npm - @contember/engine-tenant-api - Versions diffs - 2.1.0-beta.1 → 2.2.0-alpha.1 - Mend

@contember/engine-tenant-api 2.1.0-beta.1 → 2.2.0-alpha.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3102) hide show

package/dist/production/src/model/authorization/AclSchemaAccessNodeFactory.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"AclSchemaAccessNodeFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/AclSchemaAccessNodeFactory.ts"],"sourcesContent":["import { AccessNode } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions'\nimport { Acl } from '@contember/schema'\nimport { MembershipMatcher } from './MembershipMatcher'\nimport { DirectPermissionsAccessNode } from './DirectPermissionsAccessNode'\n\nexport class AclSchemaAccessNodeFactory {\n\tcreate(schema: Acl.Schema, memberships: readonly Acl.Membership[]): AccessNode {\n\t\tconst createVerifier = (getRule: (permissions: Acl.TenantPermissions) => Acl.MembershipMatchRule) => {\n\t\t\tconst membershipMatcher = new MembershipMatcher(memberships.map(it => ({\n\t\t\t\t...it,\n\t\t\t\tmatchRule: getRule(schema.roles[it.role]?.tenant ?? {}),\n\t\t\t})))\n\n\t\t\treturn ({ memberships }: { memberships: readonly Acl.Membership[] }) => {\n\t\t\t\treturn memberships.every(it => membershipMatcher.matches(it))\n\t\t\t}\n\t\t}\n\n\t\tconst membershipRoles = memberships.map(it => schema.roles[it.role]).filter(it => !!it)\n\t\tconst node = new DirectPermissionsAccessNode()\n\n\t\tif (membershipRoles.some(it => it.tenant?.invite)) {\n\t\t\tconst verifier = createVerifier(it => it.invite && it.invite !== true ? it.invite : it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PERSON_INVITE([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.unmanagedInvite)) {\n\t\t\tconst verifier = createVerifier(it => it.unmanagedInvite && it.unmanagedInvite !== true ? it.unmanagedInvite : it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PERSON_INVITE_UNMANAGED([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.manage)) {\n\t\t\tconst verifier = createVerifier(it => it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PROJECT_ADD_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_UPDATE_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_REMOVE_MEMBER([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.view)) {\n\t\t\tconst verifier = createVerifier(it => it.view ?? {})\n\t\t\tnode.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)\n\t\t}\n\n\t\treturn node\n\t}\n}\n"],"names":["MembershipMatcher","memberships","DirectPermissionsAccessNode","PermissionActions"],"mappings":";;;;;AAMO,MAAM,2BAA2B;AAAA,EACvC,OAAO,QAAoB,aAAoD;AAC9E,UAAM,iBAAiB,CAAC,YAA6E;AACpG,YAAM,oBAAoB,IAAIA,kBAAAA,kBAAkB,YAAY,IAAI,CAAA,QAAO;AAAA,QACtE,GAAG;AAAA,QACH,WAAW,QAAQ,OAAO,MAAM,GAAG,IAAI,GAAG,UAAU,CAAA,CAAE;AAAA,MAAA,EACrD,CAAC;AAEH,aAAO,CAAC,EAAE,aAAAC,mBAA8D;AACvE,eAAOA,aAAY,MAAM,CAAA,OAAM,kBAAkB,QAAQ,EAAE,CAAC;AAAA,MAC7D;AAAA,IACD;AAEA,UAAM,kBAAkB,YAAY,IAAI,CAAA,OAAM,OAAO,MAAM,GAAG,IAAI,CAAC,EAAE,OAAO,CAAA,OAAM,CAAC,CAAC,EAAE;AACtF,UAAM,OAAO,IAAIC,wDAAA;AAEjB,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,MAAM,GAAG;AAClD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,UAAU,GAAG,WAAW,OAAO,GAAG,SAAS,GAAG,UAAU,CAAA,CAAE;AACnG,WAAK,MAAMC,kBAAAA,kBAAkB,cAAc,CAAA,CAAE,GAAG,QAAQ;AAAA,IACzD;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,eAAe,GAAG;AAC3D,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,mBAAmB,GAAG,oBAAoB,OAAO,GAAG,kBAAkB,GAAG,UAAU,CAAA,CAAE;AAC9H,WAAK,MAAMA,kBAAAA,kBAAkB,wBAAwB,CAAA,CAAE,GAAG,QAAQ;AAAA,IACnE;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,MAAM,GAAG;AAClD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,UAAU,EAAE;AACrD,WAAK,MAAMA,kBAAAA,kBAAkB,mBAAmB,CAAA,CAAE,GAAG,QAAQ;AAC7D,WAAK,MAAMA,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,GAAG,QAAQ;AAC9D,WAAK,MAAMA,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,GAAG,QAAQ;AAChE,WAAK,MAAMA,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,GAAG,QAAQ;AAAA,IACjE;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,IAAI,GAAG;AAChD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,QAAQ,EAAE;AACnD,WAAK,MAAMA,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,GAAG,QAAQ;AAAA,IAC/D;AAEA,WAAO;AAAA,EACR;AACD;;"}
1	+ {"version":3,"file":"AclSchemaAccessNodeFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/AclSchemaAccessNodeFactory.ts"],"sourcesContent":["import { AccessNode } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions.js'\nimport { Acl } from '@contember/schema'\nimport { MembershipMatcher } from './MembershipMatcher.js'\nimport { DirectPermissionsAccessNode } from './DirectPermissionsAccessNode.js'\n\nexport class AclSchemaAccessNodeFactory {\n\tcreate(schema: Acl.Schema, memberships: readonly Acl.Membership[]): AccessNode {\n\t\tconst createVerifier = (getRule: (permissions: Acl.TenantPermissions) => Acl.MembershipMatchRule) => {\n\t\t\tconst membershipMatcher = new MembershipMatcher(memberships.map(it => ({\n\t\t\t\t...it,\n\t\t\t\tmatchRule: getRule(schema.roles[it.role]?.tenant ?? {}),\n\t\t\t})))\n\n\t\t\treturn ({ memberships }: { memberships: readonly Acl.Membership[] }) => {\n\t\t\t\treturn memberships.every(it => membershipMatcher.matches(it))\n\t\t\t}\n\t\t}\n\n\t\tconst membershipRoles = memberships.map(it => schema.roles[it.role]).filter(it => !!it)\n\t\tconst node = new DirectPermissionsAccessNode()\n\n\t\tif (membershipRoles.some(it => it.tenant?.invite)) {\n\t\t\tconst verifier = createVerifier(it => it.invite && it.invite !== true ? it.invite : it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PERSON_INVITE([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.unmanagedInvite)) {\n\t\t\tconst verifier = createVerifier(it => it.unmanagedInvite && it.unmanagedInvite !== true ? it.unmanagedInvite : it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PERSON_INVITE_UNMANAGED([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.manage)) {\n\t\t\tconst verifier = createVerifier(it => it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PROJECT_ADD_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_UPDATE_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_REMOVE_MEMBER([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.view)) {\n\t\t\tconst verifier = createVerifier(it => it.view ?? {})\n\t\t\tnode.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)\n\t\t}\n\n\t\treturn node\n\t}\n}\n"],"names":["MembershipMatcher","memberships","DirectPermissionsAccessNode","PermissionActions"],"mappings":";;;;;AAMO,MAAM,2BAA2B;AAAA,EACvC,OAAO,QAAoB,aAAoD;AAC9E,UAAM,iBAAiB,CAAC,YAA6E;AACpG,YAAM,oBAAoB,IAAIA,kBAAAA,kBAAkB,YAAY,IAAI,CAAA,QAAO;AAAA,QACtE,GAAG;AAAA,QACH,WAAW,QAAQ,OAAO,MAAM,GAAG,IAAI,GAAG,UAAU,CAAA,CAAE;AAAA,MAAA,EACrD,CAAC;AAEH,aAAO,CAAC,EAAE,aAAAC,mBAA8D;AACvE,eAAOA,aAAY,MAAM,CAAA,OAAM,kBAAkB,QAAQ,EAAE,CAAC;AAAA,MAC7D;AAAA,IACD;AAEA,UAAM,kBAAkB,YAAY,IAAI,CAAA,OAAM,OAAO,MAAM,GAAG,IAAI,CAAC,EAAE,OAAO,CAAA,OAAM,CAAC,CAAC,EAAE;AACtF,UAAM,OAAO,IAAIC,wDAAA;AAEjB,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,MAAM,GAAG;AAClD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,UAAU,GAAG,WAAW,OAAO,GAAG,SAAS,GAAG,UAAU,CAAA,CAAE;AACnG,WAAK,MAAMC,kBAAAA,kBAAkB,cAAc,CAAA,CAAE,GAAG,QAAQ;AAAA,IACzD;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,eAAe,GAAG;AAC3D,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,mBAAmB,GAAG,oBAAoB,OAAO,GAAG,kBAAkB,GAAG,UAAU,CAAA,CAAE;AAC9H,WAAK,MAAMA,kBAAAA,kBAAkB,wBAAwB,CAAA,CAAE,GAAG,QAAQ;AAAA,IACnE;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,MAAM,GAAG;AAClD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,UAAU,EAAE;AACrD,WAAK,MAAMA,kBAAAA,kBAAkB,mBAAmB,CAAA,CAAE,GAAG,QAAQ;AAC7D,WAAK,MAAMA,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,GAAG,QAAQ;AAC9D,WAAK,MAAMA,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,GAAG,QAAQ;AAChE,WAAK,MAAMA,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,GAAG,QAAQ;AAAA,IACjE;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,IAAI,GAAG;AAChD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,QAAQ,EAAE;AACnD,WAAK,MAAMA,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,GAAG,QAAQ;AAAA,IAC/D;AAEA,WAAO;AAAA,EACR;AACD;;"}

package/dist/production/src/model/authorization/AclSchemaAccessNodeFactory.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"AclSchemaAccessNodeFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/AclSchemaAccessNodeFactory.ts"],"sourcesContent":["import { AccessNode } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions'\nimport { Acl } from '@contember/schema'\nimport { MembershipMatcher } from './MembershipMatcher'\nimport { DirectPermissionsAccessNode } from './DirectPermissionsAccessNode'\n\nexport class AclSchemaAccessNodeFactory {\n\tcreate(schema: Acl.Schema, memberships: readonly Acl.Membership[]): AccessNode {\n\t\tconst createVerifier = (getRule: (permissions: Acl.TenantPermissions) => Acl.MembershipMatchRule) => {\n\t\t\tconst membershipMatcher = new MembershipMatcher(memberships.map(it => ({\n\t\t\t\t...it,\n\t\t\t\tmatchRule: getRule(schema.roles[it.role]?.tenant ?? {}),\n\t\t\t})))\n\n\t\t\treturn ({ memberships }: { memberships: readonly Acl.Membership[] }) => {\n\t\t\t\treturn memberships.every(it => membershipMatcher.matches(it))\n\t\t\t}\n\t\t}\n\n\t\tconst membershipRoles = memberships.map(it => schema.roles[it.role]).filter(it => !!it)\n\t\tconst node = new DirectPermissionsAccessNode()\n\n\t\tif (membershipRoles.some(it => it.tenant?.invite)) {\n\t\t\tconst verifier = createVerifier(it => it.invite && it.invite !== true ? it.invite : it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PERSON_INVITE([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.unmanagedInvite)) {\n\t\t\tconst verifier = createVerifier(it => it.unmanagedInvite && it.unmanagedInvite !== true ? it.unmanagedInvite : it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PERSON_INVITE_UNMANAGED([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.manage)) {\n\t\t\tconst verifier = createVerifier(it => it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PROJECT_ADD_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_UPDATE_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_REMOVE_MEMBER([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.view)) {\n\t\t\tconst verifier = createVerifier(it => it.view ?? {})\n\t\t\tnode.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)\n\t\t}\n\n\t\treturn node\n\t}\n}\n"],"names":["memberships"],"mappings":";;;AAMO,MAAM,2BAA2B;AAAA,EACvC,OAAO,QAAoB,aAAoD;AAC9E,UAAM,iBAAiB,CAAC,YAA6E;AACpG,YAAM,oBAAoB,IAAI,kBAAkB,YAAY,IAAI,CAAA,QAAO;AAAA,QACtE,GAAG;AAAA,QACH,WAAW,QAAQ,OAAO,MAAM,GAAG,IAAI,GAAG,UAAU,CAAA,CAAE;AAAA,MAAA,EACrD,CAAC;AAEH,aAAO,CAAC,EAAE,aAAAA,mBAA8D;AACvE,eAAOA,aAAY,MAAM,CAAA,OAAM,kBAAkB,QAAQ,EAAE,CAAC;AAAA,MAC7D;AAAA,IACD;AAEA,UAAM,kBAAkB,YAAY,IAAI,CAAA,OAAM,OAAO,MAAM,GAAG,IAAI,CAAC,EAAE,OAAO,CAAA,OAAM,CAAC,CAAC,EAAE;AACtF,UAAM,OAAO,IAAI,4BAAA;AAEjB,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,MAAM,GAAG;AAClD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,UAAU,GAAG,WAAW,OAAO,GAAG,SAAS,GAAG,UAAU,CAAA,CAAE;AACnG,WAAK,MAAM,kBAAkB,cAAc,CAAA,CAAE,GAAG,QAAQ;AAAA,IACzD;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,eAAe,GAAG;AAC3D,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,mBAAmB,GAAG,oBAAoB,OAAO,GAAG,kBAAkB,GAAG,UAAU,CAAA,CAAE;AAC9H,WAAK,MAAM,kBAAkB,wBAAwB,CAAA,CAAE,GAAG,QAAQ;AAAA,IACnE;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,MAAM,GAAG;AAClD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,UAAU,EAAE;AACrD,WAAK,MAAM,kBAAkB,mBAAmB,CAAA,CAAE,GAAG,QAAQ;AAC7D,WAAK,MAAM,kBAAkB,oBAAoB,CAAA,CAAE,GAAG,QAAQ;AAC9D,WAAK,MAAM,kBAAkB,sBAAsB,CAAA,CAAE,GAAG,QAAQ;AAChE,WAAK,MAAM,kBAAkB,sBAAsB,CAAA,CAAE,GAAG,QAAQ;AAAA,IACjE;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,IAAI,GAAG;AAChD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,QAAQ,EAAE;AACnD,WAAK,MAAM,kBAAkB,oBAAoB,CAAA,CAAE,GAAG,QAAQ;AAAA,IAC/D;AAEA,WAAO;AAAA,EACR;AACD;"}
1	+ {"version":3,"file":"AclSchemaAccessNodeFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/AclSchemaAccessNodeFactory.ts"],"sourcesContent":["import { AccessNode } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions.js'\nimport { Acl } from '@contember/schema'\nimport { MembershipMatcher } from './MembershipMatcher.js'\nimport { DirectPermissionsAccessNode } from './DirectPermissionsAccessNode.js'\n\nexport class AclSchemaAccessNodeFactory {\n\tcreate(schema: Acl.Schema, memberships: readonly Acl.Membership[]): AccessNode {\n\t\tconst createVerifier = (getRule: (permissions: Acl.TenantPermissions) => Acl.MembershipMatchRule) => {\n\t\t\tconst membershipMatcher = new MembershipMatcher(memberships.map(it => ({\n\t\t\t\t...it,\n\t\t\t\tmatchRule: getRule(schema.roles[it.role]?.tenant ?? {}),\n\t\t\t})))\n\n\t\t\treturn ({ memberships }: { memberships: readonly Acl.Membership[] }) => {\n\t\t\t\treturn memberships.every(it => membershipMatcher.matches(it))\n\t\t\t}\n\t\t}\n\n\t\tconst membershipRoles = memberships.map(it => schema.roles[it.role]).filter(it => !!it)\n\t\tconst node = new DirectPermissionsAccessNode()\n\n\t\tif (membershipRoles.some(it => it.tenant?.invite)) {\n\t\t\tconst verifier = createVerifier(it => it.invite && it.invite !== true ? it.invite : it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PERSON_INVITE([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.unmanagedInvite)) {\n\t\t\tconst verifier = createVerifier(it => it.unmanagedInvite && it.unmanagedInvite !== true ? it.unmanagedInvite : it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PERSON_INVITE_UNMANAGED([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.manage)) {\n\t\t\tconst verifier = createVerifier(it => it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PROJECT_ADD_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_UPDATE_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_REMOVE_MEMBER([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.view)) {\n\t\t\tconst verifier = createVerifier(it => it.view ?? {})\n\t\t\tnode.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)\n\t\t}\n\n\t\treturn node\n\t}\n}\n"],"names":["memberships"],"mappings":";;;AAMO,MAAM,2BAA2B;AAAA,EACvC,OAAO,QAAoB,aAAoD;AAC9E,UAAM,iBAAiB,CAAC,YAA6E;AACpG,YAAM,oBAAoB,IAAI,kBAAkB,YAAY,IAAI,CAAA,QAAO;AAAA,QACtE,GAAG;AAAA,QACH,WAAW,QAAQ,OAAO,MAAM,GAAG,IAAI,GAAG,UAAU,CAAA,CAAE;AAAA,MAAA,EACrD,CAAC;AAEH,aAAO,CAAC,EAAE,aAAAA,mBAA8D;AACvE,eAAOA,aAAY,MAAM,CAAA,OAAM,kBAAkB,QAAQ,EAAE,CAAC;AAAA,MAC7D;AAAA,IACD;AAEA,UAAM,kBAAkB,YAAY,IAAI,CAAA,OAAM,OAAO,MAAM,GAAG,IAAI,CAAC,EAAE,OAAO,CAAA,OAAM,CAAC,CAAC,EAAE;AACtF,UAAM,OAAO,IAAI,4BAAA;AAEjB,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,MAAM,GAAG;AAClD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,UAAU,GAAG,WAAW,OAAO,GAAG,SAAS,GAAG,UAAU,CAAA,CAAE;AACnG,WAAK,MAAM,kBAAkB,cAAc,CAAA,CAAE,GAAG,QAAQ;AAAA,IACzD;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,eAAe,GAAG;AAC3D,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,mBAAmB,GAAG,oBAAoB,OAAO,GAAG,kBAAkB,GAAG,UAAU,CAAA,CAAE;AAC9H,WAAK,MAAM,kBAAkB,wBAAwB,CAAA,CAAE,GAAG,QAAQ;AAAA,IACnE;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,MAAM,GAAG;AAClD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,UAAU,EAAE;AACrD,WAAK,MAAM,kBAAkB,mBAAmB,CAAA,CAAE,GAAG,QAAQ;AAC7D,WAAK,MAAM,kBAAkB,oBAAoB,CAAA,CAAE,GAAG,QAAQ;AAC9D,WAAK,MAAM,kBAAkB,sBAAsB,CAAA,CAAE,GAAG,QAAQ;AAChE,WAAK,MAAM,kBAAkB,sBAAsB,CAAA,CAAE,GAAG,QAAQ;AAAA,IACjE;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,IAAI,GAAG;AAChD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,QAAQ,EAAE;AACnD,WAAK,MAAM,kBAAkB,oBAAoB,CAAA,CAAE,GAAG,QAAQ;AAAA,IAC/D;AAEA,WAAO;AAAA,EACR;AACD;"}

package/dist/production/src/model/authorization/Identity.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"Identity.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/Identity.ts"],"sourcesContent":["import { ProjectMemberManager } from '../service'\nimport { DatabaseContext } from '../utils'\nimport { Acl } from '@contember/schema'\n\nexport interface Identity {\n\treadonly id: string\n\treadonly roles: readonly string[]\n\n\tgetProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]>\n}\n\nexport class StaticIdentity implements Identity {\n\tconstructor(\n\t\tpublic readonly id: string,\n\t\tpublic readonly roles: string[],\n\t\tprivate projectMemberships: Record<string, readonly Acl.Membership[]> = {},\n\t) {}\n\n\tgetProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]> {\n\t\treturn Promise.resolve(this.projectMemberships[projectSlug] \|\| {})\n\t}\n}\n\nexport class ProjectAwareIdentity implements Identity {\n\tprivate projectMembershipCache: Record<string, Promise<readonly Acl.Membership[]>> = {}\n\n\tconstructor(\n\t\tpublic readonly id: string,\n\t\tpublic readonly roles: readonly string[],\n\t\tprivate readonly dbContext: DatabaseContext,\n\t\tprivate readonly memberManager: ProjectMemberManager,\n\t) {}\n\n\tasync getProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]> {\n\t\tthis.projectMembershipCache[projectSlug] ??= this.memberManager.getEffectiveProjectMemberships(this.dbContext, { slug: projectSlug }, this)\n\t\treturn await this.projectMembershipCache[projectSlug]\n\t}\n}\n"],"names":[],"mappings":";;;;;AAWO,MAAM,eAAmC;AAAA,EAC/C,YACiB,IACA,OACR,qBAAgE,CAAA,GACvE;AAHe,SAAA,KAAA;AACA,SAAA,QAAA;AACR,SAAA,qBAAA;AAAA,EACN;AAAA,EAEH,sBAAsB,aAAyD;AAC9E,WAAO,QAAQ,QAAQ,KAAK,mBAAmB,WAAW,KAAK,EAAE;AAAA,EAClE;AACD;AAEO,MAAM,qBAAyC;AAAA,EAGrD,YACiB,IACA,OACC,WACA,eAChB;AAJe,SAAA,KAAA;AACA,SAAA,QAAA;AACC,SAAA,YAAA;AACA,SAAA,gBAAA;AANlB,kBAAA,MAAQ,0BAA6E,EAAC;AAAA,EAOnF;AAAA,EAEH,MAAM,sBAAsB,aAAyD;AAjCtF,QAAA;AAkCE,KAAA,KAAA,KAAK,wBAAL,WAAA,MAAA,GAAA,WAAA,IAA6C,KAAK,cAAc,+BAA+B,KAAK,WAAW,EAAE,MAAM,YAAA,GAAe,IAAI;AAC1I,WAAO,MAAM,KAAK,uBAAuB,WAAW;AAAA,EACrD;AACD;;;"}
1	+ {"version":3,"file":"Identity.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/Identity.ts"],"sourcesContent":["import { ProjectMemberManager } from '../service/index.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { Acl } from '@contember/schema'\n\nexport interface Identity {\n\treadonly id: string\n\treadonly roles: readonly string[]\n\n\tgetProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]>\n}\n\nexport class StaticIdentity implements Identity {\n\tconstructor(\n\t\tpublic readonly id: string,\n\t\tpublic readonly roles: string[],\n\t\tprivate projectMemberships: Record<string, readonly Acl.Membership[]> = {},\n\t) {}\n\n\tgetProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]> {\n\t\treturn Promise.resolve(this.projectMemberships[projectSlug] \|\| {})\n\t}\n}\n\nexport class ProjectAwareIdentity implements Identity {\n\tprivate projectMembershipCache: Record<string, Promise<readonly Acl.Membership[]>> = {}\n\n\tconstructor(\n\t\tpublic readonly id: string,\n\t\tpublic readonly roles: readonly string[],\n\t\tprivate readonly dbContext: DatabaseContext,\n\t\tprivate readonly memberManager: ProjectMemberManager,\n\t) {}\n\n\tasync getProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]> {\n\t\tthis.projectMembershipCache[projectSlug] ??= this.memberManager.getEffectiveProjectMemberships(this.dbContext, { slug: projectSlug }, this)\n\t\treturn await this.projectMembershipCache[projectSlug]\n\t}\n}\n"],"names":[],"mappings":";;;;;AAWO,MAAM,eAAmC;AAAA,EAC/C,YACiB,IACA,OACR,qBAAgE,CAAA,GACvE;AAHe,SAAA,KAAA;AACA,SAAA,QAAA;AACR,SAAA,qBAAA;AAAA,EACN;AAAA,EAEH,sBAAsB,aAAyD;AAC9E,WAAO,QAAQ,QAAQ,KAAK,mBAAmB,WAAW,KAAK,EAAE;AAAA,EAClE;AACD;AAEO,MAAM,qBAAyC;AAAA,EAGrD,YACiB,IACA,OACC,WACA,eAChB;AAJe,SAAA,KAAA;AACA,SAAA,QAAA;AACC,SAAA,YAAA;AACA,SAAA,gBAAA;AANlB,kBAAA,MAAQ,0BAA6E,EAAC;AAAA,EAOnF;AAAA,EAEH,MAAM,sBAAsB,aAAyD;AAjCtF,QAAA;AAkCE,KAAA,KAAA,KAAK,wBAAL,WAAA,MAAA,GAAA,WAAA,IAA6C,KAAK,cAAc,+BAA+B,KAAK,WAAW,EAAE,MAAM,YAAA,GAAe,IAAI;AAC1I,WAAO,MAAM,KAAK,uBAAuB,WAAW;AAAA,EACrD;AACD;;;"}

package/dist/production/src/model/authorization/Identity.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"Identity.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/Identity.ts"],"sourcesContent":["import { ProjectMemberManager } from '../service'\nimport { DatabaseContext } from '../utils'\nimport { Acl } from '@contember/schema'\n\nexport interface Identity {\n\treadonly id: string\n\treadonly roles: readonly string[]\n\n\tgetProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]>\n}\n\nexport class StaticIdentity implements Identity {\n\tconstructor(\n\t\tpublic readonly id: string,\n\t\tpublic readonly roles: string[],\n\t\tprivate projectMemberships: Record<string, readonly Acl.Membership[]> = {},\n\t) {}\n\n\tgetProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]> {\n\t\treturn Promise.resolve(this.projectMemberships[projectSlug] \|\| {})\n\t}\n}\n\nexport class ProjectAwareIdentity implements Identity {\n\tprivate projectMembershipCache: Record<string, Promise<readonly Acl.Membership[]>> = {}\n\n\tconstructor(\n\t\tpublic readonly id: string,\n\t\tpublic readonly roles: readonly string[],\n\t\tprivate readonly dbContext: DatabaseContext,\n\t\tprivate readonly memberManager: ProjectMemberManager,\n\t) {}\n\n\tasync getProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]> {\n\t\tthis.projectMembershipCache[projectSlug] ??= this.memberManager.getEffectiveProjectMemberships(this.dbContext, { slug: projectSlug }, this)\n\t\treturn await this.projectMembershipCache[projectSlug]\n\t}\n}\n"],"names":[],"mappings":";;;AAWO,MAAM,eAAmC;AAAA,EAC/C,YACiB,IACA,OACR,qBAAgE,CAAA,GACvE;AAHe,SAAA,KAAA;AACA,SAAA,QAAA;AACR,SAAA,qBAAA;AAAA,EACN;AAAA,EAEH,sBAAsB,aAAyD;AAC9E,WAAO,QAAQ,QAAQ,KAAK,mBAAmB,WAAW,KAAK,EAAE;AAAA,EAClE;AACD;AAEO,MAAM,qBAAyC;AAAA,EAGrD,YACiB,IACA,OACC,WACA,eAChB;AAJe,SAAA,KAAA;AACA,SAAA,QAAA;AACC,SAAA,YAAA;AACA,SAAA,gBAAA;AANlB,kBAAA,MAAQ,0BAA6E,EAAC;AAAA,EAOnF;AAAA,EAEH,MAAM,sBAAsB,aAAyD;AAjCtF,QAAA;AAkCE,KAAA,KAAA,KAAK,wBAAL,WAAA,MAAA,GAAA,WAAA,IAA6C,KAAK,cAAc,+BAA+B,KAAK,WAAW,EAAE,MAAM,YAAA,GAAe,IAAI;AAC1I,WAAO,MAAM,KAAK,uBAAuB,WAAW;AAAA,EACrD;AACD;"}
1	+ {"version":3,"file":"Identity.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/Identity.ts"],"sourcesContent":["import { ProjectMemberManager } from '../service/index.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { Acl } from '@contember/schema'\n\nexport interface Identity {\n\treadonly id: string\n\treadonly roles: readonly string[]\n\n\tgetProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]>\n}\n\nexport class StaticIdentity implements Identity {\n\tconstructor(\n\t\tpublic readonly id: string,\n\t\tpublic readonly roles: string[],\n\t\tprivate projectMemberships: Record<string, readonly Acl.Membership[]> = {},\n\t) {}\n\n\tgetProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]> {\n\t\treturn Promise.resolve(this.projectMemberships[projectSlug] \|\| {})\n\t}\n}\n\nexport class ProjectAwareIdentity implements Identity {\n\tprivate projectMembershipCache: Record<string, Promise<readonly Acl.Membership[]>> = {}\n\n\tconstructor(\n\t\tpublic readonly id: string,\n\t\tpublic readonly roles: readonly string[],\n\t\tprivate readonly dbContext: DatabaseContext,\n\t\tprivate readonly memberManager: ProjectMemberManager,\n\t) {}\n\n\tasync getProjectMemberships(projectSlug: string): Promise<readonly Acl.Membership[]> {\n\t\tthis.projectMembershipCache[projectSlug] ??= this.memberManager.getEffectiveProjectMemberships(this.dbContext, { slug: projectSlug }, this)\n\t\treturn await this.projectMembershipCache[projectSlug]\n\t}\n}\n"],"names":[],"mappings":";;;AAWO,MAAM,eAAmC;AAAA,EAC/C,YACiB,IACA,OACR,qBAAgE,CAAA,GACvE;AAHe,SAAA,KAAA;AACA,SAAA,QAAA;AACR,SAAA,qBAAA;AAAA,EACN;AAAA,EAEH,sBAAsB,aAAyD;AAC9E,WAAO,QAAQ,QAAQ,KAAK,mBAAmB,WAAW,KAAK,EAAE;AAAA,EAClE;AACD;AAEO,MAAM,qBAAyC;AAAA,EAGrD,YACiB,IACA,OACC,WACA,eAChB;AAJe,SAAA,KAAA;AACA,SAAA,QAAA;AACC,SAAA,YAAA;AACA,SAAA,gBAAA;AANlB,kBAAA,MAAQ,0BAA6E,EAAC;AAAA,EAOnF;AAAA,EAEH,MAAM,sBAAsB,aAAyD;AAjCtF,QAAA;AAkCE,KAAA,KAAA,KAAK,wBAAL,WAAA,MAAA,GAAA,WAAA,IAA6C,KAAK,cAAc,+BAA+B,KAAK,WAAW,EAAE,MAAM,YAAA,GAAe,IAAI;AAC1I,WAAO,MAAM,KAAK,uBAAuB,WAAW;AAAA,EACrD;AACD;"}

package/dist/production/src/model/authorization/IdentityFactory.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"IdentityFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/IdentityFactory.ts"],"sourcesContent":["import { ProjectMemberManager } from '../service'\nimport { Identity, ProjectAwareIdentity } from './Identity'\nimport { DatabaseContext } from '../utils'\n\nexport class IdentityFactory {\n\tconstructor(private readonly projectMemberManager: ProjectMemberManager) {}\n\n\tpublic create(dbContext: DatabaseContext, args: { id: string; roles: readonly string[] }): Identity {\n\t\treturn new ProjectAwareIdentity(args.id, args.roles, dbContext, this.projectMemberManager)\n\t}\n}\n"],"names":["ProjectAwareIdentity"],"mappings":";;;AAIO,MAAM,gBAAgB;AAAA,EAC5B,YAA6B,sBAA4C;AAA5C,SAAA,uBAAA;AAAA,EAA6C;AAAA,EAEnE,OAAO,WAA4B,MAA0D;AACnG,WAAO,IAAIA,SAAAA,qBAAqB,KAAK,IAAI,KAAK,OAAO,WAAW,KAAK,oBAAoB;AAAA,EAC1F;AACD;;"}
1	+ {"version":3,"file":"IdentityFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/IdentityFactory.ts"],"sourcesContent":["import { ProjectMemberManager } from '../service/index.js'\nimport { Identity, ProjectAwareIdentity } from './Identity.js'\nimport { DatabaseContext } from '../utils/index.js'\n\nexport class IdentityFactory {\n\tconstructor(private readonly projectMemberManager: ProjectMemberManager) {}\n\n\tpublic create(dbContext: DatabaseContext, args: { id: string; roles: readonly string[] }): Identity {\n\t\treturn new ProjectAwareIdentity(args.id, args.roles, dbContext, this.projectMemberManager)\n\t}\n}\n"],"names":["ProjectAwareIdentity"],"mappings":";;;AAIO,MAAM,gBAAgB;AAAA,EAC5B,YAA6B,sBAA4C;AAA5C,SAAA,uBAAA;AAAA,EAA6C;AAAA,EAEnE,OAAO,WAA4B,MAA0D;AACnG,WAAO,IAAIA,SAAAA,qBAAqB,KAAK,IAAI,KAAK,OAAO,WAAW,KAAK,oBAAoB;AAAA,EAC1F;AACD;;"}

package/dist/production/src/model/authorization/IdentityFactory.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"IdentityFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/IdentityFactory.ts"],"sourcesContent":["import { ProjectMemberManager } from '../service'\nimport { Identity, ProjectAwareIdentity } from './Identity'\nimport { DatabaseContext } from '../utils'\n\nexport class IdentityFactory {\n\tconstructor(private readonly projectMemberManager: ProjectMemberManager) {}\n\n\tpublic create(dbContext: DatabaseContext, args: { id: string; roles: readonly string[] }): Identity {\n\t\treturn new ProjectAwareIdentity(args.id, args.roles, dbContext, this.projectMemberManager)\n\t}\n}\n"],"names":[],"mappings":";AAIO,MAAM,gBAAgB;AAAA,EAC5B,YAA6B,sBAA4C;AAA5C,SAAA,uBAAA;AAAA,EAA6C;AAAA,EAEnE,OAAO,WAA4B,MAA0D;AACnG,WAAO,IAAI,qBAAqB,KAAK,IAAI,KAAK,OAAO,WAAW,KAAK,oBAAoB;AAAA,EAC1F;AACD;"}
1	+ {"version":3,"file":"IdentityFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/IdentityFactory.ts"],"sourcesContent":["import { ProjectMemberManager } from '../service/index.js'\nimport { Identity, ProjectAwareIdentity } from './Identity.js'\nimport { DatabaseContext } from '../utils/index.js'\n\nexport class IdentityFactory {\n\tconstructor(private readonly projectMemberManager: ProjectMemberManager) {}\n\n\tpublic create(dbContext: DatabaseContext, args: { id: string; roles: readonly string[] }): Identity {\n\t\treturn new ProjectAwareIdentity(args.id, args.roles, dbContext, this.projectMemberManager)\n\t}\n}\n"],"names":[],"mappings":";AAIO,MAAM,gBAAgB;AAAA,EAC5B,YAA6B,sBAA4C;AAA5C,SAAA,uBAAA;AAAA,EAA6C;AAAA,EAEnE,OAAO,WAA4B,MAA0D;AACnG,WAAO,IAAI,qBAAqB,KAAK,IAAI,KAAK,OAAO,WAAW,KAAK,oBAAoB;AAAA,EAC1F;AACD;"}

package/dist/production/src/model/authorization/IdentityScope.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"IdentityScope.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/IdentityScope.ts"],"sourcesContent":["import { AccessNode, AuthorizationScope } from '@contember/authorization'\nimport { TenantRole } from './Roles'\nimport { Identity } from './Identity'\n\nclass IdentityScope implements AuthorizationScope<Identity> {\n\tconstructor(private readonly identityId: string) {}\n\n\tasync getIdentityAccess(identity: Identity): Promise<AccessNode> {\n\t\treturn new AccessNode.Roles(identity.id === this.identityId ? [TenantRole.SELF] : [])\n\t}\n}\n\nexport { IdentityScope }\n"],"names":["AccessNode","TenantRole"],"mappings":";;;;AAIA,MAAM,cAAsD;AAAA,EAC3D,YAA6B,YAAoB;AAApB,SAAA,aAAA;AAAA,EAAqB;AAAA,EAElD,MAAM,kBAAkB,UAAyC;AAChE,WAAO,IAAIA,cAAAA,WAAW,MAAM,SAAS,OAAO,KAAK,aAAa,CAACC,MAAAA,WAAW,IAAI,IAAI,CAAA,CAAE;AAAA,EACrF;AACD;;"}
1	+ {"version":3,"file":"IdentityScope.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/IdentityScope.ts"],"sourcesContent":["import { AccessNode, AuthorizationScope } from '@contember/authorization'\nimport { TenantRole } from './Roles.js'\nimport { Identity } from './Identity.js'\n\nclass IdentityScope implements AuthorizationScope<Identity> {\n\tconstructor(private readonly identityId: string) {}\n\n\tasync getIdentityAccess(identity: Identity): Promise<AccessNode> {\n\t\treturn new AccessNode.Roles(identity.id === this.identityId ? [TenantRole.SELF] : [])\n\t}\n}\n\nexport { IdentityScope }\n"],"names":["AccessNode","TenantRole"],"mappings":";;;;AAIA,MAAM,cAAsD;AAAA,EAC3D,YAA6B,YAAoB;AAApB,SAAA,aAAA;AAAA,EAAqB;AAAA,EAElD,MAAM,kBAAkB,UAAyC;AAChE,WAAO,IAAIA,cAAAA,WAAW,MAAM,SAAS,OAAO,KAAK,aAAa,CAACC,MAAAA,WAAW,IAAI,IAAI,CAAA,CAAE;AAAA,EACrF;AACD;;"}

package/dist/production/src/model/authorization/IdentityScope.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"IdentityScope.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/IdentityScope.ts"],"sourcesContent":["import { AccessNode, AuthorizationScope } from '@contember/authorization'\nimport { TenantRole } from './Roles'\nimport { Identity } from './Identity'\n\nclass IdentityScope implements AuthorizationScope<Identity> {\n\tconstructor(private readonly identityId: string) {}\n\n\tasync getIdentityAccess(identity: Identity): Promise<AccessNode> {\n\t\treturn new AccessNode.Roles(identity.id === this.identityId ? [TenantRole.SELF] : [])\n\t}\n}\n\nexport { IdentityScope }\n"],"names":[],"mappings":";;AAIA,MAAM,cAAsD;AAAA,EAC3D,YAA6B,YAAoB;AAApB,SAAA,aAAA;AAAA,EAAqB;AAAA,EAElD,MAAM,kBAAkB,UAAyC;AAChE,WAAO,IAAI,WAAW,MAAM,SAAS,OAAO,KAAK,aAAa,CAAC,WAAW,IAAI,IAAI,CAAA,CAAE;AAAA,EACrF;AACD;"}
1	+ {"version":3,"file":"IdentityScope.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/IdentityScope.ts"],"sourcesContent":["import { AccessNode, AuthorizationScope } from '@contember/authorization'\nimport { TenantRole } from './Roles.js'\nimport { Identity } from './Identity.js'\n\nclass IdentityScope implements AuthorizationScope<Identity> {\n\tconstructor(private readonly identityId: string) {}\n\n\tasync getIdentityAccess(identity: Identity): Promise<AccessNode> {\n\t\treturn new AccessNode.Roles(identity.id === this.identityId ? [TenantRole.SELF] : [])\n\t}\n}\n\nexport { IdentityScope }\n"],"names":[],"mappings":";;AAIA,MAAM,cAAsD;AAAA,EAC3D,YAA6B,YAAoB;AAApB,SAAA,aAAA;AAAA,EAAqB;AAAA,EAElD,MAAM,kBAAkB,UAAyC;AAChE,WAAO,IAAI,WAAW,MAAM,SAAS,OAAO,KAAK,aAAa,CAAC,WAAW,IAAI,IAAI,CAAA,CAAE;AAAA,EACrF;AACD;"}

package/dist/production/src/model/authorization/PermissionActions.cjs CHANGED Viewed

@@ -15,11 +15,17 @@ exports.PermissionActions = void 0;
   })(PermissionActions2.Resources || (PermissionActions2.Resources = {}));
   PermissionActions2.CONFIGURE = authorization.Authorizator.createAction("system", "configure");
   PermissionActions2.CONFIG_VIEW = authorization.Authorizator.createAction("system", "viewConfig");
+  PermissionActions2.AUTH_LOG_VIEW = authorization.Authorizator.createAction("system", "viewAuthLog");
   PermissionActions2.IDENTITY_VIEW_PERMISSIONS = authorization.Authorizator.createAction("identity", "viewPermissions");
   PermissionActions2.IDENTITY_ADD_GLOBAL_ROLES = (roles) => authorization.Authorizator.createAction("identity", "addGlobalRoles", { roles });
   PermissionActions2.IDENTITY_REMOVE_GLOBAL_ROLES = (roles) => authorization.Authorizator.createAction("identity", "removeGlobalRoles", { roles });
   PermissionActions2.PERSON_DISABLE = (roles) => authorization.Authorizator.createAction("person", "disable", { roles });
+  PermissionActions2.PERSON_FORCE_SIGN_OUT = (roles) => authorization.Authorizator.createAction("person", "forceSignOut", { roles });
+  PermissionActions2.PERSON_RESET_MFA = (roles) => authorization.Authorizator.createAction("person", "resetMfa", { roles });
+  PermissionActions2.PERSON_REVOKE_SESSION = authorization.Authorizator.createAction("person", "revokeSession");
+  PermissionActions2.PERSON_VIEW_SESSIONS = (roles) => authorization.Authorizator.createAction("person", "viewSessions", { roles });
   PermissionActions2.PERSON_VIEW = authorization.Authorizator.createAction("person", "view");
+  PermissionActions2.PERSON_LIST = authorization.Authorizator.createAction("person", "list");
   PermissionActions2.PERSON_SIGN_IN = authorization.Authorizator.createAction("person", "signIn");
   PermissionActions2.PERSON_SIGN_UP = (roles) => authorization.Authorizator.createAction("person", "signUp", { roles });
   PermissionActions2.PERSON_SIGN_OUT = authorization.Authorizator.createAction("person", "signOut");
@@ -32,6 +38,8 @@ exports.PermissionActions = void 0;
   PermissionActions2.PERSON_RESET_PASSWORD = authorization.Authorizator.createAction("person", "resetPassword");
   PermissionActions2.PERSON_CREATE_IDP_URL = authorization.Authorizator.createAction("person", "createIdPUrl");
   PermissionActions2.PERSON_SIGN_IN_IDP = authorization.Authorizator.createAction("person", "signInIdp");
+  PermissionActions2.PERSON_VIEW_IDP = (roles) => authorization.Authorizator.createAction("person", "viewIdp", { roles });
+  PermissionActions2.PERSON_DISCONNECT_MY_IDP = authorization.Authorizator.createAction("person", "disconnectMyIdp");
   PermissionActions2.PERSON_REQUEST_PASSWORDLESS_SIGN_IN = authorization.Authorizator.createAction("person", "requestPasswordlessSignIn");
   PermissionActions2.PERSON_PASSWORDLESS_SIGN_IN = authorization.Authorizator.createAction("person", "passwordlessSignIn");
   PermissionActions2.PERSON_CREATE_SESSION_KEY = (roles) => authorization.Authorizator.createAction("person", "createSessionToken", { roles });
@@ -39,6 +47,7 @@ exports.PermissionActions = void 0;
   PermissionActions2.PERSON_INVITE_UNMANAGED = (memberships) => authorization.Authorizator.createAction("person", "invite_unmanaged", { memberships });
   PermissionActions2.PROJECT_VIEW = authorization.Authorizator.createAction("project", "view");
   PermissionActions2.PROJECT_SET_SECRET = authorization.Authorizator.createAction("project", "setSecret");
+  PermissionActions2.PROJECT_VIEW_SECRETS = authorization.Authorizator.createAction("project", "viewSecrets");
   PermissionActions2.PROJECT_UPDATE = authorization.Authorizator.createAction("project", "update");
   PermissionActions2.PROJECT_CREATE = authorization.Authorizator.createAction("project", "create");
   PermissionActions2.ENTRYPOINT_DEPLOY = authorization.Authorizator.createAction("entrypoint", "deployEntrypoint");
@@ -49,6 +58,7 @@ exports.PermissionActions = void 0;
   PermissionActions2.API_KEY_CREATE = authorization.Authorizator.createAction("apiKey", "create");
   PermissionActions2.API_KEY_CREATE_GLOBAL = (roles) => authorization.Authorizator.createAction("apiKey", "createGlobal", { roles });
   PermissionActions2.API_KEY_DISABLE = authorization.Authorizator.createAction("apiKey", "disable");
+  PermissionActions2.API_KEY_LIST = authorization.Authorizator.createAction("apiKey", "list");
   PermissionActions2.MAIL_TEMPLATE_ADD = authorization.Authorizator.createAction("mailTemplate", "add");
   PermissionActions2.MAIL_TEMPLATE_REMOVE = authorization.Authorizator.createAction("mailTemplate", "remove");
   PermissionActions2.MAIL_TEMPLATE_LIST = authorization.Authorizator.createAction("mailTemplate", "list");

package/dist/production/src/model/authorization/PermissionActions.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"PermissionActions.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionActions.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { Acl } from '@contember/schema'\n\nnamespace PermissionActions {\n\texport enum Resources {\n\t\tsystem = 'system',\n\t\tentrypoint = 'entrypoint',\n\t\tperson = 'person',\n\t\tidentity = 'identity',\n\t\tproject = 'project',\n\t\tapiKey = 'apiKey',\n\t\tmailTemplate = 'mailTemplate',\n\t\tidp = 'idp',\n\t}\n\n\texport const CONFIGURE = Authorizator.createAction(Resources.system, 'configure')\n\texport const CONFIG_VIEW = Authorizator.createAction(Resources.system, 'viewConfig')\n\n\texport const IDENTITY_VIEW_PERMISSIONS = Authorizator.createAction(Resources.identity, 'viewPermissions')\n\texport const IDENTITY_ADD_GLOBAL_ROLES = (roles?: readonly string[]) => Authorizator.createAction(Resources.identity, 'addGlobalRoles', { roles })\n\texport const IDENTITY_REMOVE_GLOBAL_ROLES = (roles?: readonly string[]) =>\n\t\tAuthorizator.createAction(Resources.identity, 'removeGlobalRoles', { roles })\n\n\texport const PERSON_DISABLE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'disable', { roles })\n\n\texport const PERSON_VIEW = Authorizator.createAction(Resources.person, 'view')\n\texport const PERSON_SIGN_IN = Authorizator.createAction(Resources.person, 'signIn')\n\texport const PERSON_SIGN_UP = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'signUp', { roles })\n\texport const PERSON_SIGN_OUT = Authorizator.createAction(Resources.person, 'signOut')\n\texport const PERSON_SETUP_OTP = Authorizator.createAction(Resources.person, 'setupOtp')\n\texport const PERSON_CHANGE_PROFILE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'changeProfile', { roles })\n\texport const PERSON_CHANGE_MY_PROFILE = Authorizator.createAction(Resources.person, 'changeMyProfile')\n\texport const PERSON_TOGGLE_PASSWORDLESS = Authorizator.createAction(Resources.person, 'togglePasswordless')\n\texport const PERSON_CHANGE_PASSWORD = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'changePassword', { roles })\n\texport const PERSON_CHANGE_MY_PASSWORD = Authorizator.createAction(Resources.person, 'changeMyPassword')\n\texport const PERSON_RESET_PASSWORD = Authorizator.createAction(Resources.person, 'resetPassword')\n\texport const PERSON_CREATE_IDP_URL = Authorizator.createAction(Resources.person, 'createIdPUrl')\n\texport const PERSON_SIGN_IN_IDP = Authorizator.createAction(Resources.person, 'signInIdp')\n\texport const PERSON_REQUEST_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'requestPasswordlessSignIn')\n\texport const PERSON_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'passwordlessSignIn')\n\texport const PERSON_CREATE_SESSION_KEY = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'createSessionToken', { roles })\n\n\texport const PERSON_INVITE = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.person, 'invite', { memberships })\n\texport const PERSON_INVITE_UNMANAGED = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.person, 'invite_unmanaged', { memberships })\n\n\texport const PROJECT_VIEW = Authorizator.createAction(Resources.project, 'view')\n\texport const PROJECT_SET_SECRET = Authorizator.createAction(Resources.project, 'setSecret')\n\texport const PROJECT_UPDATE = Authorizator.createAction(Resources.project, 'update')\n\n\texport const PROJECT_CREATE = Authorizator.createAction(Resources.project, 'create')\n\texport const ENTRYPOINT_DEPLOY = Authorizator.createAction(Resources.entrypoint, 'deployEntrypoint')\n\n\texport const PROJECT_VIEW_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'viewMembers', { memberships })\n\texport const PROJECT_ADD_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'addMember', { memberships })\n\texport const PROJECT_REMOVE_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'removeMember', { memberships })\n\texport const PROJECT_UPDATE_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'updateMember', { memberships })\n\n\texport const API_KEY_CREATE = Authorizator.createAction(Resources.apiKey, 'create')\n\texport const API_KEY_CREATE_GLOBAL = (roles?: readonly string[]) => Authorizator.createAction(Resources.apiKey, 'createGlobal', { roles })\n\texport const API_KEY_DISABLE = Authorizator.createAction(Resources.apiKey, 'disable')\n\n\texport const MAIL_TEMPLATE_ADD = Authorizator.createAction(Resources.mailTemplate, 'add')\n\texport const MAIL_TEMPLATE_REMOVE = Authorizator.createAction(Resources.mailTemplate, 'remove')\n\texport const MAIL_TEMPLATE_LIST = Authorizator.createAction(Resources.mailTemplate, 'list')\n\n\texport const IDP_ADD = Authorizator.createAction(Resources.idp, 'add')\n\texport const IDP_UPDATE = Authorizator.createAction(Resources.idp, 'update')\n\texport const IDP_DISABLE = Authorizator.createAction(Resources.idp, 'disable')\n\texport const IDP_ENABLE = Authorizator.createAction(Resources.idp, 'enable')\n\texport const IDP_LIST = Authorizator.createAction(Resources.idp, 'list')\n}\n\nexport { PermissionActions }\n"],"names":["PermissionActions","Resources","Authorizator"],"mappings":";;;AAGUA,QAAAA,oBAAAA;AAAAA,CAAV,CAAUA,uBAAV;AACQ,GAAA,CAAKC,eAAL;AACNA,eAAA,QAAA,IAAS;AACTA,eAAA,YAAA,IAAa;AACbA,eAAA,QAAA,IAAS;AACTA,eAAA,UAAA,IAAW;AACXA,eAAA,SAAA,IAAU;AACVA,eAAA,QAAA,IAAS;AACTA,eAAA,cAAA,IAAe;AACfA,eAAA,KAAA,IAAM;AAAA,EAAA,GARKD,mBAAA,cAAAA,mBAAA,YAAA,CAAA,EAAA;AAWCA,qBAAA,YAAYE,cAAAA,aAAa,aAAa,UAAkB,WAAW;AACnEF,qBAAA,cAAcE,cAAAA,aAAa,aAAa,UAAkB,YAAY;AAEtEF,qBAAA,4BAA4BE,cAAAA,aAAa,aAAa,YAAoB,iBAAiB;AAC3FF,qBAAA,4BAA4B,CAAC,UAA8BE,cAAAA,aAAa,aAAa,YAAoB,kBAAkB,EAAE,OAAO;AACpIF,qBAAA,+BAA+B,CAAC,UAC5CE,cAAAA,aAAa,aAAa,YAAoB,qBAAqB,EAAE,OAAO;AAEhEF,qBAAA,iBAAiB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,WAAW,EAAE,OAAO;AAEhHF,qBAAA,cAAcE,cAAAA,aAAa,aAAa,UAAkB,MAAM;AAChEF,qBAAA,iBAAiBE,cAAAA,aAAa,aAAa,UAAkB,QAAQ;AACrEF,qBAAA,iBAAiB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,UAAU,EAAE,OAAO;AAC/GF,qBAAA,kBAAkBE,cAAAA,aAAa,aAAa,UAAkB,SAAS;AACvEF,qBAAA,mBAAmBE,cAAAA,aAAa,aAAa,UAAkB,UAAU;AACzEF,qBAAA,wBAAwB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,iBAAiB,EAAE,OAAO;AAC7HF,qBAAA,2BAA2BE,cAAAA,aAAa,aAAa,UAAkB,iBAAiB;AACxFF,qBAAA,6BAA6BE,cAAAA,aAAa,aAAa,UAAkB,oBAAoB;AAC7FF,qBAAA,yBAAyB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,kBAAkB,EAAE,OAAO;AAC/HF,qBAAA,4BAA4BE,cAAAA,aAAa,aAAa,UAAkB,kBAAkB;AAC1FF,qBAAA,wBAAwBE,cAAAA,aAAa,aAAa,UAAkB,eAAe;AACnFF,qBAAA,wBAAwBE,cAAAA,aAAa,aAAa,UAAkB,cAAc;AAClFF,qBAAA,qBAAqBE,cAAAA,aAAa,aAAa,UAAkB,WAAW;AAC5EF,qBAAA,sCAAsCE,cAAAA,aAAa,aAAa,UAAkB,2BAA2B;AAC7GF,qBAAA,8BAA8BE,cAAAA,aAAa,aAAa,UAAkB,oBAAoB;AAC9FF,qBAAA,4BAA4B,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,sBAAsB,EAAE,OAAO;AAEtIF,qBAAA,gBAAgB,CAAC,gBAA2CE,cAAAA,aAAa,aAAa,UAAkB,UAAU,EAAE,aAAa;AACjIF,qBAAA,0BAA0B,CAAC,gBACvCE,cAAAA,aAAa,aAAa,UAAkB,oBAAoB,EAAE,aAAa;AAEnEF,qBAAA,eAAeE,cAAAA,aAAa,aAAa,WAAmB,MAAM;AAClEF,qBAAA,qBAAqBE,cAAAA,aAAa,aAAa,WAAmB,WAAW;AAC7EF,qBAAA,iBAAiBE,cAAAA,aAAa,aAAa,WAAmB,QAAQ;AAEtEF,qBAAA,iBAAiBE,cAAAA,aAAa,aAAa,WAAmB,QAAQ;AACtEF,qBAAA,oBAAoBE,cAAAA,aAAa,aAAa,cAAsB,kBAAkB;AAEtFF,qBAAA,sBAAsB,CAAC,gBACnCE,cAAAA,aAAa,aAAa,WAAmB,eAAe,EAAE,aAAa;AAC/DF,qBAAA,qBAAqB,CAAC,gBAClCE,cAAAA,aAAa,aAAa,WAAmB,aAAa,EAAE,aAAa;AAC7DF,qBAAA,wBAAwB,CAAC,gBACrCE,cAAAA,aAAa,aAAa,WAAmB,gBAAgB,EAAE,aAAa;AAChEF,qBAAA,wBAAwB,CAAC,gBACrCE,cAAAA,aAAa,aAAa,WAAmB,gBAAgB,EAAE,aAAa;AAEhEF,qBAAA,iBAAiBE,cAAAA,aAAa,aAAa,UAAkB,QAAQ;AACrEF,qBAAA,wBAAwB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,gBAAgB,EAAE,OAAO;AAC5HF,qBAAA,kBAAkBE,cAAAA,aAAa,aAAa,UAAkB,SAAS;AAEvEF,qBAAA,oBAAoBE,cAAAA,aAAa,aAAa,gBAAwB,KAAK;AAC3EF,qBAAA,uBAAuBE,cAAAA,aAAa,aAAa,gBAAwB,QAAQ;AACjFF,qBAAA,qBAAqBE,cAAAA,aAAa,aAAa,gBAAwB,MAAM;AAE7EF,qBAAA,UAAUE,cAAAA,aAAa,aAAa,OAAe,KAAK;AACxDF,qBAAA,aAAaE,cAAAA,aAAa,aAAa,OAAe,QAAQ;AAC9DF,qBAAA,cAAcE,cAAAA,aAAa,aAAa,OAAe,SAAS;AAChEF,qBAAA,aAAaE,cAAAA,aAAa,aAAa,OAAe,QAAQ;AAC9DF,qBAAA,WAAWE,cAAAA,aAAa,aAAa,OAAe,MAAM;AAAA,GAvE9DF,QAAAA,sBAAAA,4BAAA,CAAA,EAAA;"}
1	+ {"version":3,"file":"PermissionActions.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionActions.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { Acl } from '@contember/schema'\n\nnamespace PermissionActions {\n\texport enum Resources {\n\t\tsystem = 'system',\n\t\tentrypoint = 'entrypoint',\n\t\tperson = 'person',\n\t\tidentity = 'identity',\n\t\tproject = 'project',\n\t\tapiKey = 'apiKey',\n\t\tmailTemplate = 'mailTemplate',\n\t\tidp = 'idp',\n\t}\n\n\texport const CONFIGURE = Authorizator.createAction(Resources.system, 'configure')\n\texport const CONFIG_VIEW = Authorizator.createAction(Resources.system, 'viewConfig')\n\texport const AUTH_LOG_VIEW = Authorizator.createAction(Resources.system, 'viewAuthLog')\n\n\texport const IDENTITY_VIEW_PERMISSIONS = Authorizator.createAction(Resources.identity, 'viewPermissions')\n\texport const IDENTITY_ADD_GLOBAL_ROLES = (roles?: readonly string[]) => Authorizator.createAction(Resources.identity, 'addGlobalRoles', { roles })\n\texport const IDENTITY_REMOVE_GLOBAL_ROLES = (roles?: readonly string[]) =>\n\t\tAuthorizator.createAction(Resources.identity, 'removeGlobalRoles', { roles })\n\n\texport const PERSON_DISABLE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'disable', { roles })\n\texport const PERSON_FORCE_SIGN_OUT = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'forceSignOut', { roles })\n\texport const PERSON_RESET_MFA = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'resetMfa', { roles })\n\texport const PERSON_REVOKE_SESSION = Authorizator.createAction(Resources.person, 'revokeSession')\n\texport const PERSON_VIEW_SESSIONS = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'viewSessions', { roles })\n\n\texport const PERSON_VIEW = Authorizator.createAction(Resources.person, 'view')\n\texport const PERSON_LIST = Authorizator.createAction(Resources.person, 'list')\n\texport const PERSON_SIGN_IN = Authorizator.createAction(Resources.person, 'signIn')\n\texport const PERSON_SIGN_UP = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'signUp', { roles })\n\texport const PERSON_SIGN_OUT = Authorizator.createAction(Resources.person, 'signOut')\n\texport const PERSON_SETUP_OTP = Authorizator.createAction(Resources.person, 'setupOtp')\n\texport const PERSON_CHANGE_PROFILE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'changeProfile', { roles })\n\texport const PERSON_CHANGE_MY_PROFILE = Authorizator.createAction(Resources.person, 'changeMyProfile')\n\texport const PERSON_TOGGLE_PASSWORDLESS = Authorizator.createAction(Resources.person, 'togglePasswordless')\n\texport const PERSON_CHANGE_PASSWORD = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'changePassword', { roles })\n\texport const PERSON_CHANGE_MY_PASSWORD = Authorizator.createAction(Resources.person, 'changeMyPassword')\n\texport const PERSON_RESET_PASSWORD = Authorizator.createAction(Resources.person, 'resetPassword')\n\texport const PERSON_CREATE_IDP_URL = Authorizator.createAction(Resources.person, 'createIdPUrl')\n\texport const PERSON_SIGN_IN_IDP = Authorizator.createAction(Resources.person, 'signInIdp')\n\texport const PERSON_VIEW_IDP = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'viewIdp', { roles })\n\texport const PERSON_DISCONNECT_MY_IDP = Authorizator.createAction(Resources.person, 'disconnectMyIdp')\n\texport const PERSON_REQUEST_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'requestPasswordlessSignIn')\n\texport const PERSON_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'passwordlessSignIn')\n\texport const PERSON_CREATE_SESSION_KEY = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'createSessionToken', { roles })\n\n\texport const PERSON_INVITE = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.person, 'invite', { memberships })\n\texport const PERSON_INVITE_UNMANAGED = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.person, 'invite_unmanaged', { memberships })\n\n\texport const PROJECT_VIEW = Authorizator.createAction(Resources.project, 'view')\n\texport const PROJECT_SET_SECRET = Authorizator.createAction(Resources.project, 'setSecret')\n\texport const PROJECT_VIEW_SECRETS = Authorizator.createAction(Resources.project, 'viewSecrets')\n\texport const PROJECT_UPDATE = Authorizator.createAction(Resources.project, 'update')\n\n\texport const PROJECT_CREATE = Authorizator.createAction(Resources.project, 'create')\n\texport const ENTRYPOINT_DEPLOY = Authorizator.createAction(Resources.entrypoint, 'deployEntrypoint')\n\n\texport const PROJECT_VIEW_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'viewMembers', { memberships })\n\texport const PROJECT_ADD_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'addMember', { memberships })\n\texport const PROJECT_REMOVE_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'removeMember', { memberships })\n\texport const PROJECT_UPDATE_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'updateMember', { memberships })\n\n\texport const API_KEY_CREATE = Authorizator.createAction(Resources.apiKey, 'create')\n\texport const API_KEY_CREATE_GLOBAL = (roles?: readonly string[]) => Authorizator.createAction(Resources.apiKey, 'createGlobal', { roles })\n\texport const API_KEY_DISABLE = Authorizator.createAction(Resources.apiKey, 'disable')\n\texport const API_KEY_LIST = Authorizator.createAction(Resources.apiKey, 'list')\n\n\texport const MAIL_TEMPLATE_ADD = Authorizator.createAction(Resources.mailTemplate, 'add')\n\texport const MAIL_TEMPLATE_REMOVE = Authorizator.createAction(Resources.mailTemplate, 'remove')\n\texport const MAIL_TEMPLATE_LIST = Authorizator.createAction(Resources.mailTemplate, 'list')\n\n\texport const IDP_ADD = Authorizator.createAction(Resources.idp, 'add')\n\texport const IDP_UPDATE = Authorizator.createAction(Resources.idp, 'update')\n\texport const IDP_DISABLE = Authorizator.createAction(Resources.idp, 'disable')\n\texport const IDP_ENABLE = Authorizator.createAction(Resources.idp, 'enable')\n\texport const IDP_LIST = Authorizator.createAction(Resources.idp, 'list')\n}\n\nexport { PermissionActions }\n"],"names":["PermissionActions","Resources","Authorizator"],"mappings":";;;AAGUA,QAAAA,oBAAAA;AAAAA,CAAV,CAAUA,uBAAV;AACQ,GAAA,CAAKC,eAAL;AACNA,eAAA,QAAA,IAAS;AACTA,eAAA,YAAA,IAAa;AACbA,eAAA,QAAA,IAAS;AACTA,eAAA,UAAA,IAAW;AACXA,eAAA,SAAA,IAAU;AACVA,eAAA,QAAA,IAAS;AACTA,eAAA,cAAA,IAAe;AACfA,eAAA,KAAA,IAAM;AAAA,EAAA,GARKD,mBAAA,cAAAA,mBAAA,YAAA,CAAA,EAAA;AAWCA,qBAAA,YAAYE,cAAAA,aAAa,aAAa,UAAkB,WAAW;AACnEF,qBAAA,cAAcE,cAAAA,aAAa,aAAa,UAAkB,YAAY;AACtEF,qBAAA,gBAAgBE,cAAAA,aAAa,aAAa,UAAkB,aAAa;AAEzEF,qBAAA,4BAA4BE,cAAAA,aAAa,aAAa,YAAoB,iBAAiB;AAC3FF,qBAAA,4BAA4B,CAAC,UAA8BE,cAAAA,aAAa,aAAa,YAAoB,kBAAkB,EAAE,OAAO;AACpIF,qBAAA,+BAA+B,CAAC,UAC5CE,cAAAA,aAAa,aAAa,YAAoB,qBAAqB,EAAE,OAAO;AAEhEF,qBAAA,iBAAiB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,WAAW,EAAE,OAAO;AAChHF,qBAAA,wBAAwB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,gBAAgB,EAAE,OAAO;AAC5HF,qBAAA,mBAAmB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,YAAY,EAAE,OAAO;AACnHF,qBAAA,wBAAwBE,cAAAA,aAAa,aAAa,UAAkB,eAAe;AACnFF,qBAAA,uBAAuB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,gBAAgB,EAAE,OAAO;AAE3HF,qBAAA,cAAcE,cAAAA,aAAa,aAAa,UAAkB,MAAM;AAChEF,qBAAA,cAAcE,cAAAA,aAAa,aAAa,UAAkB,MAAM;AAChEF,qBAAA,iBAAiBE,cAAAA,aAAa,aAAa,UAAkB,QAAQ;AACrEF,qBAAA,iBAAiB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,UAAU,EAAE,OAAO;AAC/GF,qBAAA,kBAAkBE,cAAAA,aAAa,aAAa,UAAkB,SAAS;AACvEF,qBAAA,mBAAmBE,cAAAA,aAAa,aAAa,UAAkB,UAAU;AACzEF,qBAAA,wBAAwB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,iBAAiB,EAAE,OAAO;AAC7HF,qBAAA,2BAA2BE,cAAAA,aAAa,aAAa,UAAkB,iBAAiB;AACxFF,qBAAA,6BAA6BE,cAAAA,aAAa,aAAa,UAAkB,oBAAoB;AAC7FF,qBAAA,yBAAyB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,kBAAkB,EAAE,OAAO;AAC/HF,qBAAA,4BAA4BE,cAAAA,aAAa,aAAa,UAAkB,kBAAkB;AAC1FF,qBAAA,wBAAwBE,cAAAA,aAAa,aAAa,UAAkB,eAAe;AACnFF,qBAAA,wBAAwBE,cAAAA,aAAa,aAAa,UAAkB,cAAc;AAClFF,qBAAA,qBAAqBE,cAAAA,aAAa,aAAa,UAAkB,WAAW;AAC5EF,qBAAA,kBAAkB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,WAAW,EAAE,OAAO;AACjHF,qBAAA,2BAA2BE,cAAAA,aAAa,aAAa,UAAkB,iBAAiB;AACxFF,qBAAA,sCAAsCE,cAAAA,aAAa,aAAa,UAAkB,2BAA2B;AAC7GF,qBAAA,8BAA8BE,cAAAA,aAAa,aAAa,UAAkB,oBAAoB;AAC9FF,qBAAA,4BAA4B,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,sBAAsB,EAAE,OAAO;AAEtIF,qBAAA,gBAAgB,CAAC,gBAA2CE,cAAAA,aAAa,aAAa,UAAkB,UAAU,EAAE,aAAa;AACjIF,qBAAA,0BAA0B,CAAC,gBACvCE,cAAAA,aAAa,aAAa,UAAkB,oBAAoB,EAAE,aAAa;AAEnEF,qBAAA,eAAeE,cAAAA,aAAa,aAAa,WAAmB,MAAM;AAClEF,qBAAA,qBAAqBE,cAAAA,aAAa,aAAa,WAAmB,WAAW;AAC7EF,qBAAA,uBAAuBE,cAAAA,aAAa,aAAa,WAAmB,aAAa;AACjFF,qBAAA,iBAAiBE,cAAAA,aAAa,aAAa,WAAmB,QAAQ;AAEtEF,qBAAA,iBAAiBE,cAAAA,aAAa,aAAa,WAAmB,QAAQ;AACtEF,qBAAA,oBAAoBE,cAAAA,aAAa,aAAa,cAAsB,kBAAkB;AAEtFF,qBAAA,sBAAsB,CAAC,gBACnCE,cAAAA,aAAa,aAAa,WAAmB,eAAe,EAAE,aAAa;AAC/DF,qBAAA,qBAAqB,CAAC,gBAClCE,cAAAA,aAAa,aAAa,WAAmB,aAAa,EAAE,aAAa;AAC7DF,qBAAA,wBAAwB,CAAC,gBACrCE,cAAAA,aAAa,aAAa,WAAmB,gBAAgB,EAAE,aAAa;AAChEF,qBAAA,wBAAwB,CAAC,gBACrCE,cAAAA,aAAa,aAAa,WAAmB,gBAAgB,EAAE,aAAa;AAEhEF,qBAAA,iBAAiBE,cAAAA,aAAa,aAAa,UAAkB,QAAQ;AACrEF,qBAAA,wBAAwB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,gBAAgB,EAAE,OAAO;AAC5HF,qBAAA,kBAAkBE,cAAAA,aAAa,aAAa,UAAkB,SAAS;AACvEF,qBAAA,eAAeE,cAAAA,aAAa,aAAa,UAAkB,MAAM;AAEjEF,qBAAA,oBAAoBE,cAAAA,aAAa,aAAa,gBAAwB,KAAK;AAC3EF,qBAAA,uBAAuBE,cAAAA,aAAa,aAAa,gBAAwB,QAAQ;AACjFF,qBAAA,qBAAqBE,cAAAA,aAAa,aAAa,gBAAwB,MAAM;AAE7EF,qBAAA,UAAUE,cAAAA,aAAa,aAAa,OAAe,KAAK;AACxDF,qBAAA,aAAaE,cAAAA,aAAa,aAAa,OAAe,QAAQ;AAC9DF,qBAAA,cAAcE,cAAAA,aAAa,aAAa,OAAe,SAAS;AAChEF,qBAAA,aAAaE,cAAAA,aAAa,aAAa,OAAe,QAAQ;AAC9DF,qBAAA,WAAWE,cAAAA,aAAa,aAAa,OAAe,MAAM;AAAA,GAjF9DF,QAAAA,sBAAAA,4BAAA,CAAA,EAAA;"}

package/dist/production/src/model/authorization/PermissionActions.js CHANGED Viewed

@@ -13,11 +13,17 @@ var PermissionActions;
   })(PermissionActions2.Resources || (PermissionActions2.Resources = {}));
   PermissionActions2.CONFIGURE = Authorizator.createAction("system", "configure");
   PermissionActions2.CONFIG_VIEW = Authorizator.createAction("system", "viewConfig");
+  PermissionActions2.AUTH_LOG_VIEW = Authorizator.createAction("system", "viewAuthLog");
   PermissionActions2.IDENTITY_VIEW_PERMISSIONS = Authorizator.createAction("identity", "viewPermissions");
   PermissionActions2.IDENTITY_ADD_GLOBAL_ROLES = (roles) => Authorizator.createAction("identity", "addGlobalRoles", { roles });
   PermissionActions2.IDENTITY_REMOVE_GLOBAL_ROLES = (roles) => Authorizator.createAction("identity", "removeGlobalRoles", { roles });
   PermissionActions2.PERSON_DISABLE = (roles) => Authorizator.createAction("person", "disable", { roles });
+  PermissionActions2.PERSON_FORCE_SIGN_OUT = (roles) => Authorizator.createAction("person", "forceSignOut", { roles });
+  PermissionActions2.PERSON_RESET_MFA = (roles) => Authorizator.createAction("person", "resetMfa", { roles });
+  PermissionActions2.PERSON_REVOKE_SESSION = Authorizator.createAction("person", "revokeSession");
+  PermissionActions2.PERSON_VIEW_SESSIONS = (roles) => Authorizator.createAction("person", "viewSessions", { roles });
   PermissionActions2.PERSON_VIEW = Authorizator.createAction("person", "view");
+  PermissionActions2.PERSON_LIST = Authorizator.createAction("person", "list");
   PermissionActions2.PERSON_SIGN_IN = Authorizator.createAction("person", "signIn");
   PermissionActions2.PERSON_SIGN_UP = (roles) => Authorizator.createAction("person", "signUp", { roles });
   PermissionActions2.PERSON_SIGN_OUT = Authorizator.createAction("person", "signOut");
@@ -30,6 +36,8 @@ var PermissionActions;
   PermissionActions2.PERSON_RESET_PASSWORD = Authorizator.createAction("person", "resetPassword");
   PermissionActions2.PERSON_CREATE_IDP_URL = Authorizator.createAction("person", "createIdPUrl");
   PermissionActions2.PERSON_SIGN_IN_IDP = Authorizator.createAction("person", "signInIdp");
+  PermissionActions2.PERSON_VIEW_IDP = (roles) => Authorizator.createAction("person", "viewIdp", { roles });
+  PermissionActions2.PERSON_DISCONNECT_MY_IDP = Authorizator.createAction("person", "disconnectMyIdp");
   PermissionActions2.PERSON_REQUEST_PASSWORDLESS_SIGN_IN = Authorizator.createAction("person", "requestPasswordlessSignIn");
   PermissionActions2.PERSON_PASSWORDLESS_SIGN_IN = Authorizator.createAction("person", "passwordlessSignIn");
   PermissionActions2.PERSON_CREATE_SESSION_KEY = (roles) => Authorizator.createAction("person", "createSessionToken", { roles });
@@ -37,6 +45,7 @@ var PermissionActions;
   PermissionActions2.PERSON_INVITE_UNMANAGED = (memberships) => Authorizator.createAction("person", "invite_unmanaged", { memberships });
   PermissionActions2.PROJECT_VIEW = Authorizator.createAction("project", "view");
   PermissionActions2.PROJECT_SET_SECRET = Authorizator.createAction("project", "setSecret");
+  PermissionActions2.PROJECT_VIEW_SECRETS = Authorizator.createAction("project", "viewSecrets");
   PermissionActions2.PROJECT_UPDATE = Authorizator.createAction("project", "update");
   PermissionActions2.PROJECT_CREATE = Authorizator.createAction("project", "create");
   PermissionActions2.ENTRYPOINT_DEPLOY = Authorizator.createAction("entrypoint", "deployEntrypoint");
@@ -47,6 +56,7 @@ var PermissionActions;
   PermissionActions2.API_KEY_CREATE = Authorizator.createAction("apiKey", "create");
   PermissionActions2.API_KEY_CREATE_GLOBAL = (roles) => Authorizator.createAction("apiKey", "createGlobal", { roles });
   PermissionActions2.API_KEY_DISABLE = Authorizator.createAction("apiKey", "disable");
+  PermissionActions2.API_KEY_LIST = Authorizator.createAction("apiKey", "list");
   PermissionActions2.MAIL_TEMPLATE_ADD = Authorizator.createAction("mailTemplate", "add");
   PermissionActions2.MAIL_TEMPLATE_REMOVE = Authorizator.createAction("mailTemplate", "remove");
   PermissionActions2.MAIL_TEMPLATE_LIST = Authorizator.createAction("mailTemplate", "list");

package/dist/production/src/model/authorization/PermissionActions.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"PermissionActions.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionActions.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { Acl } from '@contember/schema'\n\nnamespace PermissionActions {\n\texport enum Resources {\n\t\tsystem = 'system',\n\t\tentrypoint = 'entrypoint',\n\t\tperson = 'person',\n\t\tidentity = 'identity',\n\t\tproject = 'project',\n\t\tapiKey = 'apiKey',\n\t\tmailTemplate = 'mailTemplate',\n\t\tidp = 'idp',\n\t}\n\n\texport const CONFIGURE = Authorizator.createAction(Resources.system, 'configure')\n\texport const CONFIG_VIEW = Authorizator.createAction(Resources.system, 'viewConfig')\n\n\texport const IDENTITY_VIEW_PERMISSIONS = Authorizator.createAction(Resources.identity, 'viewPermissions')\n\texport const IDENTITY_ADD_GLOBAL_ROLES = (roles?: readonly string[]) => Authorizator.createAction(Resources.identity, 'addGlobalRoles', { roles })\n\texport const IDENTITY_REMOVE_GLOBAL_ROLES = (roles?: readonly string[]) =>\n\t\tAuthorizator.createAction(Resources.identity, 'removeGlobalRoles', { roles })\n\n\texport const PERSON_DISABLE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'disable', { roles })\n\n\texport const PERSON_VIEW = Authorizator.createAction(Resources.person, 'view')\n\texport const PERSON_SIGN_IN = Authorizator.createAction(Resources.person, 'signIn')\n\texport const PERSON_SIGN_UP = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'signUp', { roles })\n\texport const PERSON_SIGN_OUT = Authorizator.createAction(Resources.person, 'signOut')\n\texport const PERSON_SETUP_OTP = Authorizator.createAction(Resources.person, 'setupOtp')\n\texport const PERSON_CHANGE_PROFILE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'changeProfile', { roles })\n\texport const PERSON_CHANGE_MY_PROFILE = Authorizator.createAction(Resources.person, 'changeMyProfile')\n\texport const PERSON_TOGGLE_PASSWORDLESS = Authorizator.createAction(Resources.person, 'togglePasswordless')\n\texport const PERSON_CHANGE_PASSWORD = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'changePassword', { roles })\n\texport const PERSON_CHANGE_MY_PASSWORD = Authorizator.createAction(Resources.person, 'changeMyPassword')\n\texport const PERSON_RESET_PASSWORD = Authorizator.createAction(Resources.person, 'resetPassword')\n\texport const PERSON_CREATE_IDP_URL = Authorizator.createAction(Resources.person, 'createIdPUrl')\n\texport const PERSON_SIGN_IN_IDP = Authorizator.createAction(Resources.person, 'signInIdp')\n\texport const PERSON_REQUEST_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'requestPasswordlessSignIn')\n\texport const PERSON_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'passwordlessSignIn')\n\texport const PERSON_CREATE_SESSION_KEY = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'createSessionToken', { roles })\n\n\texport const PERSON_INVITE = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.person, 'invite', { memberships })\n\texport const PERSON_INVITE_UNMANAGED = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.person, 'invite_unmanaged', { memberships })\n\n\texport const PROJECT_VIEW = Authorizator.createAction(Resources.project, 'view')\n\texport const PROJECT_SET_SECRET = Authorizator.createAction(Resources.project, 'setSecret')\n\texport const PROJECT_UPDATE = Authorizator.createAction(Resources.project, 'update')\n\n\texport const PROJECT_CREATE = Authorizator.createAction(Resources.project, 'create')\n\texport const ENTRYPOINT_DEPLOY = Authorizator.createAction(Resources.entrypoint, 'deployEntrypoint')\n\n\texport const PROJECT_VIEW_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'viewMembers', { memberships })\n\texport const PROJECT_ADD_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'addMember', { memberships })\n\texport const PROJECT_REMOVE_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'removeMember', { memberships })\n\texport const PROJECT_UPDATE_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'updateMember', { memberships })\n\n\texport const API_KEY_CREATE = Authorizator.createAction(Resources.apiKey, 'create')\n\texport const API_KEY_CREATE_GLOBAL = (roles?: readonly string[]) => Authorizator.createAction(Resources.apiKey, 'createGlobal', { roles })\n\texport const API_KEY_DISABLE = Authorizator.createAction(Resources.apiKey, 'disable')\n\n\texport const MAIL_TEMPLATE_ADD = Authorizator.createAction(Resources.mailTemplate, 'add')\n\texport const MAIL_TEMPLATE_REMOVE = Authorizator.createAction(Resources.mailTemplate, 'remove')\n\texport const MAIL_TEMPLATE_LIST = Authorizator.createAction(Resources.mailTemplate, 'list')\n\n\texport const IDP_ADD = Authorizator.createAction(Resources.idp, 'add')\n\texport const IDP_UPDATE = Authorizator.createAction(Resources.idp, 'update')\n\texport const IDP_DISABLE = Authorizator.createAction(Resources.idp, 'disable')\n\texport const IDP_ENABLE = Authorizator.createAction(Resources.idp, 'enable')\n\texport const IDP_LIST = Authorizator.createAction(Resources.idp, 'list')\n}\n\nexport { PermissionActions }\n"],"names":["PermissionActions","Resources"],"mappings":";AAGA,IAAU;AAAA,CAAV,CAAUA,uBAAV;AACQ,GAAA,CAAKC,eAAL;AACNA,eAAA,QAAA,IAAS;AACTA,eAAA,YAAA,IAAa;AACbA,eAAA,QAAA,IAAS;AACTA,eAAA,UAAA,IAAW;AACXA,eAAA,SAAA,IAAU;AACVA,eAAA,QAAA,IAAS;AACTA,eAAA,cAAA,IAAe;AACfA,eAAA,KAAA,IAAM;AAAA,EAAA,GARKD,mBAAA,cAAAA,mBAAA,YAAA,CAAA,EAAA;AAWCA,qBAAA,YAAY,aAAa,aAAa,UAAkB,WAAW;AACnEA,qBAAA,cAAc,aAAa,aAAa,UAAkB,YAAY;~~AAEtEA~~,qBAAA,4BAA4B,aAAa,aAAa,YAAoB,iBAAiB;AAC3FA,qBAAA,4BAA4B,CAAC,UAA8B,aAAa,aAAa,YAAoB,kBAAkB,EAAE,OAAO;AACpIA,qBAAA,+BAA+B,CAAC,UAC5C,aAAa,aAAa,YAAoB,qBAAqB,EAAE,OAAO;AAEhEA,qBAAA,iBAAiB,CAAC,UAA8B,aAAa,aAAa,UAAkB,WAAW,EAAE,OAAO;~~AAEhHA~~,qBAAA,cAAc,aAAa,aAAa,UAAkB,MAAM;AAChEA,qBAAA,iBAAiB,aAAa,aAAa,UAAkB,QAAQ;AACrEA,qBAAA,iBAAiB,CAAC,UAA8B,aAAa,aAAa,UAAkB,UAAU,EAAE,OAAO;AAC/GA,qBAAA,kBAAkB,aAAa,aAAa,UAAkB,SAAS;AACvEA,qBAAA,mBAAmB,aAAa,aAAa,UAAkB,UAAU;AACzEA,qBAAA,wBAAwB,CAAC,UAA8B,aAAa,aAAa,UAAkB,iBAAiB,EAAE,OAAO;AAC7HA,qBAAA,2BAA2B,aAAa,aAAa,UAAkB,iBAAiB;AACxFA,qBAAA,6BAA6B,aAAa,aAAa,UAAkB,oBAAoB;AAC7FA,qBAAA,yBAAyB,CAAC,UAA8B,aAAa,aAAa,UAAkB,kBAAkB,EAAE,OAAO;AAC/HA,qBAAA,4BAA4B,aAAa,aAAa,UAAkB,kBAAkB;AAC1FA,qBAAA,wBAAwB,aAAa,aAAa,UAAkB,eAAe;AACnFA,qBAAA,wBAAwB,aAAa,aAAa,UAAkB,cAAc;AAClFA,qBAAA,qBAAqB,aAAa,aAAa,UAAkB,WAAW;AAC5EA,qBAAA,sCAAsC,aAAa,aAAa,UAAkB,2BAA2B;AAC7GA,qBAAA,8BAA8B,aAAa,aAAa,UAAkB,oBAAoB;AAC9FA,qBAAA,4BAA4B,CAAC,UAA8B,aAAa,aAAa,UAAkB,sBAAsB,EAAE,OAAO;AAEtIA,qBAAA,gBAAgB,CAAC,gBAA2C,aAAa,aAAa,UAAkB,UAAU,EAAE,aAAa;AACjIA,qBAAA,0BAA0B,CAAC,gBACvC,aAAa,aAAa,UAAkB,oBAAoB,EAAE,aAAa;AAEnEA,qBAAA,eAAe,aAAa,aAAa,WAAmB,MAAM;AAClEA,qBAAA,qBAAqB,aAAa,aAAa,WAAmB,WAAW;AAC7EA,qBAAA,iBAAiB,aAAa,aAAa,WAAmB,QAAQ;AAEtEA,qBAAA,iBAAiB,aAAa,aAAa,WAAmB,QAAQ;AACtEA,qBAAA,oBAAoB,aAAa,aAAa,cAAsB,kBAAkB;AAEtFA,qBAAA,sBAAsB,CAAC,gBACnC,aAAa,aAAa,WAAmB,eAAe,EAAE,aAAa;AAC/DA,qBAAA,qBAAqB,CAAC,gBAClC,aAAa,aAAa,WAAmB,aAAa,EAAE,aAAa;AAC7DA,qBAAA,wBAAwB,CAAC,gBACrC,aAAa,aAAa,WAAmB,gBAAgB,EAAE,aAAa;AAChEA,qBAAA,wBAAwB,CAAC,gBACrC,aAAa,aAAa,WAAmB,gBAAgB,EAAE,aAAa;AAEhEA,qBAAA,iBAAiB,aAAa,aAAa,UAAkB,QAAQ;AACrEA,qBAAA,wBAAwB,CAAC,UAA8B,aAAa,aAAa,UAAkB,gBAAgB,EAAE,OAAO;AAC5HA,qBAAA,kBAAkB,aAAa,aAAa,UAAkB,SAAS;~~AAEvEA~~,qBAAA,oBAAoB,aAAa,aAAa,gBAAwB,KAAK;AAC3EA,qBAAA,uBAAuB,aAAa,aAAa,gBAAwB,QAAQ;AACjFA,qBAAA,qBAAqB,aAAa,aAAa,gBAAwB,MAAM;AAE7EA,qBAAA,UAAU,aAAa,aAAa,OAAe,KAAK;AACxDA,qBAAA,aAAa,aAAa,aAAa,OAAe,QAAQ;AAC9DA,qBAAA,cAAc,aAAa,aAAa,OAAe,SAAS;AAChEA,qBAAA,aAAa,aAAa,aAAa,OAAe,QAAQ;AAC9DA,qBAAA,WAAW,aAAa,aAAa,OAAe,MAAM;AAAA,~~GAvE9D~~,sBAAA,oBAAA,CAAA,EAAA;"}
1	+ {"version":3,"file":"PermissionActions.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionActions.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { Acl } from '@contember/schema'\n\nnamespace PermissionActions {\n\texport enum Resources {\n\t\tsystem = 'system',\n\t\tentrypoint = 'entrypoint',\n\t\tperson = 'person',\n\t\tidentity = 'identity',\n\t\tproject = 'project',\n\t\tapiKey = 'apiKey',\n\t\tmailTemplate = 'mailTemplate',\n\t\tidp = 'idp',\n\t}\n\n\texport const CONFIGURE = Authorizator.createAction(Resources.system, 'configure')\n\texport const CONFIG_VIEW = Authorizator.createAction(Resources.system, 'viewConfig')\n\texport const AUTH_LOG_VIEW = Authorizator.createAction(Resources.system, 'viewAuthLog')\n\n\texport const IDENTITY_VIEW_PERMISSIONS = Authorizator.createAction(Resources.identity, 'viewPermissions')\n\texport const IDENTITY_ADD_GLOBAL_ROLES = (roles?: readonly string[]) => Authorizator.createAction(Resources.identity, 'addGlobalRoles', { roles })\n\texport const IDENTITY_REMOVE_GLOBAL_ROLES = (roles?: readonly string[]) =>\n\t\tAuthorizator.createAction(Resources.identity, 'removeGlobalRoles', { roles })\n\n\texport const PERSON_DISABLE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'disable', { roles })\n\texport const PERSON_FORCE_SIGN_OUT = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'forceSignOut', { roles })\n\texport const PERSON_RESET_MFA = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'resetMfa', { roles })\n\texport const PERSON_REVOKE_SESSION = Authorizator.createAction(Resources.person, 'revokeSession')\n\texport const PERSON_VIEW_SESSIONS = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'viewSessions', { roles })\n\n\texport const PERSON_VIEW = Authorizator.createAction(Resources.person, 'view')\n\texport const PERSON_LIST = Authorizator.createAction(Resources.person, 'list')\n\texport const PERSON_SIGN_IN = Authorizator.createAction(Resources.person, 'signIn')\n\texport const PERSON_SIGN_UP = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'signUp', { roles })\n\texport const PERSON_SIGN_OUT = Authorizator.createAction(Resources.person, 'signOut')\n\texport const PERSON_SETUP_OTP = Authorizator.createAction(Resources.person, 'setupOtp')\n\texport const PERSON_CHANGE_PROFILE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'changeProfile', { roles })\n\texport const PERSON_CHANGE_MY_PROFILE = Authorizator.createAction(Resources.person, 'changeMyProfile')\n\texport const PERSON_TOGGLE_PASSWORDLESS = Authorizator.createAction(Resources.person, 'togglePasswordless')\n\texport const PERSON_CHANGE_PASSWORD = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'changePassword', { roles })\n\texport const PERSON_CHANGE_MY_PASSWORD = Authorizator.createAction(Resources.person, 'changeMyPassword')\n\texport const PERSON_RESET_PASSWORD = Authorizator.createAction(Resources.person, 'resetPassword')\n\texport const PERSON_CREATE_IDP_URL = Authorizator.createAction(Resources.person, 'createIdPUrl')\n\texport const PERSON_SIGN_IN_IDP = Authorizator.createAction(Resources.person, 'signInIdp')\n\texport const PERSON_VIEW_IDP = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'viewIdp', { roles })\n\texport const PERSON_DISCONNECT_MY_IDP = Authorizator.createAction(Resources.person, 'disconnectMyIdp')\n\texport const PERSON_REQUEST_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'requestPasswordlessSignIn')\n\texport const PERSON_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'passwordlessSignIn')\n\texport const PERSON_CREATE_SESSION_KEY = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'createSessionToken', { roles })\n\n\texport const PERSON_INVITE = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.person, 'invite', { memberships })\n\texport const PERSON_INVITE_UNMANAGED = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.person, 'invite_unmanaged', { memberships })\n\n\texport const PROJECT_VIEW = Authorizator.createAction(Resources.project, 'view')\n\texport const PROJECT_SET_SECRET = Authorizator.createAction(Resources.project, 'setSecret')\n\texport const PROJECT_VIEW_SECRETS = Authorizator.createAction(Resources.project, 'viewSecrets')\n\texport const PROJECT_UPDATE = Authorizator.createAction(Resources.project, 'update')\n\n\texport const PROJECT_CREATE = Authorizator.createAction(Resources.project, 'create')\n\texport const ENTRYPOINT_DEPLOY = Authorizator.createAction(Resources.entrypoint, 'deployEntrypoint')\n\n\texport const PROJECT_VIEW_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'viewMembers', { memberships })\n\texport const PROJECT_ADD_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'addMember', { memberships })\n\texport const PROJECT_REMOVE_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'removeMember', { memberships })\n\texport const PROJECT_UPDATE_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'updateMember', { memberships })\n\n\texport const API_KEY_CREATE = Authorizator.createAction(Resources.apiKey, 'create')\n\texport const API_KEY_CREATE_GLOBAL = (roles?: readonly string[]) => Authorizator.createAction(Resources.apiKey, 'createGlobal', { roles })\n\texport const API_KEY_DISABLE = Authorizator.createAction(Resources.apiKey, 'disable')\n\texport const API_KEY_LIST = Authorizator.createAction(Resources.apiKey, 'list')\n\n\texport const MAIL_TEMPLATE_ADD = Authorizator.createAction(Resources.mailTemplate, 'add')\n\texport const MAIL_TEMPLATE_REMOVE = Authorizator.createAction(Resources.mailTemplate, 'remove')\n\texport const MAIL_TEMPLATE_LIST = Authorizator.createAction(Resources.mailTemplate, 'list')\n\n\texport const IDP_ADD = Authorizator.createAction(Resources.idp, 'add')\n\texport const IDP_UPDATE = Authorizator.createAction(Resources.idp, 'update')\n\texport const IDP_DISABLE = Authorizator.createAction(Resources.idp, 'disable')\n\texport const IDP_ENABLE = Authorizator.createAction(Resources.idp, 'enable')\n\texport const IDP_LIST = Authorizator.createAction(Resources.idp, 'list')\n}\n\nexport { PermissionActions }\n"],"names":["PermissionActions","Resources"],"mappings":";AAGA,IAAU;AAAA,CAAV,CAAUA,uBAAV;AACQ,GAAA,CAAKC,eAAL;AACNA,eAAA,QAAA,IAAS;AACTA,eAAA,YAAA,IAAa;AACbA,eAAA,QAAA,IAAS;AACTA,eAAA,UAAA,IAAW;AACXA,eAAA,SAAA,IAAU;AACVA,eAAA,QAAA,IAAS;AACTA,eAAA,cAAA,IAAe;AACfA,eAAA,KAAA,IAAM;AAAA,EAAA,GARKD,mBAAA,cAAAA,mBAAA,YAAA,CAAA,EAAA;AAWCA,qBAAA,YAAY,aAAa,aAAa,UAAkB,WAAW;AACnEA,qBAAA,cAAc,aAAa,aAAa,UAAkB,YAAY;AACtEA,qBAAA,gBAAgB,aAAa,aAAa,UAAkB,aAAa;AAEzEA,qBAAA,4BAA4B,aAAa,aAAa,YAAoB,iBAAiB;AAC3FA,qBAAA,4BAA4B,CAAC,UAA8B,aAAa,aAAa,YAAoB,kBAAkB,EAAE,OAAO;AACpIA,qBAAA,+BAA+B,CAAC,UAC5C,aAAa,aAAa,YAAoB,qBAAqB,EAAE,OAAO;AAEhEA,qBAAA,iBAAiB,CAAC,UAA8B,aAAa,aAAa,UAAkB,WAAW,EAAE,OAAO;AAChHA,qBAAA,wBAAwB,CAAC,UAA8B,aAAa,aAAa,UAAkB,gBAAgB,EAAE,OAAO;AAC5HA,qBAAA,mBAAmB,CAAC,UAA8B,aAAa,aAAa,UAAkB,YAAY,EAAE,OAAO;AACnHA,qBAAA,wBAAwB,aAAa,aAAa,UAAkB,eAAe;AACnFA,qBAAA,uBAAuB,CAAC,UAA8B,aAAa,aAAa,UAAkB,gBAAgB,EAAE,OAAO;AAE3HA,qBAAA,cAAc,aAAa,aAAa,UAAkB,MAAM;AAChEA,qBAAA,cAAc,aAAa,aAAa,UAAkB,MAAM;AAChEA,qBAAA,iBAAiB,aAAa,aAAa,UAAkB,QAAQ;AACrEA,qBAAA,iBAAiB,CAAC,UAA8B,aAAa,aAAa,UAAkB,UAAU,EAAE,OAAO;AAC/GA,qBAAA,kBAAkB,aAAa,aAAa,UAAkB,SAAS;AACvEA,qBAAA,mBAAmB,aAAa,aAAa,UAAkB,UAAU;AACzEA,qBAAA,wBAAwB,CAAC,UAA8B,aAAa,aAAa,UAAkB,iBAAiB,EAAE,OAAO;AAC7HA,qBAAA,2BAA2B,aAAa,aAAa,UAAkB,iBAAiB;AACxFA,qBAAA,6BAA6B,aAAa,aAAa,UAAkB,oBAAoB;AAC7FA,qBAAA,yBAAyB,CAAC,UAA8B,aAAa,aAAa,UAAkB,kBAAkB,EAAE,OAAO;AAC/HA,qBAAA,4BAA4B,aAAa,aAAa,UAAkB,kBAAkB;AAC1FA,qBAAA,wBAAwB,aAAa,aAAa,UAAkB,eAAe;AACnFA,qBAAA,wBAAwB,aAAa,aAAa,UAAkB,cAAc;AAClFA,qBAAA,qBAAqB,aAAa,aAAa,UAAkB,WAAW;AAC5EA,qBAAA,kBAAkB,CAAC,UAA8B,aAAa,aAAa,UAAkB,WAAW,EAAE,OAAO;AACjHA,qBAAA,2BAA2B,aAAa,aAAa,UAAkB,iBAAiB;AACxFA,qBAAA,sCAAsC,aAAa,aAAa,UAAkB,2BAA2B;AAC7GA,qBAAA,8BAA8B,aAAa,aAAa,UAAkB,oBAAoB;AAC9FA,qBAAA,4BAA4B,CAAC,UAA8B,aAAa,aAAa,UAAkB,sBAAsB,EAAE,OAAO;AAEtIA,qBAAA,gBAAgB,CAAC,gBAA2C,aAAa,aAAa,UAAkB,UAAU,EAAE,aAAa;AACjIA,qBAAA,0BAA0B,CAAC,gBACvC,aAAa,aAAa,UAAkB,oBAAoB,EAAE,aAAa;AAEnEA,qBAAA,eAAe,aAAa,aAAa,WAAmB,MAAM;AAClEA,qBAAA,qBAAqB,aAAa,aAAa,WAAmB,WAAW;AAC7EA,qBAAA,uBAAuB,aAAa,aAAa,WAAmB,aAAa;AACjFA,qBAAA,iBAAiB,aAAa,aAAa,WAAmB,QAAQ;AAEtEA,qBAAA,iBAAiB,aAAa,aAAa,WAAmB,QAAQ;AACtEA,qBAAA,oBAAoB,aAAa,aAAa,cAAsB,kBAAkB;AAEtFA,qBAAA,sBAAsB,CAAC,gBACnC,aAAa,aAAa,WAAmB,eAAe,EAAE,aAAa;AAC/DA,qBAAA,qBAAqB,CAAC,gBAClC,aAAa,aAAa,WAAmB,aAAa,EAAE,aAAa;AAC7DA,qBAAA,wBAAwB,CAAC,gBACrC,aAAa,aAAa,WAAmB,gBAAgB,EAAE,aAAa;AAChEA,qBAAA,wBAAwB,CAAC,gBACrC,aAAa,aAAa,WAAmB,gBAAgB,EAAE,aAAa;AAEhEA,qBAAA,iBAAiB,aAAa,aAAa,UAAkB,QAAQ;AACrEA,qBAAA,wBAAwB,CAAC,UAA8B,aAAa,aAAa,UAAkB,gBAAgB,EAAE,OAAO;AAC5HA,qBAAA,kBAAkB,aAAa,aAAa,UAAkB,SAAS;AACvEA,qBAAA,eAAe,aAAa,aAAa,UAAkB,MAAM;AAEjEA,qBAAA,oBAAoB,aAAa,aAAa,gBAAwB,KAAK;AAC3EA,qBAAA,uBAAuB,aAAa,aAAa,gBAAwB,QAAQ;AACjFA,qBAAA,qBAAqB,aAAa,aAAa,gBAAwB,MAAM;AAE7EA,qBAAA,UAAU,aAAa,aAAa,OAAe,KAAK;AACxDA,qBAAA,aAAa,aAAa,aAAa,OAAe,QAAQ;AAC9DA,qBAAA,cAAc,aAAa,aAAa,OAAe,SAAS;AAChEA,qBAAA,aAAa,aAAa,aAAa,OAAe,QAAQ;AAC9DA,qBAAA,WAAW,aAAa,aAAa,OAAe,MAAM;AAAA,GAjF9D,sBAAA,oBAAA,CAAA,EAAA;"}

package/dist/production/src/model/authorization/PermissionContext.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"PermissionContext.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionContext.ts"],"sourcesContent":["import { AccessNode, AuthorizationScope, Authorizator } from '@contember/authorization'\nimport { ForbiddenError } from '@contember/graphql-utils'\nimport { ProjectScopeFactory } from './ProjectScopeFactory'\nimport { Project, ProjectSchemaResolver } from '../type'\nimport { Identity } from './Identity'\n\nexport type AccessVerifier = (action: Authorizator.Action) => Promise<boolean>\n\nconst deniedScope = new AuthorizationScope.Fixed(AccessNode.Fixed.denied())\n\nexport class PermissionContext {\n\tprivate projectScopes: Record<string, AuthorizationScope<Identity>> = {}\n\n\tconstructor(\n\t\tpublic readonly identity: Identity,\n\t\tpublic readonly authorizator: Authorizator<Identity>,\n\t\tprivate readonly projectScopeFactory: ProjectScopeFactory,\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tpublic async isAllowed<Meta extends {} \| undefined>({\n\t\tscope,\n\t\taction,\n\t}: {\n\t\tscope?: AuthorizationScope<Identity>\n\t\taction: Authorizator.Action<Meta>\n\t}): Promise<boolean> {\n\t\treturn await this.authorizator.isAllowed(this.identity, scope \|\| new AuthorizationScope.Global(), action)\n\t}\n\n\tpublic createAccessVerifier(scope: AuthorizationScope<Identity>): AccessVerifier {\n\t\treturn action => this.isAllowed({ scope, action })\n\t}\n\n\tpublic async requireAccess<Meta extends {} \| undefined>({\n\t\tscope,\n\t\taction,\n\t\tmessage,\n\t}: {\n\t\tscope?: AuthorizationScope<Identity>\n\t\taction: Authorizator.Action<Meta>\n\t\tmessage?: string\n\t}): Promise<void> {\n\t\tif (!(await this.isAllowed({ scope, action }))) {\n\t\t\tthrow new ForbiddenError(message \|\| 'Forbidden')\n\t\t}\n\t}\n\n\tpublic async createProjectScope(project: Pick<Project, 'slug'> \| null): Promise<AuthorizationScope<Identity>> {\n\t\tif (!project) {\n\t\t\treturn deniedScope\n\t\t}\n\t\tif (!this.projectScopes[project.slug]) {\n\t\t\tthis.projectScopes[project.slug] = (await this.projectScopeFactory.create(this.schemaResolver, project)) \|\| deniedScope\n\t\t}\n\t\treturn this.projectScopes[project.slug]\n\t}\n}\n"],"names":["AuthorizationScope","AccessNode","ForbiddenError"],"mappings":";;;;;;;AAQA,MAAM,cAAc,IAAIA,cAAAA,mBAAmB,MAAMC,cAAAA,WAAW,MAAM,QAAQ;AAEnE,MAAM,kBAAkB;AAAA,EAG9B,YACiB,UACA,cACC,qBACA,gBAChB;AAJe,SAAA,WAAA;AACA,SAAA,eAAA;AACC,SAAA,sBAAA;AACA,SAAA,iBAAA;AANlB,kBAAA,MAAQ,iBAA8D,EAAC;AAAA,EAOpE;AAAA,EAEH,MAAa,UAAuC;AAAA,IACnD;AAAA,IACA;AAAA,EAAA,GAIoB;AACpB,WAAO,MAAM,KAAK,aAAa,UAAU,KAAK,UAAU,SAAS,IAAID,cAAAA,mBAAmB,OAAA,GAAU,MAAM;AAAA,EACzG;AAAA,EAEO,qBAAqB,OAAqD;AAChF,WAAO,YAAU,KAAK,UAAU,EAAE,OAAO,QAAQ;AAAA,EAClD;AAAA,EAEA,MAAa,cAA2C;AAAA,IACvD;AAAA,IACA;AAAA,IACA;AAAA,EAAA,GAKiB;AACjB,QAAI,CAAE,MAAM,KAAK,UAAU,EAAE,OAAO,OAAA,CAAQ,GAAI;AAC/C,YAAM,IAAIE,aAAAA,eAAe,WAAW,WAAW;AAAA,IAChD;AAAA,EACD;AAAA,EAEA,MAAa,mBAAmB,SAA8E;AAC7G,QAAI,CAAC,SAAS;AACb,aAAO;AAAA,IACR;AACA,QAAI,CAAC,KAAK,cAAc,QAAQ,IAAI,GAAG;AACtC,WAAK,cAAc,QAAQ,IAAI,IAAK,MAAM,KAAK,oBAAoB,OAAO,KAAK,gBAAgB,OAAO,KAAM;AAAA,IAC7G;AACA,WAAO,KAAK,cAAc,QAAQ,IAAI;AAAA,EACvC;AACD;;"}
1	+ {"version":3,"file":"PermissionContext.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionContext.ts"],"sourcesContent":["import { AccessNode, AuthorizationScope, Authorizator } from '@contember/authorization'\nimport { ForbiddenError } from '@contember/graphql-utils'\nimport { ProjectScopeFactory } from './ProjectScopeFactory.js'\nimport { Project, ProjectSchemaResolver } from '../type/index.js'\nimport { Identity } from './Identity.js'\n\nexport type AccessVerifier = (action: Authorizator.Action) => Promise<boolean>\n\nconst deniedScope = new AuthorizationScope.Fixed(AccessNode.Fixed.denied())\n\nexport class PermissionContext {\n\tprivate projectScopes: Record<string, AuthorizationScope<Identity>> = {}\n\n\tconstructor(\n\t\tpublic readonly identity: Identity,\n\t\tpublic readonly authorizator: Authorizator<Identity>,\n\t\tprivate readonly projectScopeFactory: ProjectScopeFactory,\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tpublic async isAllowed<Meta extends {} \| undefined>({\n\t\tscope,\n\t\taction,\n\t}: {\n\t\tscope?: AuthorizationScope<Identity>\n\t\taction: Authorizator.Action<Meta>\n\t}): Promise<boolean> {\n\t\treturn await this.authorizator.isAllowed(this.identity, scope \|\| new AuthorizationScope.Global(), action)\n\t}\n\n\tpublic createAccessVerifier(scope: AuthorizationScope<Identity>): AccessVerifier {\n\t\treturn action => this.isAllowed({ scope, action })\n\t}\n\n\tpublic async requireAccess<Meta extends {} \| undefined>({\n\t\tscope,\n\t\taction,\n\t\tmessage,\n\t}: {\n\t\tscope?: AuthorizationScope<Identity>\n\t\taction: Authorizator.Action<Meta>\n\t\tmessage?: string\n\t}): Promise<void> {\n\t\tif (!(await this.isAllowed({ scope, action }))) {\n\t\t\tthrow new ForbiddenError(message \|\| 'Forbidden')\n\t\t}\n\t}\n\n\tpublic async createProjectScope(project: Pick<Project, 'slug'> \| null): Promise<AuthorizationScope<Identity>> {\n\t\tif (!project) {\n\t\t\treturn deniedScope\n\t\t}\n\t\tif (!this.projectScopes[project.slug]) {\n\t\t\tthis.projectScopes[project.slug] = (await this.projectScopeFactory.create(this.schemaResolver, project)) \|\| deniedScope\n\t\t}\n\t\treturn this.projectScopes[project.slug]\n\t}\n}\n"],"names":["AuthorizationScope","AccessNode","ForbiddenError"],"mappings":";;;;;;;AAQA,MAAM,cAAc,IAAIA,cAAAA,mBAAmB,MAAMC,cAAAA,WAAW,MAAM,QAAQ;AAEnE,MAAM,kBAAkB;AAAA,EAG9B,YACiB,UACA,cACC,qBACA,gBAChB;AAJe,SAAA,WAAA;AACA,SAAA,eAAA;AACC,SAAA,sBAAA;AACA,SAAA,iBAAA;AANlB,kBAAA,MAAQ,iBAA8D,EAAC;AAAA,EAOpE;AAAA,EAEH,MAAa,UAAuC;AAAA,IACnD;AAAA,IACA;AAAA,EAAA,GAIoB;AACpB,WAAO,MAAM,KAAK,aAAa,UAAU,KAAK,UAAU,SAAS,IAAID,cAAAA,mBAAmB,OAAA,GAAU,MAAM;AAAA,EACzG;AAAA,EAEO,qBAAqB,OAAqD;AAChF,WAAO,YAAU,KAAK,UAAU,EAAE,OAAO,QAAQ;AAAA,EAClD;AAAA,EAEA,MAAa,cAA2C;AAAA,IACvD;AAAA,IACA;AAAA,IACA;AAAA,EAAA,GAKiB;AACjB,QAAI,CAAE,MAAM,KAAK,UAAU,EAAE,OAAO,OAAA,CAAQ,GAAI;AAC/C,YAAM,IAAIE,aAAAA,eAAe,WAAW,WAAW;AAAA,IAChD;AAAA,EACD;AAAA,EAEA,MAAa,mBAAmB,SAA8E;AAC7G,QAAI,CAAC,SAAS;AACb,aAAO;AAAA,IACR;AACA,QAAI,CAAC,KAAK,cAAc,QAAQ,IAAI,GAAG;AACtC,WAAK,cAAc,QAAQ,IAAI,IAAK,MAAM,KAAK,oBAAoB,OAAO,KAAK,gBAAgB,OAAO,KAAM;AAAA,IAC7G;AACA,WAAO,KAAK,cAAc,QAAQ,IAAI;AAAA,EACvC;AACD;;"}

package/dist/production/src/model/authorization/PermissionContext.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"PermissionContext.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionContext.ts"],"sourcesContent":["import { AccessNode, AuthorizationScope, Authorizator } from '@contember/authorization'\nimport { ForbiddenError } from '@contember/graphql-utils'\nimport { ProjectScopeFactory } from './ProjectScopeFactory'\nimport { Project, ProjectSchemaResolver } from '../type'\nimport { Identity } from './Identity'\n\nexport type AccessVerifier = (action: Authorizator.Action) => Promise<boolean>\n\nconst deniedScope = new AuthorizationScope.Fixed(AccessNode.Fixed.denied())\n\nexport class PermissionContext {\n\tprivate projectScopes: Record<string, AuthorizationScope<Identity>> = {}\n\n\tconstructor(\n\t\tpublic readonly identity: Identity,\n\t\tpublic readonly authorizator: Authorizator<Identity>,\n\t\tprivate readonly projectScopeFactory: ProjectScopeFactory,\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tpublic async isAllowed<Meta extends {} \| undefined>({\n\t\tscope,\n\t\taction,\n\t}: {\n\t\tscope?: AuthorizationScope<Identity>\n\t\taction: Authorizator.Action<Meta>\n\t}): Promise<boolean> {\n\t\treturn await this.authorizator.isAllowed(this.identity, scope \|\| new AuthorizationScope.Global(), action)\n\t}\n\n\tpublic createAccessVerifier(scope: AuthorizationScope<Identity>): AccessVerifier {\n\t\treturn action => this.isAllowed({ scope, action })\n\t}\n\n\tpublic async requireAccess<Meta extends {} \| undefined>({\n\t\tscope,\n\t\taction,\n\t\tmessage,\n\t}: {\n\t\tscope?: AuthorizationScope<Identity>\n\t\taction: Authorizator.Action<Meta>\n\t\tmessage?: string\n\t}): Promise<void> {\n\t\tif (!(await this.isAllowed({ scope, action }))) {\n\t\t\tthrow new ForbiddenError(message \|\| 'Forbidden')\n\t\t}\n\t}\n\n\tpublic async createProjectScope(project: Pick<Project, 'slug'> \| null): Promise<AuthorizationScope<Identity>> {\n\t\tif (!project) {\n\t\t\treturn deniedScope\n\t\t}\n\t\tif (!this.projectScopes[project.slug]) {\n\t\t\tthis.projectScopes[project.slug] = (await this.projectScopeFactory.create(this.schemaResolver, project)) \|\| deniedScope\n\t\t}\n\t\treturn this.projectScopes[project.slug]\n\t}\n}\n"],"names":[],"mappings":";;;;;AAQA,MAAM,cAAc,IAAI,mBAAmB,MAAM,WAAW,MAAM,QAAQ;AAEnE,MAAM,kBAAkB;AAAA,EAG9B,YACiB,UACA,cACC,qBACA,gBAChB;AAJe,SAAA,WAAA;AACA,SAAA,eAAA;AACC,SAAA,sBAAA;AACA,SAAA,iBAAA;AANlB,kBAAA,MAAQ,iBAA8D,EAAC;AAAA,EAOpE;AAAA,EAEH,MAAa,UAAuC;AAAA,IACnD;AAAA,IACA;AAAA,EAAA,GAIoB;AACpB,WAAO,MAAM,KAAK,aAAa,UAAU,KAAK,UAAU,SAAS,IAAI,mBAAmB,OAAA,GAAU,MAAM;AAAA,EACzG;AAAA,EAEO,qBAAqB,OAAqD;AAChF,WAAO,YAAU,KAAK,UAAU,EAAE,OAAO,QAAQ;AAAA,EAClD;AAAA,EAEA,MAAa,cAA2C;AAAA,IACvD;AAAA,IACA;AAAA,IACA;AAAA,EAAA,GAKiB;AACjB,QAAI,CAAE,MAAM,KAAK,UAAU,EAAE,OAAO,OAAA,CAAQ,GAAI;AAC/C,YAAM,IAAI,eAAe,WAAW,WAAW;AAAA,IAChD;AAAA,EACD;AAAA,EAEA,MAAa,mBAAmB,SAA8E;AAC7G,QAAI,CAAC,SAAS;AACb,aAAO;AAAA,IACR;AACA,QAAI,CAAC,KAAK,cAAc,QAAQ,IAAI,GAAG;AACtC,WAAK,cAAc,QAAQ,IAAI,IAAK,MAAM,KAAK,oBAAoB,OAAO,KAAK,gBAAgB,OAAO,KAAM;AAAA,IAC7G;AACA,WAAO,KAAK,cAAc,QAAQ,IAAI;AAAA,EACvC;AACD;"}
1	+ {"version":3,"file":"PermissionContext.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionContext.ts"],"sourcesContent":["import { AccessNode, AuthorizationScope, Authorizator } from '@contember/authorization'\nimport { ForbiddenError } from '@contember/graphql-utils'\nimport { ProjectScopeFactory } from './ProjectScopeFactory.js'\nimport { Project, ProjectSchemaResolver } from '../type/index.js'\nimport { Identity } from './Identity.js'\n\nexport type AccessVerifier = (action: Authorizator.Action) => Promise<boolean>\n\nconst deniedScope = new AuthorizationScope.Fixed(AccessNode.Fixed.denied())\n\nexport class PermissionContext {\n\tprivate projectScopes: Record<string, AuthorizationScope<Identity>> = {}\n\n\tconstructor(\n\t\tpublic readonly identity: Identity,\n\t\tpublic readonly authorizator: Authorizator<Identity>,\n\t\tprivate readonly projectScopeFactory: ProjectScopeFactory,\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tpublic async isAllowed<Meta extends {} \| undefined>({\n\t\tscope,\n\t\taction,\n\t}: {\n\t\tscope?: AuthorizationScope<Identity>\n\t\taction: Authorizator.Action<Meta>\n\t}): Promise<boolean> {\n\t\treturn await this.authorizator.isAllowed(this.identity, scope \|\| new AuthorizationScope.Global(), action)\n\t}\n\n\tpublic createAccessVerifier(scope: AuthorizationScope<Identity>): AccessVerifier {\n\t\treturn action => this.isAllowed({ scope, action })\n\t}\n\n\tpublic async requireAccess<Meta extends {} \| undefined>({\n\t\tscope,\n\t\taction,\n\t\tmessage,\n\t}: {\n\t\tscope?: AuthorizationScope<Identity>\n\t\taction: Authorizator.Action<Meta>\n\t\tmessage?: string\n\t}): Promise<void> {\n\t\tif (!(await this.isAllowed({ scope, action }))) {\n\t\t\tthrow new ForbiddenError(message \|\| 'Forbidden')\n\t\t}\n\t}\n\n\tpublic async createProjectScope(project: Pick<Project, 'slug'> \| null): Promise<AuthorizationScope<Identity>> {\n\t\tif (!project) {\n\t\t\treturn deniedScope\n\t\t}\n\t\tif (!this.projectScopes[project.slug]) {\n\t\t\tthis.projectScopes[project.slug] = (await this.projectScopeFactory.create(this.schemaResolver, project)) \|\| deniedScope\n\t\t}\n\t\treturn this.projectScopes[project.slug]\n\t}\n}\n"],"names":[],"mappings":";;;;;AAQA,MAAM,cAAc,IAAI,mBAAmB,MAAM,WAAW,MAAM,QAAQ;AAEnE,MAAM,kBAAkB;AAAA,EAG9B,YACiB,UACA,cACC,qBACA,gBAChB;AAJe,SAAA,WAAA;AACA,SAAA,eAAA;AACC,SAAA,sBAAA;AACA,SAAA,iBAAA;AANlB,kBAAA,MAAQ,iBAA8D,EAAC;AAAA,EAOpE;AAAA,EAEH,MAAa,UAAuC;AAAA,IACnD;AAAA,IACA;AAAA,EAAA,GAIoB;AACpB,WAAO,MAAM,KAAK,aAAa,UAAU,KAAK,UAAU,SAAS,IAAI,mBAAmB,OAAA,GAAU,MAAM;AAAA,EACzG;AAAA,EAEO,qBAAqB,OAAqD;AAChF,WAAO,YAAU,KAAK,UAAU,EAAE,OAAO,QAAQ;AAAA,EAClD;AAAA,EAEA,MAAa,cAA2C;AAAA,IACvD;AAAA,IACA;AAAA,IACA;AAAA,EAAA,GAKiB;AACjB,QAAI,CAAE,MAAM,KAAK,UAAU,EAAE,OAAO,OAAA,CAAQ,GAAI;AAC/C,YAAM,IAAI,eAAe,WAAW,WAAW;AAAA,IAChD;AAAA,EACD;AAAA,EAEA,MAAa,mBAAmB,SAA8E;AAC7G,QAAI,CAAC,SAAS;AACb,aAAO;AAAA,IACR;AACA,QAAI,CAAC,KAAK,cAAc,QAAQ,IAAI,GAAG;AACtC,WAAK,cAAc,QAAQ,IAAI,IAAK,MAAM,KAAK,oBAAoB,OAAO,KAAK,gBAAgB,OAAO,KAAM;AAAA,IAC7G;AACA,WAAO,KAAK,cAAc,QAAQ,IAAI;AAAA,EACvC;AACD;"}

package/dist/production/src/model/authorization/PermissionContextFactory.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"PermissionContextFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionContextFactory.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { IdentityFactory } from './IdentityFactory'\nimport { PermissionContext } from './PermissionContext'\nimport { ProjectScopeFactory } from './ProjectScopeFactory'\nimport { ProjectSchemaResolver } from '../type'\nimport { DatabaseContext } from '../utils'\n\nexport class PermissionContextFactory {\n\tconstructor(\n\t\tprivate readonly authorizator: Authorizator,\n\t\tprivate readonly identityFactory: IdentityFactory,\n\t\tprivate readonly projectScopeFactory: ProjectScopeFactory,\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tpublic create(db: DatabaseContext, args: { id: string; roles: readonly string[] }): PermissionContext {\n\t\tconst identity = this.identityFactory.create(db, args)\n\t\treturn new PermissionContext(identity, this.authorizator, this.projectScopeFactory, this.schemaResolver)\n\t}\n}\n"],"names":["PermissionContext"],"mappings":";;;AAOO,MAAM,yBAAyB;AAAA,EACrC,YACkB,cACA,iBACA,qBACA,gBAChB;AAJgB,SAAA,eAAA;AACA,SAAA,kBAAA;AACA,SAAA,sBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEI,OAAO,IAAqB,MAAmE;AACrG,UAAM,WAAW,KAAK,gBAAgB,OAAO,IAAI,IAAI;AACrD,WAAO,IAAIA,kBAAAA,kBAAkB,UAAU,KAAK,cAAc,KAAK,qBAAqB,KAAK,cAAc;AAAA,EACxG;AACD;;"}
1	+ {"version":3,"file":"PermissionContextFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionContextFactory.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { IdentityFactory } from './IdentityFactory.js'\nimport { PermissionContext } from './PermissionContext.js'\nimport { ProjectScopeFactory } from './ProjectScopeFactory.js'\nimport { ProjectSchemaResolver } from '../type/index.js'\nimport { DatabaseContext } from '../utils/index.js'\n\nexport class PermissionContextFactory {\n\tconstructor(\n\t\tprivate readonly authorizator: Authorizator,\n\t\tprivate readonly identityFactory: IdentityFactory,\n\t\tprivate readonly projectScopeFactory: ProjectScopeFactory,\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tpublic create(db: DatabaseContext, args: { id: string; roles: readonly string[] }): PermissionContext {\n\t\tconst identity = this.identityFactory.create(db, args)\n\t\treturn new PermissionContext(identity, this.authorizator, this.projectScopeFactory, this.schemaResolver)\n\t}\n}\n"],"names":["PermissionContext"],"mappings":";;;AAOO,MAAM,yBAAyB;AAAA,EACrC,YACkB,cACA,iBACA,qBACA,gBAChB;AAJgB,SAAA,eAAA;AACA,SAAA,kBAAA;AACA,SAAA,sBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEI,OAAO,IAAqB,MAAmE;AACrG,UAAM,WAAW,KAAK,gBAAgB,OAAO,IAAI,IAAI;AACrD,WAAO,IAAIA,kBAAAA,kBAAkB,UAAU,KAAK,cAAc,KAAK,qBAAqB,KAAK,cAAc;AAAA,EACxG;AACD;;"}

package/dist/production/src/model/authorization/PermissionContextFactory.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"PermissionContextFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionContextFactory.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { IdentityFactory } from './IdentityFactory'\nimport { PermissionContext } from './PermissionContext'\nimport { ProjectScopeFactory } from './ProjectScopeFactory'\nimport { ProjectSchemaResolver } from '../type'\nimport { DatabaseContext } from '../utils'\n\nexport class PermissionContextFactory {\n\tconstructor(\n\t\tprivate readonly authorizator: Authorizator,\n\t\tprivate readonly identityFactory: IdentityFactory,\n\t\tprivate readonly projectScopeFactory: ProjectScopeFactory,\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tpublic create(db: DatabaseContext, args: { id: string; roles: readonly string[] }): PermissionContext {\n\t\tconst identity = this.identityFactory.create(db, args)\n\t\treturn new PermissionContext(identity, this.authorizator, this.projectScopeFactory, this.schemaResolver)\n\t}\n}\n"],"names":[],"mappings":";AAOO,MAAM,yBAAyB;AAAA,EACrC,YACkB,cACA,iBACA,qBACA,gBAChB;AAJgB,SAAA,eAAA;AACA,SAAA,kBAAA;AACA,SAAA,sBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEI,OAAO,IAAqB,MAAmE;AACrG,UAAM,WAAW,KAAK,gBAAgB,OAAO,IAAI,IAAI;AACrD,WAAO,IAAI,kBAAkB,UAAU,KAAK,cAAc,KAAK,qBAAqB,KAAK,cAAc;AAAA,EACxG;AACD;"}
1	+ {"version":3,"file":"PermissionContextFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionContextFactory.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { IdentityFactory } from './IdentityFactory.js'\nimport { PermissionContext } from './PermissionContext.js'\nimport { ProjectScopeFactory } from './ProjectScopeFactory.js'\nimport { ProjectSchemaResolver } from '../type/index.js'\nimport { DatabaseContext } from '../utils/index.js'\n\nexport class PermissionContextFactory {\n\tconstructor(\n\t\tprivate readonly authorizator: Authorizator,\n\t\tprivate readonly identityFactory: IdentityFactory,\n\t\tprivate readonly projectScopeFactory: ProjectScopeFactory,\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tpublic create(db: DatabaseContext, args: { id: string; roles: readonly string[] }): PermissionContext {\n\t\tconst identity = this.identityFactory.create(db, args)\n\t\treturn new PermissionContext(identity, this.authorizator, this.projectScopeFactory, this.schemaResolver)\n\t}\n}\n"],"names":[],"mappings":";AAOO,MAAM,yBAAyB;AAAA,EACrC,YACkB,cACA,iBACA,qBACA,gBAChB;AAJgB,SAAA,eAAA;AACA,SAAA,kBAAA;AACA,SAAA,sBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEI,OAAO,IAAqB,MAAmE;AACrG,UAAM,WAAW,KAAK,gBAAgB,OAAO,IAAI,IAAI;AACrD,WAAO,IAAI,kBAAkB,UAAU,KAAK,cAAc,KAAK,qBAAqB,KAAK,cAAc;AAAA,EACxG;AACD;"}

package/dist/production/src/model/authorization/PermissionsFactory.cjs CHANGED Viewed

@@ -27,6 +27,8 @@ class PermissionsFactory {
     permissions.allow(Roles.TenantRole.PERSON, PermissionActions.PermissionActions.PERSON_TOGGLE_PASSWORDLESS);
     permissions.allow(Roles.TenantRole.PERSON, PermissionActions.PermissionActions.PERSON_SIGN_OUT);
     permissions.allow(Roles.TenantRole.PERSON, PermissionActions.PermissionActions.PERSON_SETUP_OTP);
+    permissions.allow(Roles.TenantRole.PERSON, PermissionActions.PermissionActions.PERSON_REVOKE_SESSION);
+    permissions.allow(Roles.TenantRole.PERSON, PermissionActions.PermissionActions.PERSON_DISCONNECT_MY_IDP);
     permissions.allow(Roles.TenantRole.PROJECT_MEMBER, PermissionActions.PermissionActions.PROJECT_VIEW);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PROJECT_VIEW);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDENTITY_VIEW_PERMISSIONS);
@@ -39,12 +41,17 @@ class PermissionsFactory {
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedInputRoles);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_CREATE_SESSION_KEY(), projectAdminUseRolesVerifier);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_DISABLE(), projectAdminUseRolesVerifier);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_FORCE_SIGN_OUT(), projectAdminUseRolesVerifier);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_RESET_MFA(), projectAdminUseRolesVerifier);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_VIEW_SESSIONS(), projectAdminUseRolesVerifier);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_VIEW_IDP(), projectAdminUseRolesVerifier);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_CHANGE_PROFILE(), projectAdminUseRolesVerifier);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_CHANGE_PASSWORD(), projectAdminUseRolesVerifier);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PROJECT_VIEW_MEMBER([]));
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PROJECT_ADD_MEMBER([]));
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PROJECT_UPDATE_MEMBER([]));
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PROJECT_REMOVE_MEMBER([]));
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PROJECT_VIEW_SECRETS);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_INVITE([]));
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_INVITE_UNMANAGED([]));
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.MAIL_TEMPLATE_ADD);

package/dist/production/src/model/authorization/PermissionsFactory.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"PermissionsFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionsFactory.ts"],"sourcesContent":["import { Permissions } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions'\nimport { TenantRole } from './Roles'\n\nconst allowedRoles = new Set<string>([TenantRole.LOGIN, TenantRole.PROJECT_ADMIN, TenantRole.ENTRYPOINT_DEPLOYER])\n\nconst projectAdminAllowedInputRoles = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined \|\| roles.every(it => allowedRoles.has(it))\n}\n\nconst forbiddenRoles = new Set<string>([TenantRole.SUPER_ADMIN, TenantRole.PROJECT_CREATOR])\n\nconst projectAdminUseRolesVerifier = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined \|\| roles.every(it => !forbiddenRoles.has(it))\n}\n\nclass PermissionsFactory {\n\tpublic create(): Permissions {\n\t\tconst permissions = new Permissions()\n\n\t\tpermissions.allow(TenantRole.SUPER_ADMIN, { resource: Permissions.ALL, privilege: Permissions.ALL })\n\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_RESET_PASSWORD)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_CREATE_IDP_URL)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN_IDP)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_PASSWORDLESS_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN)\n\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PASSWORD)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PROFILE)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_TOGGLE_PASSWORDLESS)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SIGN_OUT)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP)\n\n\t\tpermissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_VIEW_PERMISSIONS)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CREATE_SESSION_KEY(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(), projectAdminUseRolesVerifier)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_ADD_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_UPDATE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_REMOVE_MEMBER([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE_UNMANAGED([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_UPDATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ENABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.ENTRYPOINT_DEPLOY)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIGURE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIG_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_CREATOR, PermissionActions.PROJECT_CREATE)\n\t\tpermissions.allow(TenantRole.ENTRYPOINT_DEPLOYER, PermissionActions.ENTRYPOINT_DEPLOY)\n\n\t\treturn permissions\n\t}\n}\n\nexport { PermissionsFactory }\n"],"names":["TenantRole","Permissions","PermissionActions"],"mappings":";;;;;AAIA,MAAM,eAAe,oBAAI,IAAY,CAACA,iBAAW,OAAOA,MAAAA,WAAW,eAAeA,iBAAW,mBAAmB,CAAC;AAEjH,MAAM,gCAAgC,CAAC,EAAE,YAA2C;AACnF,SAAO,UAAU,UAAa,MAAM,MAAM,QAAM,aAAa,IAAI,EAAE,CAAC;AACrE;AAEA,MAAM,qCAAqB,IAAY,CAACA,MAAAA,WAAW,aAAaA,MAAAA,WAAW,eAAe,CAAC;AAE3F,MAAM,+BAA+B,CAAC,EAAE,YAA2C;AAClF,SAAO,UAAU,UAAa,MAAM,MAAM,QAAM,CAAC,eAAe,IAAI,EAAE,CAAC;AACxE;AAEA,MAAM,mBAAmB;AAAA,EACjB,SAAsB;AAC5B,UAAM,cAAc,IAAIC,0BAAA;AAExB,gBAAY,MAAMD,iBAAW,aAAa,EAAE,UAAUC,cAAAA,YAAY,KAAK,WAAWA,cAAAA,YAAY,IAAA,CAAK;AAEnG,gBAAY,MAAMD,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,cAAc;AACpE,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,kBAAkB;AACxE,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,2BAA2B;AACjF,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,mCAAmC;AAEzF,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,WAAW;AAClE,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,yBAAyB;AAChF,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,wBAAwB;AAC/E,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,0BAA0B;AACjF,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,eAAe;AACtE,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,gBAAgB;~~AAEvE~~,gBAAY,MAAMF,MAAAA,WAAW,gBAAgBE,kBAAAA,kBAAkB,YAAY;AAE3E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,YAAY;AAC1E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,yBAAyB;AACvF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,WAAW;AACzE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,cAAc;AAC5E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,eAAe;AAC7E,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,sBAAA,GAAyB,6BAA6B;AAEpH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,eAAA,GAAkB,6BAA6B;AAC7G,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,0BAAA,GAA6B,6BAA6B;AACxH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,6BAAA,GAAgC,6BAA6B;AAC3H,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,0BAAA,GAA6B,4BAA4B;AACvH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,eAAA,GAAkB,4BAA4B;AAC5G,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,sBAAA,GAAyB,4BAA4B;AACnH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,uBAAA,GAA0B,4BAA4B;AAEpH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,CAAC;AACrF,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,mBAAmB,CAAA,CAAE,CAAC;AACpF,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AACvF,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;~~AAEvF~~,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,cAAc,CAAA,CAAE,CAAC;AAC/E,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,wBAAwB,CAAA,CAAE,CAAC;AAEzF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,oBAAoB;AAClF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,kBAAkB;AAEhF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,OAAO;AACrE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,UAAU;AACxE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,WAAW;AACzE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,UAAU;AACxE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,QAAQ;AAEtE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,SAAS;AACvE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,WAAW;AAEzE,gBAAY,MAAMF,MAAAA,WAAW,iBAAiBE,kBAAAA,kBAAkB,cAAc;AAC9E,gBAAY,MAAMF,MAAAA,WAAW,qBAAqBE,kBAAAA,kBAAkB,iBAAiB;AAErF,WAAO;AAAA,EACR;AACD;;"}
1	+ {"version":3,"file":"PermissionsFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionsFactory.ts"],"sourcesContent":["import { Permissions } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions.js'\nimport { TenantRole } from './Roles.js'\n\nconst allowedRoles = new Set<string>([TenantRole.LOGIN, TenantRole.PROJECT_ADMIN, TenantRole.ENTRYPOINT_DEPLOYER])\n\nconst projectAdminAllowedInputRoles = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined \|\| roles.every(it => allowedRoles.has(it))\n}\n\nconst forbiddenRoles = new Set<string>([TenantRole.SUPER_ADMIN, TenantRole.PROJECT_CREATOR])\n\nconst projectAdminUseRolesVerifier = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined \|\| roles.every(it => !forbiddenRoles.has(it))\n}\n\nclass PermissionsFactory {\n\tpublic create(): Permissions {\n\t\tconst permissions = new Permissions()\n\n\t\tpermissions.allow(TenantRole.SUPER_ADMIN, { resource: Permissions.ALL, privilege: Permissions.ALL })\n\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_RESET_PASSWORD)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_CREATE_IDP_URL)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN_IDP)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_PASSWORDLESS_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN)\n\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PASSWORD)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PROFILE)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_TOGGLE_PASSWORDLESS)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SIGN_OUT)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_REVOKE_SESSION)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_DISCONNECT_MY_IDP)\n\n\t\tpermissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_VIEW_PERMISSIONS)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CREATE_SESSION_KEY(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_FORCE_SIGN_OUT(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_RESET_MFA(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW_SESSIONS(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW_IDP(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(), projectAdminUseRolesVerifier)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_ADD_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_UPDATE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_REMOVE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_SECRETS)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE_UNMANAGED([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_UPDATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ENABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.ENTRYPOINT_DEPLOY)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIGURE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIG_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_CREATOR, PermissionActions.PROJECT_CREATE)\n\t\tpermissions.allow(TenantRole.ENTRYPOINT_DEPLOYER, PermissionActions.ENTRYPOINT_DEPLOY)\n\n\t\treturn permissions\n\t}\n}\n\nexport { PermissionsFactory }\n"],"names":["TenantRole","Permissions","PermissionActions"],"mappings":";;;;;AAIA,MAAM,eAAe,oBAAI,IAAY,CAACA,iBAAW,OAAOA,MAAAA,WAAW,eAAeA,iBAAW,mBAAmB,CAAC;AAEjH,MAAM,gCAAgC,CAAC,EAAE,YAA2C;AACnF,SAAO,UAAU,UAAa,MAAM,MAAM,QAAM,aAAa,IAAI,EAAE,CAAC;AACrE;AAEA,MAAM,qCAAqB,IAAY,CAACA,MAAAA,WAAW,aAAaA,MAAAA,WAAW,eAAe,CAAC;AAE3F,MAAM,+BAA+B,CAAC,EAAE,YAA2C;AAClF,SAAO,UAAU,UAAa,MAAM,MAAM,QAAM,CAAC,eAAe,IAAI,EAAE,CAAC;AACxE;AAEA,MAAM,mBAAmB;AAAA,EACjB,SAAsB;AAC5B,UAAM,cAAc,IAAIC,0BAAA;AAExB,gBAAY,MAAMD,iBAAW,aAAa,EAAE,UAAUC,cAAAA,YAAY,KAAK,WAAWA,cAAAA,YAAY,IAAA,CAAK;AAEnG,gBAAY,MAAMD,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,cAAc;AACpE,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,kBAAkB;AACxE,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,2BAA2B;AACjF,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,mCAAmC;AAEzF,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,WAAW;AAClE,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,yBAAyB;AAChF,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,wBAAwB;AAC/E,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,0BAA0B;AACjF,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,eAAe;AACtE,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,gBAAgB;AACvE,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,qBAAqB;AAC5E,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,wBAAwB;AAE/E,gBAAY,MAAMF,MAAAA,WAAW,gBAAgBE,kBAAAA,kBAAkB,YAAY;AAE3E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,YAAY;AAC1E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,yBAAyB;AACvF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,WAAW;AACzE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,cAAc;AAC5E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,eAAe;AAC7E,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,sBAAA,GAAyB,6BAA6B;AAEpH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,eAAA,GAAkB,6BAA6B;AAC7G,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,0BAAA,GAA6B,6BAA6B;AACxH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,6BAAA,GAAgC,6BAA6B;AAC3H,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,0BAAA,GAA6B,4BAA4B;AACvH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,eAAA,GAAkB,4BAA4B;AAC5G,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,sBAAA,GAAyB,4BAA4B;AACnH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,iBAAA,GAAoB,4BAA4B;AAC9G,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,qBAAA,GAAwB,4BAA4B;AAClH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,gBAAA,GAAmB,4BAA4B;AAC7G,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,sBAAA,GAAyB,4BAA4B;AACnH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,uBAAA,GAA0B,4BAA4B;AAEpH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,CAAC;AACrF,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,mBAAmB,CAAA,CAAE,CAAC;AACpF,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AACvF,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AACvF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,oBAAoB;AAElF,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,cAAc,CAAA,CAAE,CAAC;AAC/E,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,wBAAwB,CAAA,CAAE,CAAC;AAEzF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,oBAAoB;AAClF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,kBAAkB;AAEhF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,OAAO;AACrE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,UAAU;AACxE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,WAAW;AACzE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,UAAU;AACxE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,QAAQ;AAEtE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,SAAS;AACvE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,WAAW;AAEzE,gBAAY,MAAMF,MAAAA,WAAW,iBAAiBE,kBAAAA,kBAAkB,cAAc;AAC9E,gBAAY,MAAMF,MAAAA,WAAW,qBAAqBE,kBAAAA,kBAAkB,iBAAiB;AAErF,WAAO;AAAA,EACR;AACD;;"}

package/dist/production/src/model/authorization/PermissionsFactory.js CHANGED Viewed

@@ -25,6 +25,8 @@ class PermissionsFactory {
     permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_TOGGLE_PASSWORDLESS);
     permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SIGN_OUT);
     permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP);
+    permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_REVOKE_SESSION);
+    permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_DISCONNECT_MY_IDP);
     permissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_VIEW_PERMISSIONS);
@@ -37,12 +39,17 @@ class PermissionsFactory {
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedInputRoles);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CREATE_SESSION_KEY(), projectAdminUseRolesVerifier);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(), projectAdminUseRolesVerifier);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_FORCE_SIGN_OUT(), projectAdminUseRolesVerifier);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_RESET_MFA(), projectAdminUseRolesVerifier);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW_SESSIONS(), projectAdminUseRolesVerifier);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW_IDP(), projectAdminUseRolesVerifier);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(), projectAdminUseRolesVerifier);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(), projectAdminUseRolesVerifier);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_MEMBER([]));
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_ADD_MEMBER([]));
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_UPDATE_MEMBER([]));
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_REMOVE_MEMBER([]));
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_SECRETS);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE([]));
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE_UNMANAGED([]));
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD);

package/dist/production/src/model/authorization/PermissionsFactory.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"PermissionsFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionsFactory.ts"],"sourcesContent":["import { Permissions } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions'\nimport { TenantRole } from './Roles'\n\nconst allowedRoles = new Set<string>([TenantRole.LOGIN, TenantRole.PROJECT_ADMIN, TenantRole.ENTRYPOINT_DEPLOYER])\n\nconst projectAdminAllowedInputRoles = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined \|\| roles.every(it => allowedRoles.has(it))\n}\n\nconst forbiddenRoles = new Set<string>([TenantRole.SUPER_ADMIN, TenantRole.PROJECT_CREATOR])\n\nconst projectAdminUseRolesVerifier = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined \|\| roles.every(it => !forbiddenRoles.has(it))\n}\n\nclass PermissionsFactory {\n\tpublic create(): Permissions {\n\t\tconst permissions = new Permissions()\n\n\t\tpermissions.allow(TenantRole.SUPER_ADMIN, { resource: Permissions.ALL, privilege: Permissions.ALL })\n\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_RESET_PASSWORD)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_CREATE_IDP_URL)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN_IDP)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_PASSWORDLESS_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN)\n\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PASSWORD)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PROFILE)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_TOGGLE_PASSWORDLESS)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SIGN_OUT)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP)\n\n\t\tpermissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_VIEW_PERMISSIONS)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CREATE_SESSION_KEY(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(), projectAdminUseRolesVerifier)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_ADD_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_UPDATE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_REMOVE_MEMBER([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE_UNMANAGED([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_UPDATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ENABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.ENTRYPOINT_DEPLOY)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIGURE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIG_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_CREATOR, PermissionActions.PROJECT_CREATE)\n\t\tpermissions.allow(TenantRole.ENTRYPOINT_DEPLOYER, PermissionActions.ENTRYPOINT_DEPLOY)\n\n\t\treturn permissions\n\t}\n}\n\nexport { PermissionsFactory }\n"],"names":[],"mappings":";;;AAIA,MAAM,eAAe,oBAAI,IAAY,CAAC,WAAW,OAAO,WAAW,eAAe,WAAW,mBAAmB,CAAC;AAEjH,MAAM,gCAAgC,CAAC,EAAE,YAA2C;AACnF,SAAO,UAAU,UAAa,MAAM,MAAM,QAAM,aAAa,IAAI,EAAE,CAAC;AACrE;AAEA,MAAM,qCAAqB,IAAY,CAAC,WAAW,aAAa,WAAW,eAAe,CAAC;AAE3F,MAAM,+BAA+B,CAAC,EAAE,YAA2C;AAClF,SAAO,UAAU,UAAa,MAAM,MAAM,QAAM,CAAC,eAAe,IAAI,EAAE,CAAC;AACxE;AAEA,MAAM,mBAAmB;AAAA,EACjB,SAAsB;AAC5B,UAAM,cAAc,IAAI,YAAA;AAExB,gBAAY,MAAM,WAAW,aAAa,EAAE,UAAU,YAAY,KAAK,WAAW,YAAY,IAAA,CAAK;AAEnG,gBAAY,MAAM,WAAW,OAAO,kBAAkB,cAAc;AACpE,gBAAY,MAAM,WAAW,OAAO,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAM,WAAW,OAAO,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAM,WAAW,OAAO,kBAAkB,kBAAkB;AACxE,gBAAY,MAAM,WAAW,OAAO,kBAAkB,2BAA2B;AACjF,gBAAY,MAAM,WAAW,OAAO,kBAAkB,mCAAmC;AAEzF,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,WAAW;AAClE,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,yBAAyB;AAChF,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,wBAAwB;AAC/E,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,0BAA0B;AACjF,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,eAAe;AACtE,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,gBAAgB;~~AAEvE~~,gBAAY,MAAM,WAAW,gBAAgB,kBAAkB,YAAY;AAE3E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,YAAY;AAC1E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,yBAAyB;AACvF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,WAAW;AACzE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,cAAc;AAC5E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,eAAe;AAC7E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAA,GAAyB,6BAA6B;AAEpH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,eAAA,GAAkB,6BAA6B;AAC7G,gBAAY,MAAM,WAAW,eAAe,kBAAkB,0BAAA,GAA6B,6BAA6B;AACxH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,6BAAA,GAAgC,6BAA6B;AAC3H,gBAAY,MAAM,WAAW,eAAe,kBAAkB,0BAAA,GAA6B,4BAA4B;AACvH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,eAAA,GAAkB,4BAA4B;AAC5G,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAA,GAAyB,4BAA4B;AACnH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,uBAAA,GAA0B,4BAA4B;AAEpH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,oBAAoB,CAAA,CAAE,CAAC;AACrF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,mBAAmB,CAAA,CAAE,CAAC;AACpF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AACvF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;~~AAEvF~~,gBAAY,MAAM,WAAW,eAAe,kBAAkB,cAAc,CAAA,CAAE,CAAC;AAC/E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,wBAAwB,CAAA,CAAE,CAAC;AAEzF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,oBAAoB;AAClF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,kBAAkB;AAEhF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,OAAO;AACrE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,UAAU;AACxE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,WAAW;AACzE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,UAAU;AACxE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,QAAQ;AAEtE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,SAAS;AACvE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,WAAW;AAEzE,gBAAY,MAAM,WAAW,iBAAiB,kBAAkB,cAAc;AAC9E,gBAAY,MAAM,WAAW,qBAAqB,kBAAkB,iBAAiB;AAErF,WAAO;AAAA,EACR;AACD;"}
1	+ {"version":3,"file":"PermissionsFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionsFactory.ts"],"sourcesContent":["import { Permissions } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions.js'\nimport { TenantRole } from './Roles.js'\n\nconst allowedRoles = new Set<string>([TenantRole.LOGIN, TenantRole.PROJECT_ADMIN, TenantRole.ENTRYPOINT_DEPLOYER])\n\nconst projectAdminAllowedInputRoles = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined \|\| roles.every(it => allowedRoles.has(it))\n}\n\nconst forbiddenRoles = new Set<string>([TenantRole.SUPER_ADMIN, TenantRole.PROJECT_CREATOR])\n\nconst projectAdminUseRolesVerifier = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined \|\| roles.every(it => !forbiddenRoles.has(it))\n}\n\nclass PermissionsFactory {\n\tpublic create(): Permissions {\n\t\tconst permissions = new Permissions()\n\n\t\tpermissions.allow(TenantRole.SUPER_ADMIN, { resource: Permissions.ALL, privilege: Permissions.ALL })\n\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_RESET_PASSWORD)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_CREATE_IDP_URL)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN_IDP)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_PASSWORDLESS_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN)\n\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PASSWORD)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PROFILE)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_TOGGLE_PASSWORDLESS)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SIGN_OUT)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_REVOKE_SESSION)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_DISCONNECT_MY_IDP)\n\n\t\tpermissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_VIEW_PERMISSIONS)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CREATE_SESSION_KEY(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_FORCE_SIGN_OUT(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_RESET_MFA(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW_SESSIONS(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW_IDP(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(), projectAdminUseRolesVerifier)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_ADD_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_UPDATE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_REMOVE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_SECRETS)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE_UNMANAGED([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_UPDATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ENABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.ENTRYPOINT_DEPLOY)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIGURE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIG_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_CREATOR, PermissionActions.PROJECT_CREATE)\n\t\tpermissions.allow(TenantRole.ENTRYPOINT_DEPLOYER, PermissionActions.ENTRYPOINT_DEPLOY)\n\n\t\treturn permissions\n\t}\n}\n\nexport { PermissionsFactory }\n"],"names":[],"mappings":";;;AAIA,MAAM,eAAe,oBAAI,IAAY,CAAC,WAAW,OAAO,WAAW,eAAe,WAAW,mBAAmB,CAAC;AAEjH,MAAM,gCAAgC,CAAC,EAAE,YAA2C;AACnF,SAAO,UAAU,UAAa,MAAM,MAAM,QAAM,aAAa,IAAI,EAAE,CAAC;AACrE;AAEA,MAAM,qCAAqB,IAAY,CAAC,WAAW,aAAa,WAAW,eAAe,CAAC;AAE3F,MAAM,+BAA+B,CAAC,EAAE,YAA2C;AAClF,SAAO,UAAU,UAAa,MAAM,MAAM,QAAM,CAAC,eAAe,IAAI,EAAE,CAAC;AACxE;AAEA,MAAM,mBAAmB;AAAA,EACjB,SAAsB;AAC5B,UAAM,cAAc,IAAI,YAAA;AAExB,gBAAY,MAAM,WAAW,aAAa,EAAE,UAAU,YAAY,KAAK,WAAW,YAAY,IAAA,CAAK;AAEnG,gBAAY,MAAM,WAAW,OAAO,kBAAkB,cAAc;AACpE,gBAAY,MAAM,WAAW,OAAO,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAM,WAAW,OAAO,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAM,WAAW,OAAO,kBAAkB,kBAAkB;AACxE,gBAAY,MAAM,WAAW,OAAO,kBAAkB,2BAA2B;AACjF,gBAAY,MAAM,WAAW,OAAO,kBAAkB,mCAAmC;AAEzF,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,WAAW;AAClE,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,yBAAyB;AAChF,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,wBAAwB;AAC/E,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,0BAA0B;AACjF,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,eAAe;AACtE,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,gBAAgB;AACvE,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,qBAAqB;AAC5E,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,wBAAwB;AAE/E,gBAAY,MAAM,WAAW,gBAAgB,kBAAkB,YAAY;AAE3E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,YAAY;AAC1E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,yBAAyB;AACvF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,WAAW;AACzE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,cAAc;AAC5E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,eAAe;AAC7E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAA,GAAyB,6BAA6B;AAEpH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,eAAA,GAAkB,6BAA6B;AAC7G,gBAAY,MAAM,WAAW,eAAe,kBAAkB,0BAAA,GAA6B,6BAA6B;AACxH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,6BAAA,GAAgC,6BAA6B;AAC3H,gBAAY,MAAM,WAAW,eAAe,kBAAkB,0BAAA,GAA6B,4BAA4B;AACvH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,eAAA,GAAkB,4BAA4B;AAC5G,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAA,GAAyB,4BAA4B;AACnH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,iBAAA,GAAoB,4BAA4B;AAC9G,gBAAY,MAAM,WAAW,eAAe,kBAAkB,qBAAA,GAAwB,4BAA4B;AAClH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,gBAAA,GAAmB,4BAA4B;AAC7G,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAA,GAAyB,4BAA4B;AACnH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,uBAAA,GAA0B,4BAA4B;AAEpH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,oBAAoB,CAAA,CAAE,CAAC;AACrF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,mBAAmB,CAAA,CAAE,CAAC;AACpF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AACvF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AACvF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,oBAAoB;AAElF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,cAAc,CAAA,CAAE,CAAC;AAC/E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,wBAAwB,CAAA,CAAE,CAAC;AAEzF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,oBAAoB;AAClF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,kBAAkB;AAEhF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,OAAO;AACrE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,UAAU;AACxE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,WAAW;AACzE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,UAAU;AACxE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,QAAQ;AAEtE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,SAAS;AACvE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,WAAW;AAEzE,gBAAY,MAAM,WAAW,iBAAiB,kBAAkB,cAAc;AAC9E,gBAAY,MAAM,WAAW,qBAAqB,kBAAkB,iBAAiB;AAErF,WAAO;AAAA,EACR;AACD;"}

package/dist/production/src/model/authorization/ProjectScope.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ProjectScope.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/ProjectScope.ts"],"sourcesContent":["import { AccessNode, AuthorizationScope } from '@contember/authorization'\nimport { Project } from '../type'\nimport { TenantRole } from './Roles'\nimport { Acl, ProjectRole } from '@contember/schema'\nimport { AclSchemaAccessNodeFactory } from './AclSchemaAccessNodeFactory'\nimport { Identity } from './Identity'\n\nexport class ProjectScope implements AuthorizationScope<Identity> {\n\tconstructor(\n\t\tprivate readonly project: Pick<Project, 'slug'>,\n\t\tprivate readonly aclSchema: Acl.Schema,\n\t\tprivate readonly aclSchemaAccessNodeFactory: AclSchemaAccessNodeFactory,\n\t) {}\n\n\tasync getIdentityAccess(identity: Identity): Promise<AccessNode> {\n\t\tconst projectMemberships = await identity.getProjectMemberships(this.project.slug)\n\t\tconst tenantRoles = []\n\t\tif (projectMemberships.length > 0) {\n\t\t\ttenantRoles.push(TenantRole.PROJECT_MEMBER)\n\t\t}\n\t\tconst projectRoles = projectMemberships.map(it => it.role)\n\t\tif (projectRoles.includes(ProjectRole.ADMIN)) {\n\t\t\ttenantRoles.push(TenantRole.PROJECT_ADMIN)\n\t\t}\n\t\tconst accessNode = this.aclSchemaAccessNodeFactory.create(this.aclSchema, projectMemberships)\n\t\treturn new AccessNode.Union([\n\t\t\tnew AccessNode.Roles(tenantRoles),\n\t\t\taccessNode,\n\t\t])\n\t}\n}\n"],"names":["TenantRole","ProjectRole","AccessNode"],"mappings":";;;;;AAOO,MAAM,aAAqD;AAAA,EACjE,YACkB,SACA,WACA,4BAChB;AAHgB,SAAA,UAAA;AACA,SAAA,YAAA;AACA,SAAA,6BAAA;AAAA,EACf;AAAA,EAEH,MAAM,kBAAkB,UAAyC;AAChE,UAAM,qBAAqB,MAAM,SAAS,sBAAsB,KAAK,QAAQ,IAAI;AACjF,UAAM,cAAc,CAAA;AACpB,QAAI,mBAAmB,SAAS,GAAG;AAClC,kBAAY,KAAKA,MAAAA,WAAW,cAAc;AAAA,IAC3C;AACA,UAAM,eAAe,mBAAmB,IAAI,CAAA,OAAM,GAAG,IAAI;AACzD,QAAI,aAAa,SAASC,OAAAA,YAAY,KAAK,GAAG;AAC7C,kBAAY,KAAKD,MAAAA,WAAW,aAAa;AAAA,IAC1C;AACA,UAAM,aAAa,KAAK,2BAA2B,OAAO,KAAK,WAAW,kBAAkB;AAC5F,WAAO,IAAIE,cAAAA,WAAW,MAAM;AAAA,MAC3B,IAAIA,cAAAA,WAAW,MAAM,WAAW;AAAA,MAChC;AAAA,IAAA,CACA;AAAA,EACF;AACD;;"}
1	+ {"version":3,"file":"ProjectScope.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/ProjectScope.ts"],"sourcesContent":["import { AccessNode, AuthorizationScope } from '@contember/authorization'\nimport { Project } from '../type/index.js'\nimport { TenantRole } from './Roles.js'\nimport { Acl, ProjectRole } from '@contember/schema'\nimport { AclSchemaAccessNodeFactory } from './AclSchemaAccessNodeFactory.js'\nimport { Identity } from './Identity.js'\n\nexport class ProjectScope implements AuthorizationScope<Identity> {\n\tconstructor(\n\t\tprivate readonly project: Pick<Project, 'slug'>,\n\t\tprivate readonly aclSchema: Acl.Schema,\n\t\tprivate readonly aclSchemaAccessNodeFactory: AclSchemaAccessNodeFactory,\n\t) {}\n\n\tasync getIdentityAccess(identity: Identity): Promise<AccessNode> {\n\t\tconst projectMemberships = await identity.getProjectMemberships(this.project.slug)\n\t\tconst tenantRoles = []\n\t\tif (projectMemberships.length > 0) {\n\t\t\ttenantRoles.push(TenantRole.PROJECT_MEMBER)\n\t\t}\n\t\tconst projectRoles = projectMemberships.map(it => it.role)\n\t\tif (projectRoles.includes(ProjectRole.ADMIN)) {\n\t\t\ttenantRoles.push(TenantRole.PROJECT_ADMIN)\n\t\t}\n\t\tconst accessNode = this.aclSchemaAccessNodeFactory.create(this.aclSchema, projectMemberships)\n\t\treturn new AccessNode.Union([\n\t\t\tnew AccessNode.Roles(tenantRoles),\n\t\t\taccessNode,\n\t\t])\n\t}\n}\n"],"names":["TenantRole","ProjectRole","AccessNode"],"mappings":";;;;;AAOO,MAAM,aAAqD;AAAA,EACjE,YACkB,SACA,WACA,4BAChB;AAHgB,SAAA,UAAA;AACA,SAAA,YAAA;AACA,SAAA,6BAAA;AAAA,EACf;AAAA,EAEH,MAAM,kBAAkB,UAAyC;AAChE,UAAM,qBAAqB,MAAM,SAAS,sBAAsB,KAAK,QAAQ,IAAI;AACjF,UAAM,cAAc,CAAA;AACpB,QAAI,mBAAmB,SAAS,GAAG;AAClC,kBAAY,KAAKA,MAAAA,WAAW,cAAc;AAAA,IAC3C;AACA,UAAM,eAAe,mBAAmB,IAAI,CAAA,OAAM,GAAG,IAAI;AACzD,QAAI,aAAa,SAASC,OAAAA,YAAY,KAAK,GAAG;AAC7C,kBAAY,KAAKD,MAAAA,WAAW,aAAa;AAAA,IAC1C;AACA,UAAM,aAAa,KAAK,2BAA2B,OAAO,KAAK,WAAW,kBAAkB;AAC5F,WAAO,IAAIE,cAAAA,WAAW,MAAM;AAAA,MAC3B,IAAIA,cAAAA,WAAW,MAAM,WAAW;AAAA,MAChC;AAAA,IAAA,CACA;AAAA,EACF;AACD;;"}

package/dist/production/src/model/authorization/ProjectScope.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ProjectScope.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/ProjectScope.ts"],"sourcesContent":["import { AccessNode, AuthorizationScope } from '@contember/authorization'\nimport { Project } from '../type'\nimport { TenantRole } from './Roles'\nimport { Acl, ProjectRole } from '@contember/schema'\nimport { AclSchemaAccessNodeFactory } from './AclSchemaAccessNodeFactory'\nimport { Identity } from './Identity'\n\nexport class ProjectScope implements AuthorizationScope<Identity> {\n\tconstructor(\n\t\tprivate readonly project: Pick<Project, 'slug'>,\n\t\tprivate readonly aclSchema: Acl.Schema,\n\t\tprivate readonly aclSchemaAccessNodeFactory: AclSchemaAccessNodeFactory,\n\t) {}\n\n\tasync getIdentityAccess(identity: Identity): Promise<AccessNode> {\n\t\tconst projectMemberships = await identity.getProjectMemberships(this.project.slug)\n\t\tconst tenantRoles = []\n\t\tif (projectMemberships.length > 0) {\n\t\t\ttenantRoles.push(TenantRole.PROJECT_MEMBER)\n\t\t}\n\t\tconst projectRoles = projectMemberships.map(it => it.role)\n\t\tif (projectRoles.includes(ProjectRole.ADMIN)) {\n\t\t\ttenantRoles.push(TenantRole.PROJECT_ADMIN)\n\t\t}\n\t\tconst accessNode = this.aclSchemaAccessNodeFactory.create(this.aclSchema, projectMemberships)\n\t\treturn new AccessNode.Union([\n\t\t\tnew AccessNode.Roles(tenantRoles),\n\t\t\taccessNode,\n\t\t])\n\t}\n}\n"],"names":[],"mappings":";;;AAOO,MAAM,aAAqD;AAAA,EACjE,YACkB,SACA,WACA,4BAChB;AAHgB,SAAA,UAAA;AACA,SAAA,YAAA;AACA,SAAA,6BAAA;AAAA,EACf;AAAA,EAEH,MAAM,kBAAkB,UAAyC;AAChE,UAAM,qBAAqB,MAAM,SAAS,sBAAsB,KAAK,QAAQ,IAAI;AACjF,UAAM,cAAc,CAAA;AACpB,QAAI,mBAAmB,SAAS,GAAG;AAClC,kBAAY,KAAK,WAAW,cAAc;AAAA,IAC3C;AACA,UAAM,eAAe,mBAAmB,IAAI,CAAA,OAAM,GAAG,IAAI;AACzD,QAAI,aAAa,SAAS,YAAY,KAAK,GAAG;AAC7C,kBAAY,KAAK,WAAW,aAAa;AAAA,IAC1C;AACA,UAAM,aAAa,KAAK,2BAA2B,OAAO,KAAK,WAAW,kBAAkB;AAC5F,WAAO,IAAI,WAAW,MAAM;AAAA,MAC3B,IAAI,WAAW,MAAM,WAAW;AAAA,MAChC;AAAA,IAAA,CACA;AAAA,EACF;AACD;"}
1	+ {"version":3,"file":"ProjectScope.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/ProjectScope.ts"],"sourcesContent":["import { AccessNode, AuthorizationScope } from '@contember/authorization'\nimport { Project } from '../type/index.js'\nimport { TenantRole } from './Roles.js'\nimport { Acl, ProjectRole } from '@contember/schema'\nimport { AclSchemaAccessNodeFactory } from './AclSchemaAccessNodeFactory.js'\nimport { Identity } from './Identity.js'\n\nexport class ProjectScope implements AuthorizationScope<Identity> {\n\tconstructor(\n\t\tprivate readonly project: Pick<Project, 'slug'>,\n\t\tprivate readonly aclSchema: Acl.Schema,\n\t\tprivate readonly aclSchemaAccessNodeFactory: AclSchemaAccessNodeFactory,\n\t) {}\n\n\tasync getIdentityAccess(identity: Identity): Promise<AccessNode> {\n\t\tconst projectMemberships = await identity.getProjectMemberships(this.project.slug)\n\t\tconst tenantRoles = []\n\t\tif (projectMemberships.length > 0) {\n\t\t\ttenantRoles.push(TenantRole.PROJECT_MEMBER)\n\t\t}\n\t\tconst projectRoles = projectMemberships.map(it => it.role)\n\t\tif (projectRoles.includes(ProjectRole.ADMIN)) {\n\t\t\ttenantRoles.push(TenantRole.PROJECT_ADMIN)\n\t\t}\n\t\tconst accessNode = this.aclSchemaAccessNodeFactory.create(this.aclSchema, projectMemberships)\n\t\treturn new AccessNode.Union([\n\t\t\tnew AccessNode.Roles(tenantRoles),\n\t\t\taccessNode,\n\t\t])\n\t}\n}\n"],"names":[],"mappings":";;;AAOO,MAAM,aAAqD;AAAA,EACjE,YACkB,SACA,WACA,4BAChB;AAHgB,SAAA,UAAA;AACA,SAAA,YAAA;AACA,SAAA,6BAAA;AAAA,EACf;AAAA,EAEH,MAAM,kBAAkB,UAAyC;AAChE,UAAM,qBAAqB,MAAM,SAAS,sBAAsB,KAAK,QAAQ,IAAI;AACjF,UAAM,cAAc,CAAA;AACpB,QAAI,mBAAmB,SAAS,GAAG;AAClC,kBAAY,KAAK,WAAW,cAAc;AAAA,IAC3C;AACA,UAAM,eAAe,mBAAmB,IAAI,CAAA,OAAM,GAAG,IAAI;AACzD,QAAI,aAAa,SAAS,YAAY,KAAK,GAAG;AAC7C,kBAAY,KAAK,WAAW,aAAa;AAAA,IAC1C;AACA,UAAM,aAAa,KAAK,2BAA2B,OAAO,KAAK,WAAW,kBAAkB;AAC5F,WAAO,IAAI,WAAW,MAAM;AAAA,MAC3B,IAAI,WAAW,MAAM,WAAW;AAAA,MAChC;AAAA,IAAA,CACA;AAAA,EACF;AACD;"}

package/dist/production/src/model/authorization/ProjectScopeFactory.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ProjectScopeFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/ProjectScopeFactory.ts"],"sourcesContent":["import { Project, ProjectSchemaResolver } from '../type'\nimport { AclSchemaAccessNodeFactory } from './AclSchemaAccessNodeFactory'\nimport { AuthorizationScope } from '@contember/authorization'\nimport { ProjectScope } from './ProjectScope'\nimport { Identity } from './Identity'\n\nexport class ProjectScopeFactory {\n\tconstructor(\n\t\tprivate readonly schemaAccessNodeFactory: AclSchemaAccessNodeFactory,\n\t) {}\n\n\tasync create(schemaResolver: ProjectSchemaResolver, project: Pick<Project, 'slug'>): Promise<AuthorizationScope<Identity> \| null> {\n\t\tconst schema = await schemaResolver.getSchema(project.slug)\n\t\tif (!schema) {\n\t\t\treturn null\n\t\t}\n\t\treturn new ProjectScope(project, schema.acl, this.schemaAccessNodeFactory)\n\t}\n}\n"],"names":["ProjectScope"],"mappings":";;;AAMO,MAAM,oBAAoB;AAAA,EAChC,YACkB,yBAChB;AADgB,SAAA,0BAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,gBAAuC,SAA8E;AACjI,UAAM,SAAS,MAAM,eAAe,UAAU,QAAQ,IAAI;AAC1D,QAAI,CAAC,QAAQ;AACZ,aAAO;AAAA,IACR;AACA,WAAO,IAAIA,aAAAA,aAAa,SAAS,OAAO,KAAK,KAAK,uBAAuB;AAAA,EAC1E;AACD;;"}
1	+ {"version":3,"file":"ProjectScopeFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/ProjectScopeFactory.ts"],"sourcesContent":["import { Project, ProjectSchemaResolver } from '../type/index.js'\nimport { AclSchemaAccessNodeFactory } from './AclSchemaAccessNodeFactory.js'\nimport { AuthorizationScope } from '@contember/authorization'\nimport { ProjectScope } from './ProjectScope.js'\nimport { Identity } from './Identity.js'\n\nexport class ProjectScopeFactory {\n\tconstructor(\n\t\tprivate readonly schemaAccessNodeFactory: AclSchemaAccessNodeFactory,\n\t) {}\n\n\tasync create(schemaResolver: ProjectSchemaResolver, project: Pick<Project, 'slug'>): Promise<AuthorizationScope<Identity> \| null> {\n\t\tconst schema = await schemaResolver.getSchema(project.slug)\n\t\tif (!schema) {\n\t\t\treturn null\n\t\t}\n\t\treturn new ProjectScope(project, schema.acl, this.schemaAccessNodeFactory)\n\t}\n}\n"],"names":["ProjectScope"],"mappings":";;;AAMO,MAAM,oBAAoB;AAAA,EAChC,YACkB,yBAChB;AADgB,SAAA,0BAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,gBAAuC,SAA8E;AACjI,UAAM,SAAS,MAAM,eAAe,UAAU,QAAQ,IAAI;AAC1D,QAAI,CAAC,QAAQ;AACZ,aAAO;AAAA,IACR;AACA,WAAO,IAAIA,aAAAA,aAAa,SAAS,OAAO,KAAK,KAAK,uBAAuB;AAAA,EAC1E;AACD;;"}

package/dist/production/src/model/authorization/ProjectScopeFactory.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ProjectScopeFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/ProjectScopeFactory.ts"],"sourcesContent":["import { Project, ProjectSchemaResolver } from '../type'\nimport { AclSchemaAccessNodeFactory } from './AclSchemaAccessNodeFactory'\nimport { AuthorizationScope } from '@contember/authorization'\nimport { ProjectScope } from './ProjectScope'\nimport { Identity } from './Identity'\n\nexport class ProjectScopeFactory {\n\tconstructor(\n\t\tprivate readonly schemaAccessNodeFactory: AclSchemaAccessNodeFactory,\n\t) {}\n\n\tasync create(schemaResolver: ProjectSchemaResolver, project: Pick<Project, 'slug'>): Promise<AuthorizationScope<Identity> \| null> {\n\t\tconst schema = await schemaResolver.getSchema(project.slug)\n\t\tif (!schema) {\n\t\t\treturn null\n\t\t}\n\t\treturn new ProjectScope(project, schema.acl, this.schemaAccessNodeFactory)\n\t}\n}\n"],"names":[],"mappings":";AAMO,MAAM,oBAAoB;AAAA,EAChC,YACkB,yBAChB;AADgB,SAAA,0BAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,gBAAuC,SAA8E;AACjI,UAAM,SAAS,MAAM,eAAe,UAAU,QAAQ,IAAI;AAC1D,QAAI,CAAC,QAAQ;AACZ,aAAO;AAAA,IACR;AACA,WAAO,IAAI,aAAa,SAAS,OAAO,KAAK,KAAK,uBAAuB;AAAA,EAC1E;AACD;"}
1	+ {"version":3,"file":"ProjectScopeFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/ProjectScopeFactory.ts"],"sourcesContent":["import { Project, ProjectSchemaResolver } from '../type/index.js'\nimport { AclSchemaAccessNodeFactory } from './AclSchemaAccessNodeFactory.js'\nimport { AuthorizationScope } from '@contember/authorization'\nimport { ProjectScope } from './ProjectScope.js'\nimport { Identity } from './Identity.js'\n\nexport class ProjectScopeFactory {\n\tconstructor(\n\t\tprivate readonly schemaAccessNodeFactory: AclSchemaAccessNodeFactory,\n\t) {}\n\n\tasync create(schemaResolver: ProjectSchemaResolver, project: Pick<Project, 'slug'>): Promise<AuthorizationScope<Identity> \| null> {\n\t\tconst schema = await schemaResolver.getSchema(project.slug)\n\t\tif (!schema) {\n\t\t\treturn null\n\t\t}\n\t\treturn new ProjectScope(project, schema.acl, this.schemaAccessNodeFactory)\n\t}\n}\n"],"names":[],"mappings":";AAMO,MAAM,oBAAoB;AAAA,EAChC,YACkB,yBAChB;AADgB,SAAA,0BAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,gBAAuC,SAA8E;AACjI,UAAM,SAAS,MAAM,eAAe,UAAU,QAAQ,IAAI;AAC1D,QAAI,CAAC,QAAQ;AACZ,aAAO;AAAA,IACR;AACA,WAAO,IAAI,aAAa,SAAS,OAAO,KAAK,KAAK,uBAAuB;AAAA,EAC1E;AACD;"}

package/dist/production/src/model/commands/CommandBus.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"CommandBus.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/commands/CommandBus.ts"],"sourcesContent":["import { Command } from './Command'\nimport { Client, Connection } from '@contember/database'\nimport { Providers } from '../providers'\n\nexport class CommandBus<ConnectionType extends Connection.ConnectionLike = Connection.ConnectionLike> {\n\tconstructor(public readonly client: Client<ConnectionType>, private readonly providers: Providers) {}\n\n\tpublic async execute<T>(command: Command<T>): Promise<T> {\n\t\treturn await command.execute({ db: this.client, providers: this.providers, bus: this })\n\t}\n\n\tasync transaction<T>(\n\t\ttransactionScope: (wrapper: CommandBus<Connection.TransactionLike>) => Promise<T> \| T,\n\t): Promise<T> {\n\t\treturn await this.client.transaction(client => transactionScope(new CommandBus<Connection.TransactionLike>(client, this.providers)))\n\t}\n}\n"],"names":[],"mappings":";;AAIO,MAAM,WAAyF;AAAA,EACrG,YAA4B,QAAiD,WAAsB;AAAvE,SAAA,SAAA;AAAiD,SAAA,YAAA;AAAA,EAAuB;AAAA,EAEpG,MAAa,QAAW,SAAiC;AACxD,WAAO,MAAM,QAAQ,QAAQ,EAAE,IAAI,KAAK,QAAQ,WAAW,KAAK,WAAW,KAAK,KAAA,CAAM;AAAA,EACvF;AAAA,EAEA,MAAM,YACL,kBACa;AACb,WAAO,MAAM,KAAK,OAAO,YAAY,CAAA,WAAU,iBAAiB,IAAI,WAAuC,QAAQ,KAAK,SAAS,CAAC,CAAC;AAAA,EACpI;AACD;;"}
1	+ {"version":3,"file":"CommandBus.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/commands/CommandBus.ts"],"sourcesContent":["import { Command } from './Command.js'\nimport { Client, Connection } from '@contember/database'\nimport { Providers } from '../providers.js'\n\nexport class CommandBus<ConnectionType extends Connection.ConnectionLike = Connection.ConnectionLike> {\n\tconstructor(public readonly client: Client<ConnectionType>, private readonly providers: Providers) {}\n\n\tpublic async execute<T>(command: Command<T>): Promise<T> {\n\t\treturn await command.execute({ db: this.client, providers: this.providers, bus: this })\n\t}\n\n\tasync transaction<T>(\n\t\ttransactionScope: (wrapper: CommandBus<Connection.TransactionLike>) => Promise<T> \| T,\n\t): Promise<T> {\n\t\treturn await this.client.transaction(client => transactionScope(new CommandBus<Connection.TransactionLike>(client, this.providers)))\n\t}\n}\n"],"names":[],"mappings":";;AAIO,MAAM,WAAyF;AAAA,EACrG,YAA4B,QAAiD,WAAsB;AAAvE,SAAA,SAAA;AAAiD,SAAA,YAAA;AAAA,EAAuB;AAAA,EAEpG,MAAa,QAAW,SAAiC;AACxD,WAAO,MAAM,QAAQ,QAAQ,EAAE,IAAI,KAAK,QAAQ,WAAW,KAAK,WAAW,KAAK,KAAA,CAAM;AAAA,EACvF;AAAA,EAEA,MAAM,YACL,kBACa;AACb,WAAO,MAAM,KAAK,OAAO,YAAY,CAAA,WAAU,iBAAiB,IAAI,WAAuC,QAAQ,KAAK,SAAS,CAAC,CAAC;AAAA,EACpI;AACD;;"}

package/dist/production/src/model/commands/CommandBus.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"CommandBus.js","sources":["../../../../../../packages/engine-tenant-api/src/model/commands/CommandBus.ts"],"sourcesContent":["import { Command } from './Command'\nimport { Client, Connection } from '@contember/database'\nimport { Providers } from '../providers'\n\nexport class CommandBus<ConnectionType extends Connection.ConnectionLike = Connection.ConnectionLike> {\n\tconstructor(public readonly client: Client<ConnectionType>, private readonly providers: Providers) {}\n\n\tpublic async execute<T>(command: Command<T>): Promise<T> {\n\t\treturn await command.execute({ db: this.client, providers: this.providers, bus: this })\n\t}\n\n\tasync transaction<T>(\n\t\ttransactionScope: (wrapper: CommandBus<Connection.TransactionLike>) => Promise<T> \| T,\n\t): Promise<T> {\n\t\treturn await this.client.transaction(client => transactionScope(new CommandBus<Connection.TransactionLike>(client, this.providers)))\n\t}\n}\n"],"names":[],"mappings":"AAIO,MAAM,WAAyF;AAAA,EACrG,YAA4B,QAAiD,WAAsB;AAAvE,SAAA,SAAA;AAAiD,SAAA,YAAA;AAAA,EAAuB;AAAA,EAEpG,MAAa,QAAW,SAAiC;AACxD,WAAO,MAAM,QAAQ,QAAQ,EAAE,IAAI,KAAK,QAAQ,WAAW,KAAK,WAAW,KAAK,KAAA,CAAM;AAAA,EACvF;AAAA,EAEA,MAAM,YACL,kBACa;AACb,WAAO,MAAM,KAAK,OAAO,YAAY,CAAA,WAAU,iBAAiB,IAAI,WAAuC,QAAQ,KAAK,SAAS,CAAC,CAAC;AAAA,EACpI;AACD;"}
1	+ {"version":3,"file":"CommandBus.js","sources":["../../../../../../packages/engine-tenant-api/src/model/commands/CommandBus.ts"],"sourcesContent":["import { Command } from './Command.js'\nimport { Client, Connection } from '@contember/database'\nimport { Providers } from '../providers.js'\n\nexport class CommandBus<ConnectionType extends Connection.ConnectionLike = Connection.ConnectionLike> {\n\tconstructor(public readonly client: Client<ConnectionType>, private readonly providers: Providers) {}\n\n\tpublic async execute<T>(command: Command<T>): Promise<T> {\n\t\treturn await command.execute({ db: this.client, providers: this.providers, bus: this })\n\t}\n\n\tasync transaction<T>(\n\t\ttransactionScope: (wrapper: CommandBus<Connection.TransactionLike>) => Promise<T> \| T,\n\t): Promise<T> {\n\t\treturn await this.client.transaction(client => transactionScope(new CommandBus<Connection.TransactionLike>(client, this.providers)))\n\t}\n}\n"],"names":[],"mappings":"AAIO,MAAM,WAAyF;AAAA,EACrG,YAA4B,QAAiD,WAAsB;AAAvE,SAAA,SAAA;AAAiD,SAAA,YAAA;AAAA,EAAuB;AAAA,EAEpG,MAAa,QAAW,SAAiC;AACxD,WAAO,MAAM,QAAQ,QAAQ,EAAE,IAAI,KAAK,QAAQ,WAAW,KAAK,WAAW,KAAK,KAAA,CAAM;AAAA,EACvF;AAAA,EAEA,MAAM,YACL,kBACa;AACb,WAAO,MAAM,KAAK,OAAO,YAAY,CAAA,WAAU,iBAAiB,IAAI,WAAuC,QAAQ,KAAK,SAAS,CAAC,CAAC;AAAA,EACpI;AACD;"}