npm - @contember/engine-tenant-api - Versions diffs - 2.1.0-rc.3 → 2.2.0-alpha.10 - Mend

@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3631) hide show

package/dist/production/src/model/authorization/PermissionActions.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"PermissionActions.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionActions.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { Acl } from '@contember/schema'\n\nnamespace PermissionActions {\n\texport enum Resources {\n\t\tsystem = 'system',\n\t\tentrypoint = 'entrypoint',\n\t\tperson = 'person',\n\t\tidentity = 'identity',\n\t\tproject = 'project',\n\t\tapiKey = 'apiKey',\n\t\tmailTemplate = 'mailTemplate',\n\t\tidp = 'idp',\n\t}\n\n\texport const CONFIGURE = Authorizator.createAction(Resources.system, 'configure')\n\texport const CONFIG_VIEW = Authorizator.createAction(Resources.system, 'viewConfig')\n\n\texport const IDENTITY_VIEW_PERMISSIONS = Authorizator.createAction(Resources.identity, 'viewPermissions')\n\texport const IDENTITY_ADD_GLOBAL_ROLES = (roles?: readonly string[]) => Authorizator.createAction(Resources.identity, 'addGlobalRoles', { roles })\n\texport const IDENTITY_REMOVE_GLOBAL_ROLES = (roles?: readonly string[]) =>\n\t\tAuthorizator.createAction(Resources.identity, 'removeGlobalRoles', { roles })\n\n\texport const PERSON_DISABLE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'disable', { roles })\n\n\texport const PERSON_VIEW = Authorizator.createAction(Resources.person, 'view')\n\texport const PERSON_SIGN_IN = Authorizator.createAction(Resources.person, 'signIn')\n\texport const PERSON_SIGN_UP = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'signUp', { roles })\n\texport const PERSON_SIGN_OUT = Authorizator.createAction(Resources.person, 'signOut')\n\texport const PERSON_SETUP_OTP = Authorizator.createAction(Resources.person, 'setupOtp')\n\texport const PERSON_CHANGE_PROFILE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'changeProfile', { roles })\n\texport const PERSON_CHANGE_MY_PROFILE = Authorizator.createAction(Resources.person, 'changeMyProfile')\n\texport const PERSON_TOGGLE_PASSWORDLESS = Authorizator.createAction(Resources.person, 'togglePasswordless')\n\texport const PERSON_CHANGE_PASSWORD = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'changePassword', { roles })\n\texport const PERSON_CHANGE_MY_PASSWORD = Authorizator.createAction(Resources.person, 'changeMyPassword')\n\texport const PERSON_RESET_PASSWORD = Authorizator.createAction(Resources.person, 'resetPassword')\n\texport const PERSON_CREATE_IDP_URL = Authorizator.createAction(Resources.person, 'createIdPUrl')\n\texport const PERSON_SIGN_IN_IDP = Authorizator.createAction(Resources.person, 'signInIdp')\n\texport const PERSON_REQUEST_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'requestPasswordlessSignIn')\n\texport const PERSON_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'passwordlessSignIn')\n\texport const PERSON_CREATE_SESSION_KEY = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'createSessionToken', { roles })\n\n\texport const PERSON_INVITE = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.person, 'invite', { memberships })\n\texport const PERSON_INVITE_UNMANAGED = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.person, 'invite_unmanaged', { memberships })\n\n\texport const PROJECT_VIEW = Authorizator.createAction(Resources.project, 'view')\n\texport const PROJECT_SET_SECRET = Authorizator.createAction(Resources.project, 'setSecret')\n\texport const PROJECT_UPDATE = Authorizator.createAction(Resources.project, 'update')\n\n\texport const PROJECT_CREATE = Authorizator.createAction(Resources.project, 'create')\n\texport const ENTRYPOINT_DEPLOY = Authorizator.createAction(Resources.entrypoint, 'deployEntrypoint')\n\n\texport const PROJECT_VIEW_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'viewMembers', { memberships })\n\texport const PROJECT_ADD_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'addMember', { memberships })\n\texport const PROJECT_REMOVE_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'removeMember', { memberships })\n\texport const PROJECT_UPDATE_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'updateMember', { memberships })\n\n\texport const API_KEY_CREATE = Authorizator.createAction(Resources.apiKey, 'create')\n\texport const API_KEY_CREATE_GLOBAL = (roles?: readonly string[]) => Authorizator.createAction(Resources.apiKey, 'createGlobal', { roles })\n\texport const API_KEY_DISABLE = Authorizator.createAction(Resources.apiKey, 'disable')\n\n\texport const MAIL_TEMPLATE_ADD = Authorizator.createAction(Resources.mailTemplate, 'add')\n\texport const MAIL_TEMPLATE_REMOVE = Authorizator.createAction(Resources.mailTemplate, 'remove')\n\texport const MAIL_TEMPLATE_LIST = Authorizator.createAction(Resources.mailTemplate, 'list')\n\n\texport const IDP_ADD = Authorizator.createAction(Resources.idp, 'add')\n\texport const IDP_UPDATE = Authorizator.createAction(Resources.idp, 'update')\n\texport const IDP_DISABLE = Authorizator.createAction(Resources.idp, 'disable')\n\texport const IDP_ENABLE = Authorizator.createAction(Resources.idp, 'enable')\n\texport const IDP_LIST = Authorizator.createAction(Resources.idp, 'list')\n}\n\nexport { PermissionActions }\n"],"names":["PermissionActions","Resources","Authorizator"],"mappings":";;;AAGUA,QAAAA,oBAAAA;AAAAA,CAAV,CAAUA,uBAAV;AACQ,GAAA,CAAKC,eAAL;AACNA,eAAA,QAAA,IAAS;AACTA,eAAA,YAAA,IAAa;AACbA,eAAA,QAAA,IAAS;AACTA,eAAA,UAAA,IAAW;AACXA,eAAA,SAAA,IAAU;AACVA,eAAA,QAAA,IAAS;AACTA,eAAA,cAAA,IAAe;AACfA,eAAA,KAAA,IAAM;AAAA,EAAA,GARKD,mBAAA,cAAAA,mBAAA,YAAA,CAAA,EAAA;AAWCA,qBAAA,YAAYE,cAAAA,aAAa,aAAa,UAAkB,WAAW;AACnEF,qBAAA,cAAcE,cAAAA,aAAa,aAAa,UAAkB,YAAY;AAEtEF,qBAAA,4BAA4BE,cAAAA,aAAa,aAAa,YAAoB,iBAAiB;AAC3FF,qBAAA,4BAA4B,CAAC,UAA8BE,cAAAA,aAAa,aAAa,YAAoB,kBAAkB,EAAE,OAAO;AACpIF,qBAAA,+BAA+B,CAAC,UAC5CE,cAAAA,aAAa,aAAa,YAAoB,qBAAqB,EAAE,OAAO;AAEhEF,qBAAA,iBAAiB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,WAAW,EAAE,OAAO;AAEhHF,qBAAA,cAAcE,cAAAA,aAAa,aAAa,UAAkB,MAAM;AAChEF,qBAAA,iBAAiBE,cAAAA,aAAa,aAAa,UAAkB,QAAQ;AACrEF,qBAAA,iBAAiB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,UAAU,EAAE,OAAO;AAC/GF,qBAAA,kBAAkBE,cAAAA,aAAa,aAAa,UAAkB,SAAS;AACvEF,qBAAA,mBAAmBE,cAAAA,aAAa,aAAa,UAAkB,UAAU;AACzEF,qBAAA,wBAAwB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,iBAAiB,EAAE,OAAO;AAC7HF,qBAAA,2BAA2BE,cAAAA,aAAa,aAAa,UAAkB,iBAAiB;AACxFF,qBAAA,6BAA6BE,cAAAA,aAAa,aAAa,UAAkB,oBAAoB;AAC7FF,qBAAA,yBAAyB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,kBAAkB,EAAE,OAAO;AAC/HF,qBAAA,4BAA4BE,cAAAA,aAAa,aAAa,UAAkB,kBAAkB;AAC1FF,qBAAA,wBAAwBE,cAAAA,aAAa,aAAa,UAAkB,eAAe;AACnFF,qBAAA,wBAAwBE,cAAAA,aAAa,aAAa,UAAkB,cAAc;AAClFF,qBAAA,qBAAqBE,cAAAA,aAAa,aAAa,UAAkB,WAAW;AAC5EF,qBAAA,sCAAsCE,cAAAA,aAAa,aAAa,UAAkB,2BAA2B;AAC7GF,qBAAA,8BAA8BE,cAAAA,aAAa,aAAa,UAAkB,oBAAoB;AAC9FF,qBAAA,4BAA4B,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,sBAAsB,EAAE,OAAO;AAEtIF,qBAAA,gBAAgB,CAAC,gBAA2CE,cAAAA,aAAa,aAAa,UAAkB,UAAU,EAAE,aAAa;AACjIF,qBAAA,0BAA0B,CAAC,gBACvCE,cAAAA,aAAa,aAAa,UAAkB,oBAAoB,EAAE,aAAa;AAEnEF,qBAAA,eAAeE,cAAAA,aAAa,aAAa,WAAmB,MAAM;AAClEF,qBAAA,qBAAqBE,cAAAA,aAAa,aAAa,WAAmB,WAAW;AAC7EF,qBAAA,iBAAiBE,cAAAA,aAAa,aAAa,WAAmB,QAAQ;AAEtEF,qBAAA,iBAAiBE,cAAAA,aAAa,aAAa,WAAmB,QAAQ;AACtEF,qBAAA,oBAAoBE,cAAAA,aAAa,aAAa,cAAsB,kBAAkB;AAEtFF,qBAAA,sBAAsB,CAAC,gBACnCE,cAAAA,aAAa,aAAa,WAAmB,eAAe,EAAE,aAAa;AAC/DF,qBAAA,qBAAqB,CAAC,gBAClCE,cAAAA,aAAa,aAAa,WAAmB,aAAa,EAAE,aAAa;AAC7DF,qBAAA,wBAAwB,CAAC,gBACrCE,cAAAA,aAAa,aAAa,WAAmB,gBAAgB,EAAE,aAAa;AAChEF,qBAAA,wBAAwB,CAAC,gBACrCE,cAAAA,aAAa,aAAa,WAAmB,gBAAgB,EAAE,aAAa;AAEhEF,qBAAA,iBAAiBE,cAAAA,aAAa,aAAa,UAAkB,QAAQ;AACrEF,qBAAA,wBAAwB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,gBAAgB,EAAE,OAAO;AAC5HF,qBAAA,kBAAkBE,cAAAA,aAAa,aAAa,UAAkB,SAAS;AAEvEF,qBAAA,oBAAoBE,cAAAA,aAAa,aAAa,gBAAwB,KAAK;AAC3EF,qBAAA,uBAAuBE,cAAAA,aAAa,aAAa,gBAAwB,QAAQ;AACjFF,qBAAA,qBAAqBE,cAAAA,aAAa,aAAa,gBAAwB,MAAM;AAE7EF,qBAAA,UAAUE,cAAAA,aAAa,aAAa,OAAe,KAAK;AACxDF,qBAAA,aAAaE,cAAAA,aAAa,aAAa,OAAe,QAAQ;AAC9DF,qBAAA,cAAcE,cAAAA,aAAa,aAAa,OAAe,SAAS;AAChEF,qBAAA,aAAaE,cAAAA,aAAa,aAAa,OAAe,QAAQ;AAC9DF,qBAAA,WAAWE,cAAAA,aAAa,aAAa,OAAe,MAAM;AAAA,GAvE9DF,QAAAA,sBAAAA,4BAAA,CAAA,EAAA;"}
1	+ {"version":3,"file":"PermissionActions.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionActions.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { Acl } from '@contember/schema'\n\nexport type TargetIdentityPermissionTarget = {\n\treadonly id: string\n\treadonly globalRoles: readonly string[]\n\treadonly hasProjectMemberships: boolean\n}\n\nexport type TargetIdentityPermissionMeta = {\n\treadonly target: TargetIdentityPermissionTarget \| null\n}\n\nexport type ProfileField = 'name' \| 'email'\n\nexport type ChangeProfilePermissionMeta = TargetIdentityPermissionMeta & {\n\treadonly fields: readonly ProfileField[]\n}\n\nexport type CreateSessionTokenPermissionMeta = {\n\treadonly phase: 'preflight' \| 'target'\n\treadonly target?: TargetIdentityPermissionTarget\n\treadonly requestedExpirationMinutes?: number \| null\n\treadonly trustForwardedClientInfo?: boolean\n}\n\nexport type GlobalRoleMutationPermissionMeta = {\n\treadonly requestedRoles: readonly string[]\n\treadonly target: TargetIdentityPermissionTarget\n\treadonly self: boolean\n}\n\nexport type GlobalApiKeyPermissionMeta = {\n\treadonly requestedRoles: readonly string[]\n\treadonly trustForwardedClientInfo: boolean\n}\n\nexport type ApiKeyPermissionMeta = {\n\treadonly trustForwardedClientInfo: boolean\n}\n\nexport type MailTemplatePermissionMeta = {\n\treadonly kind: 'global' \| 'project'\n\treadonly projectSlug: string \| null\n\treadonly type: string\n}\n\nnamespace PermissionActions {\n\texport enum Resources {\n\t\tsystem = 'system',\n\t\tentrypoint = 'entrypoint',\n\t\tperson = 'person',\n\t\tidentity = 'identity',\n\t\tproject = 'project',\n\t\tapiKey = 'apiKey',\n\t\tmailTemplate = 'mailTemplate',\n\t\tidp = 'idp',\n\t\tcustomRole = 'customRole',\n\t}\n\n\texport const CONFIGURE = Authorizator.createAction(Resources.system, 'configure')\n\texport const CONFIG_VIEW = Authorizator.createAction(Resources.system, 'viewConfig')\n\texport const AUTH_LOG_VIEW = Authorizator.createAction(Resources.system, 'viewAuthLog')\n\n\texport const IDENTITY_VIEW_PERMISSIONS = Authorizator.createAction(Resources.identity, 'viewPermissions')\n\texport const IDENTITY_ADD_GLOBAL_ROLES = (meta?: GlobalRoleMutationPermissionMeta) =>\n\t\tAuthorizator.createAction(Resources.identity, 'addGlobalRoles', meta)\n\texport const IDENTITY_REMOVE_GLOBAL_ROLES = (meta?: GlobalRoleMutationPermissionMeta) =>\n\t\tAuthorizator.createAction(Resources.identity, 'removeGlobalRoles', meta)\n\n\texport const PERSON_DISABLE = (target: TargetIdentityPermissionTarget \| null) => Authorizator.createAction(Resources.person, 'disable', { target })\n\texport const PERSON_FORCE_SIGN_OUT = (target: TargetIdentityPermissionTarget \| null) =>\n\t\tAuthorizator.createAction(Resources.person, 'forceSignOut', { target })\n\texport const PERSON_RESET_MFA = (target: TargetIdentityPermissionTarget \| null) =>\n\t\tAuthorizator.createAction(Resources.person, 'resetMfa', { target })\n\texport const PERSON_REVOKE_SESSION = Authorizator.createAction(Resources.person, 'revokeSession')\n\texport const PERSON_VIEW_SESSIONS = (target: TargetIdentityPermissionTarget \| null) =>\n\t\tAuthorizator.createAction(Resources.person, 'viewSessions', { target })\n\n\texport const PERSON_VIEW = Authorizator.createAction(Resources.person, 'view')\n\texport const PERSON_LIST = Authorizator.createAction(Resources.person, 'list')\n\texport const PERSON_SIGN_IN = Authorizator.createAction(Resources.person, 'signIn')\n\texport const PERSON_SIGN_UP = (requestedRoles?: readonly string[]) => Authorizator.createAction(Resources.person, 'signUp', { requestedRoles })\n\texport const PERSON_SIGN_OUT = Authorizator.createAction(Resources.person, 'signOut')\n\texport const PERSON_SETUP_OTP = Authorizator.createAction(Resources.person, 'setupOtp')\n\texport const PERSON_CHANGE_PROFILE = (target: TargetIdentityPermissionTarget \| null, fields: readonly ProfileField[]) =>\n\t\tAuthorizator.createAction(Resources.person, 'changeProfile', { target, fields })\n\texport const PERSON_CHANGE_MY_PROFILE = Authorizator.createAction(Resources.person, 'changeMyProfile')\n\texport const PERSON_TOGGLE_PASSWORDLESS = Authorizator.createAction(Resources.person, 'togglePasswordless')\n\texport const PERSON_CHANGE_PASSWORD = (target: TargetIdentityPermissionTarget \| null) =>\n\t\tAuthorizator.createAction(Resources.person, 'changePassword', { target })\n\texport const PERSON_CHANGE_MY_PASSWORD = Authorizator.createAction(Resources.person, 'changeMyPassword')\n\texport const PERSON_RESET_PASSWORD = Authorizator.createAction(Resources.person, 'resetPassword')\n\texport const PERSON_CREATE_IDP_URL = Authorizator.createAction(Resources.person, 'createIdPUrl')\n\texport const PERSON_SIGN_IN_IDP = Authorizator.createAction(Resources.person, 'signInIdp')\n\texport const PERSON_VIEW_IDP = (target: TargetIdentityPermissionTarget \| null) => Authorizator.createAction(Resources.person, 'viewIdp', { target })\n\texport const PERSON_DISCONNECT_MY_IDP = Authorizator.createAction(Resources.person, 'disconnectMyIdp')\n\texport const PERSON_REQUEST_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'requestPasswordlessSignIn')\n\texport const PERSON_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'passwordlessSignIn')\n\texport const PERSON_CREATE_SESSION_KEY = (meta: CreateSessionTokenPermissionMeta) =>\n\t\tAuthorizator.createAction(Resources.person, 'createSessionToken', meta)\n\n\texport const PERSON_INVITE = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.person, 'invite', { memberships })\n\texport const PERSON_INVITE_UNMANAGED = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.person, 'invite_unmanaged', { memberships })\n\n\texport const PROJECT_VIEW = Authorizator.createAction(Resources.project, 'view')\n\texport const PROJECT_SET_SECRET = Authorizator.createAction(Resources.project, 'setSecret')\n\texport const PROJECT_VIEW_SECRETS = Authorizator.createAction(Resources.project, 'viewSecrets')\n\texport const PROJECT_UPDATE = Authorizator.createAction(Resources.project, 'update')\n\n\texport const PROJECT_CREATE = Authorizator.createAction(Resources.project, 'create')\n\texport const ENTRYPOINT_DEPLOY = Authorizator.createAction(Resources.entrypoint, 'deployEntrypoint')\n\n\texport const PROJECT_VIEW_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'viewMembers', { memberships })\n\texport const PROJECT_ADD_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'addMember', { memberships })\n\texport const PROJECT_REMOVE_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'removeMember', { memberships })\n\texport const PROJECT_UPDATE_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'updateMember', { memberships })\n\n\texport const API_KEY_CREATE = (meta?: ApiKeyPermissionMeta) => Authorizator.createAction(Resources.apiKey, 'create', meta)\n\texport const API_KEY_CREATE_GLOBAL = (meta?: GlobalApiKeyPermissionMeta) => Authorizator.createAction(Resources.apiKey, 'createGlobal', meta)\n\texport const API_KEY_DISABLE = Authorizator.createAction(Resources.apiKey, 'disable')\n\texport const API_KEY_LIST = Authorizator.createAction(Resources.apiKey, 'list')\n\n\t// meta is optional only so a grant can be registered without one — `Permissions.allow`\n\t// keys on resource + privilege and never reads it. Every check site passes it.\n\texport const MAIL_TEMPLATE_ADD = (meta?: MailTemplatePermissionMeta) => Authorizator.createAction(Resources.mailTemplate, 'add', meta)\n\texport const MAIL_TEMPLATE_REMOVE = (meta?: MailTemplatePermissionMeta) => Authorizator.createAction(Resources.mailTemplate, 'remove', meta)\n\texport const MAIL_TEMPLATE_LIST = (meta?: MailTemplatePermissionMeta) => Authorizator.createAction(Resources.mailTemplate, 'list', meta)\n\n\texport const IDP_ADD = Authorizator.createAction(Resources.idp, 'add')\n\texport const IDP_UPDATE = Authorizator.createAction(Resources.idp, 'update')\n\texport const IDP_DISABLE = Authorizator.createAction(Resources.idp, 'disable')\n\texport const IDP_ENABLE = Authorizator.createAction(Resources.idp, 'enable')\n\texport const IDP_LIST = Authorizator.createAction(Resources.idp, 'list')\n\n\texport const CUSTOM_ROLE_MANAGE = Authorizator.createAction(Resources.customRole, 'manage')\n\texport const CUSTOM_ROLE_VIEW = Authorizator.createAction(Resources.customRole, 'view')\n}\n\nexport { PermissionActions }\n"],"names":["PermissionActions","Resources","Authorizator"],"mappings":";;;AA+CUA,QAAAA,oBAAAA;AAAAA,CAAV,CAAUA,uBAAV;AACQ,GAAA,CAAKC,eAAL;AACNA,eAAA,QAAA,IAAS;AACTA,eAAA,YAAA,IAAa;AACbA,eAAA,QAAA,IAAS;AACTA,eAAA,UAAA,IAAW;AACXA,eAAA,SAAA,IAAU;AACVA,eAAA,QAAA,IAAS;AACTA,eAAA,cAAA,IAAe;AACfA,eAAA,KAAA,IAAM;AACNA,eAAA,YAAA,IAAa;AAAA,EAAA,GATFD,mBAAA,cAAAA,mBAAA,YAAA,CAAA,EAAA;AAYCA,qBAAA,YAAYE,cAAAA,aAAa,aAAa,UAAkB,WAAW;AACnEF,qBAAA,cAAcE,cAAAA,aAAa,aAAa,UAAkB,YAAY;AACtEF,qBAAA,gBAAgBE,cAAAA,aAAa,aAAa,UAAkB,aAAa;AAEzEF,qBAAA,4BAA4BE,cAAAA,aAAa,aAAa,YAAoB,iBAAiB;AAC3FF,qBAAA,4BAA4B,CAAC,SACzCE,cAAAA,aAAa,aAAa,YAAoB,kBAAkB,IAAI;AACxDF,qBAAA,+BAA+B,CAAC,SAC5CE,cAAAA,aAAa,aAAa,YAAoB,qBAAqB,IAAI;AAE3DF,qBAAA,iBAAiB,CAAC,WAAkDE,cAAAA,aAAa,aAAa,UAAkB,WAAW,EAAE,QAAQ;AACrIF,qBAAA,wBAAwB,CAAC,WACrCE,cAAAA,aAAa,aAAa,UAAkB,gBAAgB,EAAE,QAAQ;AAC1DF,qBAAA,mBAAmB,CAAC,WAChCE,cAAAA,aAAa,aAAa,UAAkB,YAAY,EAAE,QAAQ;AACtDF,qBAAA,wBAAwBE,cAAAA,aAAa,aAAa,UAAkB,eAAe;AACnFF,qBAAA,uBAAuB,CAAC,WACpCE,cAAAA,aAAa,aAAa,UAAkB,gBAAgB,EAAE,QAAQ;AAE1DF,qBAAA,cAAcE,cAAAA,aAAa,aAAa,UAAkB,MAAM;AAChEF,qBAAA,cAAcE,cAAAA,aAAa,aAAa,UAAkB,MAAM;AAChEF,qBAAA,iBAAiBE,cAAAA,aAAa,aAAa,UAAkB,QAAQ;AACrEF,qBAAA,iBAAiB,CAAC,mBAAuCE,cAAAA,aAAa,aAAa,UAAkB,UAAU,EAAE,gBAAgB;AACjIF,qBAAA,kBAAkBE,cAAAA,aAAa,aAAa,UAAkB,SAAS;AACvEF,qBAAA,mBAAmBE,cAAAA,aAAa,aAAa,UAAkB,UAAU;AACzEF,qBAAA,wBAAwB,CAAC,QAA+C,WACpFE,cAAAA,aAAa,aAAa,UAAkB,iBAAiB,EAAE,QAAQ,OAAA,CAAQ;AACnEF,qBAAA,2BAA2BE,cAAAA,aAAa,aAAa,UAAkB,iBAAiB;AACxFF,qBAAA,6BAA6BE,cAAAA,aAAa,aAAa,UAAkB,oBAAoB;AAC7FF,qBAAA,yBAAyB,CAAC,WACtCE,cAAAA,aAAa,aAAa,UAAkB,kBAAkB,EAAE,QAAQ;AAC5DF,qBAAA,4BAA4BE,cAAAA,aAAa,aAAa,UAAkB,kBAAkB;AAC1FF,qBAAA,wBAAwBE,cAAAA,aAAa,aAAa,UAAkB,eAAe;AACnFF,qBAAA,wBAAwBE,cAAAA,aAAa,aAAa,UAAkB,cAAc;AAClFF,qBAAA,qBAAqBE,cAAAA,aAAa,aAAa,UAAkB,WAAW;AAC5EF,qBAAA,kBAAkB,CAAC,WAAkDE,cAAAA,aAAa,aAAa,UAAkB,WAAW,EAAE,QAAQ;AACtIF,qBAAA,2BAA2BE,cAAAA,aAAa,aAAa,UAAkB,iBAAiB;AACxFF,qBAAA,sCAAsCE,cAAAA,aAAa,aAAa,UAAkB,2BAA2B;AAC7GF,qBAAA,8BAA8BE,cAAAA,aAAa,aAAa,UAAkB,oBAAoB;AAC9FF,qBAAA,4BAA4B,CAAC,SACzCE,cAAAA,aAAa,aAAa,UAAkB,sBAAsB,IAAI;AAE1DF,qBAAA,gBAAgB,CAAC,gBAA2CE,cAAAA,aAAa,aAAa,UAAkB,UAAU,EAAE,aAAa;AACjIF,qBAAA,0BAA0B,CAAC,gBACvCE,cAAAA,aAAa,aAAa,UAAkB,oBAAoB,EAAE,aAAa;AAEnEF,qBAAA,eAAeE,cAAAA,aAAa,aAAa,WAAmB,MAAM;AAClEF,qBAAA,qBAAqBE,cAAAA,aAAa,aAAa,WAAmB,WAAW;AAC7EF,qBAAA,uBAAuBE,cAAAA,aAAa,aAAa,WAAmB,aAAa;AACjFF,qBAAA,iBAAiBE,cAAAA,aAAa,aAAa,WAAmB,QAAQ;AAEtEF,qBAAA,iBAAiBE,cAAAA,aAAa,aAAa,WAAmB,QAAQ;AACtEF,qBAAA,oBAAoBE,cAAAA,aAAa,aAAa,cAAsB,kBAAkB;AAEtFF,qBAAA,sBAAsB,CAAC,gBACnCE,cAAAA,aAAa,aAAa,WAAmB,eAAe,EAAE,aAAa;AAC/DF,qBAAA,qBAAqB,CAAC,gBAClCE,cAAAA,aAAa,aAAa,WAAmB,aAAa,EAAE,aAAa;AAC7DF,qBAAA,wBAAwB,CAAC,gBACrCE,cAAAA,aAAa,aAAa,WAAmB,gBAAgB,EAAE,aAAa;AAChEF,qBAAA,wBAAwB,CAAC,gBACrCE,cAAAA,aAAa,aAAa,WAAmB,gBAAgB,EAAE,aAAa;AAEhEF,qBAAA,iBAAiB,CAAC,SAAgCE,cAAAA,aAAa,aAAa,UAAkB,UAAU,IAAI;AAC5GF,qBAAA,wBAAwB,CAAC,SAAsCE,cAAAA,aAAa,aAAa,UAAkB,gBAAgB,IAAI;AAC/HF,qBAAA,kBAAkBE,cAAAA,aAAa,aAAa,UAAkB,SAAS;AACvEF,qBAAA,eAAeE,cAAAA,aAAa,aAAa,UAAkB,MAAM;AAIjEF,qBAAA,oBAAoB,CAAC,SAAsCE,cAAAA,aAAa,aAAa,gBAAwB,OAAO,IAAI;AACxHF,qBAAA,uBAAuB,CAAC,SAAsCE,cAAAA,aAAa,aAAa,gBAAwB,UAAU,IAAI;AAC9HF,qBAAA,qBAAqB,CAAC,SAAsCE,cAAAA,aAAa,aAAa,gBAAwB,QAAQ,IAAI;AAE1HF,qBAAA,UAAUE,cAAAA,aAAa,aAAa,OAAe,KAAK;AACxDF,qBAAA,aAAaE,cAAAA,aAAa,aAAa,OAAe,QAAQ;AAC9DF,qBAAA,cAAcE,cAAAA,aAAa,aAAa,OAAe,SAAS;AAChEF,qBAAA,aAAaE,cAAAA,aAAa,aAAa,OAAe,QAAQ;AAC9DF,qBAAA,WAAWE,cAAAA,aAAa,aAAa,OAAe,MAAM;AAE1DF,qBAAA,qBAAqBE,cAAAA,aAAa,aAAa,cAAsB,QAAQ;AAC7EF,qBAAA,mBAAmBE,cAAAA,aAAa,aAAa,cAAsB,MAAM;AAAA,GA9F7EF,QAAAA,sBAAAA,4BAAA,CAAA,EAAA;"}

package/dist/production/src/model/authorization/PermissionActions.js CHANGED Viewed

@@ -10,33 +10,43 @@ var PermissionActions;
     Resources2["apiKey"] = "apiKey";
     Resources2["mailTemplate"] = "mailTemplate";
     Resources2["idp"] = "idp";
+    Resources2["customRole"] = "customRole";
   })(PermissionActions2.Resources || (PermissionActions2.Resources = {}));
   PermissionActions2.CONFIGURE = Authorizator.createAction("system", "configure");
   PermissionActions2.CONFIG_VIEW = Authorizator.createAction("system", "viewConfig");
+  PermissionActions2.AUTH_LOG_VIEW = Authorizator.createAction("system", "viewAuthLog");
   PermissionActions2.IDENTITY_VIEW_PERMISSIONS = Authorizator.createAction("identity", "viewPermissions");
-  PermissionActions2.IDENTITY_ADD_GLOBAL_ROLES = (roles) => Authorizator.createAction("identity", "addGlobalRoles", { roles });
-  PermissionActions2.IDENTITY_REMOVE_GLOBAL_ROLES = (roles) => Authorizator.createAction("identity", "removeGlobalRoles", { roles });
-  PermissionActions2.PERSON_DISABLE = (roles) => Authorizator.createAction("person", "disable", { roles });
+  PermissionActions2.IDENTITY_ADD_GLOBAL_ROLES = (meta) => Authorizator.createAction("identity", "addGlobalRoles", meta);
+  PermissionActions2.IDENTITY_REMOVE_GLOBAL_ROLES = (meta) => Authorizator.createAction("identity", "removeGlobalRoles", meta);
+  PermissionActions2.PERSON_DISABLE = (target) => Authorizator.createAction("person", "disable", { target });
+  PermissionActions2.PERSON_FORCE_SIGN_OUT = (target) => Authorizator.createAction("person", "forceSignOut", { target });
+  PermissionActions2.PERSON_RESET_MFA = (target) => Authorizator.createAction("person", "resetMfa", { target });
+  PermissionActions2.PERSON_REVOKE_SESSION = Authorizator.createAction("person", "revokeSession");
+  PermissionActions2.PERSON_VIEW_SESSIONS = (target) => Authorizator.createAction("person", "viewSessions", { target });
   PermissionActions2.PERSON_VIEW = Authorizator.createAction("person", "view");
+  PermissionActions2.PERSON_LIST = Authorizator.createAction("person", "list");
   PermissionActions2.PERSON_SIGN_IN = Authorizator.createAction("person", "signIn");
-  PermissionActions2.PERSON_SIGN_UP = (roles) => Authorizator.createAction("person", "signUp", { roles });
+  PermissionActions2.PERSON_SIGN_UP = (requestedRoles) => Authorizator.createAction("person", "signUp", { requestedRoles });
   PermissionActions2.PERSON_SIGN_OUT = Authorizator.createAction("person", "signOut");
   PermissionActions2.PERSON_SETUP_OTP = Authorizator.createAction("person", "setupOtp");
-  PermissionActions2.PERSON_CHANGE_PROFILE = (roles) => Authorizator.createAction("person", "changeProfile", { roles });
+  PermissionActions2.PERSON_CHANGE_PROFILE = (target, fields) => Authorizator.createAction("person", "changeProfile", { target, fields });
   PermissionActions2.PERSON_CHANGE_MY_PROFILE = Authorizator.createAction("person", "changeMyProfile");
   PermissionActions2.PERSON_TOGGLE_PASSWORDLESS = Authorizator.createAction("person", "togglePasswordless");
-  PermissionActions2.PERSON_CHANGE_PASSWORD = (roles) => Authorizator.createAction("person", "changePassword", { roles });
+  PermissionActions2.PERSON_CHANGE_PASSWORD = (target) => Authorizator.createAction("person", "changePassword", { target });
   PermissionActions2.PERSON_CHANGE_MY_PASSWORD = Authorizator.createAction("person", "changeMyPassword");
   PermissionActions2.PERSON_RESET_PASSWORD = Authorizator.createAction("person", "resetPassword");
   PermissionActions2.PERSON_CREATE_IDP_URL = Authorizator.createAction("person", "createIdPUrl");
   PermissionActions2.PERSON_SIGN_IN_IDP = Authorizator.createAction("person", "signInIdp");
+  PermissionActions2.PERSON_VIEW_IDP = (target) => Authorizator.createAction("person", "viewIdp", { target });
+  PermissionActions2.PERSON_DISCONNECT_MY_IDP = Authorizator.createAction("person", "disconnectMyIdp");
   PermissionActions2.PERSON_REQUEST_PASSWORDLESS_SIGN_IN = Authorizator.createAction("person", "requestPasswordlessSignIn");
   PermissionActions2.PERSON_PASSWORDLESS_SIGN_IN = Authorizator.createAction("person", "passwordlessSignIn");
-  PermissionActions2.PERSON_CREATE_SESSION_KEY = (roles) => Authorizator.createAction("person", "createSessionToken", { roles });
+  PermissionActions2.PERSON_CREATE_SESSION_KEY = (meta) => Authorizator.createAction("person", "createSessionToken", meta);
   PermissionActions2.PERSON_INVITE = (memberships) => Authorizator.createAction("person", "invite", { memberships });
   PermissionActions2.PERSON_INVITE_UNMANAGED = (memberships) => Authorizator.createAction("person", "invite_unmanaged", { memberships });
   PermissionActions2.PROJECT_VIEW = Authorizator.createAction("project", "view");
   PermissionActions2.PROJECT_SET_SECRET = Authorizator.createAction("project", "setSecret");
+  PermissionActions2.PROJECT_VIEW_SECRETS = Authorizator.createAction("project", "viewSecrets");
   PermissionActions2.PROJECT_UPDATE = Authorizator.createAction("project", "update");
   PermissionActions2.PROJECT_CREATE = Authorizator.createAction("project", "create");
   PermissionActions2.ENTRYPOINT_DEPLOY = Authorizator.createAction("entrypoint", "deployEntrypoint");
@@ -44,17 +54,20 @@ var PermissionActions;
   PermissionActions2.PROJECT_ADD_MEMBER = (memberships) => Authorizator.createAction("project", "addMember", { memberships });
   PermissionActions2.PROJECT_REMOVE_MEMBER = (memberships) => Authorizator.createAction("project", "removeMember", { memberships });
   PermissionActions2.PROJECT_UPDATE_MEMBER = (memberships) => Authorizator.createAction("project", "updateMember", { memberships });
-  PermissionActions2.API_KEY_CREATE = Authorizator.createAction("apiKey", "create");
-  PermissionActions2.API_KEY_CREATE_GLOBAL = (roles) => Authorizator.createAction("apiKey", "createGlobal", { roles });
+  PermissionActions2.API_KEY_CREATE = (meta) => Authorizator.createAction("apiKey", "create", meta);
+  PermissionActions2.API_KEY_CREATE_GLOBAL = (meta) => Authorizator.createAction("apiKey", "createGlobal", meta);
   PermissionActions2.API_KEY_DISABLE = Authorizator.createAction("apiKey", "disable");
-  PermissionActions2.MAIL_TEMPLATE_ADD = Authorizator.createAction("mailTemplate", "add");
-  PermissionActions2.MAIL_TEMPLATE_REMOVE = Authorizator.createAction("mailTemplate", "remove");
-  PermissionActions2.MAIL_TEMPLATE_LIST = Authorizator.createAction("mailTemplate", "list");
+  PermissionActions2.API_KEY_LIST = Authorizator.createAction("apiKey", "list");
+  PermissionActions2.MAIL_TEMPLATE_ADD = (meta) => Authorizator.createAction("mailTemplate", "add", meta);
+  PermissionActions2.MAIL_TEMPLATE_REMOVE = (meta) => Authorizator.createAction("mailTemplate", "remove", meta);
+  PermissionActions2.MAIL_TEMPLATE_LIST = (meta) => Authorizator.createAction("mailTemplate", "list", meta);
   PermissionActions2.IDP_ADD = Authorizator.createAction("idp", "add");
   PermissionActions2.IDP_UPDATE = Authorizator.createAction("idp", "update");
   PermissionActions2.IDP_DISABLE = Authorizator.createAction("idp", "disable");
   PermissionActions2.IDP_ENABLE = Authorizator.createAction("idp", "enable");
   PermissionActions2.IDP_LIST = Authorizator.createAction("idp", "list");
+  PermissionActions2.CUSTOM_ROLE_MANAGE = Authorizator.createAction("customRole", "manage");
+  PermissionActions2.CUSTOM_ROLE_VIEW = Authorizator.createAction("customRole", "view");
 })(PermissionActions || (PermissionActions = {}));
 export {
   PermissionActions

package/dist/production/src/model/authorization/PermissionActions.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"PermissionActions.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionActions.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { Acl } from '@contember/schema'\n\nnamespace PermissionActions {\n\texport enum Resources {\n\t\tsystem = 'system',\n\t\tentrypoint = 'entrypoint',\n\t\tperson = 'person',\n\t\tidentity = 'identity',\n\t\tproject = 'project',\n\t\tapiKey = 'apiKey',\n\t\tmailTemplate = 'mailTemplate',\n\t\tidp = 'idp',\n\t}\n\n\texport const CONFIGURE = Authorizator.createAction(Resources.system, 'configure')\n\texport const CONFIG_VIEW = Authorizator.createAction(Resources.system, 'viewConfig')\n\n\texport const IDENTITY_VIEW_PERMISSIONS = Authorizator.createAction(Resources.identity, 'viewPermissions')\n\texport const IDENTITY_ADD_GLOBAL_ROLES = (roles?: readonly string[]) => Authorizator.createAction(Resources.identity, 'addGlobalRoles', { roles })\n\texport const IDENTITY_REMOVE_GLOBAL_ROLES = (roles?: readonly string[]) =>\n\t\tAuthorizator.createAction(Resources.identity, 'removeGlobalRoles', { roles })\n\n\texport const PERSON_DISABLE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'disable', { roles })\n\n\texport const PERSON_VIEW = Authorizator.createAction(Resources.person, 'view')\n\texport const PERSON_SIGN_IN = Authorizator.createAction(Resources.person, 'signIn')\n\texport const PERSON_SIGN_UP = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'signUp', { roles })\n\texport const PERSON_SIGN_OUT = Authorizator.createAction(Resources.person, 'signOut')\n\texport const PERSON_SETUP_OTP = Authorizator.createAction(Resources.person, 'setupOtp')\n\texport const PERSON_CHANGE_PROFILE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'changeProfile', { roles })\n\texport const PERSON_CHANGE_MY_PROFILE = Authorizator.createAction(Resources.person, 'changeMyProfile')\n\texport const PERSON_TOGGLE_PASSWORDLESS = Authorizator.createAction(Resources.person, 'togglePasswordless')\n\texport const PERSON_CHANGE_PASSWORD = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'changePassword', { roles })\n\texport const PERSON_CHANGE_MY_PASSWORD = Authorizator.createAction(Resources.person, 'changeMyPassword')\n\texport const PERSON_RESET_PASSWORD = Authorizator.createAction(Resources.person, 'resetPassword')\n\texport const PERSON_CREATE_IDP_URL = Authorizator.createAction(Resources.person, 'createIdPUrl')\n\texport const PERSON_SIGN_IN_IDP = Authorizator.createAction(Resources.person, 'signInIdp')\n\texport const PERSON_REQUEST_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'requestPasswordlessSignIn')\n\texport const PERSON_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'passwordlessSignIn')\n\texport const PERSON_CREATE_SESSION_KEY = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'createSessionToken', { roles })\n\n\texport const PERSON_INVITE = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.person, 'invite', { memberships })\n\texport const PERSON_INVITE_UNMANAGED = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.person, 'invite_unmanaged', { memberships })\n\n\texport const PROJECT_VIEW = Authorizator.createAction(Resources.project, 'view')\n\texport const PROJECT_SET_SECRET = Authorizator.createAction(Resources.project, 'setSecret')\n\texport const PROJECT_UPDATE = Authorizator.createAction(Resources.project, 'update')\n\n\texport const PROJECT_CREATE = Authorizator.createAction(Resources.project, 'create')\n\texport const ENTRYPOINT_DEPLOY = Authorizator.createAction(Resources.entrypoint, 'deployEntrypoint')\n\n\texport const PROJECT_VIEW_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'viewMembers', { memberships })\n\texport const PROJECT_ADD_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'addMember', { memberships })\n\texport const PROJECT_REMOVE_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'removeMember', { memberships })\n\texport const PROJECT_UPDATE_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'updateMember', { memberships })\n\n\texport const API_KEY_CREATE = Authorizator.createAction(Resources.apiKey, 'create')\n\texport const API_KEY_CREATE_GLOBAL = (roles?: readonly string[]) => Authorizator.createAction(Resources.apiKey, 'createGlobal', { roles })\n\texport const API_KEY_DISABLE = Authorizator.createAction(Resources.apiKey, 'disable')\n\n\texport const MAIL_TEMPLATE_ADD = Authorizator.createAction(Resources.mailTemplate, 'add')\n\texport const MAIL_TEMPLATE_REMOVE = Authorizator.createAction(Resources.mailTemplate, 'remove')\n\texport const MAIL_TEMPLATE_LIST = Authorizator.createAction(Resources.mailTemplate, 'list')\n\n\texport const IDP_ADD = Authorizator.createAction(Resources.idp, 'add')\n\texport const IDP_UPDATE = Authorizator.createAction(Resources.idp, 'update')\n\texport const IDP_DISABLE = Authorizator.createAction(Resources.idp, 'disable')\n\texport const IDP_ENABLE = Authorizator.createAction(Resources.idp, 'enable')\n\texport const IDP_LIST = Authorizator.createAction(Resources.idp, 'list')\n}\n\nexport { PermissionActions }\n"],"names":["PermissionActions","Resources"],"mappings":";AAGA,IAAU;AAAA,CAAV,CAAUA,uBAAV;AACQ,GAAA,CAAKC,eAAL;AACNA,eAAA,QAAA,IAAS;AACTA,eAAA,YAAA,IAAa;AACbA,eAAA,QAAA,IAAS;AACTA,eAAA,UAAA,IAAW;AACXA,eAAA,SAAA,IAAU;AACVA,eAAA,QAAA,IAAS;AACTA,eAAA,cAAA,IAAe;AACfA,eAAA,KAAA,IAAM;AAAA,EAAA,GARKD,mBAAA,cAAAA,mBAAA,YAAA,CAAA,EAAA;AAWCA,qBAAA,YAAY,aAAa,aAAa,UAAkB,WAAW;AACnEA,qBAAA,cAAc,aAAa,aAAa,UAAkB,YAAY;AAEtEA,qBAAA,4BAA4B,aAAa,aAAa,YAAoB,iBAAiB;AAC3FA,qBAAA,4BAA4B,CAAC,UAA8B,aAAa,aAAa,YAAoB,kBAAkB,EAAE,OAAO;AACpIA,qBAAA,+BAA+B,CAAC,UAC5C,aAAa,aAAa,YAAoB,qBAAqB,EAAE,OAAO;AAEhEA,qBAAA,iBAAiB,CAAC,UAA8B,aAAa,aAAa,UAAkB,WAAW,EAAE,OAAO;AAEhHA,qBAAA,cAAc,aAAa,aAAa,UAAkB,MAAM;AAChEA,qBAAA,iBAAiB,aAAa,aAAa,UAAkB,QAAQ;AACrEA,qBAAA,iBAAiB,CAAC,UAA8B,aAAa,aAAa,UAAkB,UAAU,EAAE,OAAO;AAC/GA,qBAAA,kBAAkB,aAAa,aAAa,UAAkB,SAAS;AACvEA,qBAAA,mBAAmB,aAAa,aAAa,UAAkB,UAAU;AACzEA,qBAAA,wBAAwB,CAAC,UAA8B,aAAa,aAAa,UAAkB,iBAAiB,EAAE,OAAO;AAC7HA,qBAAA,2BAA2B,aAAa,aAAa,UAAkB,iBAAiB;AACxFA,qBAAA,6BAA6B,aAAa,aAAa,UAAkB,oBAAoB;AAC7FA,qBAAA,yBAAyB,CAAC,UAA8B,aAAa,aAAa,UAAkB,kBAAkB,EAAE,OAAO;AAC/HA,qBAAA,4BAA4B,aAAa,aAAa,UAAkB,kBAAkB;AAC1FA,qBAAA,wBAAwB,aAAa,aAAa,UAAkB,eAAe;AACnFA,qBAAA,wBAAwB,aAAa,aAAa,UAAkB,cAAc;AAClFA,qBAAA,qBAAqB,aAAa,aAAa,UAAkB,WAAW;AAC5EA,qBAAA,sCAAsC,aAAa,aAAa,UAAkB,2BAA2B;AAC7GA,qBAAA,8BAA8B,aAAa,aAAa,UAAkB,oBAAoB;AAC9FA,qBAAA,4BAA4B,CAAC,UAA8B,aAAa,aAAa,UAAkB,sBAAsB,EAAE,OAAO;AAEtIA,qBAAA,gBAAgB,CAAC,gBAA2C,aAAa,aAAa,UAAkB,UAAU,EAAE,aAAa;AACjIA,qBAAA,0BAA0B,CAAC,gBACvC,aAAa,aAAa,UAAkB,oBAAoB,EAAE,aAAa;AAEnEA,qBAAA,eAAe,aAAa,aAAa,WAAmB,MAAM;AAClEA,qBAAA,qBAAqB,aAAa,aAAa,WAAmB,WAAW;AAC7EA,qBAAA,iBAAiB,aAAa,aAAa,WAAmB,QAAQ;AAEtEA,qBAAA,iBAAiB,aAAa,aAAa,WAAmB,QAAQ;AACtEA,qBAAA,oBAAoB,aAAa,aAAa,cAAsB,kBAAkB;AAEtFA,qBAAA,sBAAsB,CAAC,gBACnC,aAAa,aAAa,WAAmB,eAAe,EAAE,aAAa;AAC/DA,qBAAA,qBAAqB,CAAC,gBAClC,aAAa,aAAa,WAAmB,aAAa,EAAE,aAAa;AAC7DA,qBAAA,wBAAwB,CAAC,gBACrC,aAAa,aAAa,WAAmB,gBAAgB,EAAE,aAAa;AAChEA,qBAAA,wBAAwB,CAAC,gBACrC,aAAa,aAAa,WAAmB,gBAAgB,EAAE,aAAa;AAEhEA,qBAAA,iBAAiB,aAAa,aAAa,UAAkB,QAAQ;AACrEA,qBAAA,wBAAwB,CAAC,UAA8B,aAAa,aAAa,UAAkB,gBAAgB,EAAE,OAAO;AAC5HA,qBAAA,kBAAkB,aAAa,aAAa,UAAkB,SAAS;AAEvEA,qBAAA,oBAAoB,aAAa,aAAa,gBAAwB,KAAK;AAC3EA,qBAAA,uBAAuB,aAAa,aAAa,gBAAwB,QAAQ;AACjFA,qBAAA,qBAAqB,aAAa,aAAa,gBAAwB,MAAM;AAE7EA,qBAAA,UAAU,aAAa,aAAa,OAAe,KAAK;AACxDA,qBAAA,aAAa,aAAa,aAAa,OAAe,QAAQ;AAC9DA,qBAAA,cAAc,aAAa,aAAa,OAAe,SAAS;AAChEA,qBAAA,aAAa,aAAa,aAAa,OAAe,QAAQ;AAC9DA,qBAAA,WAAW,aAAa,aAAa,OAAe,MAAM;AAAA,GAvE9D,sBAAA,oBAAA,CAAA,EAAA;"}
1	+ {"version":3,"file":"PermissionActions.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionActions.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { Acl } from '@contember/schema'\n\nexport type TargetIdentityPermissionTarget = {\n\treadonly id: string\n\treadonly globalRoles: readonly string[]\n\treadonly hasProjectMemberships: boolean\n}\n\nexport type TargetIdentityPermissionMeta = {\n\treadonly target: TargetIdentityPermissionTarget \| null\n}\n\nexport type ProfileField = 'name' \| 'email'\n\nexport type ChangeProfilePermissionMeta = TargetIdentityPermissionMeta & {\n\treadonly fields: readonly ProfileField[]\n}\n\nexport type CreateSessionTokenPermissionMeta = {\n\treadonly phase: 'preflight' \| 'target'\n\treadonly target?: TargetIdentityPermissionTarget\n\treadonly requestedExpirationMinutes?: number \| null\n\treadonly trustForwardedClientInfo?: boolean\n}\n\nexport type GlobalRoleMutationPermissionMeta = {\n\treadonly requestedRoles: readonly string[]\n\treadonly target: TargetIdentityPermissionTarget\n\treadonly self: boolean\n}\n\nexport type GlobalApiKeyPermissionMeta = {\n\treadonly requestedRoles: readonly string[]\n\treadonly trustForwardedClientInfo: boolean\n}\n\nexport type ApiKeyPermissionMeta = {\n\treadonly trustForwardedClientInfo: boolean\n}\n\nexport type MailTemplatePermissionMeta = {\n\treadonly kind: 'global' \| 'project'\n\treadonly projectSlug: string \| null\n\treadonly type: string\n}\n\nnamespace PermissionActions {\n\texport enum Resources {\n\t\tsystem = 'system',\n\t\tentrypoint = 'entrypoint',\n\t\tperson = 'person',\n\t\tidentity = 'identity',\n\t\tproject = 'project',\n\t\tapiKey = 'apiKey',\n\t\tmailTemplate = 'mailTemplate',\n\t\tidp = 'idp',\n\t\tcustomRole = 'customRole',\n\t}\n\n\texport const CONFIGURE = Authorizator.createAction(Resources.system, 'configure')\n\texport const CONFIG_VIEW = Authorizator.createAction(Resources.system, 'viewConfig')\n\texport const AUTH_LOG_VIEW = Authorizator.createAction(Resources.system, 'viewAuthLog')\n\n\texport const IDENTITY_VIEW_PERMISSIONS = Authorizator.createAction(Resources.identity, 'viewPermissions')\n\texport const IDENTITY_ADD_GLOBAL_ROLES = (meta?: GlobalRoleMutationPermissionMeta) =>\n\t\tAuthorizator.createAction(Resources.identity, 'addGlobalRoles', meta)\n\texport const IDENTITY_REMOVE_GLOBAL_ROLES = (meta?: GlobalRoleMutationPermissionMeta) =>\n\t\tAuthorizator.createAction(Resources.identity, 'removeGlobalRoles', meta)\n\n\texport const PERSON_DISABLE = (target: TargetIdentityPermissionTarget \| null) => Authorizator.createAction(Resources.person, 'disable', { target })\n\texport const PERSON_FORCE_SIGN_OUT = (target: TargetIdentityPermissionTarget \| null) =>\n\t\tAuthorizator.createAction(Resources.person, 'forceSignOut', { target })\n\texport const PERSON_RESET_MFA = (target: TargetIdentityPermissionTarget \| null) =>\n\t\tAuthorizator.createAction(Resources.person, 'resetMfa', { target })\n\texport const PERSON_REVOKE_SESSION = Authorizator.createAction(Resources.person, 'revokeSession')\n\texport const PERSON_VIEW_SESSIONS = (target: TargetIdentityPermissionTarget \| null) =>\n\t\tAuthorizator.createAction(Resources.person, 'viewSessions', { target })\n\n\texport const PERSON_VIEW = Authorizator.createAction(Resources.person, 'view')\n\texport const PERSON_LIST = Authorizator.createAction(Resources.person, 'list')\n\texport const PERSON_SIGN_IN = Authorizator.createAction(Resources.person, 'signIn')\n\texport const PERSON_SIGN_UP = (requestedRoles?: readonly string[]) => Authorizator.createAction(Resources.person, 'signUp', { requestedRoles })\n\texport const PERSON_SIGN_OUT = Authorizator.createAction(Resources.person, 'signOut')\n\texport const PERSON_SETUP_OTP = Authorizator.createAction(Resources.person, 'setupOtp')\n\texport const PERSON_CHANGE_PROFILE = (target: TargetIdentityPermissionTarget \| null, fields: readonly ProfileField[]) =>\n\t\tAuthorizator.createAction(Resources.person, 'changeProfile', { target, fields })\n\texport const PERSON_CHANGE_MY_PROFILE = Authorizator.createAction(Resources.person, 'changeMyProfile')\n\texport const PERSON_TOGGLE_PASSWORDLESS = Authorizator.createAction(Resources.person, 'togglePasswordless')\n\texport const PERSON_CHANGE_PASSWORD = (target: TargetIdentityPermissionTarget \| null) =>\n\t\tAuthorizator.createAction(Resources.person, 'changePassword', { target })\n\texport const PERSON_CHANGE_MY_PASSWORD = Authorizator.createAction(Resources.person, 'changeMyPassword')\n\texport const PERSON_RESET_PASSWORD = Authorizator.createAction(Resources.person, 'resetPassword')\n\texport const PERSON_CREATE_IDP_URL = Authorizator.createAction(Resources.person, 'createIdPUrl')\n\texport const PERSON_SIGN_IN_IDP = Authorizator.createAction(Resources.person, 'signInIdp')\n\texport const PERSON_VIEW_IDP = (target: TargetIdentityPermissionTarget \| null) => Authorizator.createAction(Resources.person, 'viewIdp', { target })\n\texport const PERSON_DISCONNECT_MY_IDP = Authorizator.createAction(Resources.person, 'disconnectMyIdp')\n\texport const PERSON_REQUEST_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'requestPasswordlessSignIn')\n\texport const PERSON_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'passwordlessSignIn')\n\texport const PERSON_CREATE_SESSION_KEY = (meta: CreateSessionTokenPermissionMeta) =>\n\t\tAuthorizator.createAction(Resources.person, 'createSessionToken', meta)\n\n\texport const PERSON_INVITE = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.person, 'invite', { memberships })\n\texport const PERSON_INVITE_UNMANAGED = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.person, 'invite_unmanaged', { memberships })\n\n\texport const PROJECT_VIEW = Authorizator.createAction(Resources.project, 'view')\n\texport const PROJECT_SET_SECRET = Authorizator.createAction(Resources.project, 'setSecret')\n\texport const PROJECT_VIEW_SECRETS = Authorizator.createAction(Resources.project, 'viewSecrets')\n\texport const PROJECT_UPDATE = Authorizator.createAction(Resources.project, 'update')\n\n\texport const PROJECT_CREATE = Authorizator.createAction(Resources.project, 'create')\n\texport const ENTRYPOINT_DEPLOY = Authorizator.createAction(Resources.entrypoint, 'deployEntrypoint')\n\n\texport const PROJECT_VIEW_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'viewMembers', { memberships })\n\texport const PROJECT_ADD_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'addMember', { memberships })\n\texport const PROJECT_REMOVE_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'removeMember', { memberships })\n\texport const PROJECT_UPDATE_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'updateMember', { memberships })\n\n\texport const API_KEY_CREATE = (meta?: ApiKeyPermissionMeta) => Authorizator.createAction(Resources.apiKey, 'create', meta)\n\texport const API_KEY_CREATE_GLOBAL = (meta?: GlobalApiKeyPermissionMeta) => Authorizator.createAction(Resources.apiKey, 'createGlobal', meta)\n\texport const API_KEY_DISABLE = Authorizator.createAction(Resources.apiKey, 'disable')\n\texport const API_KEY_LIST = Authorizator.createAction(Resources.apiKey, 'list')\n\n\t// meta is optional only so a grant can be registered without one — `Permissions.allow`\n\t// keys on resource + privilege and never reads it. Every check site passes it.\n\texport const MAIL_TEMPLATE_ADD = (meta?: MailTemplatePermissionMeta) => Authorizator.createAction(Resources.mailTemplate, 'add', meta)\n\texport const MAIL_TEMPLATE_REMOVE = (meta?: MailTemplatePermissionMeta) => Authorizator.createAction(Resources.mailTemplate, 'remove', meta)\n\texport const MAIL_TEMPLATE_LIST = (meta?: MailTemplatePermissionMeta) => Authorizator.createAction(Resources.mailTemplate, 'list', meta)\n\n\texport const IDP_ADD = Authorizator.createAction(Resources.idp, 'add')\n\texport const IDP_UPDATE = Authorizator.createAction(Resources.idp, 'update')\n\texport const IDP_DISABLE = Authorizator.createAction(Resources.idp, 'disable')\n\texport const IDP_ENABLE = Authorizator.createAction(Resources.idp, 'enable')\n\texport const IDP_LIST = Authorizator.createAction(Resources.idp, 'list')\n\n\texport const CUSTOM_ROLE_MANAGE = Authorizator.createAction(Resources.customRole, 'manage')\n\texport const CUSTOM_ROLE_VIEW = Authorizator.createAction(Resources.customRole, 'view')\n}\n\nexport { PermissionActions }\n"],"names":["PermissionActions","Resources"],"mappings":";AA+CA,IAAU;AAAA,CAAV,CAAUA,uBAAV;AACQ,GAAA,CAAKC,eAAL;AACNA,eAAA,QAAA,IAAS;AACTA,eAAA,YAAA,IAAa;AACbA,eAAA,QAAA,IAAS;AACTA,eAAA,UAAA,IAAW;AACXA,eAAA,SAAA,IAAU;AACVA,eAAA,QAAA,IAAS;AACTA,eAAA,cAAA,IAAe;AACfA,eAAA,KAAA,IAAM;AACNA,eAAA,YAAA,IAAa;AAAA,EAAA,GATFD,mBAAA,cAAAA,mBAAA,YAAA,CAAA,EAAA;AAYCA,qBAAA,YAAY,aAAa,aAAa,UAAkB,WAAW;AACnEA,qBAAA,cAAc,aAAa,aAAa,UAAkB,YAAY;AACtEA,qBAAA,gBAAgB,aAAa,aAAa,UAAkB,aAAa;AAEzEA,qBAAA,4BAA4B,aAAa,aAAa,YAAoB,iBAAiB;AAC3FA,qBAAA,4BAA4B,CAAC,SACzC,aAAa,aAAa,YAAoB,kBAAkB,IAAI;AACxDA,qBAAA,+BAA+B,CAAC,SAC5C,aAAa,aAAa,YAAoB,qBAAqB,IAAI;AAE3DA,qBAAA,iBAAiB,CAAC,WAAkD,aAAa,aAAa,UAAkB,WAAW,EAAE,QAAQ;AACrIA,qBAAA,wBAAwB,CAAC,WACrC,aAAa,aAAa,UAAkB,gBAAgB,EAAE,QAAQ;AAC1DA,qBAAA,mBAAmB,CAAC,WAChC,aAAa,aAAa,UAAkB,YAAY,EAAE,QAAQ;AACtDA,qBAAA,wBAAwB,aAAa,aAAa,UAAkB,eAAe;AACnFA,qBAAA,uBAAuB,CAAC,WACpC,aAAa,aAAa,UAAkB,gBAAgB,EAAE,QAAQ;AAE1DA,qBAAA,cAAc,aAAa,aAAa,UAAkB,MAAM;AAChEA,qBAAA,cAAc,aAAa,aAAa,UAAkB,MAAM;AAChEA,qBAAA,iBAAiB,aAAa,aAAa,UAAkB,QAAQ;AACrEA,qBAAA,iBAAiB,CAAC,mBAAuC,aAAa,aAAa,UAAkB,UAAU,EAAE,gBAAgB;AACjIA,qBAAA,kBAAkB,aAAa,aAAa,UAAkB,SAAS;AACvEA,qBAAA,mBAAmB,aAAa,aAAa,UAAkB,UAAU;AACzEA,qBAAA,wBAAwB,CAAC,QAA+C,WACpF,aAAa,aAAa,UAAkB,iBAAiB,EAAE,QAAQ,OAAA,CAAQ;AACnEA,qBAAA,2BAA2B,aAAa,aAAa,UAAkB,iBAAiB;AACxFA,qBAAA,6BAA6B,aAAa,aAAa,UAAkB,oBAAoB;AAC7FA,qBAAA,yBAAyB,CAAC,WACtC,aAAa,aAAa,UAAkB,kBAAkB,EAAE,QAAQ;AAC5DA,qBAAA,4BAA4B,aAAa,aAAa,UAAkB,kBAAkB;AAC1FA,qBAAA,wBAAwB,aAAa,aAAa,UAAkB,eAAe;AACnFA,qBAAA,wBAAwB,aAAa,aAAa,UAAkB,cAAc;AAClFA,qBAAA,qBAAqB,aAAa,aAAa,UAAkB,WAAW;AAC5EA,qBAAA,kBAAkB,CAAC,WAAkD,aAAa,aAAa,UAAkB,WAAW,EAAE,QAAQ;AACtIA,qBAAA,2BAA2B,aAAa,aAAa,UAAkB,iBAAiB;AACxFA,qBAAA,sCAAsC,aAAa,aAAa,UAAkB,2BAA2B;AAC7GA,qBAAA,8BAA8B,aAAa,aAAa,UAAkB,oBAAoB;AAC9FA,qBAAA,4BAA4B,CAAC,SACzC,aAAa,aAAa,UAAkB,sBAAsB,IAAI;AAE1DA,qBAAA,gBAAgB,CAAC,gBAA2C,aAAa,aAAa,UAAkB,UAAU,EAAE,aAAa;AACjIA,qBAAA,0BAA0B,CAAC,gBACvC,aAAa,aAAa,UAAkB,oBAAoB,EAAE,aAAa;AAEnEA,qBAAA,eAAe,aAAa,aAAa,WAAmB,MAAM;AAClEA,qBAAA,qBAAqB,aAAa,aAAa,WAAmB,WAAW;AAC7EA,qBAAA,uBAAuB,aAAa,aAAa,WAAmB,aAAa;AACjFA,qBAAA,iBAAiB,aAAa,aAAa,WAAmB,QAAQ;AAEtEA,qBAAA,iBAAiB,aAAa,aAAa,WAAmB,QAAQ;AACtEA,qBAAA,oBAAoB,aAAa,aAAa,cAAsB,kBAAkB;AAEtFA,qBAAA,sBAAsB,CAAC,gBACnC,aAAa,aAAa,WAAmB,eAAe,EAAE,aAAa;AAC/DA,qBAAA,qBAAqB,CAAC,gBAClC,aAAa,aAAa,WAAmB,aAAa,EAAE,aAAa;AAC7DA,qBAAA,wBAAwB,CAAC,gBACrC,aAAa,aAAa,WAAmB,gBAAgB,EAAE,aAAa;AAChEA,qBAAA,wBAAwB,CAAC,gBACrC,aAAa,aAAa,WAAmB,gBAAgB,EAAE,aAAa;AAEhEA,qBAAA,iBAAiB,CAAC,SAAgC,aAAa,aAAa,UAAkB,UAAU,IAAI;AAC5GA,qBAAA,wBAAwB,CAAC,SAAsC,aAAa,aAAa,UAAkB,gBAAgB,IAAI;AAC/HA,qBAAA,kBAAkB,aAAa,aAAa,UAAkB,SAAS;AACvEA,qBAAA,eAAe,aAAa,aAAa,UAAkB,MAAM;AAIjEA,qBAAA,oBAAoB,CAAC,SAAsC,aAAa,aAAa,gBAAwB,OAAO,IAAI;AACxHA,qBAAA,uBAAuB,CAAC,SAAsC,aAAa,aAAa,gBAAwB,UAAU,IAAI;AAC9HA,qBAAA,qBAAqB,CAAC,SAAsC,aAAa,aAAa,gBAAwB,QAAQ,IAAI;AAE1HA,qBAAA,UAAU,aAAa,aAAa,OAAe,KAAK;AACxDA,qBAAA,aAAa,aAAa,aAAa,OAAe,QAAQ;AAC9DA,qBAAA,cAAc,aAAa,aAAa,OAAe,SAAS;AAChEA,qBAAA,aAAa,aAAa,aAAa,OAAe,QAAQ;AAC9DA,qBAAA,WAAW,aAAa,aAAa,OAAe,MAAM;AAE1DA,qBAAA,qBAAqB,aAAa,aAAa,cAAsB,QAAQ;AAC7EA,qBAAA,mBAAmB,aAAa,aAAa,cAAsB,MAAM;AAAA,GA9F7E,sBAAA,oBAAA,CAAA,EAAA;"}

package/dist/production/src/model/authorization/PermissionContext.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"PermissionContext.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionContext.ts"],"sourcesContent":["import { AccessNode, AuthorizationScope, Authorizator } from '@contember/authorization'\nimport { ForbiddenError } from '@contember/graphql-utils'\nimport { ProjectScopeFactory } from './ProjectScopeFactory'\nimport { Project, ProjectSchemaResolver } from '../type'\nimport { Identity } from './Identity'\n\nexport type AccessVerifier = (action: Authorizator.Action) => Promise<boolean>\n\nconst deniedScope = new AuthorizationScope.Fixed(AccessNode.Fixed.denied())\n\nexport class PermissionContext {\n\tprivate projectScopes: Record<string, AuthorizationScope<Identity>> = {}\n\n\tconstructor(\n\t\tpublic readonly identity: Identity,\n\t\tpublic readonly authorizator: Authorizator<Identity>,\n\t\tprivate readonly projectScopeFactory: ProjectScopeFactory,\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tpublic async isAllowed<Meta extends {} \| undefined>({\n\t\tscope,\n\t\taction,\n\t}: {\n\t\tscope?: AuthorizationScope<Identity>\n\t\taction: Authorizator.Action<Meta>\n\t}): Promise<boolean> {\n\t\treturn await this.authorizator.isAllowed(this.identity, scope \|\| new AuthorizationScope.Global(), action)\n\t}\n\n\tpublic createAccessVerifier(scope: AuthorizationScope<Identity>): AccessVerifier {\n\t\treturn action => this.isAllowed({ scope, action })\n\t}\n\n\tpublic async requireAccess<Meta extends {} \| undefined>({\n\t\tscope,\n\t\taction,\n\t\tmessage,\n\t}: {\n\t\tscope?: AuthorizationScope<Identity>\n\t\taction: Authorizator.Action<Meta>\n\t\tmessage?: string\n\t}): Promise<void> {\n\t\tif (!(await this.isAllowed({ scope, action }))) {\n\t\t\tthrow new ForbiddenError(message \|\| 'Forbidden')\n\t\t}\n\t}\n\n\tpublic async createProjectScope(project: Pick<Project, 'slug'> \| null): Promise<AuthorizationScope<Identity>> {\n\t\tif (!project) {\n\t\t\treturn deniedScope\n\t\t}\n\t\tif (!this.projectScopes[project.slug]) {\n\t\t\tthis.projectScopes[project.slug] = (await this.projectScopeFactory.create(this.schemaResolver, project)) \|\| deniedScope\n\t\t}\n\t\treturn this.projectScopes[project.slug]\n\t}\n}\n"],"names":["AuthorizationScope","AccessNode","ForbiddenError"],"mappings":";;;;;;;AAQA,MAAM,cAAc,IAAIA,cAAAA,mBAAmB,MAAMC,cAAAA,WAAW,MAAM,QAAQ;AAEnE,MAAM,kBAAkB;AAAA,EAG9B,YACiB,UACA,cACC,qBACA,gBAChB;AAJe,SAAA,WAAA;AACA,SAAA,eAAA;AACC,SAAA,sBAAA;AACA,SAAA,iBAAA;AANlB,kBAAA,MAAQ,iBAA8D,EAAC;AAAA,EAOpE;AAAA,EAEH,MAAa,UAAuC;AAAA,IACnD;AAAA,IACA;AAAA,EAAA,GAIoB;AACpB,WAAO,MAAM,KAAK,aAAa,UAAU,KAAK,UAAU,SAAS,IAAID,cAAAA,mBAAmB,OAAA,GAAU,MAAM;AAAA,EACzG;AAAA,EAEO,qBAAqB,OAAqD;AAChF,WAAO,YAAU,KAAK,UAAU,EAAE,OAAO,QAAQ;AAAA,EAClD;AAAA,EAEA,MAAa,cAA2C;AAAA,IACvD;AAAA,IACA;AAAA,IACA;AAAA,EAAA,GAKiB;AACjB,QAAI,CAAE,MAAM,KAAK,UAAU,EAAE,OAAO,OAAA,CAAQ,GAAI;AAC/C,YAAM,IAAIE,aAAAA,eAAe,WAAW,WAAW;AAAA,IAChD;AAAA,EACD;AAAA,EAEA,MAAa,mBAAmB,SAA8E;AAC7G,QAAI,CAAC,SAAS;AACb,aAAO;AAAA,IACR;AACA,QAAI,CAAC,KAAK,cAAc,QAAQ,IAAI,GAAG;AACtC,WAAK,cAAc,QAAQ,IAAI,IAAK,MAAM,KAAK,oBAAoB,OAAO,KAAK,gBAAgB,OAAO,KAAM;AAAA,IAC7G;AACA,WAAO,KAAK,cAAc,QAAQ,IAAI;AAAA,EACvC;AACD;;"}
1	+ {"version":3,"file":"PermissionContext.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionContext.ts"],"sourcesContent":["import { AccessNode, AuthorizationScope, Authorizator } from '@contember/authorization'\nimport { ForbiddenError } from '@contember/graphql-utils'\nimport { ProjectScopeFactory } from './ProjectScopeFactory.js'\nimport { Project, ProjectSchemaResolver } from '../type/index.js'\nimport { Identity } from './Identity.js'\n\nexport type AccessVerifier = (action: Authorizator.Action) => Promise<boolean>\n\nconst deniedScope = new AuthorizationScope.Fixed(AccessNode.Fixed.denied())\n\nexport class PermissionContext {\n\tprivate projectScopes: Record<string, AuthorizationScope<Identity>> = {}\n\n\tconstructor(\n\t\tpublic readonly identity: Identity,\n\t\tpublic readonly authorizator: Authorizator<Identity>,\n\t\tprivate readonly projectScopeFactory: ProjectScopeFactory,\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tpublic async isAllowed<Meta extends {} \| undefined>({\n\t\tscope,\n\t\taction,\n\t}: {\n\t\tscope?: AuthorizationScope<Identity>\n\t\taction: Authorizator.Action<Meta>\n\t}): Promise<boolean> {\n\t\treturn await this.authorizator.isAllowed(this.identity, scope \|\| new AuthorizationScope.Global(), action)\n\t}\n\n\tpublic createAccessVerifier(scope: AuthorizationScope<Identity>): AccessVerifier {\n\t\treturn action => this.isAllowed({ scope, action })\n\t}\n\n\tpublic async requireAccess<Meta extends {} \| undefined>({\n\t\tscope,\n\t\taction,\n\t\tmessage,\n\t}: {\n\t\tscope?: AuthorizationScope<Identity>\n\t\taction: Authorizator.Action<Meta>\n\t\tmessage?: string\n\t}): Promise<void> {\n\t\tif (!(await this.isAllowed({ scope, action }))) {\n\t\t\tthrow new ForbiddenError(message \|\| 'Forbidden')\n\t\t}\n\t}\n\n\tpublic async createProjectScope(project: Pick<Project, 'slug'> \| null): Promise<AuthorizationScope<Identity>> {\n\t\tif (!project) {\n\t\t\treturn deniedScope\n\t\t}\n\t\tif (!this.projectScopes[project.slug]) {\n\t\t\tthis.projectScopes[project.slug] = (await this.projectScopeFactory.create(this.schemaResolver, project)) \|\| deniedScope\n\t\t}\n\t\treturn this.projectScopes[project.slug]\n\t}\n}\n"],"names":["AuthorizationScope","AccessNode","ForbiddenError"],"mappings":";;;;;;;AAQA,MAAM,cAAc,IAAIA,cAAAA,mBAAmB,MAAMC,cAAAA,WAAW,MAAM,QAAQ;AAEnE,MAAM,kBAAkB;AAAA,EAG9B,YACiB,UACA,cACC,qBACA,gBAChB;AAJe,SAAA,WAAA;AACA,SAAA,eAAA;AACC,SAAA,sBAAA;AACA,SAAA,iBAAA;AANlB,kBAAA,MAAQ,iBAA8D,EAAC;AAAA,EAOpE;AAAA,EAEH,MAAa,UAAuC;AAAA,IACnD;AAAA,IACA;AAAA,EAAA,GAIoB;AACpB,WAAO,MAAM,KAAK,aAAa,UAAU,KAAK,UAAU,SAAS,IAAID,cAAAA,mBAAmB,OAAA,GAAU,MAAM;AAAA,EACzG;AAAA,EAEO,qBAAqB,OAAqD;AAChF,WAAO,YAAU,KAAK,UAAU,EAAE,OAAO,QAAQ;AAAA,EAClD;AAAA,EAEA,MAAa,cAA2C;AAAA,IACvD;AAAA,IACA;AAAA,IACA;AAAA,EAAA,GAKiB;AACjB,QAAI,CAAE,MAAM,KAAK,UAAU,EAAE,OAAO,OAAA,CAAQ,GAAI;AAC/C,YAAM,IAAIE,aAAAA,eAAe,WAAW,WAAW;AAAA,IAChD;AAAA,EACD;AAAA,EAEA,MAAa,mBAAmB,SAA8E;AAC7G,QAAI,CAAC,SAAS;AACb,aAAO;AAAA,IACR;AACA,QAAI,CAAC,KAAK,cAAc,QAAQ,IAAI,GAAG;AACtC,WAAK,cAAc,QAAQ,IAAI,IAAK,MAAM,KAAK,oBAAoB,OAAO,KAAK,gBAAgB,OAAO,KAAM;AAAA,IAC7G;AACA,WAAO,KAAK,cAAc,QAAQ,IAAI;AAAA,EACvC;AACD;;"}

package/dist/production/src/model/authorization/PermissionContext.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"PermissionContext.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionContext.ts"],"sourcesContent":["import { AccessNode, AuthorizationScope, Authorizator } from '@contember/authorization'\nimport { ForbiddenError } from '@contember/graphql-utils'\nimport { ProjectScopeFactory } from './ProjectScopeFactory'\nimport { Project, ProjectSchemaResolver } from '../type'\nimport { Identity } from './Identity'\n\nexport type AccessVerifier = (action: Authorizator.Action) => Promise<boolean>\n\nconst deniedScope = new AuthorizationScope.Fixed(AccessNode.Fixed.denied())\n\nexport class PermissionContext {\n\tprivate projectScopes: Record<string, AuthorizationScope<Identity>> = {}\n\n\tconstructor(\n\t\tpublic readonly identity: Identity,\n\t\tpublic readonly authorizator: Authorizator<Identity>,\n\t\tprivate readonly projectScopeFactory: ProjectScopeFactory,\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tpublic async isAllowed<Meta extends {} \| undefined>({\n\t\tscope,\n\t\taction,\n\t}: {\n\t\tscope?: AuthorizationScope<Identity>\n\t\taction: Authorizator.Action<Meta>\n\t}): Promise<boolean> {\n\t\treturn await this.authorizator.isAllowed(this.identity, scope \|\| new AuthorizationScope.Global(), action)\n\t}\n\n\tpublic createAccessVerifier(scope: AuthorizationScope<Identity>): AccessVerifier {\n\t\treturn action => this.isAllowed({ scope, action })\n\t}\n\n\tpublic async requireAccess<Meta extends {} \| undefined>({\n\t\tscope,\n\t\taction,\n\t\tmessage,\n\t}: {\n\t\tscope?: AuthorizationScope<Identity>\n\t\taction: Authorizator.Action<Meta>\n\t\tmessage?: string\n\t}): Promise<void> {\n\t\tif (!(await this.isAllowed({ scope, action }))) {\n\t\t\tthrow new ForbiddenError(message \|\| 'Forbidden')\n\t\t}\n\t}\n\n\tpublic async createProjectScope(project: Pick<Project, 'slug'> \| null): Promise<AuthorizationScope<Identity>> {\n\t\tif (!project) {\n\t\t\treturn deniedScope\n\t\t}\n\t\tif (!this.projectScopes[project.slug]) {\n\t\t\tthis.projectScopes[project.slug] = (await this.projectScopeFactory.create(this.schemaResolver, project)) \|\| deniedScope\n\t\t}\n\t\treturn this.projectScopes[project.slug]\n\t}\n}\n"],"names":[],"mappings":";;;;;AAQA,MAAM,cAAc,IAAI,mBAAmB,MAAM,WAAW,MAAM,QAAQ;AAEnE,MAAM,kBAAkB;AAAA,EAG9B,YACiB,UACA,cACC,qBACA,gBAChB;AAJe,SAAA,WAAA;AACA,SAAA,eAAA;AACC,SAAA,sBAAA;AACA,SAAA,iBAAA;AANlB,kBAAA,MAAQ,iBAA8D,EAAC;AAAA,EAOpE;AAAA,EAEH,MAAa,UAAuC;AAAA,IACnD;AAAA,IACA;AAAA,EAAA,GAIoB;AACpB,WAAO,MAAM,KAAK,aAAa,UAAU,KAAK,UAAU,SAAS,IAAI,mBAAmB,OAAA,GAAU,MAAM;AAAA,EACzG;AAAA,EAEO,qBAAqB,OAAqD;AAChF,WAAO,YAAU,KAAK,UAAU,EAAE,OAAO,QAAQ;AAAA,EAClD;AAAA,EAEA,MAAa,cAA2C;AAAA,IACvD;AAAA,IACA;AAAA,IACA;AAAA,EAAA,GAKiB;AACjB,QAAI,CAAE,MAAM,KAAK,UAAU,EAAE,OAAO,OAAA,CAAQ,GAAI;AAC/C,YAAM,IAAI,eAAe,WAAW,WAAW;AAAA,IAChD;AAAA,EACD;AAAA,EAEA,MAAa,mBAAmB,SAA8E;AAC7G,QAAI,CAAC,SAAS;AACb,aAAO;AAAA,IACR;AACA,QAAI,CAAC,KAAK,cAAc,QAAQ,IAAI,GAAG;AACtC,WAAK,cAAc,QAAQ,IAAI,IAAK,MAAM,KAAK,oBAAoB,OAAO,KAAK,gBAAgB,OAAO,KAAM;AAAA,IAC7G;AACA,WAAO,KAAK,cAAc,QAAQ,IAAI;AAAA,EACvC;AACD;"}
1	+ {"version":3,"file":"PermissionContext.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionContext.ts"],"sourcesContent":["import { AccessNode, AuthorizationScope, Authorizator } from '@contember/authorization'\nimport { ForbiddenError } from '@contember/graphql-utils'\nimport { ProjectScopeFactory } from './ProjectScopeFactory.js'\nimport { Project, ProjectSchemaResolver } from '../type/index.js'\nimport { Identity } from './Identity.js'\n\nexport type AccessVerifier = (action: Authorizator.Action) => Promise<boolean>\n\nconst deniedScope = new AuthorizationScope.Fixed(AccessNode.Fixed.denied())\n\nexport class PermissionContext {\n\tprivate projectScopes: Record<string, AuthorizationScope<Identity>> = {}\n\n\tconstructor(\n\t\tpublic readonly identity: Identity,\n\t\tpublic readonly authorizator: Authorizator<Identity>,\n\t\tprivate readonly projectScopeFactory: ProjectScopeFactory,\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tpublic async isAllowed<Meta extends {} \| undefined>({\n\t\tscope,\n\t\taction,\n\t}: {\n\t\tscope?: AuthorizationScope<Identity>\n\t\taction: Authorizator.Action<Meta>\n\t}): Promise<boolean> {\n\t\treturn await this.authorizator.isAllowed(this.identity, scope \|\| new AuthorizationScope.Global(), action)\n\t}\n\n\tpublic createAccessVerifier(scope: AuthorizationScope<Identity>): AccessVerifier {\n\t\treturn action => this.isAllowed({ scope, action })\n\t}\n\n\tpublic async requireAccess<Meta extends {} \| undefined>({\n\t\tscope,\n\t\taction,\n\t\tmessage,\n\t}: {\n\t\tscope?: AuthorizationScope<Identity>\n\t\taction: Authorizator.Action<Meta>\n\t\tmessage?: string\n\t}): Promise<void> {\n\t\tif (!(await this.isAllowed({ scope, action }))) {\n\t\t\tthrow new ForbiddenError(message \|\| 'Forbidden')\n\t\t}\n\t}\n\n\tpublic async createProjectScope(project: Pick<Project, 'slug'> \| null): Promise<AuthorizationScope<Identity>> {\n\t\tif (!project) {\n\t\t\treturn deniedScope\n\t\t}\n\t\tif (!this.projectScopes[project.slug]) {\n\t\t\tthis.projectScopes[project.slug] = (await this.projectScopeFactory.create(this.schemaResolver, project)) \|\| deniedScope\n\t\t}\n\t\treturn this.projectScopes[project.slug]\n\t}\n}\n"],"names":[],"mappings":";;;;;AAQA,MAAM,cAAc,IAAI,mBAAmB,MAAM,WAAW,MAAM,QAAQ;AAEnE,MAAM,kBAAkB;AAAA,EAG9B,YACiB,UACA,cACC,qBACA,gBAChB;AAJe,SAAA,WAAA;AACA,SAAA,eAAA;AACC,SAAA,sBAAA;AACA,SAAA,iBAAA;AANlB,kBAAA,MAAQ,iBAA8D,EAAC;AAAA,EAOpE;AAAA,EAEH,MAAa,UAAuC;AAAA,IACnD;AAAA,IACA;AAAA,EAAA,GAIoB;AACpB,WAAO,MAAM,KAAK,aAAa,UAAU,KAAK,UAAU,SAAS,IAAI,mBAAmB,OAAA,GAAU,MAAM;AAAA,EACzG;AAAA,EAEO,qBAAqB,OAAqD;AAChF,WAAO,YAAU,KAAK,UAAU,EAAE,OAAO,QAAQ;AAAA,EAClD;AAAA,EAEA,MAAa,cAA2C;AAAA,IACvD;AAAA,IACA;AAAA,IACA;AAAA,EAAA,GAKiB;AACjB,QAAI,CAAE,MAAM,KAAK,UAAU,EAAE,OAAO,OAAA,CAAQ,GAAI;AAC/C,YAAM,IAAI,eAAe,WAAW,WAAW;AAAA,IAChD;AAAA,EACD;AAAA,EAEA,MAAa,mBAAmB,SAA8E;AAC7G,QAAI,CAAC,SAAS;AACb,aAAO;AAAA,IACR;AACA,QAAI,CAAC,KAAK,cAAc,QAAQ,IAAI,GAAG;AACtC,WAAK,cAAc,QAAQ,IAAI,IAAK,MAAM,KAAK,oBAAoB,OAAO,KAAK,gBAAgB,OAAO,KAAM;AAAA,IAC7G;AACA,WAAO,KAAK,cAAc,QAAQ,IAAI;AAAA,EACvC;AACD;"}

package/dist/production/src/model/authorization/PermissionContextFactory.cjs CHANGED Viewed

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionContext = require("./PermissionContext.cjs");
+const CustomRoleAuthorizator = require("./CustomRoleAuthorizator.cjs");
 class PermissionContextFactory {
   constructor(authorizator, identityFactory, projectScopeFactory, schemaResolver) {
     this.authorizator = authorizator;
@@ -8,9 +9,26 @@ class PermissionContextFactory {
     this.projectScopeFactory = projectScopeFactory;
     this.schemaResolver = schemaResolver;
   }
-  create(db, args) {
+  create(db, args, requestAuthorizator) {
+    const authorizator = this.createAuthorizator(db, requestAuthorizator);
+    return this.buildContext(db, args, authorizator);
+  }
+  /**
+   * Same as `create`, but resolves the custom-role definitions before returning, so
+   * the request never has to query for them while holding a transaction open.
+   */
+  async createPreloaded(db, args, requestAuthorizator) {
+    const authorizator = this.createAuthorizator(db, requestAuthorizator);
+    await authorizator.preload(args.roles);
+    return this.buildContext(db, args, authorizator);
+  }
+  createAuthorizator(db, requestAuthorizator) {
+    const customRoleCache = requestAuthorizator instanceof CustomRoleAuthorizator.CustomRoleAuthorizator ? requestAuthorizator.customRoleCache : void 0;
+    return new CustomRoleAuthorizator.CustomRoleAuthorizator(this.authorizator, db, customRoleCache);
+  }
+  buildContext(db, args, authorizator) {
     const identity = this.identityFactory.create(db, args);
-    return new PermissionContext.PermissionContext(identity, this.authorizator, this.projectScopeFactory, this.schemaResolver);
+    return new PermissionContext.PermissionContext(identity, authorizator, this.projectScopeFactory, this.schemaResolver);
   }
 }
 exports.PermissionContextFactory = PermissionContextFactory;

package/dist/production/src/model/authorization/PermissionContextFactory.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"PermissionContextFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionContextFactory.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { IdentityFactory } from './IdentityFactory'\nimport { PermissionContext } from './PermissionContext'\nimport { ProjectScopeFactory } from './ProjectScopeFactory'\nimport { ProjectSchemaResolver } from '../type'\nimport { DatabaseContext } from '../utils'\n\nexport class PermissionContextFactory {\n\tconstructor(\n\t\tprivate readonly authorizator: Authorizator,\n\t\tprivate readonly identityFactory: IdentityFactory,\n\t\tprivate readonly projectScopeFactory: ProjectScopeFactory,\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tpublic create(db: DatabaseContext, args: { id: string; roles: readonly string[] }): PermissionContext {\n\t\tconst identity = this.identityFactory.create(db, args)\n\t\treturn new PermissionContext(identity, ~~this.~~authorizator, this.projectScopeFactory, this.schemaResolver)\n\t}\n}\n"],"names":["PermissionContext"],"mappings":"~~;;;AAOO~~,MAAM,yBAAyB;AAAA,EACrC,YACkB,cACA,iBACA,qBACA,gBAChB;AAJgB,SAAA,eAAA;AACA,SAAA,kBAAA;AACA,SAAA,sBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEI,~~OAAO~~,IAAqB,~~MAAmE~~;~~AACrG~~,UAAM,WAAW,KAAK,gBAAgB,OAAO,IAAI,IAAI;AACrD,WAAO,~~IAAIA~~,kBAAAA,kBAAkB,UAAU,~~KAAK,~~cAAc,KAAK,qBAAqB,KAAK,cAAc;AAAA,~~EACxG~~;AACD;;"}
1	+ {"version":3,"file":"PermissionContextFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionContextFactory.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { IdentityFactory } from './IdentityFactory.js'\nimport { PermissionContext } from './PermissionContext.js'\nimport { ProjectScopeFactory } from './ProjectScopeFactory.js'\nimport { ProjectSchemaResolver } from '../type/index.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { CustomRoleAuthorizator } from './CustomRoleAuthorizator.js'\nimport { Identity } from './Identity.js'\n\nexport class PermissionContextFactory {\n\tconstructor(\n\t\tprivate readonly authorizator: Authorizator<Identity>,\n\t\tprivate readonly identityFactory: IdentityFactory,\n\t\tprivate readonly projectScopeFactory: ProjectScopeFactory,\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tpublic create(\n\t\tdb: DatabaseContext,\n\t\targs: { id: string; roles: readonly string[] },\n\t\trequestAuthorizator?: Authorizator<Identity>,\n\t): PermissionContext {\n\t\tconst authorizator = this.createAuthorizator(db, requestAuthorizator)\n\t\treturn this.buildContext(db, args, authorizator)\n\t}\n\n\t/*\n\t Same as `create`, but resolves the custom-role definitions before returning, so\n\t * the request never has to query for them while holding a transaction open.\n\t */\n\tpublic async createPreloaded(\n\t\tdb: DatabaseContext,\n\t\targs: { id: string; roles: readonly string[] },\n\t\trequestAuthorizator?: Authorizator<Identity>,\n\t): Promise<PermissionContext> {\n\t\tconst authorizator = this.createAuthorizator(db, requestAuthorizator)\n\t\tawait authorizator.preload(args.roles)\n\t\treturn this.buildContext(db, args, authorizator)\n\t}\n\n\tprivate createAuthorizator(db: DatabaseContext, requestAuthorizator?: Authorizator<Identity>): CustomRoleAuthorizator {\n\t\tconst customRoleCache = requestAuthorizator instanceof CustomRoleAuthorizator\n\t\t\t? requestAuthorizator.customRoleCache\n\t\t\t: undefined\n\t\treturn new CustomRoleAuthorizator(this.authorizator, db, customRoleCache)\n\t}\n\n\tprivate buildContext(\n\t\tdb: DatabaseContext,\n\t\targs: { id: string; roles: readonly string[] },\n\t\tauthorizator: CustomRoleAuthorizator,\n\t): PermissionContext {\n\t\tconst identity = this.identityFactory.create(db, args)\n\t\treturn new PermissionContext(identity, authorizator, this.projectScopeFactory, this.schemaResolver)\n\t}\n}\n"],"names":["CustomRoleAuthorizator","PermissionContext"],"mappings":";;;;AASO,MAAM,yBAAyB;AAAA,EACrC,YACkB,cACA,iBACA,qBACA,gBAChB;AAJgB,SAAA,eAAA;AACA,SAAA,kBAAA;AACA,SAAA,sBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEI,OACN,IACA,MACA,qBACoB;AACpB,UAAM,eAAe,KAAK,mBAAmB,IAAI,mBAAmB;AACpE,WAAO,KAAK,aAAa,IAAI,MAAM,YAAY;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,gBACZ,IACA,MACA,qBAC6B;AAC7B,UAAM,eAAe,KAAK,mBAAmB,IAAI,mBAAmB;AACpE,UAAM,aAAa,QAAQ,KAAK,KAAK;AACrC,WAAO,KAAK,aAAa,IAAI,MAAM,YAAY;AAAA,EAChD;AAAA,EAEQ,mBAAmB,IAAqB,qBAAsE;AACrH,UAAM,kBAAkB,+BAA+BA,uBAAAA,yBACpD,oBAAoB,kBACpB;AACH,WAAO,IAAIA,uBAAAA,uBAAuB,KAAK,cAAc,IAAI,eAAe;AAAA,EACzE;AAAA,EAEQ,aACP,IACA,MACA,cACoB;AACpB,UAAM,WAAW,KAAK,gBAAgB,OAAO,IAAI,IAAI;AACrD,WAAO,IAAIC,kBAAAA,kBAAkB,UAAU,cAAc,KAAK,qBAAqB,KAAK,cAAc;AAAA,EACnG;AACD;;"}

package/dist/production/src/model/authorization/PermissionContextFactory.js CHANGED Viewed

@@ -1,4 +1,5 @@
 import { PermissionContext } from "./PermissionContext.js";
+import { CustomRoleAuthorizator } from "./CustomRoleAuthorizator.js";
 class PermissionContextFactory {
   constructor(authorizator, identityFactory, projectScopeFactory, schemaResolver) {
     this.authorizator = authorizator;
@@ -6,9 +7,26 @@ class PermissionContextFactory {
     this.projectScopeFactory = projectScopeFactory;
     this.schemaResolver = schemaResolver;
   }
-  create(db, args) {
+  create(db, args, requestAuthorizator) {
+    const authorizator = this.createAuthorizator(db, requestAuthorizator);
+    return this.buildContext(db, args, authorizator);
+  }
+  /**
+   * Same as `create`, but resolves the custom-role definitions before returning, so
+   * the request never has to query for them while holding a transaction open.
+   */
+  async createPreloaded(db, args, requestAuthorizator) {
+    const authorizator = this.createAuthorizator(db, requestAuthorizator);
+    await authorizator.preload(args.roles);
+    return this.buildContext(db, args, authorizator);
+  }
+  createAuthorizator(db, requestAuthorizator) {
+    const customRoleCache = requestAuthorizator instanceof CustomRoleAuthorizator ? requestAuthorizator.customRoleCache : void 0;
+    return new CustomRoleAuthorizator(this.authorizator, db, customRoleCache);
+  }
+  buildContext(db, args, authorizator) {
     const identity = this.identityFactory.create(db, args);
-    return new PermissionContext(identity, this.authorizator, this.projectScopeFactory, this.schemaResolver);
+    return new PermissionContext(identity, authorizator, this.projectScopeFactory, this.schemaResolver);
   }
 }
 export {

package/dist/production/src/model/authorization/PermissionContextFactory.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"PermissionContextFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionContextFactory.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { IdentityFactory } from './IdentityFactory'\nimport { PermissionContext } from './PermissionContext'\nimport { ProjectScopeFactory } from './ProjectScopeFactory'\nimport { ProjectSchemaResolver } from '../type'\nimport { DatabaseContext } from '../utils'\n\nexport class PermissionContextFactory {\n\tconstructor(\n\t\tprivate readonly authorizator: Authorizator,\n\t\tprivate readonly identityFactory: IdentityFactory,\n\t\tprivate readonly projectScopeFactory: ProjectScopeFactory,\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tpublic create(db: DatabaseContext, args: { id: string; roles: readonly string[] }): PermissionContext {\n\t\tconst identity = this.identityFactory.create(db, args)\n\t\treturn new PermissionContext(identity, ~~this.~~authorizator, this.projectScopeFactory, this.schemaResolver)\n\t}\n}\n"],"names":[],"mappings":"~~;AAOO~~,MAAM,yBAAyB;AAAA,EACrC,YACkB,cACA,iBACA,qBACA,gBAChB;AAJgB,SAAA,eAAA;AACA,SAAA,kBAAA;AACA,SAAA,sBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEI,~~OAAO~~,IAAqB,~~MAAmE~~;~~AACrG~~,UAAM,WAAW,KAAK,gBAAgB,OAAO,IAAI,IAAI;AACrD,WAAO,IAAI,kBAAkB,UAAU,~~KAAK,~~cAAc,KAAK,qBAAqB,KAAK,cAAc;AAAA,~~EACxG~~;AACD;"}
1	+ {"version":3,"file":"PermissionContextFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionContextFactory.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { IdentityFactory } from './IdentityFactory.js'\nimport { PermissionContext } from './PermissionContext.js'\nimport { ProjectScopeFactory } from './ProjectScopeFactory.js'\nimport { ProjectSchemaResolver } from '../type/index.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { CustomRoleAuthorizator } from './CustomRoleAuthorizator.js'\nimport { Identity } from './Identity.js'\n\nexport class PermissionContextFactory {\n\tconstructor(\n\t\tprivate readonly authorizator: Authorizator<Identity>,\n\t\tprivate readonly identityFactory: IdentityFactory,\n\t\tprivate readonly projectScopeFactory: ProjectScopeFactory,\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tpublic create(\n\t\tdb: DatabaseContext,\n\t\targs: { id: string; roles: readonly string[] },\n\t\trequestAuthorizator?: Authorizator<Identity>,\n\t): PermissionContext {\n\t\tconst authorizator = this.createAuthorizator(db, requestAuthorizator)\n\t\treturn this.buildContext(db, args, authorizator)\n\t}\n\n\t/*\n\t Same as `create`, but resolves the custom-role definitions before returning, so\n\t * the request never has to query for them while holding a transaction open.\n\t */\n\tpublic async createPreloaded(\n\t\tdb: DatabaseContext,\n\t\targs: { id: string; roles: readonly string[] },\n\t\trequestAuthorizator?: Authorizator<Identity>,\n\t): Promise<PermissionContext> {\n\t\tconst authorizator = this.createAuthorizator(db, requestAuthorizator)\n\t\tawait authorizator.preload(args.roles)\n\t\treturn this.buildContext(db, args, authorizator)\n\t}\n\n\tprivate createAuthorizator(db: DatabaseContext, requestAuthorizator?: Authorizator<Identity>): CustomRoleAuthorizator {\n\t\tconst customRoleCache = requestAuthorizator instanceof CustomRoleAuthorizator\n\t\t\t? requestAuthorizator.customRoleCache\n\t\t\t: undefined\n\t\treturn new CustomRoleAuthorizator(this.authorizator, db, customRoleCache)\n\t}\n\n\tprivate buildContext(\n\t\tdb: DatabaseContext,\n\t\targs: { id: string; roles: readonly string[] },\n\t\tauthorizator: CustomRoleAuthorizator,\n\t): PermissionContext {\n\t\tconst identity = this.identityFactory.create(db, args)\n\t\treturn new PermissionContext(identity, authorizator, this.projectScopeFactory, this.schemaResolver)\n\t}\n}\n"],"names":[],"mappings":";;AASO,MAAM,yBAAyB;AAAA,EACrC,YACkB,cACA,iBACA,qBACA,gBAChB;AAJgB,SAAA,eAAA;AACA,SAAA,kBAAA;AACA,SAAA,sBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEI,OACN,IACA,MACA,qBACoB;AACpB,UAAM,eAAe,KAAK,mBAAmB,IAAI,mBAAmB;AACpE,WAAO,KAAK,aAAa,IAAI,MAAM,YAAY;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,gBACZ,IACA,MACA,qBAC6B;AAC7B,UAAM,eAAe,KAAK,mBAAmB,IAAI,mBAAmB;AACpE,UAAM,aAAa,QAAQ,KAAK,KAAK;AACrC,WAAO,KAAK,aAAa,IAAI,MAAM,YAAY;AAAA,EAChD;AAAA,EAEQ,mBAAmB,IAAqB,qBAAsE;AACrH,UAAM,kBAAkB,+BAA+B,yBACpD,oBAAoB,kBACpB;AACH,WAAO,IAAI,uBAAuB,KAAK,cAAc,IAAI,eAAe;AAAA,EACzE;AAAA,EAEQ,aACP,IACA,MACA,cACoB;AACpB,UAAM,WAAW,KAAK,gBAAgB,OAAO,IAAI,IAAI;AACrD,WAAO,IAAI,kBAAkB,UAAU,cAAc,KAAK,qBAAqB,KAAK,cAAc;AAAA,EACnG;AACD;"}

package/dist/production/src/model/authorization/PermissionsFactory.cjs CHANGED Viewed

@@ -3,14 +3,14 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const authorization = require("@contember/authorization");
 const PermissionActions = require("./PermissionActions.cjs");
 const Roles = require("./Roles.cjs");
-const allowedRoles = /* @__PURE__ */ new Set([Roles.TenantRole.LOGIN, Roles.TenantRole.PROJECT_ADMIN, Roles.TenantRole.ENTRYPOINT_DEPLOYER]);
-const projectAdminAllowedInputRoles = ({ roles }) => {
-  return roles === void 0 || roles.every((it) => allowedRoles.has(it));
-};
-const forbiddenRoles = /* @__PURE__ */ new Set([Roles.TenantRole.SUPER_ADMIN, Roles.TenantRole.PROJECT_CREATOR]);
-const projectAdminUseRolesVerifier = ({ roles }) => {
-  return roles === void 0 || roles.every((it) => !forbiddenRoles.has(it));
-};
+const projectAdminAllowsRoles = (roles) => roles === void 0 || roles.every((role) => !Roles.NON_DELEGABLE_TENANT_ROLES.has(role));
+const projectAdminAllowedSignUpRoles = (meta) => projectAdminAllowsRoles(meta.requestedRoles);
+const projectAdminAllowsTrustForwardedClientInfo = (meta) => meta?.trustForwardedClientInfo !== true;
+const projectAdminAllowedApiKey = (meta) => projectAdminAllowsTrustForwardedClientInfo(meta);
+const projectAdminAllowedGlobalApiKeyRoles = (meta) => projectAdminAllowsRoles(meta?.requestedRoles) && projectAdminAllowsTrustForwardedClientInfo(meta);
+const projectAdminAllowedRoleMutation = (meta) => meta === void 0 || projectAdminAllowsRoles(meta.requestedRoles) && meta.target.globalRoles.every((role) => !Roles.NON_DELEGABLE_TENANT_ROLES.has(role));
+const projectAdminMayTarget = (meta) => meta.target === null || meta.target.globalRoles.every((role) => !Roles.NON_DELEGABLE_TENANT_ROLES.has(role));
+const projectAdminMayCreateSession = (meta) => meta.phase === "preflight" || meta.target?.globalRoles.every((role) => !Roles.NON_DELEGABLE_TENANT_ROLES.has(role)) === true;
 class PermissionsFactory {
   create() {
     const permissions = new authorization.Permissions();
@@ -27,34 +27,49 @@ class PermissionsFactory {
     permissions.allow(Roles.TenantRole.PERSON, PermissionActions.PermissionActions.PERSON_TOGGLE_PASSWORDLESS);
     permissions.allow(Roles.TenantRole.PERSON, PermissionActions.PermissionActions.PERSON_SIGN_OUT);
     permissions.allow(Roles.TenantRole.PERSON, PermissionActions.PermissionActions.PERSON_SETUP_OTP);
+    permissions.allow(Roles.TenantRole.PERSON, PermissionActions.PermissionActions.PERSON_REVOKE_SESSION);
+    permissions.allow(Roles.TenantRole.PERSON, PermissionActions.PermissionActions.PERSON_DISCONNECT_MY_IDP);
     permissions.allow(Roles.TenantRole.PROJECT_MEMBER, PermissionActions.PermissionActions.PROJECT_VIEW);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PROJECT_VIEW);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDENTITY_VIEW_PERMISSIONS);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_VIEW);
-    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.API_KEY_CREATE);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_LIST);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.API_KEY_CREATE(), projectAdminAllowedApiKey);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.API_KEY_DISABLE);
-    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles);
-    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedInputRoles);
-    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedInputRoles);
-    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedInputRoles);
-    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_CREATE_SESSION_KEY(), projectAdminUseRolesVerifier);
-    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_DISABLE(), projectAdminUseRolesVerifier);
-    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_CHANGE_PROFILE(), projectAdminUseRolesVerifier);
-    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_CHANGE_PASSWORD(), projectAdminUseRolesVerifier);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.API_KEY_LIST);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedGlobalApiKeyRoles);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedSignUpRoles);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedRoleMutation);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedRoleMutation);
+    permissions.allow(
+      Roles.TenantRole.PROJECT_ADMIN,
+      PermissionActions.PermissionActions.PERSON_CREATE_SESSION_KEY({ phase: "preflight" }),
+      projectAdminMayCreateSession
+    );
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_DISABLE(null), projectAdminMayTarget);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_FORCE_SIGN_OUT(null), projectAdminMayTarget);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_RESET_MFA(null), projectAdminMayTarget);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_VIEW_SESSIONS(null), projectAdminMayTarget);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_VIEW_IDP(null), projectAdminMayTarget);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_CHANGE_PROFILE(null, []), projectAdminMayTarget);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_CHANGE_PASSWORD(null), projectAdminMayTarget);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PROJECT_VIEW_MEMBER([]));
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PROJECT_ADD_MEMBER([]));
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PROJECT_UPDATE_MEMBER([]));
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PROJECT_REMOVE_MEMBER([]));
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PROJECT_VIEW_SECRETS);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_INVITE([]));
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_INVITE_UNMANAGED([]));
-    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.MAIL_TEMPLATE_ADD);
-    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.MAIL_TEMPLATE_REMOVE);
-    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.MAIL_TEMPLATE_LIST);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.MAIL_TEMPLATE_ADD());
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.MAIL_TEMPLATE_REMOVE());
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.MAIL_TEMPLATE_LIST());
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDP_ADD);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDP_UPDATE);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDP_DISABLE);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDP_ENABLE);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDP_LIST);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.AUTH_LOG_VIEW);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.CUSTOM_ROLE_VIEW);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.ENTRYPOINT_DEPLOY);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.CONFIGURE);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.CONFIG_VIEW);

package/dist/production/src/model/authorization/PermissionsFactory.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"PermissionsFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionsFactory.ts"],"sourcesContent":["import { Permissions } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions'\nimport { TenantRole } from './Roles'\n\nconst allowedRoles = new Set<string>([TenantRole.LOGIN, TenantRole.PROJECT_ADMIN, TenantRole.ENTRYPOINT_DEPLOYER])\n\nconst projectAdminAllowedInputRoles = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined \|\| roles.every(it => allowedRoles.has(it))\n}\n\nconst forbiddenRoles = new Set<string>([TenantRole.SUPER_ADMIN, TenantRole.PROJECT_CREATOR])\n\nconst projectAdminUseRolesVerifier = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined \|\| roles.every(it => !forbiddenRoles.has(it))\n}\n\nclass PermissionsFactory {\n\tpublic create(): Permissions {\n\t\tconst permissions = new Permissions()\n\n\t\tpermissions.allow(TenantRole.SUPER_ADMIN, { resource: Permissions.ALL, privilege: Permissions.ALL })\n\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_RESET_PASSWORD)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_CREATE_IDP_URL)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN_IDP)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_PASSWORDLESS_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN)\n\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PASSWORD)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PROFILE)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_TOGGLE_PASSWORDLESS)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SIGN_OUT)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP)\n\n\t\tpermissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_VIEW_PERMISSIONS)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CREATE_SESSION_KEY(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(), projectAdminUseRolesVerifier)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_ADD_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_UPDATE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_REMOVE_MEMBER([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE_UNMANAGED([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_UPDATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ENABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.ENTRYPOINT_DEPLOY)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIGURE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIG_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_CREATOR, PermissionActions.PROJECT_CREATE)\n\t\tpermissions.allow(TenantRole.ENTRYPOINT_DEPLOYER, PermissionActions.ENTRYPOINT_DEPLOY)\n\n\t\treturn permissions\n\t}\n}\n\nexport { PermissionsFactory }\n"],"names":["TenantRole","Permissions","PermissionActions"],"mappings":";;;;;AAIA,MAAM,eAAe,oBAAI,IAAY,CAACA,iBAAW,OAAOA,MAAAA,WAAW,eAAeA,iBAAW,mBAAmB,CAAC;AAEjH,MAAM,gCAAgC,CAAC,EAAE,YAA2C;AACnF,SAAO,UAAU,UAAa,MAAM,MAAM,QAAM,aAAa,IAAI,EAAE,CAAC;AACrE;AAEA,MAAM,qCAAqB,IAAY,CAACA,MAAAA,WAAW,aAAaA,MAAAA,WAAW,eAAe,CAAC;AAE3F,MAAM,+BAA+B,CAAC,EAAE,YAA2C;AAClF,SAAO,UAAU,UAAa,MAAM,MAAM,QAAM,CAAC,eAAe,IAAI,EAAE,CAAC;AACxE;AAEA,MAAM,mBAAmB;AAAA,EACjB,SAAsB;AAC5B,UAAM,cAAc,IAAIC,0BAAA;AAExB,gBAAY,MAAMD,iBAAW,aAAa,EAAE,UAAUC,cAAAA,YAAY,KAAK,WAAWA,cAAAA,YAAY,IAAA,CAAK;AAEnG,gBAAY,MAAMD,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,cAAc;AACpE,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,kBAAkB;AACxE,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,2BAA2B;AACjF,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,mCAAmC;AAEzF,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,WAAW;AAClE,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,yBAAyB;AAChF,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,wBAAwB;AAC/E,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,0BAA0B;AACjF,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,eAAe;AACtE,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,gBAAgB;AAEvE,gBAAY,MAAMF,MAAAA,WAAW,gBAAgBE,kBAAAA,kBAAkB,YAAY;AAE3E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,YAAY;AAC1E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,yBAAyB;AACvF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,WAAW;AACzE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,cAAc;AAC5E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,eAAe;AAC7E,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,sBAAA,GAAyB,6BAA6B;AAEpH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,eAAA,GAAkB,6BAA6B;AAC7G,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,0BAAA,GAA6B,6BAA6B;AACxH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,6BAAA,GAAgC,6BAA6B;AAC3H,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,0BAAA,GAA6B,4BAA4B;AACvH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,eAAA,GAAkB,4BAA4B;AAC5G,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,sBAAA,GAAyB,4BAA4B;AACnH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,uBAAA,GAA0B,4BAA4B;AAEpH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,CAAC;AACrF,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,mBAAmB,CAAA,CAAE,CAAC;AACpF,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AACvF,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AAEvF,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,cAAc,CAAA,CAAE,CAAC;AAC/E,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,wBAAwB,CAAA,CAAE,CAAC;AAEzF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,oBAAoB;AAClF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,kBAAkB;AAEhF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,OAAO;AACrE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,UAAU;AACxE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,WAAW;AACzE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,UAAU;AACxE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,QAAQ;AAEtE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,SAAS;AACvE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,WAAW;AAEzE,gBAAY,MAAMF,MAAAA,WAAW,iBAAiBE,kBAAAA,kBAAkB,cAAc;AAC9E,gBAAY,MAAMF,MAAAA,WAAW,qBAAqBE,kBAAAA,kBAAkB,iBAAiB;AAErF,WAAO;AAAA,EACR;AACD;;"}
1	+ {"version":3,"file":"PermissionsFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionsFactory.ts"],"sourcesContent":["import { Permissions } from '@contember/authorization'\nimport {\n\tApiKeyPermissionMeta,\n\tChangeProfilePermissionMeta,\n\tCreateSessionTokenPermissionMeta,\n\tGlobalApiKeyPermissionMeta,\n\tGlobalRoleMutationPermissionMeta,\n\tPermissionActions,\n\tTargetIdentityPermissionMeta,\n} from './PermissionActions.js'\nimport { NON_DELEGABLE_TENANT_ROLES, TenantRole } from './Roles.js'\n\nconst projectAdminAllowsRoles = (roles: readonly string[] \| undefined): boolean =>\n\troles === undefined \|\| roles.every(role => !NON_DELEGABLE_TENANT_ROLES.has(role))\n\nconst projectAdminAllowedSignUpRoles = (meta: { readonly requestedRoles?: readonly string[] }) => projectAdminAllowsRoles(meta.requestedRoles)\n\n/*\n A key minted with trust-forwarded-info decides what lands in the audit log and what per-IP rate limits key on,\n * so delegated authority may not mint one — same rule the custom-role grants apply via `allowTrustForwardedClientInfo`.\n */\nconst projectAdminAllowsTrustForwardedClientInfo = (meta: { readonly trustForwardedClientInfo?: boolean } \| undefined) =>\n\tmeta?.trustForwardedClientInfo !== true\n\nconst projectAdminAllowedApiKey = (meta: ApiKeyPermissionMeta \| undefined) => projectAdminAllowsTrustForwardedClientInfo(meta)\n\nconst projectAdminAllowedGlobalApiKeyRoles = (meta: GlobalApiKeyPermissionMeta \| undefined) =>\n\tprojectAdminAllowsRoles(meta?.requestedRoles) && projectAdminAllowsTrustForwardedClientInfo(meta)\n\nconst projectAdminAllowedRoleMutation = (meta: GlobalRoleMutationPermissionMeta \| undefined) =>\n\tmeta === undefined\n\t\|\| (\n\t\tprojectAdminAllowsRoles(meta.requestedRoles)\n\t\t&& meta.target.globalRoles.every(role => !NON_DELEGABLE_TENANT_ROLES.has(role))\n\t)\n\nconst projectAdminMayTarget = (meta: TargetIdentityPermissionMeta) =>\n\tmeta.target === null \|\| meta.target.globalRoles.every(role => !NON_DELEGABLE_TENANT_ROLES.has(role))\n\nconst projectAdminMayCreateSession = (meta: CreateSessionTokenPermissionMeta) =>\n\tmeta.phase === 'preflight' \|\| meta.target?.globalRoles.every(role => !NON_DELEGABLE_TENANT_ROLES.has(role)) === true\n\nclass PermissionsFactory {\n\tpublic create(): Permissions {\n\t\tconst permissions = new Permissions()\n\n\t\tpermissions.allow(TenantRole.SUPER_ADMIN, { resource: Permissions.ALL, privilege: Permissions.ALL })\n\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_RESET_PASSWORD)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_CREATE_IDP_URL)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN_IDP)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_PASSWORDLESS_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN)\n\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PASSWORD)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PROFILE)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_TOGGLE_PASSWORDLESS)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SIGN_OUT)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_REVOKE_SESSION)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_DISCONNECT_MY_IDP)\n\n\t\tpermissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_VIEW_PERMISSIONS)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_LIST)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE(), projectAdminAllowedApiKey)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_LIST)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedGlobalApiKeyRoles)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedSignUpRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedRoleMutation)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedRoleMutation)\n\t\tpermissions.allow(\n\t\t\tTenantRole.PROJECT_ADMIN,\n\t\t\tPermissionActions.PERSON_CREATE_SESSION_KEY({ phase: 'preflight' }),\n\t\t\tprojectAdminMayCreateSession,\n\t\t)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(null), projectAdminMayTarget)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_FORCE_SIGN_OUT(null), projectAdminMayTarget)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_RESET_MFA(null), projectAdminMayTarget)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW_SESSIONS(null), projectAdminMayTarget)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW_IDP(null), projectAdminMayTarget)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(null, []), projectAdminMayTarget)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(null), projectAdminMayTarget)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_ADD_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_UPDATE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_REMOVE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_SECRETS)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE_UNMANAGED([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD())\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE())\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_LIST())\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_UPDATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ENABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.AUTH_LOG_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CUSTOM_ROLE_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.ENTRYPOINT_DEPLOY)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIGURE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIG_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_CREATOR, PermissionActions.PROJECT_CREATE)\n\t\tpermissions.allow(TenantRole.ENTRYPOINT_DEPLOYER, PermissionActions.ENTRYPOINT_DEPLOY)\n\n\t\treturn permissions\n\t}\n}\n\nexport { PermissionsFactory }\n"],"names":["NON_DELEGABLE_TENANT_ROLES","Permissions","TenantRole","PermissionActions"],"mappings":";;;;;AAYA,MAAM,0BAA0B,CAAC,UAChC,UAAU,UAAa,MAAM,MAAM,CAAA,SAAQ,CAACA,MAAAA,2BAA2B,IAAI,IAAI,CAAC;AAEjF,MAAM,iCAAiC,CAAC,SAA0D,wBAAwB,KAAK,cAAc;AAM7I,MAAM,6CAA6C,CAAC,SACnD,MAAM,6BAA6B;AAEpC,MAAM,4BAA4B,CAAC,SAA2C,2CAA2C,IAAI;AAE7H,MAAM,uCAAuC,CAAC,SAC7C,wBAAwB,MAAM,cAAc,KAAK,2CAA2C,IAAI;AAEjG,MAAM,kCAAkC,CAAC,SACxC,SAAS,UAER,wBAAwB,KAAK,cAAc,KACxC,KAAK,OAAO,YAAY,MAAM,CAAA,SAAQ,CAACA,iCAA2B,IAAI,IAAI,CAAC;AAGhF,MAAM,wBAAwB,CAAC,SAC9B,KAAK,WAAW,QAAQ,KAAK,OAAO,YAAY,MAAM,CAAA,SAAQ,CAACA,MAAAA,2BAA2B,IAAI,IAAI,CAAC;AAEpG,MAAM,+BAA+B,CAAC,SACrC,KAAK,UAAU,eAAe,KAAK,QAAQ,YAAY,MAAM,UAAQ,CAACA,MAAAA,2BAA2B,IAAI,IAAI,CAAC,MAAM;AAEjH,MAAM,mBAAmB;AAAA,EACjB,SAAsB;AAC5B,UAAM,cAAc,IAAIC,0BAAA;AAExB,gBAAY,MAAMC,iBAAW,aAAa,EAAE,UAAUD,cAAAA,YAAY,KAAK,WAAWA,cAAAA,YAAY,IAAA,CAAK;AAEnG,gBAAY,MAAMC,MAAAA,WAAW,OAAOC,kBAAAA,kBAAkB,cAAc;AACpE,gBAAY,MAAMD,MAAAA,WAAW,OAAOC,kBAAAA,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAMD,MAAAA,WAAW,OAAOC,kBAAAA,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAMD,MAAAA,WAAW,OAAOC,kBAAAA,kBAAkB,kBAAkB;AACxE,gBAAY,MAAMD,MAAAA,WAAW,OAAOC,kBAAAA,kBAAkB,2BAA2B;AACjF,gBAAY,MAAMD,MAAAA,WAAW,OAAOC,kBAAAA,kBAAkB,mCAAmC;AAEzF,gBAAY,MAAMD,MAAAA,WAAW,QAAQC,kBAAAA,kBAAkB,WAAW;AAClE,gBAAY,MAAMD,MAAAA,WAAW,QAAQC,kBAAAA,kBAAkB,yBAAyB;AAChF,gBAAY,MAAMD,MAAAA,WAAW,QAAQC,kBAAAA,kBAAkB,wBAAwB;AAC/E,gBAAY,MAAMD,MAAAA,WAAW,QAAQC,kBAAAA,kBAAkB,0BAA0B;AACjF,gBAAY,MAAMD,MAAAA,WAAW,QAAQC,kBAAAA,kBAAkB,eAAe;AACtE,gBAAY,MAAMD,MAAAA,WAAW,QAAQC,kBAAAA,kBAAkB,gBAAgB;AACvE,gBAAY,MAAMD,MAAAA,WAAW,QAAQC,kBAAAA,kBAAkB,qBAAqB;AAC5E,gBAAY,MAAMD,MAAAA,WAAW,QAAQC,kBAAAA,kBAAkB,wBAAwB;AAE/E,gBAAY,MAAMD,MAAAA,WAAW,gBAAgBC,kBAAAA,kBAAkB,YAAY;AAE3E,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,YAAY;AAC1E,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,yBAAyB;AACvF,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,WAAW;AACzE,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,WAAW;AACzE,gBAAY,MAAMD,iBAAW,eAAeC,kBAAAA,kBAAkB,eAAA,GAAkB,yBAAyB;AACzG,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,eAAe;AAC7E,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,YAAY;AAC1E,gBAAY,MAAMD,iBAAW,eAAeC,kBAAAA,kBAAkB,sBAAA,GAAyB,oCAAoC;AAE3H,gBAAY,MAAMD,iBAAW,eAAeC,kBAAAA,kBAAkB,eAAA,GAAkB,8BAA8B;AAC9G,gBAAY,MAAMD,iBAAW,eAAeC,kBAAAA,kBAAkB,0BAAA,GAA6B,+BAA+B;AAC1H,gBAAY,MAAMD,iBAAW,eAAeC,kBAAAA,kBAAkB,6BAAA,GAAgC,+BAA+B;AAC7H,gBAAY;AAAA,MACXD,MAAAA,WAAW;AAAA,MACXC,kBAAAA,kBAAkB,0BAA0B,EAAE,OAAO,aAAa;AAAA,MAClE;AAAA,IAAA;AAED,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,eAAe,IAAI,GAAG,qBAAqB;AACzG,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,sBAAsB,IAAI,GAAG,qBAAqB;AAChH,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,iBAAiB,IAAI,GAAG,qBAAqB;AAC3G,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,qBAAqB,IAAI,GAAG,qBAAqB;AAC/G,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,gBAAgB,IAAI,GAAG,qBAAqB;AAC1G,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,sBAAsB,MAAM,EAAE,GAAG,qBAAqB;AACpH,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,uBAAuB,IAAI,GAAG,qBAAqB;AAEjH,gBAAY,MAAMD,iBAAW,eAAeC,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,CAAC;AACrF,gBAAY,MAAMD,iBAAW,eAAeC,kBAAAA,kBAAkB,mBAAmB,CAAA,CAAE,CAAC;AACpF,gBAAY,MAAMD,iBAAW,eAAeC,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AACvF,gBAAY,MAAMD,iBAAW,eAAeC,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AACvF,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,oBAAoB;AAElF,gBAAY,MAAMD,iBAAW,eAAeC,kBAAAA,kBAAkB,cAAc,CAAA,CAAE,CAAC;AAC/E,gBAAY,MAAMD,iBAAW,eAAeC,kBAAAA,kBAAkB,wBAAwB,CAAA,CAAE,CAAC;AAEzF,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,mBAAmB;AACjF,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,sBAAsB;AACpF,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,oBAAoB;AAElF,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,OAAO;AACrE,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,UAAU;AACxE,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,WAAW;AACzE,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,UAAU;AACxE,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,QAAQ;AAEtE,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,aAAa;AAC3E,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,gBAAgB;AAC9E,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,SAAS;AACvE,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,WAAW;AAEzE,gBAAY,MAAMD,MAAAA,WAAW,iBAAiBC,kBAAAA,kBAAkB,cAAc;AAC9E,gBAAY,MAAMD,MAAAA,WAAW,qBAAqBC,kBAAAA,kBAAkB,iBAAiB;AAErF,WAAO;AAAA,EACR;AACD;;"}

package/dist/production/src/model/authorization/PermissionsFactory.js CHANGED Viewed

@@ -1,14 +1,14 @@
 import { Permissions } from "@contember/authorization";
 import { PermissionActions } from "./PermissionActions.js";
-import { TenantRole } from "./Roles.js";
-const allowedRoles = /* @__PURE__ */ new Set([TenantRole.LOGIN, TenantRole.PROJECT_ADMIN, TenantRole.ENTRYPOINT_DEPLOYER]);
-const projectAdminAllowedInputRoles = ({ roles }) => {
-  return roles === void 0 || roles.every((it) => allowedRoles.has(it));
-};
-const forbiddenRoles = /* @__PURE__ */ new Set([TenantRole.SUPER_ADMIN, TenantRole.PROJECT_CREATOR]);
-const projectAdminUseRolesVerifier = ({ roles }) => {
-  return roles === void 0 || roles.every((it) => !forbiddenRoles.has(it));
-};
+import { TenantRole, NON_DELEGABLE_TENANT_ROLES } from "./Roles.js";
+const projectAdminAllowsRoles = (roles) => roles === void 0 || roles.every((role) => !NON_DELEGABLE_TENANT_ROLES.has(role));
+const projectAdminAllowedSignUpRoles = (meta) => projectAdminAllowsRoles(meta.requestedRoles);
+const projectAdminAllowsTrustForwardedClientInfo = (meta) => meta?.trustForwardedClientInfo !== true;
+const projectAdminAllowedApiKey = (meta) => projectAdminAllowsTrustForwardedClientInfo(meta);
+const projectAdminAllowedGlobalApiKeyRoles = (meta) => projectAdminAllowsRoles(meta?.requestedRoles) && projectAdminAllowsTrustForwardedClientInfo(meta);
+const projectAdminAllowedRoleMutation = (meta) => meta === void 0 || projectAdminAllowsRoles(meta.requestedRoles) && meta.target.globalRoles.every((role) => !NON_DELEGABLE_TENANT_ROLES.has(role));
+const projectAdminMayTarget = (meta) => meta.target === null || meta.target.globalRoles.every((role) => !NON_DELEGABLE_TENANT_ROLES.has(role));
+const projectAdminMayCreateSession = (meta) => meta.phase === "preflight" || meta.target?.globalRoles.every((role) => !NON_DELEGABLE_TENANT_ROLES.has(role)) === true;
 class PermissionsFactory {
   create() {
     const permissions = new Permissions();
@@ -25,34 +25,49 @@ class PermissionsFactory {
     permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_TOGGLE_PASSWORDLESS);
     permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SIGN_OUT);
     permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP);
+    permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_REVOKE_SESSION);
+    permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_DISCONNECT_MY_IDP);
     permissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_VIEW_PERMISSIONS);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW);
-    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_LIST);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE(), projectAdminAllowedApiKey);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE);
-    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles);
-    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedInputRoles);
-    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedInputRoles);
-    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedInputRoles);
-    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CREATE_SESSION_KEY(), projectAdminUseRolesVerifier);
-    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(), projectAdminUseRolesVerifier);
-    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(), projectAdminUseRolesVerifier);
-    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(), projectAdminUseRolesVerifier);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_LIST);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedGlobalApiKeyRoles);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedSignUpRoles);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedRoleMutation);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedRoleMutation);
+    permissions.allow(
+      TenantRole.PROJECT_ADMIN,
+      PermissionActions.PERSON_CREATE_SESSION_KEY({ phase: "preflight" }),
+      projectAdminMayCreateSession
+    );
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(null), projectAdminMayTarget);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_FORCE_SIGN_OUT(null), projectAdminMayTarget);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_RESET_MFA(null), projectAdminMayTarget);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW_SESSIONS(null), projectAdminMayTarget);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW_IDP(null), projectAdminMayTarget);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(null, []), projectAdminMayTarget);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(null), projectAdminMayTarget);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_MEMBER([]));
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_ADD_MEMBER([]));
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_UPDATE_MEMBER([]));
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_REMOVE_MEMBER([]));
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_SECRETS);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE([]));
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE_UNMANAGED([]));
-    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD);
-    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE);
-    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_LIST);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD());
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE());
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_LIST());
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ADD);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_UPDATE);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_DISABLE);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ENABLE);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_LIST);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.AUTH_LOG_VIEW);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CUSTOM_ROLE_VIEW);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.ENTRYPOINT_DEPLOY);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIGURE);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIG_VIEW);