@contember/engine-tenant-api 2.1.0-alpha.37 → 2.1.0-alpha.39

package/dist/development/src/model/authorization/PermissionsFactory.cjs

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const authorization = require("@contember/authorization");
+const PermissionActions = require("./PermissionActions.cjs");
+const Roles = require("./Roles.cjs");
+const allowedRoles = /* @__PURE__ */ new Set([Roles.TenantRole.LOGIN, Roles.TenantRole.PROJECT_ADMIN, Roles.TenantRole.ENTRYPOINT_DEPLOYER]);
+const projectAdminAllowedInputRoles = ({ roles }) => {
+  return roles === void 0 || roles.every((it) => allowedRoles.has(it));
+};
+const forbiddenRoles = /* @__PURE__ */ new Set([Roles.TenantRole.SUPER_ADMIN, Roles.TenantRole.PROJECT_CREATOR]);
+const projectAdminUseRolesVerifier = ({ roles }) => {
+  return roles === void 0 || roles.every((it) => !forbiddenRoles.has(it));
+};
+class PermissionsFactory {
+  create() {
+    const permissions = new authorization.Permissions();
+    permissions.allow(Roles.TenantRole.SUPER_ADMIN, { resource: authorization.Permissions.ALL, privilege: authorization.Permissions.ALL });
+    permissions.allow(Roles.TenantRole.LOGIN, PermissionActions.PermissionActions.PERSON_SIGN_IN);
+    permissions.allow(Roles.TenantRole.LOGIN, PermissionActions.PermissionActions.PERSON_RESET_PASSWORD);
+    permissions.allow(Roles.TenantRole.LOGIN, PermissionActions.PermissionActions.PERSON_CREATE_IDP_URL);
+    permissions.allow(Roles.TenantRole.LOGIN, PermissionActions.PermissionActions.PERSON_SIGN_IN_IDP);
+    permissions.allow(Roles.TenantRole.LOGIN, PermissionActions.PermissionActions.PERSON_PASSWORDLESS_SIGN_IN);
+    permissions.allow(Roles.TenantRole.LOGIN, PermissionActions.PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN);
+    permissions.allow(Roles.TenantRole.PERSON, PermissionActions.PermissionActions.PERSON_VIEW);
+    permissions.allow(Roles.TenantRole.PERSON, PermissionActions.PermissionActions.PERSON_CHANGE_MY_PASSWORD);
+    permissions.allow(Roles.TenantRole.PERSON, PermissionActions.PermissionActions.PERSON_CHANGE_MY_PROFILE);
+    permissions.allow(Roles.TenantRole.PERSON, PermissionActions.PermissionActions.PERSON_TOGGLE_PASSWORDLESS);
+    permissions.allow(Roles.TenantRole.PERSON, PermissionActions.PermissionActions.PERSON_SIGN_OUT);
+    permissions.allow(Roles.TenantRole.PERSON, PermissionActions.PermissionActions.PERSON_SETUP_OTP);
+    permissions.allow(Roles.TenantRole.PROJECT_MEMBER, PermissionActions.PermissionActions.PROJECT_VIEW);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PROJECT_VIEW);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDENTITY_VIEW_PERMISSIONS);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_VIEW);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.API_KEY_CREATE);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.API_KEY_DISABLE);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedInputRoles);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedInputRoles);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedInputRoles);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_CREATE_SESSION_KEY(), projectAdminUseRolesVerifier);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_DISABLE(), projectAdminUseRolesVerifier);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_CHANGE_PROFILE(), projectAdminUseRolesVerifier);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_CHANGE_PASSWORD(), projectAdminUseRolesVerifier);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PROJECT_VIEW_MEMBER([]));
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PROJECT_ADD_MEMBER([]));
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PROJECT_UPDATE_MEMBER([]));
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PROJECT_REMOVE_MEMBER([]));
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_INVITE([]));
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_INVITE_UNMANAGED([]));
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.MAIL_TEMPLATE_ADD);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.MAIL_TEMPLATE_REMOVE);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.MAIL_TEMPLATE_LIST);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDP_ADD);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDP_UPDATE);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDP_DISABLE);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDP_ENABLE);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDP_LIST);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.ENTRYPOINT_DEPLOY);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.CONFIGURE);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.CONFIG_VIEW);
+    permissions.allow(Roles.TenantRole.PROJECT_CREATOR, PermissionActions.PermissionActions.PROJECT_CREATE);
+    permissions.allow(Roles.TenantRole.ENTRYPOINT_DEPLOYER, PermissionActions.PermissionActions.ENTRYPOINT_DEPLOY);
+    return permissions;
+  }
+}
+exports.PermissionsFactory = PermissionsFactory;
+//# sourceMappingURL=PermissionsFactory.cjs.map

package/dist/development/src/model/authorization/PermissionsFactory.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionsFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionsFactory.ts"],"sourcesContent":["import { Permissions } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions'\nimport { TenantRole } from './Roles'\n\nconst allowedRoles = new Set<string>([TenantRole.LOGIN, TenantRole.PROJECT_ADMIN, TenantRole.ENTRYPOINT_DEPLOYER])\n\nconst projectAdminAllowedInputRoles = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined || roles.every(it => allowedRoles.has(it))\n}\n\nconst forbiddenRoles = new Set<string>([TenantRole.SUPER_ADMIN, TenantRole.PROJECT_CREATOR])\n\nconst projectAdminUseRolesVerifier = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined || roles.every(it => !forbiddenRoles.has(it))\n}\n\nclass PermissionsFactory {\n\tpublic create(): Permissions {\n\t\tconst permissions = new Permissions()\n\n\t\tpermissions.allow(TenantRole.SUPER_ADMIN, { resource: Permissions.ALL, privilege: Permissions.ALL })\n\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_RESET_PASSWORD)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_CREATE_IDP_URL)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN_IDP)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_PASSWORDLESS_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN)\n\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PASSWORD)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PROFILE)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_TOGGLE_PASSWORDLESS)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SIGN_OUT)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP)\n\n\t\tpermissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_VIEW_PERMISSIONS)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CREATE_SESSION_KEY(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(), projectAdminUseRolesVerifier)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_ADD_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_UPDATE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_REMOVE_MEMBER([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE_UNMANAGED([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_UPDATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ENABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.ENTRYPOINT_DEPLOY)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIGURE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIG_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_CREATOR, PermissionActions.PROJECT_CREATE)\n\t\tpermissions.allow(TenantRole.ENTRYPOINT_DEPLOYER, PermissionActions.ENTRYPOINT_DEPLOY)\n\n\t\treturn permissions\n\t}\n}\n\nexport { PermissionsFactory }\n"],"names":["TenantRole","Permissions","PermissionActions"],"mappings":";;;;;AAIA,MAAM,eAAe,oBAAI,IAAY,CAACA,iBAAW,OAAOA,MAAAA,WAAW,eAAeA,iBAAW,mBAAmB,CAAC;AAEjH,MAAM,gCAAgC,CAAC,EAAE,YAA2C;AACnF,SAAO,UAAU,UAAa,MAAM,MAAM,QAAM,aAAa,IAAI,EAAE,CAAC;AACrE;AAEA,MAAM,qCAAqB,IAAY,CAACA,MAAAA,WAAW,aAAaA,MAAAA,WAAW,eAAe,CAAC;AAE3F,MAAM,+BAA+B,CAAC,EAAE,YAA2C;AAClF,SAAO,UAAU,UAAa,MAAM,MAAM,QAAM,CAAC,eAAe,IAAI,EAAE,CAAC;AACxE;AAEA,MAAM,mBAAmB;AAAA,EACjB,SAAsB;AAC5B,UAAM,cAAc,IAAIC,0BAAA;AAExB,gBAAY,MAAMD,iBAAW,aAAa,EAAE,UAAUC,cAAAA,YAAY,KAAK,WAAWA,cAAAA,YAAY,IAAA,CAAK;AAEnG,gBAAY,MAAMD,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,cAAc;AACpE,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,kBAAkB;AACxE,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,2BAA2B;AACjF,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,mCAAmC;AAEzF,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,WAAW;AAClE,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,yBAAyB;AAChF,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,wBAAwB;AAC/E,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,0BAA0B;AACjF,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,eAAe;AACtE,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,gBAAgB;AAEvE,gBAAY,MAAMF,MAAAA,WAAW,gBAAgBE,kBAAAA,kBAAkB,YAAY;AAE3E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,YAAY;AAC1E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,yBAAyB;AACvF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,WAAW;AACzE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,cAAc;AAC5E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,eAAe;AAC7E,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,sBAAA,GAAyB,6BAA6B;AAEpH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,eAAA,GAAkB,6BAA6B;AAC7G,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,0BAAA,GAA6B,6BAA6B;AACxH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,6BAAA,GAAgC,6BAA6B;AAC3H,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,0BAAA,GAA6B,4BAA4B;AACvH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,eAAA,GAAkB,4BAA4B;AAC5G,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,sBAAA,GAAyB,4BAA4B;AACnH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,uBAAA,GAA0B,4BAA4B;AAEpH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,CAAC;AACrF,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,mBAAmB,CAAA,CAAE,CAAC;AACpF,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AACvF,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AAEvF,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,cAAc,CAAA,CAAE,CAAC;AAC/E,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,wBAAwB,CAAA,CAAE,CAAC;AAEzF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,oBAAoB;AAClF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,kBAAkB;AAEhF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,OAAO;AACrE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,UAAU;AACxE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,WAAW;AACzE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,UAAU;AACxE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,QAAQ;AAEtE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,SAAS;AACvE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,WAAW;AAEzE,gBAAY,MAAMF,MAAAA,WAAW,iBAAiBE,kBAAAA,kBAAkB,cAAc;AAC9E,gBAAY,MAAMF,MAAAA,WAAW,qBAAqBE,kBAAAA,kBAAkB,iBAAiB;AAErF,WAAO;AAAA,EACR;AACD;;"}

package/dist/development/src/model/authorization/PermissionsFactory.js

@@ -0,0 +1,67 @@
+import { Permissions } from "@contember/authorization";
+import { PermissionActions } from "./PermissionActions.js";
+import { TenantRole } from "./Roles.js";
+const allowedRoles = /* @__PURE__ */ new Set([TenantRole.LOGIN, TenantRole.PROJECT_ADMIN, TenantRole.ENTRYPOINT_DEPLOYER]);
+const projectAdminAllowedInputRoles = ({ roles }) => {
+  return roles === void 0 || roles.every((it) => allowedRoles.has(it));
+};
+const forbiddenRoles = /* @__PURE__ */ new Set([TenantRole.SUPER_ADMIN, TenantRole.PROJECT_CREATOR]);
+const projectAdminUseRolesVerifier = ({ roles }) => {
+  return roles === void 0 || roles.every((it) => !forbiddenRoles.has(it));
+};
+class PermissionsFactory {
+  create() {
+    const permissions = new Permissions();
+    permissions.allow(TenantRole.SUPER_ADMIN, { resource: Permissions.ALL, privilege: Permissions.ALL });
+    permissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN);
+    permissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_RESET_PASSWORD);
+    permissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_CREATE_IDP_URL);
+    permissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN_IDP);
+    permissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_PASSWORDLESS_SIGN_IN);
+    permissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN);
+    permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_VIEW);
+    permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PASSWORD);
+    permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PROFILE);
+    permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_TOGGLE_PASSWORDLESS);
+    permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SIGN_OUT);
+    permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP);
+    permissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_VIEW_PERMISSIONS);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedInputRoles);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedInputRoles);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedInputRoles);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CREATE_SESSION_KEY(), projectAdminUseRolesVerifier);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(), projectAdminUseRolesVerifier);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(), projectAdminUseRolesVerifier);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(), projectAdminUseRolesVerifier);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_MEMBER([]));
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_ADD_MEMBER([]));
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_UPDATE_MEMBER([]));
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_REMOVE_MEMBER([]));
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE([]));
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE_UNMANAGED([]));
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_LIST);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ADD);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_UPDATE);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_DISABLE);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ENABLE);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_LIST);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.ENTRYPOINT_DEPLOY);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIGURE);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIG_VIEW);
+    permissions.allow(TenantRole.PROJECT_CREATOR, PermissionActions.PROJECT_CREATE);
+    permissions.allow(TenantRole.ENTRYPOINT_DEPLOYER, PermissionActions.ENTRYPOINT_DEPLOY);
+    return permissions;
+  }
+}
+export {
+  PermissionsFactory
+};
+//# sourceMappingURL=PermissionsFactory.js.map

package/dist/development/src/model/authorization/PermissionsFactory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionsFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionsFactory.ts"],"sourcesContent":["import { Permissions } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions'\nimport { TenantRole } from './Roles'\n\nconst allowedRoles = new Set<string>([TenantRole.LOGIN, TenantRole.PROJECT_ADMIN, TenantRole.ENTRYPOINT_DEPLOYER])\n\nconst projectAdminAllowedInputRoles = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined || roles.every(it => allowedRoles.has(it))\n}\n\nconst forbiddenRoles = new Set<string>([TenantRole.SUPER_ADMIN, TenantRole.PROJECT_CREATOR])\n\nconst projectAdminUseRolesVerifier = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined || roles.every(it => !forbiddenRoles.has(it))\n}\n\nclass PermissionsFactory {\n\tpublic create(): Permissions {\n\t\tconst permissions = new Permissions()\n\n\t\tpermissions.allow(TenantRole.SUPER_ADMIN, { resource: Permissions.ALL, privilege: Permissions.ALL })\n\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_RESET_PASSWORD)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_CREATE_IDP_URL)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN_IDP)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_PASSWORDLESS_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN)\n\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PASSWORD)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PROFILE)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_TOGGLE_PASSWORDLESS)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SIGN_OUT)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP)\n\n\t\tpermissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_VIEW_PERMISSIONS)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CREATE_SESSION_KEY(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(), projectAdminUseRolesVerifier)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_ADD_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_UPDATE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_REMOVE_MEMBER([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE_UNMANAGED([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_UPDATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ENABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.ENTRYPOINT_DEPLOY)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIGURE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIG_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_CREATOR, PermissionActions.PROJECT_CREATE)\n\t\tpermissions.allow(TenantRole.ENTRYPOINT_DEPLOYER, PermissionActions.ENTRYPOINT_DEPLOY)\n\n\t\treturn permissions\n\t}\n}\n\nexport { PermissionsFactory }\n"],"names":[],"mappings":";;;AAIA,MAAM,eAAe,oBAAI,IAAY,CAAC,WAAW,OAAO,WAAW,eAAe,WAAW,mBAAmB,CAAC;AAEjH,MAAM,gCAAgC,CAAC,EAAE,YAA2C;AACnF,SAAO,UAAU,UAAa,MAAM,MAAM,QAAM,aAAa,IAAI,EAAE,CAAC;AACrE;AAEA,MAAM,qCAAqB,IAAY,CAAC,WAAW,aAAa,WAAW,eAAe,CAAC;AAE3F,MAAM,+BAA+B,CAAC,EAAE,YAA2C;AAClF,SAAO,UAAU,UAAa,MAAM,MAAM,QAAM,CAAC,eAAe,IAAI,EAAE,CAAC;AACxE;AAEA,MAAM,mBAAmB;AAAA,EACjB,SAAsB;AAC5B,UAAM,cAAc,IAAI,YAAA;AAExB,gBAAY,MAAM,WAAW,aAAa,EAAE,UAAU,YAAY,KAAK,WAAW,YAAY,IAAA,CAAK;AAEnG,gBAAY,MAAM,WAAW,OAAO,kBAAkB,cAAc;AACpE,gBAAY,MAAM,WAAW,OAAO,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAM,WAAW,OAAO,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAM,WAAW,OAAO,kBAAkB,kBAAkB;AACxE,gBAAY,MAAM,WAAW,OAAO,kBAAkB,2BAA2B;AACjF,gBAAY,MAAM,WAAW,OAAO,kBAAkB,mCAAmC;AAEzF,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,WAAW;AAClE,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,yBAAyB;AAChF,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,wBAAwB;AAC/E,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,0BAA0B;AACjF,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,eAAe;AACtE,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,gBAAgB;AAEvE,gBAAY,MAAM,WAAW,gBAAgB,kBAAkB,YAAY;AAE3E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,YAAY;AAC1E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,yBAAyB;AACvF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,WAAW;AACzE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,cAAc;AAC5E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,eAAe;AAC7E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAA,GAAyB,6BAA6B;AAEpH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,eAAA,GAAkB,6BAA6B;AAC7G,gBAAY,MAAM,WAAW,eAAe,kBAAkB,0BAAA,GAA6B,6BAA6B;AACxH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,6BAAA,GAAgC,6BAA6B;AAC3H,gBAAY,MAAM,WAAW,eAAe,kBAAkB,0BAAA,GAA6B,4BAA4B;AACvH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,eAAA,GAAkB,4BAA4B;AAC5G,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAA,GAAyB,4BAA4B;AACnH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,uBAAA,GAA0B,4BAA4B;AAEpH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,oBAAoB,CAAA,CAAE,CAAC;AACrF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,mBAAmB,CAAA,CAAE,CAAC;AACpF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AACvF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AAEvF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,cAAc,CAAA,CAAE,CAAC;AAC/E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,wBAAwB,CAAA,CAAE,CAAC;AAEzF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,oBAAoB;AAClF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,kBAAkB;AAEhF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,OAAO;AACrE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,UAAU;AACxE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,WAAW;AACzE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,UAAU;AACxE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,QAAQ;AAEtE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,SAAS;AACvE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,WAAW;AAEzE,gBAAY,MAAM,WAAW,iBAAiB,kBAAkB,cAAc;AAC9E,gBAAY,MAAM,WAAW,qBAAqB,kBAAkB,iBAAiB;AAErF,WAAO;AAAA,EACR;AACD;"}

package/dist/development/src/model/authorization/ProjectScope.cjs

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const authorization = require("@contember/authorization");
+const Roles = require("./Roles.cjs");
+const schema = require("@contember/schema");
+class ProjectScope {
+  constructor(project, aclSchema, aclSchemaAccessNodeFactory) {
+    this.project = project;
+    this.aclSchema = aclSchema;
+    this.aclSchemaAccessNodeFactory = aclSchemaAccessNodeFactory;
+  }
+  async getIdentityAccess(identity) {
+    const projectMemberships = await identity.getProjectMemberships(this.project.slug);
+    const tenantRoles = [];
+    if (projectMemberships.length > 0) {
+      tenantRoles.push(Roles.TenantRole.PROJECT_MEMBER);
+    }
+    const projectRoles = projectMemberships.map((it) => it.role);
+    if (projectRoles.includes(schema.ProjectRole.ADMIN)) {
+      tenantRoles.push(Roles.TenantRole.PROJECT_ADMIN);
+    }
+    const accessNode = this.aclSchemaAccessNodeFactory.create(this.aclSchema, projectMemberships);
+    return new authorization.AccessNode.Union([
+      new authorization.AccessNode.Roles(tenantRoles),
+      accessNode
+    ]);
+  }
+}
+exports.ProjectScope = ProjectScope;
+//# sourceMappingURL=ProjectScope.cjs.map

package/dist/development/src/model/authorization/ProjectScope.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProjectScope.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/ProjectScope.ts"],"sourcesContent":["import { AccessNode, AuthorizationScope } from '@contember/authorization'\nimport { Project } from '../type'\nimport { TenantRole } from './Roles'\nimport { Acl, ProjectRole } from '@contember/schema'\nimport { AclSchemaAccessNodeFactory } from './AclSchemaAccessNodeFactory'\nimport { Identity } from './Identity'\n\nexport class ProjectScope implements AuthorizationScope<Identity> {\n\tconstructor(\n\t\tprivate readonly project: Pick<Project, 'slug'>,\n\t\tprivate readonly aclSchema: Acl.Schema,\n\t\tprivate readonly aclSchemaAccessNodeFactory: AclSchemaAccessNodeFactory,\n\t) {}\n\n\tasync getIdentityAccess(identity: Identity): Promise<AccessNode> {\n\t\tconst projectMemberships = await identity.getProjectMemberships(this.project.slug)\n\t\tconst tenantRoles = []\n\t\tif (projectMemberships.length > 0) {\n\t\t\ttenantRoles.push(TenantRole.PROJECT_MEMBER)\n\t\t}\n\t\tconst projectRoles = projectMemberships.map(it => it.role)\n\t\tif (projectRoles.includes(ProjectRole.ADMIN)) {\n\t\t\ttenantRoles.push(TenantRole.PROJECT_ADMIN)\n\t\t}\n\t\tconst accessNode = this.aclSchemaAccessNodeFactory.create(this.aclSchema, projectMemberships)\n\t\treturn new AccessNode.Union([\n\t\t\tnew AccessNode.Roles(tenantRoles),\n\t\t\taccessNode,\n\t\t])\n\t}\n}\n"],"names":["TenantRole","ProjectRole","AccessNode"],"mappings":";;;;;AAOO,MAAM,aAAqD;AAAA,EACjE,YACkB,SACA,WACA,4BAChB;AAHgB,SAAA,UAAA;AACA,SAAA,YAAA;AACA,SAAA,6BAAA;AAAA,EACf;AAAA,EAEH,MAAM,kBAAkB,UAAyC;AAChE,UAAM,qBAAqB,MAAM,SAAS,sBAAsB,KAAK,QAAQ,IAAI;AACjF,UAAM,cAAc,CAAA;AACpB,QAAI,mBAAmB,SAAS,GAAG;AAClC,kBAAY,KAAKA,MAAAA,WAAW,cAAc;AAAA,IAC3C;AACA,UAAM,eAAe,mBAAmB,IAAI,CAAA,OAAM,GAAG,IAAI;AACzD,QAAI,aAAa,SAASC,OAAAA,YAAY,KAAK,GAAG;AAC7C,kBAAY,KAAKD,MAAAA,WAAW,aAAa;AAAA,IAC1C;AACA,UAAM,aAAa,KAAK,2BAA2B,OAAO,KAAK,WAAW,kBAAkB;AAC5F,WAAO,IAAIE,cAAAA,WAAW,MAAM;AAAA,MAC3B,IAAIA,cAAAA,WAAW,MAAM,WAAW;AAAA,MAChC;AAAA,IAAA,CACA;AAAA,EACF;AACD;;"}

package/dist/development/src/model/authorization/ProjectScope.js

@@ -0,0 +1,30 @@
+import { AccessNode } from "@contember/authorization";
+import { TenantRole } from "./Roles.js";
+import { ProjectRole } from "@contember/schema";
+class ProjectScope {
+  constructor(project, aclSchema, aclSchemaAccessNodeFactory) {
+    this.project = project;
+    this.aclSchema = aclSchema;
+    this.aclSchemaAccessNodeFactory = aclSchemaAccessNodeFactory;
+  }
+  async getIdentityAccess(identity) {
+    const projectMemberships = await identity.getProjectMemberships(this.project.slug);
+    const tenantRoles = [];
+    if (projectMemberships.length > 0) {
+      tenantRoles.push(TenantRole.PROJECT_MEMBER);
+    }
+    const projectRoles = projectMemberships.map((it) => it.role);
+    if (projectRoles.includes(ProjectRole.ADMIN)) {
+      tenantRoles.push(TenantRole.PROJECT_ADMIN);
+    }
+    const accessNode = this.aclSchemaAccessNodeFactory.create(this.aclSchema, projectMemberships);
+    return new AccessNode.Union([
+      new AccessNode.Roles(tenantRoles),
+      accessNode
+    ]);
+  }
+}
+export {
+  ProjectScope
+};
+//# sourceMappingURL=ProjectScope.js.map

package/dist/development/src/model/authorization/ProjectScope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProjectScope.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/ProjectScope.ts"],"sourcesContent":["import { AccessNode, AuthorizationScope } from '@contember/authorization'\nimport { Project } from '../type'\nimport { TenantRole } from './Roles'\nimport { Acl, ProjectRole } from '@contember/schema'\nimport { AclSchemaAccessNodeFactory } from './AclSchemaAccessNodeFactory'\nimport { Identity } from './Identity'\n\nexport class ProjectScope implements AuthorizationScope<Identity> {\n\tconstructor(\n\t\tprivate readonly project: Pick<Project, 'slug'>,\n\t\tprivate readonly aclSchema: Acl.Schema,\n\t\tprivate readonly aclSchemaAccessNodeFactory: AclSchemaAccessNodeFactory,\n\t) {}\n\n\tasync getIdentityAccess(identity: Identity): Promise<AccessNode> {\n\t\tconst projectMemberships = await identity.getProjectMemberships(this.project.slug)\n\t\tconst tenantRoles = []\n\t\tif (projectMemberships.length > 0) {\n\t\t\ttenantRoles.push(TenantRole.PROJECT_MEMBER)\n\t\t}\n\t\tconst projectRoles = projectMemberships.map(it => it.role)\n\t\tif (projectRoles.includes(ProjectRole.ADMIN)) {\n\t\t\ttenantRoles.push(TenantRole.PROJECT_ADMIN)\n\t\t}\n\t\tconst accessNode = this.aclSchemaAccessNodeFactory.create(this.aclSchema, projectMemberships)\n\t\treturn new AccessNode.Union([\n\t\t\tnew AccessNode.Roles(tenantRoles),\n\t\t\taccessNode,\n\t\t])\n\t}\n}\n"],"names":[],"mappings":";;;AAOO,MAAM,aAAqD;AAAA,EACjE,YACkB,SACA,WACA,4BAChB;AAHgB,SAAA,UAAA;AACA,SAAA,YAAA;AACA,SAAA,6BAAA;AAAA,EACf;AAAA,EAEH,MAAM,kBAAkB,UAAyC;AAChE,UAAM,qBAAqB,MAAM,SAAS,sBAAsB,KAAK,QAAQ,IAAI;AACjF,UAAM,cAAc,CAAA;AACpB,QAAI,mBAAmB,SAAS,GAAG;AAClC,kBAAY,KAAK,WAAW,cAAc;AAAA,IAC3C;AACA,UAAM,eAAe,mBAAmB,IAAI,CAAA,OAAM,GAAG,IAAI;AACzD,QAAI,aAAa,SAAS,YAAY,KAAK,GAAG;AAC7C,kBAAY,KAAK,WAAW,aAAa;AAAA,IAC1C;AACA,UAAM,aAAa,KAAK,2BAA2B,OAAO,KAAK,WAAW,kBAAkB;AAC5F,WAAO,IAAI,WAAW,MAAM;AAAA,MAC3B,IAAI,WAAW,MAAM,WAAW;AAAA,MAChC;AAAA,IAAA,CACA;AAAA,EACF;AACD;"}

package/dist/development/src/model/authorization/ProjectScopeFactory.cjs

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const ProjectScope = require("./ProjectScope.cjs");
+class ProjectScopeFactory {
+  constructor(schemaAccessNodeFactory) {
+    this.schemaAccessNodeFactory = schemaAccessNodeFactory;
+  }
+  async create(schemaResolver, project) {
+    const schema = await schemaResolver.getSchema(project.slug);
+    if (!schema) {
+      return null;
+    }
+    return new ProjectScope.ProjectScope(project, schema.acl, this.schemaAccessNodeFactory);
+  }
+}
+exports.ProjectScopeFactory = ProjectScopeFactory;
+//# sourceMappingURL=ProjectScopeFactory.cjs.map

package/dist/development/src/model/authorization/ProjectScopeFactory.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProjectScopeFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/ProjectScopeFactory.ts"],"sourcesContent":["import { Project, ProjectSchemaResolver } from '../type'\nimport { AclSchemaAccessNodeFactory } from './AclSchemaAccessNodeFactory'\nimport { AuthorizationScope } from '@contember/authorization'\nimport { ProjectScope } from './ProjectScope'\nimport { Identity } from './Identity'\n\nexport class ProjectScopeFactory {\n\tconstructor(\n\t\tprivate readonly schemaAccessNodeFactory: AclSchemaAccessNodeFactory,\n\t) {}\n\n\tasync create(schemaResolver: ProjectSchemaResolver, project: Pick<Project, 'slug'>): Promise<AuthorizationScope<Identity> | null> {\n\t\tconst schema = await schemaResolver.getSchema(project.slug)\n\t\tif (!schema) {\n\t\t\treturn null\n\t\t}\n\t\treturn new ProjectScope(project, schema.acl, this.schemaAccessNodeFactory)\n\t}\n}\n"],"names":["ProjectScope"],"mappings":";;;AAMO,MAAM,oBAAoB;AAAA,EAChC,YACkB,yBAChB;AADgB,SAAA,0BAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,gBAAuC,SAA8E;AACjI,UAAM,SAAS,MAAM,eAAe,UAAU,QAAQ,IAAI;AAC1D,QAAI,CAAC,QAAQ;AACZ,aAAO;AAAA,IACR;AACA,WAAO,IAAIA,aAAAA,aAAa,SAAS,OAAO,KAAK,KAAK,uBAAuB;AAAA,EAC1E;AACD;;"}

package/dist/development/src/model/authorization/ProjectScopeFactory.js

@@ -0,0 +1,17 @@
+import { ProjectScope } from "./ProjectScope.js";
+class ProjectScopeFactory {
+  constructor(schemaAccessNodeFactory) {
+    this.schemaAccessNodeFactory = schemaAccessNodeFactory;
+  }
+  async create(schemaResolver, project) {
+    const schema = await schemaResolver.getSchema(project.slug);
+    if (!schema) {
+      return null;
+    }
+    return new ProjectScope(project, schema.acl, this.schemaAccessNodeFactory);
+  }
+}
+export {
+  ProjectScopeFactory
+};
+//# sourceMappingURL=ProjectScopeFactory.js.map

package/dist/development/src/model/authorization/ProjectScopeFactory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProjectScopeFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/ProjectScopeFactory.ts"],"sourcesContent":["import { Project, ProjectSchemaResolver } from '../type'\nimport { AclSchemaAccessNodeFactory } from './AclSchemaAccessNodeFactory'\nimport { AuthorizationScope } from '@contember/authorization'\nimport { ProjectScope } from './ProjectScope'\nimport { Identity } from './Identity'\n\nexport class ProjectScopeFactory {\n\tconstructor(\n\t\tprivate readonly schemaAccessNodeFactory: AclSchemaAccessNodeFactory,\n\t) {}\n\n\tasync create(schemaResolver: ProjectSchemaResolver, project: Pick<Project, 'slug'>): Promise<AuthorizationScope<Identity> | null> {\n\t\tconst schema = await schemaResolver.getSchema(project.slug)\n\t\tif (!schema) {\n\t\t\treturn null\n\t\t}\n\t\treturn new ProjectScope(project, schema.acl, this.schemaAccessNodeFactory)\n\t}\n}\n"],"names":[],"mappings":";AAMO,MAAM,oBAAoB;AAAA,EAChC,YACkB,yBAChB;AADgB,SAAA,0BAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,gBAAuC,SAA8E;AACjI,UAAM,SAAS,MAAM,eAAe,UAAU,QAAQ,IAAI;AAC1D,QAAI,CAAC,QAAQ;AACZ,aAAO;AAAA,IACR;AACA,WAAO,IAAI,aAAa,SAAS,OAAO,KAAK,KAAK,uBAAuB;AAAA,EAC1E;AACD;"}

package/dist/development/src/model/authorization/Roles.cjs

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+var TenantRole = /* @__PURE__ */ ((TenantRole2) => {
+  TenantRole2["LOGIN"] = "login";
+  TenantRole2["SELF"] = "self";
+  TenantRole2["PERSON"] = "person";
+  TenantRole2["SUPER_ADMIN"] = "super_admin";
+  TenantRole2["PROJECT_CREATOR"] = "project_creator";
+  TenantRole2["PROJECT_MEMBER"] = "project_member";
+  TenantRole2["PROJECT_ADMIN"] = "project_admin";
+  TenantRole2["ENTRYPOINT_DEPLOYER"] = "entrypoint_deployer";
+  return TenantRole2;
+})(TenantRole || {});
+exports.TenantRole = TenantRole;
+//# sourceMappingURL=Roles.cjs.map

package/dist/development/src/model/authorization/Roles.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"Roles.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/Roles.ts"],"sourcesContent":["export enum TenantRole {\n\tLOGIN = 'login',\n\tSELF = 'self',\n\tPERSON = 'person',\n\tSUPER_ADMIN = 'super_admin',\n\tPROJECT_CREATOR = 'project_creator',\n\tPROJECT_MEMBER = 'project_member',\n\tPROJECT_ADMIN = 'project_admin',\n\tENTRYPOINT_DEPLOYER = 'entrypoint_deployer',\n}\n"],"names":["TenantRole"],"mappings":";;AAAO,IAAK,+BAAAA,gBAAL;AACNA,cAAA,OAAA,IAAQ;AACRA,cAAA,MAAA,IAAO;AACPA,cAAA,QAAA,IAAS;AACTA,cAAA,aAAA,IAAc;AACdA,cAAA,iBAAA,IAAkB;AAClBA,cAAA,gBAAA,IAAiB;AACjBA,cAAA,eAAA,IAAgB;AAChBA,cAAA,qBAAA,IAAsB;AARX,SAAAA;AAAA,GAAA,cAAA,CAAA,CAAA;;"}

package/dist/development/src/model/authorization/Roles.js

@@ -0,0 +1,15 @@
+var TenantRole = /* @__PURE__ */ ((TenantRole2) => {
+  TenantRole2["LOGIN"] = "login";
+  TenantRole2["SELF"] = "self";
+  TenantRole2["PERSON"] = "person";
+  TenantRole2["SUPER_ADMIN"] = "super_admin";
+  TenantRole2["PROJECT_CREATOR"] = "project_creator";
+  TenantRole2["PROJECT_MEMBER"] = "project_member";
+  TenantRole2["PROJECT_ADMIN"] = "project_admin";
+  TenantRole2["ENTRYPOINT_DEPLOYER"] = "entrypoint_deployer";
+  return TenantRole2;
+})(TenantRole || {});
+export {
+  TenantRole
+};
+//# sourceMappingURL=Roles.js.map

package/dist/development/src/model/authorization/Roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Roles.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/Roles.ts"],"sourcesContent":["export enum TenantRole {\n\tLOGIN = 'login',\n\tSELF = 'self',\n\tPERSON = 'person',\n\tSUPER_ADMIN = 'super_admin',\n\tPROJECT_CREATOR = 'project_creator',\n\tPROJECT_MEMBER = 'project_member',\n\tPROJECT_ADMIN = 'project_admin',\n\tENTRYPOINT_DEPLOYER = 'entrypoint_deployer',\n}\n"],"names":["TenantRole"],"mappings":"AAAO,IAAK,+BAAAA,gBAAL;AACNA,cAAA,OAAA,IAAQ;AACRA,cAAA,MAAA,IAAO;AACPA,cAAA,QAAA,IAAS;AACTA,cAAA,aAAA,IAAc;AACdA,cAAA,iBAAA,IAAkB;AAClBA,cAAA,gBAAA,IAAiB;AACjBA,cAAA,eAAA,IAAgB;AAChBA,cAAA,qBAAA,IAAsB;AARX,SAAAA;AAAA,GAAA,cAAA,CAAA,CAAA;"}

package/dist/development/src/model/commands/CommandBus.cjs

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+class CommandBus {
+  constructor(client, providers) {
+    this.client = client;
+    this.providers = providers;
+  }
+  async execute(command) {
+    return await command.execute({ db: this.client, providers: this.providers, bus: this });
+  }
+  async transaction(transactionScope) {
+    return await this.client.transaction((client) => transactionScope(new CommandBus(client, this.providers)));
+  }
+}
+exports.CommandBus = CommandBus;
+//# sourceMappingURL=CommandBus.cjs.map

package/dist/development/src/model/commands/CommandBus.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"CommandBus.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/commands/CommandBus.ts"],"sourcesContent":["import { Command } from './Command'\nimport { Client, Connection } from '@contember/database'\nimport { Providers } from '../providers'\n\nexport class CommandBus<ConnectionType extends Connection.ConnectionLike = Connection.ConnectionLike> {\n\tconstructor(public readonly client: Client<ConnectionType>, private readonly providers: Providers) {}\n\n\tpublic async execute<T>(command: Command<T>): Promise<T> {\n\t\treturn await command.execute({ db: this.client, providers: this.providers, bus: this })\n\t}\n\n\tasync transaction<T>(\n\t\ttransactionScope: (wrapper: CommandBus<Connection.TransactionLike>) => Promise<T> | T,\n\t): Promise<T> {\n\t\treturn await this.client.transaction(client => transactionScope(new CommandBus<Connection.TransactionLike>(client, this.providers)))\n\t}\n}\n"],"names":[],"mappings":";;AAIO,MAAM,WAAyF;AAAA,EACrG,YAA4B,QAAiD,WAAsB;AAAvE,SAAA,SAAA;AAAiD,SAAA,YAAA;AAAA,EAAuB;AAAA,EAEpG,MAAa,QAAW,SAAiC;AACxD,WAAO,MAAM,QAAQ,QAAQ,EAAE,IAAI,KAAK,QAAQ,WAAW,KAAK,WAAW,KAAK,KAAA,CAAM;AAAA,EACvF;AAAA,EAEA,MAAM,YACL,kBACa;AACb,WAAO,MAAM,KAAK,OAAO,YAAY,CAAA,WAAU,iBAAiB,IAAI,WAAuC,QAAQ,KAAK,SAAS,CAAC,CAAC;AAAA,EACpI;AACD;;"}

package/dist/development/src/model/commands/CommandBus.js

@@ -0,0 +1,16 @@
+class CommandBus {
+  constructor(client, providers) {
+    this.client = client;
+    this.providers = providers;
+  }
+  async execute(command) {
+    return await command.execute({ db: this.client, providers: this.providers, bus: this });
+  }
+  async transaction(transactionScope) {
+    return await this.client.transaction((client) => transactionScope(new CommandBus(client, this.providers)));
+  }
+}
+export {
+  CommandBus
+};
+//# sourceMappingURL=CommandBus.js.map

package/dist/development/src/model/commands/CommandBus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CommandBus.js","sources":["../../../../../../packages/engine-tenant-api/src/model/commands/CommandBus.ts"],"sourcesContent":["import { Command } from './Command'\nimport { Client, Connection } from '@contember/database'\nimport { Providers } from '../providers'\n\nexport class CommandBus<ConnectionType extends Connection.ConnectionLike = Connection.ConnectionLike> {\n\tconstructor(public readonly client: Client<ConnectionType>, private readonly providers: Providers) {}\n\n\tpublic async execute<T>(command: Command<T>): Promise<T> {\n\t\treturn await command.execute({ db: this.client, providers: this.providers, bus: this })\n\t}\n\n\tasync transaction<T>(\n\t\ttransactionScope: (wrapper: CommandBus<Connection.TransactionLike>) => Promise<T> | T,\n\t): Promise<T> {\n\t\treturn await this.client.transaction(client => transactionScope(new CommandBus<Connection.TransactionLike>(client, this.providers)))\n\t}\n}\n"],"names":[],"mappings":"AAIO,MAAM,WAAyF;AAAA,EACrG,YAA4B,QAAiD,WAAsB;AAAvE,SAAA,SAAA;AAAiD,SAAA,YAAA;AAAA,EAAuB;AAAA,EAEpG,MAAa,QAAW,SAAiC;AACxD,WAAO,MAAM,QAAQ,QAAQ,EAAE,IAAI,KAAK,QAAQ,WAAW,KAAK,WAAW,KAAK,KAAA,CAAM;AAAA,EACvF;AAAA,EAEA,MAAM,YACL,kBACa;AACb,WAAO,MAAM,KAAK,OAAO,YAAY,CAAA,WAAU,iBAAiB,IAAI,WAAuC,QAAQ,KAAK,SAAS,CAAC,CAAC;AAAA,EACpI;AACD;"}

package/dist/development/src/model/commands/apiKey/ApiKeyHelper.cjs

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const ApiKey = require("../../type/ApiKey.cjs");
+const time = require("../../utils/time.cjs");
+const DEFAULT_EXPIRATION = 30;
+class ApiKeyHelper {
+  static getExpiration(providers, type, expiration) {
+    switch (type) {
+      case ApiKey.ApiKey.Type.PERMANENT:
+        return null;
+      case ApiKey.ApiKey.Type.SESSION:
+        return time.plusMinutes(providers.now(), expiration || DEFAULT_EXPIRATION);
+      case ApiKey.ApiKey.Type.ONE_OFF:
+        return null;
+    }
+  }
+}
+exports.ApiKeyHelper = ApiKeyHelper;
+//# sourceMappingURL=ApiKeyHelper.cjs.map

package/dist/development/src/model/commands/apiKey/ApiKeyHelper.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiKeyHelper.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/ApiKeyHelper.ts"],"sourcesContent":["import { ApiKey } from '../../type'\nimport { Providers } from '../../providers'\nimport { plusMinutes } from '../../utils/time'\n\nconst DEFAULT_EXPIRATION = 30\nexport class ApiKeyHelper {\n\tpublic static getExpiration(providers: Providers, type: ApiKey.Type, expiration?: number | null): Date | null {\n\t\tswitch (type) {\n\t\t\tcase ApiKey.Type.PERMANENT:\n\t\t\t\treturn null\n\n\t\t\tcase ApiKey.Type.SESSION:\n\t\t\t\treturn plusMinutes(providers.now(), expiration || DEFAULT_EXPIRATION)\n\n\t\t\tcase ApiKey.Type.ONE_OFF:\n\t\t\t\treturn null\n\t\t}\n\t}\n}\n"],"names":["ApiKey","plusMinutes"],"mappings":";;;;AAIA,MAAM,qBAAqB;AACpB,MAAM,aAAa;AAAA,EACzB,OAAc,cAAc,WAAsB,MAAmB,YAAyC;AAC7G,YAAQ,MAAA;AAAA,MACP,KAAKA,OAAAA,OAAO,KAAK;AAChB,eAAO;AAAA,MAER,KAAKA,OAAAA,OAAO,KAAK;AAChB,eAAOC,KAAAA,YAAY,UAAU,IAAA,GAAO,cAAc,kBAAkB;AAAA,MAErE,KAAKD,OAAAA,OAAO,KAAK;AAChB,eAAO;AAAA,IAAA;AAAA,EAEV;AACD;;"}

package/dist/development/src/model/commands/apiKey/ApiKeyHelper.js

@@ -0,0 +1,19 @@
+import { ApiKey } from "../../type/ApiKey.js";
+import { plusMinutes } from "../../utils/time.js";
+const DEFAULT_EXPIRATION = 30;
+class ApiKeyHelper {
+  static getExpiration(providers, type, expiration) {
+    switch (type) {
+      case ApiKey.Type.PERMANENT:
+        return null;
+      case ApiKey.Type.SESSION:
+        return plusMinutes(providers.now(), expiration || DEFAULT_EXPIRATION);
+      case ApiKey.Type.ONE_OFF:
+        return null;
+    }
+  }
+}
+export {
+  ApiKeyHelper
+};
+//# sourceMappingURL=ApiKeyHelper.js.map

package/dist/development/src/model/commands/apiKey/ApiKeyHelper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiKeyHelper.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/ApiKeyHelper.ts"],"sourcesContent":["import { ApiKey } from '../../type'\nimport { Providers } from '../../providers'\nimport { plusMinutes } from '../../utils/time'\n\nconst DEFAULT_EXPIRATION = 30\nexport class ApiKeyHelper {\n\tpublic static getExpiration(providers: Providers, type: ApiKey.Type, expiration?: number | null): Date | null {\n\t\tswitch (type) {\n\t\t\tcase ApiKey.Type.PERMANENT:\n\t\t\t\treturn null\n\n\t\t\tcase ApiKey.Type.SESSION:\n\t\t\t\treturn plusMinutes(providers.now(), expiration || DEFAULT_EXPIRATION)\n\n\t\t\tcase ApiKey.Type.ONE_OFF:\n\t\t\t\treturn null\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;AAIA,MAAM,qBAAqB;AACpB,MAAM,aAAa;AAAA,EACzB,OAAc,cAAc,WAAsB,MAAmB,YAAyC;AAC7G,YAAQ,MAAA;AAAA,MACP,KAAK,OAAO,KAAK;AAChB,eAAO;AAAA,MAER,KAAK,OAAO,KAAK;AAChB,eAAO,YAAY,UAAU,IAAA,GAAO,cAAc,kBAAkB;AAAA,MAErE,KAAK,OAAO,KAAK;AAChB,eAAO;AAAA,IAAA;AAAA,EAEV;AACD;"}

package/dist/development/src/model/commands/apiKey/CreateApiKeyCommand.cjs

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const ApiKeyHelper = require("./ApiKeyHelper.cjs");
+const Database = require("@contember/database");
+require("../../type/ApiKey.cjs");
+const token = require("../../utils/token.cjs");
+class CreateApiKeyCommand {
+  constructor(args) {
+    this.args = args;
+  }
+  async execute({ db, providers }) {
+    const apiKeyId = providers.uuid();
+    let token$1;
+    let tokenHash = this.args.tokenHash;
+    if (!tokenHash) {
+      token$1 = await token.generateToken(providers);
+      tokenHash = token.computeTokenHash(token$1);
+    }
+    await Database.InsertBuilder.create().into("api_key").values({
+      id: apiKeyId,
+      token_hash: tokenHash,
+      type: this.args.type,
+      identity_id: this.args.identityId,
+      disabled_at: null,
+      expires_at: ApiKeyHelper.ApiKeyHelper.getExpiration(providers, this.args.type, this.args.expiration),
+      expiration: this.args.expiration || null,
+      created_at: providers.now()
+    }).execute(db);
+    return new CreateApiKeyCommandResult(apiKeyId, token$1);
+  }
+}
+class CreateApiKeyCommandResult {
+  constructor(id, token2) {
+    this.id = id;
+    this.token = token2;
+  }
+}
+exports.CreateApiKeyCommand = CreateApiKeyCommand;
+exports.CreateApiKeyCommandResult = CreateApiKeyCommandResult;
+//# sourceMappingURL=CreateApiKeyCommand.cjs.map

package/dist/development/src/model/commands/apiKey/CreateApiKeyCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateApiKeyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/CreateApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ApiKey } from '../../type'\nimport { ApiKeyHelper } from './ApiKeyHelper'\nimport { InsertBuilder } from '@contember/database'\nimport { computeTokenHash, generateToken, TokenHash } from '../../utils'\n\ninterface CreateSessionApiKeyArgs {\n\ttype: ApiKey.Type.SESSION\n\tidentityId: string\n\texpiration?: number\n\ttokenHash?: string\n}\n\ninterface CreatePermanentApiKeyArgs {\n\ttype: ApiKey.Type.PERMANENT\n\tidentityId: string\n\ttokenHash?: TokenHash\n\texpiration?: undefined\n}\n\nexport type CreateApiKeyArgs =\n\t| CreateSessionApiKeyArgs\n\t| CreatePermanentApiKeyArgs\n\nexport class CreateApiKeyCommand implements Command<CreateApiKeyCommandResult> {\n\tconstructor(private args: CreateApiKeyArgs) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<CreateApiKeyCommandResult> {\n\t\tconst apiKeyId = providers.uuid()\n\t\tlet token\n\t\tlet tokenHash = this.args.tokenHash\n\t\tif (!tokenHash) {\n\t\t\ttoken = await generateToken(providers)\n\t\t\ttokenHash = computeTokenHash(token)\n\t\t}\n\n\t\tawait InsertBuilder.create()\n\t\t\t.into('api_key')\n\t\t\t.values({\n\t\t\t\tid: apiKeyId,\n\t\t\t\ttoken_hash: tokenHash,\n\t\t\t\ttype: this.args.type,\n\t\t\t\tidentity_id: this.args.identityId,\n\t\t\t\tdisabled_at: null,\n\t\t\t\texpires_at: ApiKeyHelper.getExpiration(providers, this.args.type, this.args.expiration),\n\t\t\t\texpiration: this.args.expiration || null,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn new CreateApiKeyCommandResult(apiKeyId, token)\n\t}\n}\n\nexport class CreateApiKeyCommandResult {\n\tconstructor(public readonly id: string, public readonly token?: string) {\n\t}\n}\n"],"names":["token","generateToken","computeTokenHash","InsertBuilder","ApiKeyHelper"],"mappings":";;;;;;AAwBO,MAAM,oBAAkE;AAAA,EAC9E,YAAoB,MAAwB;AAAxB,SAAA,OAAA;AAAA,EAAyB;AAAA,EAE7C,MAAM,QAAQ,EAAE,IAAI,aAA+D;AAClF,UAAM,WAAW,UAAU,KAAA;AAC3B,QAAIA;AACJ,QAAI,YAAY,KAAK,KAAK;AAC1B,QAAI,CAAC,WAAW;AACfA,gBAAQ,MAAMC,MAAAA,cAAc,SAAS;AACrC,kBAAYC,MAAAA,iBAAiBF,OAAK;AAAA,IACnC;AAEA,UAAMG,SAAAA,cAAc,OAAA,EAClB,KAAK,SAAS,EACd,OAAO;AAAA,MACP,IAAI;AAAA,MACJ,YAAY;AAAA,MACZ,MAAM,KAAK,KAAK;AAAA,MAChB,aAAa,KAAK,KAAK;AAAA,MACvB,aAAa;AAAA,MACb,YAAYC,aAAAA,aAAa,cAAc,WAAW,KAAK,KAAK,MAAM,KAAK,KAAK,UAAU;AAAA,MACtF,YAAY,KAAK,KAAK,cAAc;AAAA,MACpC,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,QAAQ,EAAE;AAEZ,WAAO,IAAI,0BAA0B,UAAUJ,OAAK;AAAA,EACrD;AACD;AAEO,MAAM,0BAA0B;AAAA,EACtC,YAA4B,IAA4BA,QAAgB;AAA5C,SAAA,KAAA;AAA4B,SAAA,QAAAA;AAAA,EACxD;AACD;;;"}

package/dist/development/src/model/commands/apiKey/CreateApiKeyCommand.js

@@ -0,0 +1,40 @@
+import { ApiKeyHelper } from "./ApiKeyHelper.js";
+import { InsertBuilder as InsertBuilder$1 } from "@contember/database";
+import "../../type/ApiKey.js";
+import { generateToken, computeTokenHash } from "../../utils/token.js";
+class CreateApiKeyCommand {
+  constructor(args) {
+    this.args = args;
+  }
+  async execute({ db, providers }) {
+    const apiKeyId = providers.uuid();
+    let token;
+    let tokenHash = this.args.tokenHash;
+    if (!tokenHash) {
+      token = await generateToken(providers);
+      tokenHash = computeTokenHash(token);
+    }
+    await InsertBuilder$1.create().into("api_key").values({
+      id: apiKeyId,
+      token_hash: tokenHash,
+      type: this.args.type,
+      identity_id: this.args.identityId,
+      disabled_at: null,
+      expires_at: ApiKeyHelper.getExpiration(providers, this.args.type, this.args.expiration),
+      expiration: this.args.expiration || null,
+      created_at: providers.now()
+    }).execute(db);
+    return new CreateApiKeyCommandResult(apiKeyId, token);
+  }
+}
+class CreateApiKeyCommandResult {
+  constructor(id, token) {
+    this.id = id;
+    this.token = token;
+  }
+}
+export {
+  CreateApiKeyCommand,
+  CreateApiKeyCommandResult
+};
+//# sourceMappingURL=CreateApiKeyCommand.js.map

package/dist/development/src/model/commands/apiKey/CreateApiKeyCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateApiKeyCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/CreateApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ApiKey } from '../../type'\nimport { ApiKeyHelper } from './ApiKeyHelper'\nimport { InsertBuilder } from '@contember/database'\nimport { computeTokenHash, generateToken, TokenHash } from '../../utils'\n\ninterface CreateSessionApiKeyArgs {\n\ttype: ApiKey.Type.SESSION\n\tidentityId: string\n\texpiration?: number\n\ttokenHash?: string\n}\n\ninterface CreatePermanentApiKeyArgs {\n\ttype: ApiKey.Type.PERMANENT\n\tidentityId: string\n\ttokenHash?: TokenHash\n\texpiration?: undefined\n}\n\nexport type CreateApiKeyArgs =\n\t| CreateSessionApiKeyArgs\n\t| CreatePermanentApiKeyArgs\n\nexport class CreateApiKeyCommand implements Command<CreateApiKeyCommandResult> {\n\tconstructor(private args: CreateApiKeyArgs) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<CreateApiKeyCommandResult> {\n\t\tconst apiKeyId = providers.uuid()\n\t\tlet token\n\t\tlet tokenHash = this.args.tokenHash\n\t\tif (!tokenHash) {\n\t\t\ttoken = await generateToken(providers)\n\t\t\ttokenHash = computeTokenHash(token)\n\t\t}\n\n\t\tawait InsertBuilder.create()\n\t\t\t.into('api_key')\n\t\t\t.values({\n\t\t\t\tid: apiKeyId,\n\t\t\t\ttoken_hash: tokenHash,\n\t\t\t\ttype: this.args.type,\n\t\t\t\tidentity_id: this.args.identityId,\n\t\t\t\tdisabled_at: null,\n\t\t\t\texpires_at: ApiKeyHelper.getExpiration(providers, this.args.type, this.args.expiration),\n\t\t\t\texpiration: this.args.expiration || null,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn new CreateApiKeyCommandResult(apiKeyId, token)\n\t}\n}\n\nexport class CreateApiKeyCommandResult {\n\tconstructor(public readonly id: string, public readonly token?: string) {\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;;AAwBO,MAAM,oBAAkE;AAAA,EAC9E,YAAoB,MAAwB;AAAxB,SAAA,OAAA;AAAA,EAAyB;AAAA,EAE7C,MAAM,QAAQ,EAAE,IAAI,aAA+D;AAClF,UAAM,WAAW,UAAU,KAAA;AAC3B,QAAI;AACJ,QAAI,YAAY,KAAK,KAAK;AAC1B,QAAI,CAAC,WAAW;AACf,cAAQ,MAAM,cAAc,SAAS;AACrC,kBAAY,iBAAiB,KAAK;AAAA,IACnC;AAEA,UAAMA,gBAAc,OAAA,EAClB,KAAK,SAAS,EACd,OAAO;AAAA,MACP,IAAI;AAAA,MACJ,YAAY;AAAA,MACZ,MAAM,KAAK,KAAK;AAAA,MAChB,aAAa,KAAK,KAAK;AAAA,MACvB,aAAa;AAAA,MACb,YAAY,aAAa,cAAc,WAAW,KAAK,KAAK,MAAM,KAAK,KAAK,UAAU;AAAA,MACtF,YAAY,KAAK,KAAK,cAAc;AAAA,MACpC,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,QAAQ,EAAE;AAEZ,WAAO,IAAI,0BAA0B,UAAU,KAAK;AAAA,EACrD;AACD;AAEO,MAAM,0BAA0B;AAAA,EACtC,YAA4B,IAA4B,OAAgB;AAA5C,SAAA,KAAA;AAA4B,SAAA,QAAA;AAAA,EACxD;AACD;"}

package/dist/development/src/model/commands/apiKey/DisableApiKeyCommand.cjs

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class DisableApiKeyCommand {
+  constructor(apiKeyId) {
+    this.apiKeyId = apiKeyId;
+  }
+  async execute({ db }) {
+    const qb = Database.UpdateBuilder.create().table("api_key").where({
+      id: this.apiKeyId
+    }).values({ disabled_at: /* @__PURE__ */ new Date() });
+    return await qb.execute(db) > 0;
+  }
+}
+exports.DisableApiKeyCommand = DisableApiKeyCommand;
+//# sourceMappingURL=DisableApiKeyCommand.cjs.map

package/dist/development/src/model/commands/apiKey/DisableApiKeyCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"DisableApiKeyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/DisableApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class DisableApiKeyCommand implements Command<boolean> {\n\tconstructor(private readonly apiKeyId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({\n\t\t\t\tid: this.apiKeyId,\n\t\t\t})\n\t\t\t.values({ disabled_at: new Date() })\n\n\t\treturn (await qb.execute(db)) > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAGO,MAAM,qBAAiD;AAAA,EAC7D,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,KAAKA,SAAAA,cAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,OAAO,EAAE,aAAa,oBAAI,KAAA,GAAQ;AAEpC,WAAQ,MAAM,GAAG,QAAQ,EAAE,IAAK;AAAA,EACjC;AACD;;"}

package/dist/development/src/model/commands/apiKey/DisableApiKeyCommand.js

@@ -0,0 +1,16 @@
+import { UpdateBuilder as UpdateBuilder$1 } from "@contember/database";
+class DisableApiKeyCommand {
+  constructor(apiKeyId) {
+    this.apiKeyId = apiKeyId;
+  }
+  async execute({ db }) {
+    const qb = UpdateBuilder$1.create().table("api_key").where({
+      id: this.apiKeyId
+    }).values({ disabled_at: /* @__PURE__ */ new Date() });
+    return await qb.execute(db) > 0;
+  }
+}
+export {
+  DisableApiKeyCommand
+};
+//# sourceMappingURL=DisableApiKeyCommand.js.map

package/dist/development/src/model/commands/apiKey/DisableApiKeyCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DisableApiKeyCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/DisableApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class DisableApiKeyCommand implements Command<boolean> {\n\tconstructor(private readonly apiKeyId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({\n\t\t\t\tid: this.apiKeyId,\n\t\t\t})\n\t\t\t.values({ disabled_at: new Date() })\n\n\t\treturn (await qb.execute(db)) > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAGO,MAAM,qBAAiD;AAAA,EAC7D,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,KAAKA,gBAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,OAAO,EAAE,aAAa,oBAAI,KAAA,GAAQ;AAEpC,WAAQ,MAAM,GAAG,QAAQ,EAAE,IAAK;AAAA,EACjC;AACD;"}

package/dist/development/src/model/commands/apiKey/DisableIdentityApiKeysCommand.cjs

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class DisableIdentityApiKeysCommand {
+  constructor(identityId) {
+    this.identityId = identityId;
+  }
+  async execute({ db }) {
+    const qb = Database.UpdateBuilder.create().table("api_key").where({
+      identity_id: this.identityId
+    }).values({ disabled_at: /* @__PURE__ */ new Date() });
+    await qb.execute(db);
+  }
+}
+exports.DisableIdentityApiKeysCommand = DisableIdentityApiKeysCommand;
+//# sourceMappingURL=DisableIdentityApiKeysCommand.cjs.map

package/dist/development/src/model/commands/apiKey/DisableIdentityApiKeysCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"DisableIdentityApiKeysCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/DisableIdentityApiKeysCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class DisableIdentityApiKeysCommand implements Command<void> {\n\tconstructor(private readonly identityId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t})\n\t\t\t.values({ disabled_at: new Date() })\n\n\t\tawait qb.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAGO,MAAM,8BAAuD;AAAA,EACnE,YAA6B,YAAoB;AAApB,SAAA,aAAA;AAAA,EAAqB;AAAA,EAElD,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM,KAAKA,SAAAA,cAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM;AAAA,MACN,aAAa,KAAK;AAAA,IAAA,CAClB,EACA,OAAO,EAAE,aAAa,oBAAI,KAAA,GAAQ;AAEpC,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AACD;;"}