccess(identity) {
+    return new AccessNode.Roles(identity.id === this.identityId ? [TenantRole.SELF] : []);
+  }
+}
+export {
+  IdentityScope
+};
+//# sourceMappingURL=IdentityScope.js.map

package/dist/production/src/model/authorization/IdentityScope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdentityScope.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/IdentityScope.ts"],"sourcesContent":["import { AccessNode, AuthorizationScope } from '@contember/authorization'\nimport { TenantRole } from './Roles'\nimport { Identity } from './Identity'\n\nclass IdentityScope implements AuthorizationScope<Identity> {\n\tconstructor(private readonly identityId: string) {}\n\n\tasync getIdentityAccess(identity: Identity): Promise<AccessNode> {\n\t\treturn new AccessNode.Roles(identity.id === this.identityId ? [TenantRole.SELF] : [])\n\t}\n}\n\nexport { IdentityScope }\n"],"names":[],"mappings":";;AAIA,MAAM,cAAsD;AAAA,EAC3D,YAA6B,YAAoB;AAApB,SAAA,aAAA;AAAA,EAAqB;AAAA,EAElD,MAAM,kBAAkB,UAAyC;AAChE,WAAO,IAAI,WAAW,MAAM,SAAS,OAAO,KAAK,aAAa,CAAC,WAAW,IAAI,IAAI,CAAA,CAAE;AAAA,EACrF;AACD;"}

package/dist/production/src/model/authorization/MembershipMatcher.cjs

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+class MembershipMatcher {
+  constructor(memberships) {
+    this.memberships = memberships;
+  }
+  matches(membership) {
+    return this.memberships.some((invokerMembership) => {
+      if (invokerMembership.matchRule === true) {
+        return true;
+      }
+      if (!invokerMembership.matchRule) {
+        return false;
+      }
+      const matchRule = invokerMembership.matchRule[membership.role];
+      if (!matchRule) {
+        return false;
+      }
+      if (matchRule === true) {
+        return true;
+      }
+      const variables = matchRule?.variables;
+      if (variables === true) {
+        return true;
+      }
+      return membership.variables.every((variable) => {
+        const sourceVariableRule = variables?.[variable.name];
+        if (!sourceVariableRule) {
+          return false;
+        }
+        if (sourceVariableRule === true) {
+          return true;
+        }
+        const sourceVariable = invokerMembership.variables.find((it) => typeof sourceVariableRule === "string" && it.name === sourceVariableRule);
+        if (!sourceVariable) {
+          return false;
+        }
+        const sourceValues = new Set(sourceVariable.values);
+        return variable.values.every((it) => sourceValues.has(it));
+      });
+    });
+  }
+}
+exports.MembershipMatcher = MembershipMatcher;
+//# sourceMappingURL=MembershipMatcher.cjs.map

package/dist/production/src/model/authorization/MembershipMatcher.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"MembershipMatcher.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/MembershipMatcher.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\n\nexport type MembershipWithSubMembershipMatchRules =\n\t& Acl.Membership\n\t& {\n\t\tmatchRule: Acl.MembershipMatchRule\n\t}\n\nexport class MembershipMatcher {\n\tconstructor(private readonly memberships: readonly MembershipWithSubMembershipMatchRules[]) {\n\t}\n\n\tmatches(membership: Acl.Membership): boolean {\n\t\treturn this.memberships.some(invokerMembership => {\n\t\t\tif (invokerMembership.matchRule === true) {\n\t\t\t\treturn true\n\t\t\t}\n\t\t\tif (!invokerMembership.matchRule) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tconst matchRule = invokerMembership.matchRule[membership.role]\n\t\t\tif (!matchRule) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tif (matchRule === true) {\n\t\t\t\treturn true\n\t\t\t}\n\t\t\tconst variables = matchRule?.variables\n\t\t\tif (variables === true) {\n\t\t\t\treturn true\n\t\t\t}\n\t\t\treturn membership.variables.every(variable => {\n\t\t\t\tconst sourceVariableRule = variables?.[variable.name]\n\t\t\t\tif (!sourceVariableRule) {\n\t\t\t\t\treturn false\n\t\t\t\t}\n\t\t\t\tif (sourceVariableRule === true) {\n\t\t\t\t\treturn true\n\t\t\t\t}\n\t\t\t\tconst sourceVariable = invokerMembership.variables.find(it => typeof sourceVariableRule === 'string' && it.name === sourceVariableRule)\n\t\t\t\tif (!sourceVariable) {\n\t\t\t\t\treturn false\n\t\t\t\t}\n\t\t\t\tconst sourceValues = new Set(sourceVariable.values)\n\t\t\t\treturn variable.values.every(it => sourceValues.has(it))\n\t\t\t})\n\t\t})\n\t}\n}\n"],"names":[],"mappings":";;AAQO,MAAM,kBAAkB;AAAA,EAC9B,YAA6B,aAA+D;AAA/D,SAAA,cAAA;AAAA,EAC7B;AAAA,EAEA,QAAQ,YAAqC;AAC5C,WAAO,KAAK,YAAY,KAAK,CAAA,sBAAqB;AACjD,UAAI,kBAAkB,cAAc,MAAM;AACzC,eAAO;AAAA,MACR;AACA,UAAI,CAAC,kBAAkB,WAAW;AACjC,eAAO;AAAA,MACR;AACA,YAAM,YAAY,kBAAkB,UAAU,WAAW,IAAI;AAC7D,UAAI,CAAC,WAAW;AACf,eAAO;AAAA,MACR;AACA,UAAI,cAAc,MAAM;AACvB,eAAO;AAAA,MACR;AACA,YAAM,YAAY,WAAW;AAC7B,UAAI,cAAc,MAAM;AACvB,eAAO;AAAA,MACR;AACA,aAAO,WAAW,UAAU,MAAM,CAAA,aAAY;AAC7C,cAAM,qBAAqB,YAAY,SAAS,IAAI;AACpD,YAAI,CAAC,oBAAoB;AACxB,iBAAO;AAAA,QACR;AACA,YAAI,uBAAuB,MAAM;AAChC,iBAAO;AAAA,QACR;AACA,cAAM,iBAAiB,kBAAkB,UAAU,KAAK,CAAA,OAAM,OAAO,uBAAuB,YAAY,GAAG,SAAS,kBAAkB;AACtI,YAAI,CAAC,gBAAgB;AACpB,iBAAO;AAAA,QACR;AACA,cAAM,eAAe,IAAI,IAAI,eAAe,MAAM;AAClD,eAAO,SAAS,OAAO,MAAM,QAAM,aAAa,IAAI,EAAE,CAAC;AAAA,MACxD,CAAC;AAAA,IACF,CAAC;AAAA,EACF;AACD;;"}

package/dist/production/src/model/authorization/MembershipMatcher.js

@@ -0,0 +1,45 @@
+class MembershipMatcher {
+  constructor(memberships) {
+    this.memberships = memberships;
+  }
+  matches(membership) {
+    return this.memberships.some((invokerMembership) => {
+      if (invokerMembership.matchRule === true) {
+        return true;
+      }
+      if (!invokerMembership.matchRule) {
+        return false;
+      }
+      const matchRule = invokerMembership.matchRule[membership.role];
+      if (!matchRule) {
+        return false;
+      }
+      if (matchRule === true) {
+        return true;
+      }
+      const variables = matchRule?.variables;
+      if (variables === true) {
+        return true;
+      }
+      return membership.variables.every((variable) => {
+        const sourceVariableRule = variables?.[variable.name];
+        if (!sourceVariableRule) {
+          return false;
+        }
+        if (sourceVariableRule === true) {
+          return true;
+        }
+        const sourceVariable = invokerMembership.variables.find((it) => typeof sourceVariableRule === "string" && it.name === sourceVariableRule);
+        if (!sourceVariable) {
+          return false;
+        }
+        const sourceValues = new Set(sourceVariable.values);
+        return variable.values.every((it) => sourceValues.has(it));
+      });
+    });
+  }
+}
+export {
+  MembershipMatcher
+};
+//# sourceMappingURL=MembershipMatcher.js.map

package/dist/production/src/model/authorization/MembershipMatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MembershipMatcher.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/MembershipMatcher.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\n\nexport type MembershipWithSubMembershipMatchRules =\n\t& Acl.Membership\n\t& {\n\t\tmatchRule: Acl.MembershipMatchRule\n\t}\n\nexport class MembershipMatcher {\n\tconstructor(private readonly memberships: readonly MembershipWithSubMembershipMatchRules[]) {\n\t}\n\n\tmatches(membership: Acl.Membership): boolean {\n\t\treturn this.memberships.some(invokerMembership => {\n\t\t\tif (invokerMembership.matchRule === true) {\n\t\t\t\treturn true\n\t\t\t}\n\t\t\tif (!invokerMembership.matchRule) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tconst matchRule = invokerMembership.matchRule[membership.role]\n\t\t\tif (!matchRule) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tif (matchRule === true) {\n\t\t\t\treturn true\n\t\t\t}\n\t\t\tconst variables = matchRule?.variables\n\t\t\tif (variables === true) {\n\t\t\t\treturn true\n\t\t\t}\n\t\t\treturn membership.variables.every(variable => {\n\t\t\t\tconst sourceVariableRule = variables?.[variable.name]\n\t\t\t\tif (!sourceVariableRule) {\n\t\t\t\t\treturn false\n\t\t\t\t}\n\t\t\t\tif (sourceVariableRule === true) {\n\t\t\t\t\treturn true\n\t\t\t\t}\n\t\t\t\tconst sourceVariable = invokerMembership.variables.find(it => typeof sourceVariableRule === 'string' && it.name === sourceVariableRule)\n\t\t\t\tif (!sourceVariable) {\n\t\t\t\t\treturn false\n\t\t\t\t}\n\t\t\t\tconst sourceValues = new Set(sourceVariable.values)\n\t\t\t\treturn variable.values.every(it => sourceValues.has(it))\n\t\t\t})\n\t\t})\n\t}\n}\n"],"names":[],"mappings":"AAQO,MAAM,kBAAkB;AAAA,EAC9B,YAA6B,aAA+D;AAA/D,SAAA,cAAA;AAAA,EAC7B;AAAA,EAEA,QAAQ,YAAqC;AAC5C,WAAO,KAAK,YAAY,KAAK,CAAA,sBAAqB;AACjD,UAAI,kBAAkB,cAAc,MAAM;AACzC,eAAO;AAAA,MACR;AACA,UAAI,CAAC,kBAAkB,WAAW;AACjC,eAAO;AAAA,MACR;AACA,YAAM,YAAY,kBAAkB,UAAU,WAAW,IAAI;AAC7D,UAAI,CAAC,WAAW;AACf,eAAO;AAAA,MACR;AACA,UAAI,cAAc,MAAM;AACvB,eAAO;AAAA,MACR;AACA,YAAM,YAAY,WAAW;AAC7B,UAAI,cAAc,MAAM;AACvB,eAAO;AAAA,MACR;AACA,aAAO,WAAW,UAAU,MAAM,CAAA,aAAY;AAC7C,cAAM,qBAAqB,YAAY,SAAS,IAAI;AACpD,YAAI,CAAC,oBAAoB;AACxB,iBAAO;AAAA,QACR;AACA,YAAI,uBAAuB,MAAM;AAChC,iBAAO;AAAA,QACR;AACA,cAAM,iBAAiB,kBAAkB,UAAU,KAAK,CAAA,OAAM,OAAO,uBAAuB,YAAY,GAAG,SAAS,kBAAkB;AACtI,YAAI,CAAC,gBAAgB;AACpB,iBAAO;AAAA,QACR;AACA,cAAM,eAAe,IAAI,IAAI,eAAe,MAAM;AAClD,eAAO,SAAS,OAAO,MAAM,QAAM,aAAa,IAAI,EAAE,CAAC;AAAA,MACxD,CAAC;AAAA,IACF,CAAC;AAAA,EACF;AACD;"}

package/dist/production/src/model/authorization/PermissionActions.cjs

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const authorization = require("@contember/authorization");
+exports.PermissionActions = void 0;
+((PermissionActions2) => {
+  ((Resources2) => {
+    Resources2["system"] = "system";
+    Resources2["entrypoint"] = "entrypoint";
+    Resources2["person"] = "person";
+    Resources2["identity"] = "identity";
+    Resources2["project"] = "project";
+    Resources2["apiKey"] = "apiKey";
+    Resources2["mailTemplate"] = "mailTemplate";
+    Resources2["idp"] = "idp";
+  })(PermissionActions2.Resources || (PermissionActions2.Resources = {}));
+  PermissionActions2.CONFIGURE = authorization.Authorizator.createAction("system", "configure");
+  PermissionActions2.CONFIG_VIEW = authorization.Authorizator.createAction("system", "viewConfig");
+  PermissionActions2.IDENTITY_VIEW_PERMISSIONS = authorization.Authorizator.createAction("identity", "viewPermissions");
+  PermissionActions2.IDENTITY_ADD_GLOBAL_ROLES = (roles) => authorization.Authorizator.createAction("identity", "addGlobalRoles", { roles });
+  PermissionActions2.IDENTITY_REMOVE_GLOBAL_ROLES = (roles) => authorization.Authorizator.createAction("identity", "removeGlobalRoles", { roles });
+  PermissionActions2.PERSON_DISABLE = (roles) => authorization.Authorizator.createAction("person", "disable", { roles });
+  PermissionActions2.PERSON_VIEW = authorization.Authorizator.createAction("person", "view");
+  PermissionActions2.PERSON_SIGN_IN = authorization.Authorizator.createAction("person", "signIn");
+  PermissionActions2.PERSON_SIGN_UP = (roles) => authorization.Authorizator.createAction("person", "signUp", { roles });
+  PermissionActions2.PERSON_SIGN_OUT = authorization.Authorizator.createAction("person", "signOut");
+  PermissionActions2.PERSON_SETUP_OTP = authorization.Authorizator.createAction("person", "setupOtp");
+  PermissionActions2.PERSON_CHANGE_PROFILE = (roles) => authorization.Authorizator.createAction("person", "changeProfile", { roles });
+  PermissionActions2.PERSON_CHANGE_MY_PROFILE = authorization.Authorizator.createAction("person", "changeMyProfile");
+  PermissionActions2.PERSON_TOGGLE_PASSWORDLESS = authorization.Authorizator.createAction("person", "togglePasswordless");
+  PermissionActions2.PERSON_CHANGE_PASSWORD = (roles) => authorization.Authorizator.createAction("person", "changePassword", { roles });
+  PermissionActions2.PERSON_CHANGE_MY_PASSWORD = authorization.Authorizator.createAction("person", "changeMyPassword");
+  PermissionActions2.PERSON_RESET_PASSWORD = authorization.Authorizator.createAction("person", "resetPassword");
+  PermissionActions2.PERSON_CREATE_IDP_URL = authorization.Authorizator.createAction("person", "createIdPUrl");
+  PermissionActions2.PERSON_SIGN_IN_IDP = authorization.Authorizator.createAction("person", "signInIdp");
+  PermissionActions2.PERSON_REQUEST_PASSWORDLESS_SIGN_IN = authorization.Authorizator.createAction("person", "requestPasswordlessSignIn");
+  PermissionActions2.PERSON_PASSWORDLESS_SIGN_IN = authorization.Authorizator.createAction("person", "passwordlessSignIn");
+  PermissionActions2.PERSON_CREATE_SESSION_KEY = (roles) => authorization.Authorizator.createAction("person", "createSessionToken", { roles });
+  PermissionActions2.PERSON_INVITE = (memberships) => authorization.Authorizator.createAction("person", "invite", { memberships });
+  PermissionActions2.PERSON_INVITE_UNMANAGED = (memberships) => authorization.Authorizator.createAction("person", "invite_unmanaged", { memberships });
+  PermissionActions2.PROJECT_VIEW = authorization.Authorizator.createAction("project", "view");
+  PermissionActions2.PROJECT_SET_SECRET = authorization.Authorizator.createAction("project", "setSecret");
+  PermissionActions2.PROJECT_UPDATE = authorization.Authorizator.createAction("project", "update");
+  PermissionActions2.PROJECT_CREATE = authorization.Authorizator.createAction("project", "create");
+  PermissionActions2.ENTRYPOINT_DEPLOY = authorization.Authorizator.createAction("entrypoint", "deployEntrypoint");
+  PermissionActions2.PROJECT_VIEW_MEMBER = (memberships) => authorization.Authorizator.createAction("project", "viewMembers", { memberships });
+  PermissionActions2.PROJECT_ADD_MEMBER = (memberships) => authorization.Authorizator.createAction("project", "addMember", { memberships });
+  PermissionActions2.PROJECT_REMOVE_MEMBER = (memberships) => authorization.Authorizator.createAction("project", "removeMember", { memberships });
+  PermissionActions2.PROJECT_UPDATE_MEMBER = (memberships) => authorization.Authorizator.createAction("project", "updateMember", { memberships });
+  PermissionActions2.API_KEY_CREATE = authorization.Authorizator.createAction("apiKey", "create");
+  PermissionActions2.API_KEY_CREATE_GLOBAL = (roles) => authorization.Authorizator.createAction("apiKey", "createGlobal", { roles });
+  PermissionActions2.API_KEY_DISABLE = authorization.Authorizator.createAction("apiKey", "disable");
+  PermissionActions2.MAIL_TEMPLATE_ADD = authorization.Authorizator.createAction("mailTemplate", "add");
+  PermissionActions2.MAIL_TEMPLATE_REMOVE = authorization.Authorizator.createAction("mailTemplate", "remove");
+  PermissionActions2.MAIL_TEMPLATE_LIST = authorization.Authorizator.createAction("mailTemplate", "list");
+  PermissionActions2.IDP_ADD = authorization.Authorizator.createAction("idp", "add");
+  PermissionActions2.IDP_UPDATE = authorization.Authorizator.createAction("idp", "update");
+  PermissionActions2.IDP_DISABLE = authorization.Authorizator.createAction("idp", "disable");
+  PermissionActions2.IDP_ENABLE = authorization.Authorizator.createAction("idp", "enable");
+  PermissionActions2.IDP_LIST = authorization.Authorizator.createAction("idp", "list");
+})(exports.PermissionActions || (exports.PermissionActions = {}));
+//# sourceMappingURL=PermissionActions.cjs.map

package/dist/production/src/model/authorization/PermissionActions.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionActions.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionActions.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { Acl } from '@contember/schema'\n\nnamespace PermissionActions {\n\texport enum Resources {\n\t\tsystem = 'system',\n\t\tentrypoint = 'entrypoint',\n\t\tperson = 'person',\n\t\tidentity = 'identity',\n\t\tproject = 'project',\n\t\tapiKey = 'apiKey',\n\t\tmailTemplate = 'mailTemplate',\n\t\tidp = 'idp',\n\t}\n\n\texport const CONFIGURE = Authorizator.createAction(Resources.system, 'configure')\n\texport const CONFIG_VIEW = Authorizator.createAction(Resources.system, 'viewConfig')\n\n\texport const IDENTITY_VIEW_PERMISSIONS = Authorizator.createAction(Resources.identity, 'viewPermissions')\n\texport const IDENTITY_ADD_GLOBAL_ROLES = (roles?: readonly string[]) => Authorizator.createAction(Resources.identity, 'addGlobalRoles', { roles })\n\texport const IDENTITY_REMOVE_GLOBAL_ROLES = (roles?: readonly string[]) =>\n\t\tAuthorizator.createAction(Resources.identity, 'removeGlobalRoles', { roles })\n\n\texport const PERSON_DISABLE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'disable', { roles })\n\n\texport const PERSON_VIEW = Authorizator.createAction(Resources.person, 'view')\n\texport const PERSON_SIGN_IN = Authorizator.createAction(Resources.person, 'signIn')\n\texport const PERSON_SIGN_UP = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'signUp', { roles })\n\texport const PERSON_SIGN_OUT = Authorizator.createAction(Resources.person, 'signOut')\n\texport const PERSON_SETUP_OTP = Authorizator.createAction(Resources.person, 'setupOtp')\n\texport const PERSON_CHANGE_PROFILE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'changeProfile', { roles })\n\texport const PERSON_CHANGE_MY_PROFILE = Authorizator.createAction(Resources.person, 'changeMyProfile')\n\texport const PERSON_TOGGLE_PASSWORDLESS = Authorizator.createAction(Resources.person, 'togglePasswordless')\n\texport const PERSON_CHANGE_PASSWORD = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'changePassword', { roles })\n\texport const PERSON_CHANGE_MY_PASSWORD = Authorizator.createAction(Resources.person, 'changeMyPassword')\n\texport const PERSON_RESET_PASSWORD = Authorizator.createAction(Resources.person, 'resetPassword')\n\texport const PERSON_CREATE_IDP_URL = Authorizator.createAction(Resources.person, 'createIdPUrl')\n\texport const PERSON_SIGN_IN_IDP = Authorizator.createAction(Resources.person, 'signInIdp')\n\texport const PERSON_REQUEST_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'requestPasswordlessSignIn')\n\texport const PERSON_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'passwordlessSignIn')\n\texport const PERSON_CREATE_SESSION_KEY = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'createSessionToken', { roles })\n\n\texport const PERSON_INVITE = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.person, 'invite', { memberships })\n\texport const PERSON_INVITE_UNMANAGED = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.person, 'invite_unmanaged', { memberships })\n\n\texport const PROJECT_VIEW = Authorizator.createAction(Resources.project, 'view')\n\texport const PROJECT_SET_SECRET = Authorizator.createAction(Resources.project, 'setSecret')\n\texport const PROJECT_UPDATE = Authorizator.createAction(Resources.project, 'update')\n\n\texport const PROJECT_CREATE = Authorizator.createAction(Resources.project, 'create')\n\texport const ENTRYPOINT_DEPLOY = Authorizator.createAction(Resources.entrypoint, 'deployEntrypoint')\n\n\texport const PROJECT_VIEW_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'viewMembers', { memberships })\n\texport const PROJECT_ADD_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'addMember', { memberships })\n\texport const PROJECT_REMOVE_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'removeMember', { memberships })\n\texport const PROJECT_UPDATE_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'updateMember', { memberships })\n\n\texport const API_KEY_CREATE = Authorizator.createAction(Resources.apiKey, 'create')\n\texport const API_KEY_CREATE_GLOBAL = (roles?: readonly string[]) => Authorizator.createAction(Resources.apiKey, 'createGlobal', { roles })\n\texport const API_KEY_DISABLE = Authorizator.createAction(Resources.apiKey, 'disable')\n\n\texport const MAIL_TEMPLATE_ADD = Authorizator.createAction(Resources.mailTemplate, 'add')\n\texport const MAIL_TEMPLATE_REMOVE = Authorizator.createAction(Resources.mailTemplate, 'remove')\n\texport const MAIL_TEMPLATE_LIST = Authorizator.createAction(Resources.mailTemplate, 'list')\n\n\texport const IDP_ADD = Authorizator.createAction(Resources.idp, 'add')\n\texport const IDP_UPDATE = Authorizator.createAction(Resources.idp, 'update')\n\texport const IDP_DISABLE = Authorizator.createAction(Resources.idp, 'disable')\n\texport const IDP_ENABLE = Authorizator.createAction(Resources.idp, 'enable')\n\texport const IDP_LIST = Authorizator.createAction(Resources.idp, 'list')\n}\n\nexport { PermissionActions }\n"],"names":["PermissionActions","Resources","Authorizator"],"mappings":";;;AAGUA,QAAAA,oBAAAA;AAAAA,CAAV,CAAUA,uBAAV;AACQ,GAAA,CAAKC,eAAL;AACNA,eAAA,QAAA,IAAS;AACTA,eAAA,YAAA,IAAa;AACbA,eAAA,QAAA,IAAS;AACTA,eAAA,UAAA,IAAW;AACXA,eAAA,SAAA,IAAU;AACVA,eAAA,QAAA,IAAS;AACTA,eAAA,cAAA,IAAe;AACfA,eAAA,KAAA,IAAM;AAAA,EAAA,GARKD,mBAAA,cAAAA,mBAAA,YAAA,CAAA,EAAA;AAWCA,qBAAA,YAAYE,cAAAA,aAAa,aAAa,UAAkB,WAAW;AACnEF,qBAAA,cAAcE,cAAAA,aAAa,aAAa,UAAkB,YAAY;AAEtEF,qBAAA,4BAA4BE,cAAAA,aAAa,aAAa,YAAoB,iBAAiB;AAC3FF,qBAAA,4BAA4B,CAAC,UAA8BE,cAAAA,aAAa,aAAa,YAAoB,kBAAkB,EAAE,OAAO;AACpIF,qBAAA,+BAA+B,CAAC,UAC5CE,cAAAA,aAAa,aAAa,YAAoB,qBAAqB,EAAE,OAAO;AAEhEF,qBAAA,iBAAiB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,WAAW,EAAE,OAAO;AAEhHF,qBAAA,cAAcE,cAAAA,aAAa,aAAa,UAAkB,MAAM;AAChEF,qBAAA,iBAAiBE,cAAAA,aAAa,aAAa,UAAkB,QAAQ;AACrEF,qBAAA,iBAAiB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,UAAU,EAAE,OAAO;AAC/GF,qBAAA,kBAAkBE,cAAAA,aAAa,aAAa,UAAkB,SAAS;AACvEF,qBAAA,mBAAmBE,cAAAA,aAAa,aAAa,UAAkB,UAAU;AACzEF,qBAAA,wBAAwB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,iBAAiB,EAAE,OAAO;AAC7HF,qBAAA,2BAA2BE,cAAAA,aAAa,aAAa,UAAkB,iBAAiB;AACxFF,qBAAA,6BAA6BE,cAAAA,aAAa,aAAa,UAAkB,oBAAoB;AAC7FF,qBAAA,yBAAyB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,kBAAkB,EAAE,OAAO;AAC/HF,qBAAA,4BAA4BE,cAAAA,aAAa,aAAa,UAAkB,kBAAkB;AAC1FF,qBAAA,wBAAwBE,cAAAA,aAAa,aAAa,UAAkB,eAAe;AACnFF,qBAAA,wBAAwBE,cAAAA,aAAa,aAAa,UAAkB,cAAc;AAClFF,qBAAA,qBAAqBE,cAAAA,aAAa,aAAa,UAAkB,WAAW;AAC5EF,qBAAA,sCAAsCE,cAAAA,aAAa,aAAa,UAAkB,2BAA2B;AAC7GF,qBAAA,8BAA8BE,cAAAA,aAAa,aAAa,UAAkB,oBAAoB;AAC9FF,qBAAA,4BAA4B,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,sBAAsB,EAAE,OAAO;AAEtIF,qBAAA,gBAAgB,CAAC,gBAA2CE,cAAAA,aAAa,aAAa,UAAkB,UAAU,EAAE,aAAa;AACjIF,qBAAA,0BAA0B,CAAC,gBACvCE,cAAAA,aAAa,aAAa,UAAkB,oBAAoB,EAAE,aAAa;AAEnEF,qBAAA,eAAeE,cAAAA,aAAa,aAAa,WAAmB,MAAM;AAClEF,qBAAA,qBAAqBE,cAAAA,aAAa,aAAa,WAAmB,WAAW;AAC7EF,qBAAA,iBAAiBE,cAAAA,aAAa,aAAa,WAAmB,QAAQ;AAEtEF,qBAAA,iBAAiBE,cAAAA,aAAa,aAAa,WAAmB,QAAQ;AACtEF,qBAAA,oBAAoBE,cAAAA,aAAa,aAAa,cAAsB,kBAAkB;AAEtFF,qBAAA,sBAAsB,CAAC,gBACnCE,cAAAA,aAAa,aAAa,WAAmB,eAAe,EAAE,aAAa;AAC/DF,qBAAA,qBAAqB,CAAC,gBAClCE,cAAAA,aAAa,aAAa,WAAmB,aAAa,EAAE,aAAa;AAC7DF,qBAAA,wBAAwB,CAAC,gBACrCE,cAAAA,aAAa,aAAa,WAAmB,gBAAgB,EAAE,aAAa;AAChEF,qBAAA,wBAAwB,CAAC,gBACrCE,cAAAA,aAAa,aAAa,WAAmB,gBAAgB,EAAE,aAAa;AAEhEF,qBAAA,iBAAiBE,cAAAA,aAAa,aAAa,UAAkB,QAAQ;AACrEF,qBAAA,wBAAwB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,gBAAgB,EAAE,OAAO;AAC5HF,qBAAA,kBAAkBE,cAAAA,aAAa,aAAa,UAAkB,SAAS;AAEvEF,qBAAA,oBAAoBE,cAAAA,aAAa,aAAa,gBAAwB,KAAK;AAC3EF,qBAAA,uBAAuBE,cAAAA,aAAa,aAAa,gBAAwB,QAAQ;AACjFF,qBAAA,qBAAqBE,cAAAA,aAAa,aAAa,gBAAwB,MAAM;AAE7EF,qBAAA,UAAUE,cAAAA,aAAa,aAAa,OAAe,KAAK;AACxDF,qBAAA,aAAaE,cAAAA,aAAa,aAAa,OAAe,QAAQ;AAC9DF,qBAAA,cAAcE,cAAAA,aAAa,aAAa,OAAe,SAAS;AAChEF,qBAAA,aAAaE,cAAAA,aAAa,aAAa,OAAe,QAAQ;AAC9DF,qBAAA,WAAWE,cAAAA,aAAa,aAAa,OAAe,MAAM;AAAA,GAvE9DF,QAAAA,sBAAAA,4BAAA,CAAA,EAAA;"}

package/dist/production/src/model/authorization/PermissionActions.js

@@ -0,0 +1,62 @@
+import { Authorizator } from "@contember/authorization";
+var PermissionActions;
+((PermissionActions2) => {
+  ((Resources2) => {
+    Resources2["system"] = "system";
+    Resources2["entrypoint"] = "entrypoint";
+    Resources2["person"] = "person";
+    Resources2["identity"] = "identity";
+    Resources2["project"] = "project";
+    Resources2["apiKey"] = "apiKey";
+    Resources2["mailTemplate"] = "mailTemplate";
+    Resources2["idp"] = "idp";
+  })(PermissionActions2.Resources || (PermissionActions2.Resources = {}));
+  PermissionActions2.CONFIGURE = Authorizator.createAction("system", "configure");
+  PermissionActions2.CONFIG_VIEW = Authorizator.createAction("system", "viewConfig");
+  PermissionActions2.IDENTITY_VIEW_PERMISSIONS = Authorizator.createAction("identity", "viewPermissions");
+  PermissionActions2.IDENTITY_ADD_GLOBAL_ROLES = (roles) => Authorizator.createAction("identity", "addGlobalRoles", { roles });
+  PermissionActions2.IDENTITY_REMOVE_GLOBAL_ROLES = (roles) => Authorizator.createAction("identity", "removeGlobalRoles", { roles });
+  PermissionActions2.PERSON_DISABLE = (roles) => Authorizator.createAction("person", "disable", { roles });
+  PermissionActions2.PERSON_VIEW = Authorizator.createAction("person", "view");
+  PermissionActions2.PERSON_SIGN_IN = Authorizator.createAction("person", "signIn");
+  PermissionActions2.PERSON_SIGN_UP = (roles) => Authorizator.createAction("person", "signUp", { roles });
+  PermissionActions2.PERSON_SIGN_OUT = Authorizator.createAction("person", "signOut");
+  PermissionActions2.PERSON_SETUP_OTP = Authorizator.createAction("person", "setupOtp");
+  PermissionActions2.PERSON_CHANGE_PROFILE = (roles) => Authorizator.createAction("person", "changeProfile", { roles });
+  PermissionActions2.PERSON_CHANGE_MY_PROFILE = Authorizator.createAction("person", "changeMyProfile");
+  PermissionActions2.PERSON_TOGGLE_PASSWORDLESS = Authorizator.createAction("person", "togglePasswordless");
+  PermissionActions2.PERSON_CHANGE_PASSWORD = (roles) => Authorizator.createAction("person", "changePassword", { roles });
+  PermissionActions2.PERSON_CHANGE_MY_PASSWORD = Authorizator.createAction("person", "changeMyPassword");
+  PermissionActions2.PERSON_RESET_PASSWORD = Authorizator.createAction("person", "resetPassword");
+  PermissionActions2.PERSON_CREATE_IDP_URL = Authorizator.createAction("person", "createIdPUrl");
+  PermissionActions2.PERSON_SIGN_IN_IDP = Authorizator.createAction("person", "signInIdp");
+  PermissionActions2.PERSON_REQUEST_PASSWORDLESS_SIGN_IN = Authorizator.createAction("person", "requestPasswordlessSignIn");
+  PermissionActions2.PERSON_PASSWORDLESS_SIGN_IN = Authorizator.createAction("person", "passwordlessSignIn");
+  PermissionActions2.PERSON_CREATE_SESSION_KEY = (roles) => Authorizator.createAction("person", "createSessionToken", { roles });
+  PermissionActions2.PERSON_INVITE = (memberships) => Authorizator.createAction("person", "invite", { memberships });
+  PermissionActions2.PERSON_INVITE_UNMANAGED = (memberships) => Authorizator.createAction("person", "invite_unmanaged", { memberships });
+  PermissionActions2.PROJECT_VIEW = Authorizator.createAction("project", "view");
+  PermissionActions2.PROJECT_SET_SECRET = Authorizator.createAction("project", "setSecret");
+  PermissionActions2.PROJECT_UPDATE = Authorizator.createAction("project", "update");
+  PermissionActions2.PROJECT_CREATE = Authorizator.createAction("project", "create");
+  PermissionActions2.ENTRYPOINT_DEPLOY = Authorizator.createAction("entrypoint", "deployEntrypoint");
+  PermissionActions2.PROJECT_VIEW_MEMBER = (memberships) => Authorizator.createAction("project", "viewMembers", { memberships });
+  PermissionActions2.PROJECT_ADD_MEMBER = (memberships) => Authorizator.createAction("project", "addMember", { memberships });
+  PermissionActions2.PROJECT_REMOVE_MEMBER = (memberships) => Authorizator.createAction("project", "removeMember", { memberships });
+  PermissionActions2.PROJECT_UPDATE_MEMBER = (memberships) => Authorizator.createAction("project", "updateMember", { memberships });
+  PermissionActions2.API_KEY_CREATE = Authorizator.createAction("apiKey", "create");
+  PermissionActions2.API_KEY_CREATE_GLOBAL = (roles) => Authorizator.createAction("apiKey", "createGlobal", { roles });
+  PermissionActions2.API_KEY_DISABLE = Authorizator.createAction("apiKey", "disable");
+  PermissionActions2.MAIL_TEMPLATE_ADD = Authorizator.createAction("mailTemplate", "add");
+  PermissionActions2.MAIL_TEMPLATE_REMOVE = Authorizator.createAction("mailTemplate", "remove");
+  PermissionActions2.MAIL_TEMPLATE_LIST = Authorizator.createAction("mailTemplate", "list");
+  PermissionActions2.IDP_ADD = Authorizator.createAction("idp", "add");
+  PermissionActions2.IDP_UPDATE = Authorizator.createAction("idp", "update");
+  PermissionActions2.IDP_DISABLE = Authorizator.createAction("idp", "disable");
+  PermissionActions2.IDP_ENABLE = Authorizator.createAction("idp", "enable");
+  PermissionActions2.IDP_LIST = Authorizator.createAction("idp", "list");
+})(PermissionActions || (PermissionActions = {}));
+export {
+  PermissionActions
+};
+//# sourceMappingURL=PermissionActions.js.map

package/dist/production/src/model/authorization/PermissionActions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionActions.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionActions.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { Acl } from '@contember/schema'\n\nnamespace PermissionActions {\n\texport enum Resources {\n\t\tsystem = 'system',\n\t\tentrypoint = 'entrypoint',\n\t\tperson = 'person',\n\t\tidentity = 'identity',\n\t\tproject = 'project',\n\t\tapiKey = 'apiKey',\n\t\tmailTemplate = 'mailTemplate',\n\t\tidp = 'idp',\n\t}\n\n\texport const CONFIGURE = Authorizator.createAction(Resources.system, 'configure')\n\texport const CONFIG_VIEW = Authorizator.createAction(Resources.system, 'viewConfig')\n\n\texport const IDENTITY_VIEW_PERMISSIONS = Authorizator.createAction(Resources.identity, 'viewPermissions')\n\texport const IDENTITY_ADD_GLOBAL_ROLES = (roles?: readonly string[]) => Authorizator.createAction(Resources.identity, 'addGlobalRoles', { roles })\n\texport const IDENTITY_REMOVE_GLOBAL_ROLES = (roles?: readonly string[]) =>\n\t\tAuthorizator.createAction(Resources.identity, 'removeGlobalRoles', { roles })\n\n\texport const PERSON_DISABLE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'disable', { roles })\n\n\texport const PERSON_VIEW = Authorizator.createAction(Resources.person, 'view')\n\texport const PERSON_SIGN_IN = Authorizator.createAction(Resources.person, 'signIn')\n\texport const PERSON_SIGN_UP = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'signUp', { roles })\n\texport const PERSON_SIGN_OUT = Authorizator.createAction(Resources.person, 'signOut')\n\texport const PERSON_SETUP_OTP = Authorizator.createAction(Resources.person, 'setupOtp')\n\texport const PERSON_CHANGE_PROFILE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'changeProfile', { roles })\n\texport const PERSON_CHANGE_MY_PROFILE = Authorizator.createAction(Resources.person, 'changeMyProfile')\n\texport const PERSON_TOGGLE_PASSWORDLESS = Authorizator.createAction(Resources.person, 'togglePasswordless')\n\texport const PERSON_CHANGE_PASSWORD = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'changePassword', { roles })\n\texport const PERSON_CHANGE_MY_PASSWORD = Authorizator.createAction(Resources.person, 'changeMyPassword')\n\texport const PERSON_RESET_PASSWORD = Authorizator.createAction(Resources.person, 'resetPassword')\n\texport const PERSON_CREATE_IDP_URL = Authorizator.createAction(Resources.person, 'createIdPUrl')\n\texport const PERSON_SIGN_IN_IDP = Authorizator.createAction(Resources.person, 'signInIdp')\n\texport const PERSON_REQUEST_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'requestPasswordlessSignIn')\n\texport const PERSON_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'passwordlessSignIn')\n\texport const PERSON_CREATE_SESSION_KEY = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'createSessionToken', { roles })\n\n\texport const PERSON_INVITE = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.person, 'invite', { memberships })\n\texport const PERSON_INVITE_UNMANAGED = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.person, 'invite_unmanaged', { memberships })\n\n\texport const PROJECT_VIEW = Authorizator.createAction(Resources.project, 'view')\n\texport const PROJECT_SET_SECRET = Authorizator.createAction(Resources.project, 'setSecret')\n\texport const PROJECT_UPDATE = Authorizator.createAction(Resources.project, 'update')\n\n\texport const PROJECT_CREATE = Authorizator.createAction(Resources.project, 'create')\n\texport const ENTRYPOINT_DEPLOY = Authorizator.createAction(Resources.entrypoint, 'deployEntrypoint')\n\n\texport const PROJECT_VIEW_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'viewMembers', { memberships })\n\texport const PROJECT_ADD_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'addMember', { memberships })\n\texport const PROJECT_REMOVE_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'removeMember', { memberships })\n\texport const PROJECT_UPDATE_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'updateMember', { memberships })\n\n\texport const API_KEY_CREATE = Authorizator.createAction(Resources.apiKey, 'create')\n\texport const API_KEY_CREATE_GLOBAL = (roles?: readonly string[]) => Authorizator.createAction(Resources.apiKey, 'createGlobal', { roles })\n\texport const API_KEY_DISABLE = Authorizator.createAction(Resources.apiKey, 'disable')\n\n\texport const MAIL_TEMPLATE_ADD = Authorizator.createAction(Resources.mailTemplate, 'add')\n\texport const MAIL_TEMPLATE_REMOVE = Authorizator.createAction(Resources.mailTemplate, 'remove')\n\texport const MAIL_TEMPLATE_LIST = Authorizator.createAction(Resources.mailTemplate, 'list')\n\n\texport const IDP_ADD = Authorizator.createAction(Resources.idp, 'add')\n\texport const IDP_UPDATE = Authorizator.createAction(Resources.idp, 'update')\n\texport const IDP_DISABLE = Authorizator.createAction(Resources.idp, 'disable')\n\texport const IDP_ENABLE = Authorizator.createAction(Resources.idp, 'enable')\n\texport const IDP_LIST = Authorizator.createAction(Resources.idp, 'list')\n}\n\nexport { PermissionActions }\n"],"names":["PermissionActions","Resources"],"mappings":";AAGA,IAAU;AAAA,CAAV,CAAUA,uBAAV;AACQ,GAAA,CAAKC,eAAL;AACNA,eAAA,QAAA,IAAS;AACTA,eAAA,YAAA,IAAa;AACbA,eAAA,QAAA,IAAS;AACTA,eAAA,UAAA,IAAW;AACXA,eAAA,SAAA,IAAU;AACVA,eAAA,QAAA,IAAS;AACTA,eAAA,cAAA,IAAe;AACfA,eAAA,KAAA,IAAM;AAAA,EAAA,GARKD,mBAAA,cAAAA,mBAAA,YAAA,CAAA,EAAA;AAWCA,qBAAA,YAAY,aAAa,aAAa,UAAkB,WAAW;AACnEA,qBAAA,cAAc,aAAa,aAAa,UAAkB,YAAY;AAEtEA,qBAAA,4BAA4B,aAAa,aAAa,YAAoB,iBAAiB;AAC3FA,qBAAA,4BAA4B,CAAC,UAA8B,aAAa,aAAa,YAAoB,kBAAkB,EAAE,OAAO;AACpIA,qBAAA,+BAA+B,CAAC,UAC5C,aAAa,aAAa,YAAoB,qBAAqB,EAAE,OAAO;AAEhEA,qBAAA,iBAAiB,CAAC,UAA8B,aAAa,aAAa,UAAkB,WAAW,EAAE,OAAO;AAEhHA,qBAAA,cAAc,aAAa,aAAa,UAAkB,MAAM;AAChEA,qBAAA,iBAAiB,aAAa,aAAa,UAAkB,QAAQ;AACrEA,qBAAA,iBAAiB,CAAC,UAA8B,aAAa,aAAa,UAAkB,UAAU,EAAE,OAAO;AAC/GA,qBAAA,kBAAkB,aAAa,aAAa,UAAkB,SAAS;AACvEA,qBAAA,mBAAmB,aAAa,aAAa,UAAkB,UAAU;AACzEA,qBAAA,wBAAwB,CAAC,UAA8B,aAAa,aAAa,UAAkB,iBAAiB,EAAE,OAAO;AAC7HA,qBAAA,2BAA2B,aAAa,aAAa,UAAkB,iBAAiB;AACxFA,qBAAA,6BAA6B,aAAa,aAAa,UAAkB,oBAAoB;AAC7FA,qBAAA,yBAAyB,CAAC,UAA8B,aAAa,aAAa,UAAkB,kBAAkB,EAAE,OAAO;AAC/HA,qBAAA,4BAA4B,aAAa,aAAa,UAAkB,kBAAkB;AAC1FA,qBAAA,wBAAwB,aAAa,aAAa,UAAkB,eAAe;AACnFA,qBAAA,wBAAwB,aAAa,aAAa,UAAkB,cAAc;AAClFA,qBAAA,qBAAqB,aAAa,aAAa,UAAkB,WAAW;AAC5EA,qBAAA,sCAAsC,aAAa,aAAa,UAAkB,2BAA2B;AAC7GA,qBAAA,8BAA8B,aAAa,aAAa,UAAkB,oBAAoB;AAC9FA,qBAAA,4BAA4B,CAAC,UAA8B,aAAa,aAAa,UAAkB,sBAAsB,EAAE,OAAO;AAEtIA,qBAAA,gBAAgB,CAAC,gBAA2C,aAAa,aAAa,UAAkB,UAAU,EAAE,aAAa;AACjIA,qBAAA,0BAA0B,CAAC,gBACvC,aAAa,aAAa,UAAkB,oBAAoB,EAAE,aAAa;AAEnEA,qBAAA,eAAe,aAAa,aAAa,WAAmB,MAAM;AAClEA,qBAAA,qBAAqB,aAAa,aAAa,WAAmB,WAAW;AAC7EA,qBAAA,iBAAiB,aAAa,aAAa,WAAmB,QAAQ;AAEtEA,qBAAA,iBAAiB,aAAa,aAAa,WAAmB,QAAQ;AACtEA,qBAAA,oBAAoB,aAAa,aAAa,cAAsB,kBAAkB;AAEtFA,qBAAA,sBAAsB,CAAC,gBACnC,aAAa,aAAa,WAAmB,eAAe,EAAE,aAAa;AAC/DA,qBAAA,qBAAqB,CAAC,gBAClC,aAAa,aAAa,WAAmB,aAAa,EAAE,aAAa;AAC7DA,qBAAA,wBAAwB,CAAC,gBACrC,aAAa,aAAa,WAAmB,gBAAgB,EAAE,aAAa;AAChEA,qBAAA,wBAAwB,CAAC,gBACrC,aAAa,aAAa,WAAmB,gBAAgB,EAAE,aAAa;AAEhEA,qBAAA,iBAAiB,aAAa,aAAa,UAAkB,QAAQ;AACrEA,qBAAA,wBAAwB,CAAC,UAA8B,aAAa,aAAa,UAAkB,gBAAgB,EAAE,OAAO;AAC5HA,qBAAA,kBAAkB,aAAa,aAAa,UAAkB,SAAS;AAEvEA,qBAAA,oBAAoB,aAAa,aAAa,gBAAwB,KAAK;AAC3EA,qBAAA,uBAAuB,aAAa,aAAa,gBAAwB,QAAQ;AACjFA,qBAAA,qBAAqB,aAAa,aAAa,gBAAwB,MAAM;AAE7EA,qBAAA,UAAU,aAAa,aAAa,OAAe,KAAK;AACxDA,qBAAA,aAAa,aAAa,aAAa,OAAe,QAAQ;AAC9DA,qBAAA,cAAc,aAAa,aAAa,OAAe,SAAS;AAChEA,qBAAA,aAAa,aAAa,aAAa,OAAe,QAAQ;AAC9DA,qBAAA,WAAW,aAAa,aAAa,OAAe,MAAM;AAAA,GAvE9D,sBAAA,oBAAA,CAAA,EAAA;"}

package/dist/production/src/model/authorization/PermissionContext.cjs

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const authorization = require("@contember/authorization");
+const graphqlUtils = require("@contember/graphql-utils");
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+const deniedScope = new authorization.AuthorizationScope.Fixed(authorization.AccessNode.Fixed.denied());
+class PermissionContext {
+  constructor(identity, authorizator, projectScopeFactory, schemaResolver) {
+    this.identity = identity;
+    this.authorizator = authorizator;
+    this.projectScopeFactory = projectScopeFactory;
+    this.schemaResolver = schemaResolver;
+    __publicField(this, "projectScopes", {});
+  }
+  async isAllowed({
+    scope,
+    action
+  }) {
+    return await this.authorizator.isAllowed(this.identity, scope || new authorization.AuthorizationScope.Global(), action);
+  }
+  createAccessVerifier(scope) {
+    return (action) => this.isAllowed({ scope, action });
+  }
+  async requireAccess({
+    scope,
+    action,
+    message
+  }) {
+    if (!await this.isAllowed({ scope, action })) {
+      throw new graphqlUtils.ForbiddenError(message || "Forbidden");
+    }
+  }
+  async createProjectScope(project) {
+    if (!project) {
+      return deniedScope;
+    }
+    if (!this.projectScopes[project.slug]) {
+      this.projectScopes[project.slug] = await this.projectScopeFactory.create(this.schemaResolver, project) || deniedScope;
+    }
+    return this.projectScopes[project.slug];
+  }
+}
+exports.PermissionContext = PermissionContext;
+//# sourceMappingURL=PermissionContext.cjs.map

package/dist/production/src/model/authorization/PermissionContext.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionContext.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionContext.ts"],"sourcesContent":["import { AccessNode, AuthorizationScope, Authorizator } from '@contember/authorization'\nimport { ForbiddenError } from '@contember/graphql-utils'\nimport { ProjectScopeFactory } from './ProjectScopeFactory'\nimport { Project, ProjectSchemaResolver } from '../type'\nimport { Identity } from './Identity'\n\nexport type AccessVerifier = (action: Authorizator.Action) => Promise<boolean>\n\nconst deniedScope = new AuthorizationScope.Fixed(AccessNode.Fixed.denied())\n\nexport class PermissionContext {\n\tprivate projectScopes: Record<string, AuthorizationScope<Identity>> = {}\n\n\tconstructor(\n\t\tpublic readonly identity: Identity,\n\t\tpublic readonly authorizator: Authorizator<Identity>,\n\t\tprivate readonly projectScopeFactory: ProjectScopeFactory,\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tpublic async isAllowed<Meta extends {} | undefined>({\n\t\tscope,\n\t\taction,\n\t}: {\n\t\tscope?: AuthorizationScope<Identity>\n\t\taction: Authorizator.Action<Meta>\n\t}): Promise<boolean> {\n\t\treturn await this.authorizator.isAllowed(this.identity, scope || new AuthorizationScope.Global(), action)\n\t}\n\n\tpublic createAccessVerifier(scope: AuthorizationScope<Identity>): AccessVerifier {\n\t\treturn action => this.isAllowed({ scope, action })\n\t}\n\n\tpublic async requireAccess<Meta extends {} | undefined>({\n\t\tscope,\n\t\taction,\n\t\tmessage,\n\t}: {\n\t\tscope?: AuthorizationScope<Identity>\n\t\taction: Authorizator.Action<Meta>\n\t\tmessage?: string\n\t}): Promise<void> {\n\t\tif (!(await this.isAllowed({ scope, action }))) {\n\t\t\tthrow new ForbiddenError(message || 'Forbidden')\n\t\t}\n\t}\n\n\tpublic async createProjectScope(project: Pick<Project, 'slug'> | null): Promise<AuthorizationScope<Identity>> {\n\t\tif (!project) {\n\t\t\treturn deniedScope\n\t\t}\n\t\tif (!this.projectScopes[project.slug]) {\n\t\t\tthis.projectScopes[project.slug] = (await this.projectScopeFactory.create(this.schemaResolver, project)) || deniedScope\n\t\t}\n\t\treturn this.projectScopes[project.slug]\n\t}\n}\n"],"names":["AuthorizationScope","AccessNode","ForbiddenError"],"mappings":";;;;;;;AAQA,MAAM,cAAc,IAAIA,cAAAA,mBAAmB,MAAMC,cAAAA,WAAW,MAAM,QAAQ;AAEnE,MAAM,kBAAkB;AAAA,EAG9B,YACiB,UACA,cACC,qBACA,gBAChB;AAJe,SAAA,WAAA;AACA,SAAA,eAAA;AACC,SAAA,sBAAA;AACA,SAAA,iBAAA;AANlB,kBAAA,MAAQ,iBAA8D,EAAC;AAAA,EAOpE;AAAA,EAEH,MAAa,UAAuC;AAAA,IACnD;AAAA,IACA;AAAA,EAAA,GAIoB;AACpB,WAAO,MAAM,KAAK,aAAa,UAAU,KAAK,UAAU,SAAS,IAAID,cAAAA,mBAAmB,OAAA,GAAU,MAAM;AAAA,EACzG;AAAA,EAEO,qBAAqB,OAAqD;AAChF,WAAO,YAAU,KAAK,UAAU,EAAE,OAAO,QAAQ;AAAA,EAClD;AAAA,EAEA,MAAa,cAA2C;AAAA,IACvD;AAAA,IACA;AAAA,IACA;AAAA,EAAA,GAKiB;AACjB,QAAI,CAAE,MAAM,KAAK,UAAU,EAAE,OAAO,OAAA,CAAQ,GAAI;AAC/C,YAAM,IAAIE,aAAAA,eAAe,WAAW,WAAW;AAAA,IAChD;AAAA,EACD;AAAA,EAEA,MAAa,mBAAmB,SAA8E;AAC7G,QAAI,CAAC,SAAS;AACb,aAAO;AAAA,IACR;AACA,QAAI,CAAC,KAAK,cAAc,QAAQ,IAAI,GAAG;AACtC,WAAK,cAAc,QAAQ,IAAI,IAAK,MAAM,KAAK,oBAAoB,OAAO,KAAK,gBAAgB,OAAO,KAAM;AAAA,IAC7G;AACA,WAAO,KAAK,cAAc,QAAQ,IAAI;AAAA,EACvC;AACD;;"}

package/dist/production/src/model/authorization/PermissionContext.js

@@ -0,0 +1,46 @@
+import { AuthorizationScope, AccessNode } from "@contember/authorization";
+import { ForbiddenError } from "@contember/graphql-utils";
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+const deniedScope = new AuthorizationScope.Fixed(AccessNode.Fixed.denied());
+class PermissionContext {
+  constructor(identity, authorizator, projectScopeFactory, schemaResolver) {
+    this.identity = identity;
+    this.authorizator = authorizator;
+    this.projectScopeFactory = projectScopeFactory;
+    this.schemaResolver = schemaResolver;
+    __publicField(this, "projectScopes", {});
+  }
+  async isAllowed({
+    scope,
+    action
+  }) {
+    return await this.authorizator.isAllowed(this.identity, scope || new AuthorizationScope.Global(), action);
+  }
+  createAccessVerifier(scope) {
+    return (action) => this.isAllowed({ scope, action });
+  }
+  async requireAccess({
+    scope,
+    action,
+    message
+  }) {
+    if (!await this.isAllowed({ scope, action })) {
+      throw new ForbiddenError(message || "Forbidden");
+    }
+  }
+  async createProjectScope(project) {
+    if (!project) {
+      return deniedScope;
+    }
+    if (!this.projectScopes[project.slug]) {
+      this.projectScopes[project.slug] = await this.projectScopeFactory.create(this.schemaResolver, project) || deniedScope;
+    }
+    return this.projectScopes[project.slug];
+  }
+}
+export {
+  PermissionContext
+};
+//# sourceMappingURL=PermissionContext.js.map

package/dist/production/src/model/authorization/PermissionContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionContext.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionContext.ts"],"sourcesContent":["import { AccessNode, AuthorizationScope, Authorizator } from '@contember/authorization'\nimport { ForbiddenError } from '@contember/graphql-utils'\nimport { ProjectScopeFactory } from './ProjectScopeFactory'\nimport { Project, ProjectSchemaResolver } from '../type'\nimport { Identity } from './Identity'\n\nexport type AccessVerifier = (action: Authorizator.Action) => Promise<boolean>\n\nconst deniedScope = new AuthorizationScope.Fixed(AccessNode.Fixed.denied())\n\nexport class PermissionContext {\n\tprivate projectScopes: Record<string, AuthorizationScope<Identity>> = {}\n\n\tconstructor(\n\t\tpublic readonly identity: Identity,\n\t\tpublic readonly authorizator: Authorizator<Identity>,\n\t\tprivate readonly projectScopeFactory: ProjectScopeFactory,\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tpublic async isAllowed<Meta extends {} | undefined>({\n\t\tscope,\n\t\taction,\n\t}: {\n\t\tscope?: AuthorizationScope<Identity>\n\t\taction: Authorizator.Action<Meta>\n\t}): Promise<boolean> {\n\t\treturn await this.authorizator.isAllowed(this.identity, scope || new AuthorizationScope.Global(), action)\n\t}\n\n\tpublic createAccessVerifier(scope: AuthorizationScope<Identity>): AccessVerifier {\n\t\treturn action => this.isAllowed({ scope, action })\n\t}\n\n\tpublic async requireAccess<Meta extends {} | undefined>({\n\t\tscope,\n\t\taction,\n\t\tmessage,\n\t}: {\n\t\tscope?: AuthorizationScope<Identity>\n\t\taction: Authorizator.Action<Meta>\n\t\tmessage?: string\n\t}): Promise<void> {\n\t\tif (!(await this.isAllowed({ scope, action }))) {\n\t\t\tthrow new ForbiddenError(message || 'Forbidden')\n\t\t}\n\t}\n\n\tpublic async createProjectScope(project: Pick<Project, 'slug'> | null): Promise<AuthorizationScope<Identity>> {\n\t\tif (!project) {\n\t\t\treturn deniedScope\n\t\t}\n\t\tif (!this.projectScopes[project.slug]) {\n\t\t\tthis.projectScopes[project.slug] = (await this.projectScopeFactory.create(this.schemaResolver, project)) || deniedScope\n\t\t}\n\t\treturn this.projectScopes[project.slug]\n\t}\n}\n"],"names":[],"mappings":";;;;;AAQA,MAAM,cAAc,IAAI,mBAAmB,MAAM,WAAW,MAAM,QAAQ;AAEnE,MAAM,kBAAkB;AAAA,EAG9B,YACiB,UACA,cACC,qBACA,gBAChB;AAJe,SAAA,WAAA;AACA,SAAA,eAAA;AACC,SAAA,sBAAA;AACA,SAAA,iBAAA;AANlB,kBAAA,MAAQ,iBAA8D,EAAC;AAAA,EAOpE;AAAA,EAEH,MAAa,UAAuC;AAAA,IACnD;AAAA,IACA;AAAA,EAAA,GAIoB;AACpB,WAAO,MAAM,KAAK,aAAa,UAAU,KAAK,UAAU,SAAS,IAAI,mBAAmB,OAAA,GAAU,MAAM;AAAA,EACzG;AAAA,EAEO,qBAAqB,OAAqD;AAChF,WAAO,YAAU,KAAK,UAAU,EAAE,OAAO,QAAQ;AAAA,EAClD;AAAA,EAEA,MAAa,cAA2C;AAAA,IACvD;AAAA,IACA;AAAA,IACA;AAAA,EAAA,GAKiB;AACjB,QAAI,CAAE,MAAM,KAAK,UAAU,EAAE,OAAO,OAAA,CAAQ,GAAI;AAC/C,YAAM,IAAI,eAAe,WAAW,WAAW;AAAA,IAChD;AAAA,EACD;AAAA,EAEA,MAAa,mBAAmB,SAA8E;AAC7G,QAAI,CAAC,SAAS;AACb,aAAO;AAAA,IACR;AACA,QAAI,CAAC,KAAK,cAAc,QAAQ,IAAI,GAAG;AACtC,WAAK,cAAc,QAAQ,IAAI,IAAK,MAAM,KAAK,oBAAoB,OAAO,KAAK,gBAAgB,OAAO,KAAM;AAAA,IAC7G;AACA,WAAO,KAAK,cAAc,QAAQ,IAAI;AAAA,EACvC;AACD;"}

package/dist/production/src/model/authorization/PermissionContextFactory.cjs

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const PermissionContext = require("./PermissionContext.cjs");
+class PermissionContextFactory {
+  constructor(authorizator, identityFactory, projectScopeFactory, schemaResolver) {
+    this.authorizator = authorizator;
+    this.identityFactory = identityFactory;
+    this.projectScopeFactory = projectScopeFactory;
+    this.schemaResolver = schemaResolver;
+  }
+  create(db, args) {
+    const identity = this.identityFactory.create(db, args);
+    return new PermissionContext.PermissionContext(identity, this.authorizator, this.projectScopeFactory, this.schemaResolver);
+  }
+}
+exports.PermissionContextFactory = PermissionContextFactory;
+//# sourceMappingURL=PermissionContextFactory.cjs.map

package/dist/production/src/model/authorization/PermissionContextFactory.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionContextFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionContextFactory.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { IdentityFactory } from './IdentityFactory'\nimport { PermissionContext } from './PermissionContext'\nimport { ProjectScopeFactory } from './ProjectScopeFactory'\nimport { ProjectSchemaResolver } from '../type'\nimport { DatabaseContext } from '../utils'\n\nexport class PermissionContextFactory {\n\tconstructor(\n\t\tprivate readonly authorizator: Authorizator,\n\t\tprivate readonly identityFactory: IdentityFactory,\n\t\tprivate readonly projectScopeFactory: ProjectScopeFactory,\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tpublic create(db: DatabaseContext, args: { id: string; roles: readonly string[] }): PermissionContext {\n\t\tconst identity = this.identityFactory.create(db, args)\n\t\treturn new PermissionContext(identity, this.authorizator, this.projectScopeFactory, this.schemaResolver)\n\t}\n}\n"],"names":["PermissionContext"],"mappings":";;;AAOO,MAAM,yBAAyB;AAAA,EACrC,YACkB,cACA,iBACA,qBACA,gBAChB;AAJgB,SAAA,eAAA;AACA,SAAA,kBAAA;AACA,SAAA,sBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEI,OAAO,IAAqB,MAAmE;AACrG,UAAM,WAAW,KAAK,gBAAgB,OAAO,IAAI,IAAI;AACrD,WAAO,IAAIA,kBAAAA,kBAAkB,UAAU,KAAK,cAAc,KAAK,qBAAqB,KAAK,cAAc;AAAA,EACxG;AACD;;"}

package/dist/production/src/model/authorization/PermissionContextFactory.js

@@ -0,0 +1,17 @@
+import { PermissionContext } from "./PermissionContext.js";
+class PermissionContextFactory {
+  constructor(authorizator, identityFactory, projectScopeFactory, schemaResolver) {
+    this.authorizator = authorizator;
+    this.identityFactory = identityFactory;
+    this.projectScopeFactory = projectScopeFactory;
+    this.schemaResolver = schemaResolver;
+  }
+  create(db, args) {
+    const identity = this.identityFactory.create(db, args);
+    return new PermissionContext(identity, this.authorizator, this.projectScopeFactory, this.schemaResolver);
+  }
+}
+export {
+  PermissionContextFactory
+};
+//# sourceMappingURL=PermissionContextFactory.js.map

package/dist/production/src/model/authorization/PermissionContextFactory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionContextFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionContextFactory.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { IdentityFactory } from './IdentityFactory'\nimport { PermissionContext } from './PermissionContext'\nimport { ProjectScopeFactory } from './ProjectScopeFactory'\nimport { ProjectSchemaResolver } from '../type'\nimport { DatabaseContext } from '../utils'\n\nexport class PermissionContextFactory {\n\tconstructor(\n\t\tprivate readonly authorizator: Authorizator,\n\t\tprivate readonly identityFactory: IdentityFactory,\n\t\tprivate readonly projectScopeFactory: ProjectScopeFactory,\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tpublic create(db: DatabaseContext, args: { id: string; roles: readonly string[] }): PermissionContext {\n\t\tconst identity = this.identityFactory.create(db, args)\n\t\treturn new PermissionContext(identity, this.authorizator, this.projectScopeFactory, this.schemaResolver)\n\t}\n}\n"],"names":[],"mappings":";AAOO,MAAM,yBAAyB;AAAA,EACrC,YACkB,cACA,iBACA,qBACA,gBAChB;AAJgB,SAAA,eAAA;AACA,SAAA,kBAAA;AACA,SAAA,sBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEI,OAAO,IAAqB,MAAmE;AACrG,UAAM,WAAW,KAAK,gBAAgB,OAAO,IAAI,IAAI;AACrD,WAAO,IAAI,kBAAkB,UAAU,KAAK,cAAc,KAAK,qBAAqB,KAAK,cAAc;AAAA,EACxG;AACD;"}