@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/dist/production/src/model/authorization/CustomRolePermissions.js

@@ -0,0 +1,387 @@
+import { Permissions } from "@contember/authorization";
+import * as Typesafe from "@contember/typesafe";
+import { PermissionActions } from "./PermissionActions.js";
+import { TenantRole, NON_DELEGABLE_TENANT_ROLES, ROLE_SLUG_PATTERN } from "./Roles.js";
+import { MailType, mailTypeFromDbToSchema } from "../mailing/type.js";
+const PROJECT_SLUG_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]*$/;
+const MAIL_TYPES = new Set(Object.values(MailType).map(mailTypeFromDbToSchema));
+const BUILTIN_TENANT_ROLES = new Set(Object.values(TenantRole));
+const GLOBALLY_ASSIGNABLE_BUILTIN_ROLES = /* @__PURE__ */ new Set([
+  TenantRole.LOGIN,
+  TenantRole.PERSON,
+  TenantRole.SUPER_ADMIN,
+  TenantRole.PROJECT_CREATOR,
+  TenantRole.PROJECT_ADMIN,
+  TenantRole.ENTRYPOINT_DEPLOYER
+]);
+const RoleConstraintSchema = Typesafe.noExtraProps(Typesafe.object({
+  allowed: Typesafe.array(Typesafe.string)
+}));
+const TargetSelectorSchema = Typesafe.noExtraProps(Typesafe.object({
+  globalRoles: RoleConstraintSchema,
+  projectMemberships: Typesafe.enumeration("none", "any")
+}));
+const RoleInputConfigSchema = Typesafe.noExtraProps(Typesafe.object({
+  roles: RoleConstraintSchema
+}));
+const TargetIdentityConfigSchema = Typesafe.noExtraProps(Typesafe.object({
+  target: TargetSelectorSchema
+}));
+const RoleMutationConfigSchema = Typesafe.noExtraProps(Typesafe.object({
+  roles: RoleConstraintSchema,
+  target: TargetSelectorSchema,
+  allowSelf: Typesafe.boolean
+}));
+const GlobalApiKeyConfigSchema = Typesafe.noExtraProps(Typesafe.object({
+  roles: RoleConstraintSchema,
+  allowTrustForwardedClientInfo: Typesafe.boolean
+}));
+const ChangeProfileConfigSchema = Typesafe.noExtraProps(Typesafe.object({
+  target: TargetSelectorSchema,
+  fields: Typesafe.noExtraProps(Typesafe.object({
+    allowed: Typesafe.array(Typesafe.enumeration("name", "email"))
+  }))
+}));
+const CreateSessionTokenConfigSchema = Typesafe.noExtraProps(Typesafe.object({
+  target: TargetSelectorSchema,
+  session: Typesafe.noExtraProps(Typesafe.object({
+    maxExpirationMinutes: Typesafe.integer,
+    allowTrustForwardedClientInfo: Typesafe.boolean
+  }))
+}));
+const MailTemplateScopeConfigSchema = Typesafe.noExtraProps(Typesafe.object({
+  global: Typesafe.boolean,
+  projects: Typesafe.array(Typesafe.string),
+  types: Typesafe.array(Typesafe.string)
+}));
+const canonicalizeStrings = (values, path, validate, label) => {
+  for (let index = 0; index < values.length; index++) {
+    if (!validate(values[index])) {
+      throw new Typesafe.ParseError([...path, index], `must be a valid ${label}`);
+    }
+  }
+  return [...new Set(values)].sort();
+};
+const canonicalizeRoleConstraint = (constraint, path) => {
+  const allowed = canonicalizeStrings(constraint.allowed, [...path, "allowed"], (role) => ROLE_SLUG_PATTERN.test(role), "tenant role slug");
+  const forbidden = allowed.find((role) => NON_DELEGABLE_TENANT_ROLES.has(role));
+  if (forbidden !== void 0) {
+    throw new Typesafe.ParseError([...path, "allowed"], `role ${forbidden} is protected and cannot be delegated`);
+  }
+  return { allowed };
+};
+const canonicalizeProjects = (projects, path) => canonicalizeStrings(projects, path, (project) => PROJECT_SLUG_PATTERN.test(project), "project slug");
+const canonicalizeMailTypes = (types, path) => canonicalizeStrings(types, path, (type) => MAIL_TYPES.has(type), "mail template type");
+const createCanonicalTarget = (target, path) => ({
+  globalRoles: canonicalizeRoleConstraint(target.globalRoles, [...path, "globalRoles"]),
+  projectMemberships: target.projectMemberships
+});
+const getReferencedRoles = (...constraints) => [...new Set(constraints.flatMap((constraint) => constraint.allowed))].sort();
+const matchesRoles = (observed, config) => observed.every((role) => config.allowed.includes(role) && !NON_DELEGABLE_TENANT_ROLES.has(role));
+const matchesTarget = (target, config) => matchesRoles(target.globalRoles, config.globalRoles) && (config.projectMemberships === "any" || !target.hasProjectMemberships);
+const noConfigDefinition = (name, action) => ({
+  name,
+  configurationKind: "NONE",
+  defaultConfig: null,
+  decode: (raw, path) => {
+    if (raw !== null) {
+      throw new Typesafe.ParseError(path, "configuration is not supported for this permission");
+    }
+    return {
+      canonicalConfig: null,
+      referencedRoles: [],
+      referencedProjects: [],
+      install: (permissions, role) => permissions.allow(role, action)
+    };
+  }
+});
+const roleInputDefinition = (name, action) => ({
+  name,
+  configurationKind: "ROLE_INPUT",
+  defaultConfig: null,
+  decode: (raw, path) => {
+    const config = RoleInputConfigSchema(raw, path);
+    const roles = canonicalizeRoleConstraint(config.roles, [...path, "roles"]);
+    return {
+      canonicalConfig: { roles },
+      referencedRoles: getReferencedRoles(roles),
+      referencedProjects: [],
+      install: (permissions, role) => permissions.allow(role, action(), (meta) => meta !== void 0 && matchesRoles(meta.requestedRoles ?? [], roles))
+    };
+  }
+});
+const targetIdentityDefinition = (name, action) => ({
+  name,
+  configurationKind: "TARGET_IDENTITY",
+  defaultConfig: null,
+  decode: (raw, path) => {
+    const config = TargetIdentityConfigSchema(raw, path);
+    const target = createCanonicalTarget(config.target, [...path, "target"]);
+    return {
+      canonicalConfig: { target },
+      referencedRoles: getReferencedRoles(target.globalRoles),
+      referencedProjects: [],
+      install: (permissions, role) => permissions.allow(role, action(null), (meta) => meta !== void 0 && (meta.target === null || matchesTarget(meta.target, target)))
+    };
+  }
+});
+const roleMutationDefinition = (name, action) => ({
+  name,
+  configurationKind: "ROLE_MUTATION",
+  defaultConfig: null,
+  decode: (raw, path) => {
+    const config = RoleMutationConfigSchema(raw, path);
+    const roles = canonicalizeRoleConstraint(config.roles, [...path, "roles"]);
+    const target = createCanonicalTarget(config.target, [...path, "target"]);
+    const allowSelf = config.allowSelf;
+    return {
+      canonicalConfig: { roles, target, allowSelf },
+      referencedRoles: getReferencedRoles(roles, target.globalRoles),
+      referencedProjects: [],
+      install: (permissions, role) => permissions.allow(
+        role,
+        action(),
+        (meta) => meta === void 0 || (allowSelf || !meta.self) && matchesRoles(meta.requestedRoles, roles) && matchesTarget(meta.target, target)
+      )
+    };
+  }
+});
+const globalApiKeyDefinition = () => ({
+  name: "apiKey:createGlobal",
+  configurationKind: "GLOBAL_API_KEY",
+  defaultConfig: null,
+  decode: (raw, path) => {
+    const config = GlobalApiKeyConfigSchema(raw, path);
+    const roles = canonicalizeRoleConstraint(config.roles, [...path, "roles"]);
+    if (config.allowTrustForwardedClientInfo) {
+      throw new Typesafe.ParseError(
+        [...path, "allowTrustForwardedClientInfo"],
+        "must be false; custom roles cannot create keys trusted to forward client info"
+      );
+    }
+    return {
+      canonicalConfig: { roles, allowTrustForwardedClientInfo: false },
+      referencedRoles: getReferencedRoles(roles),
+      referencedProjects: [],
+      install: (permissions, role) => permissions.allow(
+        role,
+        PermissionActions.API_KEY_CREATE_GLOBAL(),
+        (meta) => meta !== void 0 && meta.trustForwardedClientInfo !== true && matchesRoles(meta.requestedRoles, roles)
+      )
+    };
+  }
+});
+const changeProfileDefinition = () => ({
+  name: "person:changeProfile",
+  configurationKind: "CHANGE_PROFILE",
+  defaultConfig: null,
+  decode: (raw, path) => {
+    const config = ChangeProfileConfigSchema(raw, path);
+    const target = createCanonicalTarget(config.target, [...path, "target"]);
+    const fields = [...new Set(config.fields.allowed)].sort();
+    if (fields.length === 0) {
+      throw new Typesafe.ParseError([...path, "fields", "allowed"], "must contain at least one field");
+    }
+    return {
+      canonicalConfig: { target, fields: { allowed: fields } },
+      referencedRoles: getReferencedRoles(target.globalRoles),
+      referencedProjects: [],
+      install: (permissions, role) => permissions.allow(
+        role,
+        PermissionActions.PERSON_CHANGE_PROFILE(null, []),
+        (meta) => meta !== void 0 && (meta.target === null || matchesTarget(meta.target, target)) && meta.fields.every((field) => fields.includes(field))
+      )
+    };
+  }
+});
+const createSessionTokenDefinition = () => ({
+  name: "person:createSessionToken",
+  configurationKind: "CREATE_SESSION_TOKEN",
+  defaultConfig: null,
+  decode: (raw, path) => {
+    const config = CreateSessionTokenConfigSchema(raw, path);
+    const target = createCanonicalTarget(config.target, [...path, "target"]);
+    const maxExpirationMinutes = config.session.maxExpirationMinutes;
+    if (maxExpirationMinutes <= 0) {
+      throw new Typesafe.ParseError([...path, "session", "maxExpirationMinutes"], "must be greater than zero");
+    }
+    const allowTrustForwardedClientInfo = config.session.allowTrustForwardedClientInfo;
+    return {
+      canonicalConfig: {
+        target,
+        session: { maxExpirationMinutes, allowTrustForwardedClientInfo }
+      },
+      referencedRoles: getReferencedRoles(target.globalRoles),
+      referencedProjects: [],
+      install: (permissions, role) => permissions.allow(role, PermissionActions.PERSON_CREATE_SESSION_KEY({ phase: "preflight" }), (meta) => {
+        if (meta.phase === "preflight") {
+          return true;
+        }
+        return meta.target !== void 0 && matchesTarget(meta.target, target) && (!meta.trustForwardedClientInfo || allowTrustForwardedClientInfo) && meta.requestedExpirationMinutes !== null && meta.requestedExpirationMinutes !== void 0 && meta.requestedExpirationMinutes > 0 && meta.requestedExpirationMinutes <= maxExpirationMinutes;
+      })
+    };
+  }
+});
+const mailTemplateDefinition = (name, action) => ({
+  name,
+  configurationKind: "MAIL_TEMPLATE_SCOPE",
+  defaultConfig: null,
+  decode: (raw, path) => {
+    const config = MailTemplateScopeConfigSchema(raw, path);
+    const projects = canonicalizeProjects(config.projects, [...path, "projects"]);
+    const types = canonicalizeMailTypes(config.types, [...path, "types"]);
+    if (!config.global && projects.length === 0) {
+      throw new Typesafe.ParseError(path, "must grant global or at least one project scope");
+    }
+    if (types.length === 0) {
+      throw new Typesafe.ParseError([...path, "types"], "must contain at least one mail template type");
+    }
+    const global = config.global;
+    return {
+      canonicalConfig: { global, projects, types },
+      referencedRoles: [],
+      referencedProjects: projects,
+      install: (permissions, role) => permissions.allow(role, action(), (meta) => {
+        if (meta === void 0 || !types.includes(meta.type)) {
+          return false;
+        }
+        return meta.kind === "global" ? global : meta.projectSlug !== null && projects.includes(meta.projectSlug);
+      })
+    };
+  }
+});
+const definitions = [
+  noConfigDefinition("system:configure", PermissionActions.CONFIGURE),
+  noConfigDefinition("system:viewConfig", PermissionActions.CONFIG_VIEW),
+  noConfigDefinition("system:viewAuthLog", PermissionActions.AUTH_LOG_VIEW),
+  noConfigDefinition("person:view", PermissionActions.PERSON_VIEW),
+  noConfigDefinition("person:list", PermissionActions.PERSON_LIST),
+  noConfigDefinition("entrypoint:deployEntrypoint", PermissionActions.ENTRYPOINT_DEPLOY),
+  noConfigDefinition("apiKey:list", PermissionActions.API_KEY_LIST),
+  noConfigDefinition("idp:disable", PermissionActions.IDP_DISABLE),
+  noConfigDefinition("idp:enable", PermissionActions.IDP_ENABLE),
+  noConfigDefinition("idp:list", PermissionActions.IDP_LIST),
+  noConfigDefinition("customRole:view", PermissionActions.CUSTOM_ROLE_VIEW),
+  // Exposes role *names* only. Without it a role holding `identity:addGlobalRoles` reads
+  // `Identity.roles` as null — it could mutate a role set it was unable to look at first.
+  noConfigDefinition("identity:viewPermissions", PermissionActions.IDENTITY_VIEW_PERMISSIONS),
+  roleInputDefinition("person:signUp", PermissionActions.PERSON_SIGN_UP),
+  targetIdentityDefinition("person:disable", PermissionActions.PERSON_DISABLE),
+  targetIdentityDefinition("person:forceSignOut", PermissionActions.PERSON_FORCE_SIGN_OUT),
+  targetIdentityDefinition("person:resetMfa", PermissionActions.PERSON_RESET_MFA),
+  targetIdentityDefinition("person:viewSessions", PermissionActions.PERSON_VIEW_SESSIONS),
+  targetIdentityDefinition("person:viewIdp", PermissionActions.PERSON_VIEW_IDP),
+  targetIdentityDefinition("person:changePassword", PermissionActions.PERSON_CHANGE_PASSWORD),
+  changeProfileDefinition(),
+  createSessionTokenDefinition(),
+  roleMutationDefinition("identity:addGlobalRoles", PermissionActions.IDENTITY_ADD_GLOBAL_ROLES),
+  roleMutationDefinition("identity:removeGlobalRoles", PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES),
+  globalApiKeyDefinition(),
+  mailTemplateDefinition("mailTemplate:add", PermissionActions.MAIL_TEMPLATE_ADD),
+  mailTemplateDefinition("mailTemplate:remove", PermissionActions.MAIL_TEMPLATE_REMOVE),
+  mailTemplateDefinition("mailTemplate:list", PermissionActions.MAIL_TEMPLATE_LIST)
+];
+const catalog = new Map(definitions.map((definition) => [definition.name, definition]));
+const getGrantablePermissions = () => catalog;
+class CustomRoleGrantValidationError extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+}
+const parseEnvelope = (raw, path) => {
+  const object = Typesafe.anyJsonObject(raw, path);
+  for (const key of Object.keys(object)) {
+    if (key !== "permission" && key !== "config") {
+      throw new Typesafe.ParseError(path, `extra property ${key} found`);
+    }
+  }
+  const permission = Typesafe.string(object.permission, [...path, "permission"]);
+  const config = object.config === void 0 ? null : Typesafe.anyJson(object.config, [...path, "config"]);
+  return { permission, config };
+};
+const decodeCustomRoleGrants = (raw) => {
+  if (!Array.isArray(raw)) {
+    throw new CustomRoleGrantValidationError("INVALID_PERMISSION_CONFIGURATION", "Custom role grants must be an array");
+  }
+  const decoded = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (let index = 0; index < raw.length; index++) {
+    let envelope;
+    try {
+      envelope = parseEnvelope(raw[index], [index]);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "invalid grant";
+      throw new CustomRoleGrantValidationError("INVALID_PERMISSION_CONFIGURATION", `Grant ${index}: ${message}`);
+    }
+    if (seen.has(envelope.permission)) {
+      throw new CustomRoleGrantValidationError("DUPLICATE_PERMISSION", `Permission ${envelope.permission} is present more than once`);
+    }
+    seen.add(envelope.permission);
+    const definition = catalog.get(envelope.permission);
+    if (definition === void 0) {
+      throw new CustomRoleGrantValidationError(
+        "UNKNOWN_PERMISSION",
+        `Permission ${envelope.permission} is unknown or not grantable to a custom role`
+      );
+    }
+    try {
+      decoded.push({
+        permission: envelope.permission,
+        definition,
+        grant: definition.decode(envelope.config, [index, "config"])
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "invalid configuration";
+      throw new CustomRoleGrantValidationError(
+        "INVALID_PERMISSION_CONFIGURATION",
+        `Grant ${envelope.permission}: ${message}`
+      );
+    }
+  }
+  decoded.sort((left, right) => left.permission.localeCompare(right.permission));
+  return decoded;
+};
+const parseCustomRoleGrants = (raw) => {
+  const decoded = decodeCustomRoleGrants(raw);
+  return {
+    grants: decoded.map((item) => ({ permission: item.permission, config: item.grant.canonicalConfig })),
+    referencedRoles: [...new Set(decoded.flatMap((item) => item.grant.referencedRoles))].sort(),
+    referencedProjects: [...new Set(decoded.flatMap((item) => item.grant.referencedProjects))].sort()
+  };
+};
+const decodePersistedGrants = (raw) => {
+  try {
+    return decodeCustomRoleGrants(raw);
+  } catch {
+    return [];
+  }
+};
+const parsePersistedCustomRoleGrants = (raw) => decodePersistedGrants(raw).map((item) => ({ permission: item.permission, config: item.grant.canonicalConfig }));
+const parsePersistedCustomRoleReferences = (raw) => [...new Set(decodePersistedGrants(raw).flatMap((item) => item.grant.referencedRoles))].sort();
+const PROJECT_BOUNDED_KINDS = /* @__PURE__ */ new Set(["MAIL_TEMPLATE_SCOPE"]);
+const buildCustomRolePermissions = (rows, { projectScoped = false } = {}) => {
+  const permissions = new Permissions();
+  for (const row of rows) {
+    for (const item of decodePersistedGrants(row.grants)) {
+      if (projectScoped && !PROJECT_BOUNDED_KINDS.has(item.definition.configurationKind)) {
+        continue;
+      }
+      item.grant.install(permissions, row.slug);
+    }
+  }
+  return permissions;
+};
+const isConfigurationRequired = (definition) => definition.configurationKind !== "NONE";
+export {
+  BUILTIN_TENANT_ROLES,
+  CustomRoleGrantValidationError,
+  GLOBALLY_ASSIGNABLE_BUILTIN_ROLES,
+  buildCustomRolePermissions,
+  getGrantablePermissions,
+  isConfigurationRequired,
+  parseCustomRoleGrants,
+  parsePersistedCustomRoleGrants,
+  parsePersistedCustomRoleReferences
+};
+//# sourceMappingURL=CustomRolePermissions.js.map

package/dist/production/src/model/authorization/CustomRolePermissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CustomRolePermissions.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/CustomRolePermissions.ts"],"sourcesContent":["import { Authorizator, Permissions } from '@contember/authorization'\nimport * as Typesafe from '@contember/typesafe'\nimport {\n\tGlobalApiKeyPermissionMeta,\n\tGlobalRoleMutationPermissionMeta,\n\tMailTemplatePermissionMeta,\n\tPermissionActions,\n\tProfileField,\n\tTargetIdentityPermissionMeta,\n\tTargetIdentityPermissionTarget,\n} from './PermissionActions.js'\nimport { NON_DELEGABLE_TENANT_ROLES, ROLE_SLUG_PATTERN, TenantRole } from './Roles.js'\nimport { CustomRoleRow } from '../type/CustomRole.js'\nimport { MailType, mailTypeFromDbToSchema } from '../mailing/type.js'\n\nexport type CustomRoleConfigurationKind =\n\t| 'NONE'\n\t| 'ROLE_INPUT'\n\t| 'TARGET_IDENTITY'\n\t| 'ROLE_MUTATION'\n\t| 'GLOBAL_API_KEY'\n\t| 'CHANGE_PROFILE'\n\t| 'CREATE_SESSION_TOKEN'\n\t| 'MAIL_TEMPLATE_SCOPE'\n\nexport type CustomRolePermissionDefinition = {\n\treadonly name: string\n\treadonly configurationKind: CustomRoleConfigurationKind\n\treadonly defaultConfig: Typesafe.Json\n\treadonly decode: (raw: Typesafe.Json, path: PropertyKey[]) => DecodedGrant\n}\n\nexport type CanonicalCustomRoleGrant = {\n\treadonly permission: string\n\treadonly config: Typesafe.Json\n}\n\nexport type ParsedCustomRoleGrants = {\n\treadonly grants: readonly CanonicalCustomRoleGrant[]\n\treadonly referencedRoles: readonly string[]\n\treadonly referencedProjects: readonly string[]\n}\n\ntype DecodedGrant = {\n\treadonly canonicalConfig: Typesafe.Json\n\treadonly referencedRoles: readonly string[]\n\treadonly referencedProjects: readonly string[]\n\treadonly install: (permissions: Permissions, role: string) => void\n}\n\ntype RoleInputMeta = {\n\treadonly requestedRoles?: readonly string[]\n}\n\ntype TargetSelector = ReturnType<typeof TargetSelectorSchema>\n\ntype CanonicalRoleConstraint = {\n\treadonly allowed: readonly string[]\n}\n\nconst PROJECT_SLUG_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]*$/\n\n/** Derived, so a new mail type never has to be mirrored here. */\nconst MAIL_TYPES: ReadonlySet<string> = new Set(Object.values(MailType).map(mailTypeFromDbToSchema))\n\nexport const BUILTIN_TENANT_ROLES: ReadonlySet<string> = new Set(Object.values(TenantRole))\n\nexport const GLOBALLY_ASSIGNABLE_BUILTIN_ROLES: ReadonlySet<string> = new Set([\n\tTenantRole.LOGIN,\n\tTenantRole.PERSON,\n\tTenantRole.SUPER_ADMIN,\n\tTenantRole.PROJECT_CREATOR,\n\tTenantRole.PROJECT_ADMIN,\n\tTenantRole.ENTRYPOINT_DEPLOYER,\n])\n\nconst RoleConstraintSchema = Typesafe.noExtraProps(Typesafe.object({\n\tallowed: Typesafe.array(Typesafe.string),\n}))\n\nconst TargetSelectorSchema = Typesafe.noExtraProps(Typesafe.object({\n\tglobalRoles: RoleConstraintSchema,\n\tprojectMemberships: Typesafe.enumeration('none', 'any'),\n}))\n\nconst RoleInputConfigSchema = Typesafe.noExtraProps(Typesafe.object({\n\troles: RoleConstraintSchema,\n}))\n\nconst TargetIdentityConfigSchema = Typesafe.noExtraProps(Typesafe.object({\n\ttarget: TargetSelectorSchema,\n}))\n\nconst RoleMutationConfigSchema = Typesafe.noExtraProps(Typesafe.object({\n\troles: RoleConstraintSchema,\n\ttarget: TargetSelectorSchema,\n\tallowSelf: Typesafe.boolean,\n}))\n\nconst GlobalApiKeyConfigSchema = Typesafe.noExtraProps(Typesafe.object({\n\troles: RoleConstraintSchema,\n\tallowTrustForwardedClientInfo: Typesafe.boolean,\n}))\n\nconst ChangeProfileConfigSchema = Typesafe.noExtraProps(Typesafe.object({\n\ttarget: TargetSelectorSchema,\n\tfields: Typesafe.noExtraProps(Typesafe.object({\n\t\tallowed: Typesafe.array(Typesafe.enumeration('name', 'email')),\n\t})),\n}))\n\nconst CreateSessionTokenConfigSchema = Typesafe.noExtraProps(Typesafe.object({\n\ttarget: TargetSelectorSchema,\n\tsession: Typesafe.noExtraProps(Typesafe.object({\n\t\tmaxExpirationMinutes: Typesafe.integer,\n\t\tallowTrustForwardedClientInfo: Typesafe.boolean,\n\t})),\n}))\n\nconst MailTemplateScopeConfigSchema = Typesafe.noExtraProps(Typesafe.object({\n\tglobal: Typesafe.boolean,\n\tprojects: Typesafe.array(Typesafe.string),\n\ttypes: Typesafe.array(Typesafe.string),\n}))\n\nconst canonicalizeStrings = (\n\tvalues: readonly string[],\n\tpath: PropertyKey[],\n\tvalidate: (value: string) => boolean,\n\tlabel: string,\n): string[] => {\n\tfor (let index = 0; index < values.length; index++) {\n\t\tif (!validate(values[index])) {\n\t\t\tthrow new Typesafe.ParseError([...path, index], `must be a valid ${label}`)\n\t\t}\n\t}\n\treturn [...new Set(values)].sort()\n}\n\nconst canonicalizeRoleConstraint = (constraint: { readonly allowed: readonly string[] }, path: PropertyKey[]): CanonicalRoleConstraint => {\n\tconst allowed = canonicalizeStrings(constraint.allowed, [...path, 'allowed'], role => ROLE_SLUG_PATTERN.test(role), 'tenant role slug')\n\tconst forbidden = allowed.find(role => NON_DELEGABLE_TENANT_ROLES.has(role))\n\tif (forbidden !== undefined) {\n\t\tthrow new Typesafe.ParseError([...path, 'allowed'], `role ${forbidden} is protected and cannot be delegated`)\n\t}\n\treturn { allowed }\n}\n\nconst canonicalizeProjects = (projects: readonly string[], path: PropertyKey[]): string[] =>\n\tcanonicalizeStrings(projects, path, project => PROJECT_SLUG_PATTERN.test(project), 'project slug')\n\nconst canonicalizeMailTypes = (types: readonly string[], path: PropertyKey[]): string[] =>\n\tcanonicalizeStrings(types, path, type => MAIL_TYPES.has(type), 'mail template type')\n\nconst createCanonicalTarget = (target: TargetSelector, path: PropertyKey[]) => ({\n\tglobalRoles: canonicalizeRoleConstraint(target.globalRoles, [...path, 'globalRoles']),\n\tprojectMemberships: target.projectMemberships,\n})\n\nconst getReferencedRoles = (...constraints: readonly CanonicalRoleConstraint[]): string[] =>\n\t[...new Set(constraints.flatMap(constraint => constraint.allowed))].sort()\n\n/**\n * The protected-role check is redundant with `allowed` for anything written through\n * `canonicalizeRoleConstraint`, and kept as a fail-closed backstop for rows persisted\n * before a role became protected.\n */\nconst matchesRoles = (\n\tobserved: readonly string[],\n\tconfig: CanonicalRoleConstraint,\n): boolean => observed.every(role => config.allowed.includes(role) && !NON_DELEGABLE_TENANT_ROLES.has(role))\n\nconst matchesTarget = (\n\ttarget: TargetIdentityPermissionTarget,\n\tconfig: {\n\t\treadonly globalRoles: CanonicalRoleConstraint\n\t\treadonly projectMemberships: 'none' | 'any'\n\t},\n): boolean =>\n\tmatchesRoles(target.globalRoles, config.globalRoles)\n\t&& (config.projectMemberships === 'any' || !target.hasProjectMemberships)\n\nconst noConfigDefinition = (name: string, action: Authorizator.Action): CustomRolePermissionDefinition => ({\n\tname,\n\tconfigurationKind: 'NONE',\n\tdefaultConfig: null,\n\tdecode: (raw, path) => {\n\t\tif (raw !== null) {\n\t\t\tthrow new Typesafe.ParseError(path, 'configuration is not supported for this permission')\n\t\t}\n\t\treturn {\n\t\t\tcanonicalConfig: null,\n\t\t\treferencedRoles: [],\n\t\t\treferencedProjects: [],\n\t\t\tinstall: (permissions, role) => permissions.allow(role, action),\n\t\t}\n\t},\n})\n\nconst roleInputDefinition = (\n\tname: string,\n\taction: (requestedRoles?: readonly string[]) => Authorizator.Action<RoleInputMeta>,\n): CustomRolePermissionDefinition => ({\n\tname,\n\tconfigurationKind: 'ROLE_INPUT',\n\tdefaultConfig: null,\n\tdecode: (raw, path) => {\n\t\tconst config = RoleInputConfigSchema(raw, path)\n\t\tconst roles = canonicalizeRoleConstraint(config.roles, [...path, 'roles'])\n\t\treturn {\n\t\t\tcanonicalConfig: { roles },\n\t\t\treferencedRoles: getReferencedRoles(roles),\n\t\t\treferencedProjects: [],\n\t\t\tinstall: (permissions, role) => permissions.allow(role, action(), meta => meta !== undefined && matchesRoles(meta.requestedRoles ?? [], roles)),\n\t\t}\n\t},\n})\n\nconst targetIdentityDefinition = (\n\tname: string,\n\taction: (target: TargetIdentityPermissionTarget | null) => Authorizator.Action<TargetIdentityPermissionMeta>,\n): CustomRolePermissionDefinition => ({\n\tname,\n\tconfigurationKind: 'TARGET_IDENTITY',\n\tdefaultConfig: null,\n\tdecode: (raw, path) => {\n\t\tconst config = TargetIdentityConfigSchema(raw, path)\n\t\tconst target = createCanonicalTarget(config.target, [...path, 'target'])\n\t\treturn {\n\t\t\tcanonicalConfig: { target },\n\t\t\treferencedRoles: getReferencedRoles(target.globalRoles),\n\t\t\treferencedProjects: [],\n\t\t\tinstall: (permissions, role) =>\n\t\t\t\tpermissions.allow(role, action(null), meta => meta !== undefined && (meta.target === null || matchesTarget(meta.target, target))),\n\t\t}\n\t},\n})\n\nconst roleMutationDefinition = (\n\tname: string,\n\taction: (meta?: GlobalRoleMutationPermissionMeta) => Authorizator.Action<GlobalRoleMutationPermissionMeta | undefined>,\n): CustomRolePermissionDefinition => ({\n\tname,\n\tconfigurationKind: 'ROLE_MUTATION',\n\tdefaultConfig: null,\n\tdecode: (raw, path) => {\n\t\tconst config = RoleMutationConfigSchema(raw, path)\n\t\tconst roles = canonicalizeRoleConstraint(config.roles, [...path, 'roles'])\n\t\tconst target = createCanonicalTarget(config.target, [...path, 'target'])\n\t\tconst allowSelf = config.allowSelf\n\t\treturn {\n\t\t\tcanonicalConfig: { roles, target, allowSelf },\n\t\t\treferencedRoles: getReferencedRoles(roles, target.globalRoles),\n\t\t\treferencedProjects: [],\n\t\t\tinstall: (permissions, role) =>\n\t\t\t\tpermissions.allow(\n\t\t\t\t\trole,\n\t\t\t\t\taction(),\n\t\t\t\t\tmeta =>\n\t\t\t\t\t\tmeta === undefined\n\t\t\t\t\t\t|| ((allowSelf || !meta.self)\n\t\t\t\t\t\t\t&& matchesRoles(meta.requestedRoles, roles)\n\t\t\t\t\t\t\t&& matchesTarget(meta.target, target)),\n\t\t\t\t),\n\t\t}\n\t},\n})\n\nconst globalApiKeyDefinition = (): CustomRolePermissionDefinition => ({\n\tname: 'apiKey:createGlobal',\n\tconfigurationKind: 'GLOBAL_API_KEY',\n\tdefaultConfig: null,\n\tdecode: (raw, path) => {\n\t\tconst config = GlobalApiKeyConfigSchema(raw, path)\n\t\tconst roles = canonicalizeRoleConstraint(config.roles, [...path, 'roles'])\n\t\t// project_admin may not mint a trusted-forwarding key either, and custom roles stay within its surface\n\t\tif (config.allowTrustForwardedClientInfo) {\n\t\t\tthrow new Typesafe.ParseError(\n\t\t\t\t[...path, 'allowTrustForwardedClientInfo'],\n\t\t\t\t'must be false; custom roles cannot create keys trusted to forward client info',\n\t\t\t)\n\t\t}\n\t\treturn {\n\t\t\tcanonicalConfig: { roles, allowTrustForwardedClientInfo: false },\n\t\t\treferencedRoles: getReferencedRoles(roles),\n\t\t\treferencedProjects: [],\n\t\t\tinstall: (permissions, role) =>\n\t\t\t\tpermissions.allow(\n\t\t\t\t\trole,\n\t\t\t\t\tPermissionActions.API_KEY_CREATE_GLOBAL(),\n\t\t\t\t\tmeta =>\n\t\t\t\t\t\tmeta !== undefined\n\t\t\t\t\t\t&& meta.trustForwardedClientInfo !== true\n\t\t\t\t\t\t&& matchesRoles(meta.requestedRoles, roles),\n\t\t\t\t),\n\t\t}\n\t},\n})\n\nconst changeProfileDefinition = (): CustomRolePermissionDefinition => ({\n\tname: 'person:changeProfile',\n\tconfigurationKind: 'CHANGE_PROFILE',\n\tdefaultConfig: null,\n\tdecode: (raw, path) => {\n\t\tconst config = ChangeProfileConfigSchema(raw, path)\n\t\tconst target = createCanonicalTarget(config.target, [...path, 'target'])\n\t\tconst fields: ProfileField[] = [...new Set(config.fields.allowed)].sort()\n\t\tif (fields.length === 0) {\n\t\t\tthrow new Typesafe.ParseError([...path, 'fields', 'allowed'], 'must contain at least one field')\n\t\t}\n\t\treturn {\n\t\t\tcanonicalConfig: { target, fields: { allowed: fields } },\n\t\t\treferencedRoles: getReferencedRoles(target.globalRoles),\n\t\t\treferencedProjects: [],\n\t\t\tinstall: (permissions, role) =>\n\t\t\t\tpermissions.allow(\n\t\t\t\t\trole,\n\t\t\t\t\tPermissionActions.PERSON_CHANGE_PROFILE(null, []),\n\t\t\t\t\tmeta =>\n\t\t\t\t\t\tmeta !== undefined\n\t\t\t\t\t\t&& (meta.target === null || matchesTarget(meta.target, target))\n\t\t\t\t\t\t&& meta.fields.every(field => fields.includes(field)),\n\t\t\t\t),\n\t\t}\n\t},\n})\n\nconst createSessionTokenDefinition = (): CustomRolePermissionDefinition => ({\n\tname: 'person:createSessionToken',\n\tconfigurationKind: 'CREATE_SESSION_TOKEN',\n\tdefaultConfig: null,\n\tdecode: (raw, path) => {\n\t\tconst config = CreateSessionTokenConfigSchema(raw, path)\n\t\tconst target = createCanonicalTarget(config.target, [...path, 'target'])\n\t\tconst maxExpirationMinutes = config.session.maxExpirationMinutes\n\t\tif (maxExpirationMinutes <= 0) {\n\t\t\tthrow new Typesafe.ParseError([...path, 'session', 'maxExpirationMinutes'], 'must be greater than zero')\n\t\t}\n\t\tconst allowTrustForwardedClientInfo = config.session.allowTrustForwardedClientInfo\n\t\treturn {\n\t\t\tcanonicalConfig: {\n\t\t\t\ttarget,\n\t\t\t\tsession: { maxExpirationMinutes, allowTrustForwardedClientInfo },\n\t\t\t},\n\t\t\treferencedRoles: getReferencedRoles(target.globalRoles),\n\t\t\treferencedProjects: [],\n\t\t\tinstall: (permissions, role) =>\n\t\t\t\tpermissions.allow(role, PermissionActions.PERSON_CREATE_SESSION_KEY({ phase: 'preflight' }), meta => {\n\t\t\t\t\tif (meta.phase === 'preflight') {\n\t\t\t\t\t\treturn true\n\t\t\t\t\t}\n\t\t\t\t\treturn meta.target !== undefined\n\t\t\t\t\t\t&& matchesTarget(meta.target, target)\n\t\t\t\t\t\t&& (!meta.trustForwardedClientInfo || allowTrustForwardedClientInfo)\n\t\t\t\t\t\t&& meta.requestedExpirationMinutes !== null\n\t\t\t\t\t\t&& meta.requestedExpirationMinutes !== undefined\n\t\t\t\t\t\t&& meta.requestedExpirationMinutes > 0\n\t\t\t\t\t\t&& meta.requestedExpirationMinutes <= maxExpirationMinutes\n\t\t\t\t}),\n\t\t}\n\t},\n})\n\nconst mailTemplateDefinition = (\n\tname: string,\n\taction: (meta?: MailTemplatePermissionMeta) => Authorizator.Action<MailTemplatePermissionMeta | undefined>,\n): CustomRolePermissionDefinition => ({\n\tname,\n\tconfigurationKind: 'MAIL_TEMPLATE_SCOPE',\n\tdefaultConfig: null,\n\tdecode: (raw, path) => {\n\t\tconst config = MailTemplateScopeConfigSchema(raw, path)\n\t\tconst projects = canonicalizeProjects(config.projects, [...path, 'projects'])\n\t\tconst types = canonicalizeMailTypes(config.types, [...path, 'types'])\n\t\tif (!config.global && projects.length === 0) {\n\t\t\tthrow new Typesafe.ParseError(path, 'must grant global or at least one project scope')\n\t\t}\n\t\tif (types.length === 0) {\n\t\t\tthrow new Typesafe.ParseError([...path, 'types'], 'must contain at least one mail template type')\n\t\t}\n\t\tconst global = config.global\n\t\treturn {\n\t\t\tcanonicalConfig: { global, projects, types },\n\t\t\treferencedRoles: [],\n\t\t\treferencedProjects: projects,\n\t\t\tinstall: (permissions, role) =>\n\t\t\t\tpermissions.allow(role, action(), meta => {\n\t\t\t\t\tif (meta === undefined || !types.includes(meta.type)) {\n\t\t\t\t\t\treturn false\n\t\t\t\t\t}\n\t\t\t\t\treturn meta.kind === 'global' ? global : meta.projectSlug !== null && projects.includes(meta.projectSlug)\n\t\t\t\t}),\n\t\t}\n\t},\n})\n\nconst definitions: readonly CustomRolePermissionDefinition[] = [\n\tnoConfigDefinition('system:configure', PermissionActions.CONFIGURE),\n\tnoConfigDefinition('system:viewConfig', PermissionActions.CONFIG_VIEW),\n\tnoConfigDefinition('system:viewAuthLog', PermissionActions.AUTH_LOG_VIEW),\n\tnoConfigDefinition('person:view', PermissionActions.PERSON_VIEW),\n\tnoConfigDefinition('person:list', PermissionActions.PERSON_LIST),\n\tnoConfigDefinition('entrypoint:deployEntrypoint', PermissionActions.ENTRYPOINT_DEPLOY),\n\tnoConfigDefinition('apiKey:list', PermissionActions.API_KEY_LIST),\n\tnoConfigDefinition('idp:disable', PermissionActions.IDP_DISABLE),\n\tnoConfigDefinition('idp:enable', PermissionActions.IDP_ENABLE),\n\tnoConfigDefinition('idp:list', PermissionActions.IDP_LIST),\n\tnoConfigDefinition('customRole:view', PermissionActions.CUSTOM_ROLE_VIEW),\n\t// Exposes role *names* only. Without it a role holding `identity:addGlobalRoles` reads\n\t// `Identity.roles` as null — it could mutate a role set it was unable to look at first.\n\tnoConfigDefinition('identity:viewPermissions', PermissionActions.IDENTITY_VIEW_PERMISSIONS),\n\troleInputDefinition('person:signUp', PermissionActions.PERSON_SIGN_UP),\n\ttargetIdentityDefinition('person:disable', PermissionActions.PERSON_DISABLE),\n\ttargetIdentityDefinition('person:forceSignOut', PermissionActions.PERSON_FORCE_SIGN_OUT),\n\ttargetIdentityDefinition('person:resetMfa', PermissionActions.PERSON_RESET_MFA),\n\ttargetIdentityDefinition('person:viewSessions', PermissionActions.PERSON_VIEW_SESSIONS),\n\ttargetIdentityDefinition('person:viewIdp', PermissionActions.PERSON_VIEW_IDP),\n\ttargetIdentityDefinition('person:changePassword', PermissionActions.PERSON_CHANGE_PASSWORD),\n\tchangeProfileDefinition(),\n\tcreateSessionTokenDefinition(),\n\troleMutationDefinition('identity:addGlobalRoles', PermissionActions.IDENTITY_ADD_GLOBAL_ROLES),\n\troleMutationDefinition('identity:removeGlobalRoles', PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES),\n\tglobalApiKeyDefinition(),\n\tmailTemplateDefinition('mailTemplate:add', PermissionActions.MAIL_TEMPLATE_ADD),\n\tmailTemplateDefinition('mailTemplate:remove', PermissionActions.MAIL_TEMPLATE_REMOVE),\n\tmailTemplateDefinition('mailTemplate:list', PermissionActions.MAIL_TEMPLATE_LIST),\n]\n\nconst catalog: ReadonlyMap<string, CustomRolePermissionDefinition> = new Map(definitions.map(definition => [definition.name, definition]))\n\nexport const getGrantablePermissions = (): ReadonlyMap<string, CustomRolePermissionDefinition> => catalog\n\nexport type CustomRoleGrantValidationErrorCode =\n\t| 'UNKNOWN_PERMISSION'\n\t| 'DUPLICATE_PERMISSION'\n\t| 'INVALID_PERMISSION_CONFIGURATION'\n\nexport class CustomRoleGrantValidationError extends Error {\n\tconstructor(\n\t\tpublic readonly code: CustomRoleGrantValidationErrorCode,\n\t\tmessage: string,\n\t) {\n\t\tsuper(message)\n\t}\n}\n\nconst parseEnvelope = (\n\traw: unknown,\n\tpath: PropertyKey[],\n): { readonly permission: string; readonly config: Typesafe.Json } => {\n\tconst object = Typesafe.anyJsonObject(raw, path)\n\tfor (const key of Object.keys(object)) {\n\t\tif (key !== 'permission' && key !== 'config') {\n\t\t\tthrow new Typesafe.ParseError(path, `extra property ${key} found`)\n\t\t}\n\t}\n\tconst permission = Typesafe.string(object.permission, [...path, 'permission'])\n\tconst config = object.config === undefined ? null : Typesafe.anyJson(object.config, [...path, 'config'])\n\treturn { permission, config }\n}\n\nconst decodeCustomRoleGrants = (\n\traw: unknown,\n): { readonly permission: string; readonly definition: CustomRolePermissionDefinition; readonly grant: DecodedGrant }[] => {\n\tif (!Array.isArray(raw)) {\n\t\tthrow new CustomRoleGrantValidationError('INVALID_PERMISSION_CONFIGURATION', 'Custom role grants must be an array')\n\t}\n\tconst decoded: { readonly permission: string; readonly definition: CustomRolePermissionDefinition; readonly grant: DecodedGrant }[] = []\n\tconst seen = new Set<string>()\n\tfor (let index = 0; index < raw.length; index++) {\n\t\tlet envelope: { readonly permission: string; readonly config: Typesafe.Json }\n\t\ttry {\n\t\t\tenvelope = parseEnvelope(raw[index], [index])\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof Error ? error.message : 'invalid grant'\n\t\t\tthrow new CustomRoleGrantValidationError('INVALID_PERMISSION_CONFIGURATION', `Grant ${index}: ${message}`)\n\t\t}\n\t\tif (seen.has(envelope.permission)) {\n\t\t\tthrow new CustomRoleGrantValidationError('DUPLICATE_PERMISSION', `Permission ${envelope.permission} is present more than once`)\n\t\t}\n\t\tseen.add(envelope.permission)\n\t\tconst definition = catalog.get(envelope.permission)\n\t\tif (definition === undefined) {\n\t\t\tthrow new CustomRoleGrantValidationError(\n\t\t\t\t'UNKNOWN_PERMISSION',\n\t\t\t\t`Permission ${envelope.permission} is unknown or not grantable to a custom role`,\n\t\t\t)\n\t\t}\n\t\ttry {\n\t\t\tdecoded.push({\n\t\t\t\tpermission: envelope.permission,\n\t\t\t\tdefinition,\n\t\t\t\tgrant: definition.decode(envelope.config, [index, 'config']),\n\t\t\t})\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof Error ? error.message : 'invalid configuration'\n\t\t\tthrow new CustomRoleGrantValidationError(\n\t\t\t\t'INVALID_PERMISSION_CONFIGURATION',\n\t\t\t\t`Grant ${envelope.permission}: ${message}`,\n\t\t\t)\n\t\t}\n\t}\n\tdecoded.sort((left, right) => left.permission.localeCompare(right.permission))\n\treturn decoded\n}\n\nexport const parseCustomRoleGrants = (raw: unknown): ParsedCustomRoleGrants => {\n\tconst decoded = decodeCustomRoleGrants(raw)\n\treturn {\n\t\tgrants: decoded.map(item => ({ permission: item.permission, config: item.grant.canonicalConfig })),\n\t\treferencedRoles: [...new Set(decoded.flatMap(item => item.grant.referencedRoles))].sort(),\n\t\treferencedProjects: [...new Set(decoded.flatMap(item => item.grant.referencedProjects))].sort(),\n\t}\n}\n\n/** A persisted role with any invalid grant is entirely inert, never partially applied. */\nconst decodePersistedGrants = (raw: unknown): ReturnType<typeof decodeCustomRoleGrants> => {\n\ttry {\n\t\treturn decodeCustomRoleGrants(raw)\n\t} catch {\n\t\treturn []\n\t}\n}\n\n/** Fail-closed view of a persisted row, shared by evaluation and by the read API. */\nexport const parsePersistedCustomRoleGrants = (raw: unknown): readonly CanonicalCustomRoleGrant[] =>\n\tdecodePersistedGrants(raw).map(item => ({ permission: item.permission, config: item.grant.canonicalConfig }))\n\n/** Role slugs a persisted row's configuration names. An undecodable row is wholly inert, so it references nothing. */\nexport const parsePersistedCustomRoleReferences = (raw: unknown): readonly string[] =>\n\t[...new Set(decodePersistedGrants(raw).flatMap(item => item.grant.referencedRoles))].sort()\n\n/**\n * Configuration kinds that carry their own exact project filter (`mailTemplate:*` matches project\n * slugs verbatim), so they can answer a project-scoped check on their own terms. Every other kind\n * is bounded only by being tenant-global, and `CustomRoleAuthorizator` drops the scope — so letting\n * one satisfy a scoped check would grant it on *every* project. New kinds default to the safe side.\n */\nconst PROJECT_BOUNDED_KINDS: ReadonlySet<CustomRoleConfigurationKind> = new Set<CustomRoleConfigurationKind>(['MAIL_TEMPLATE_SCOPE'])\n\nexport const buildCustomRolePermissions = (\n\trows: readonly CustomRoleRow[],\n\t{ projectScoped = false }: { readonly projectScoped?: boolean } = {},\n): Permissions => {\n\tconst permissions = new Permissions()\n\tfor (const row of rows) {\n\t\tfor (const item of decodePersistedGrants(row.grants)) {\n\t\t\tif (projectScoped && !PROJECT_BOUNDED_KINDS.has(item.definition.configurationKind)) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\titem.grant.install(permissions, row.slug)\n\t\t}\n\t}\n\treturn permissions\n}\n\n/** Every kind but `NONE` carries a required config object; there is nothing else to store. */\nexport const isConfigurationRequired = (definition: CustomRolePermissionDefinition): boolean => definition.configurationKind !== 'NONE'\n"],"names":[],"mappings":";;;;;AA4DA,MAAM,uBAAuB;AAG7B,MAAM,aAAkC,IAAI,IAAI,OAAO,OAAO,QAAQ,EAAE,IAAI,sBAAsB,CAAC;AAE5F,MAAM,uBAA4C,IAAI,IAAI,OAAO,OAAO,UAAU,CAAC;AAEnF,MAAM,wDAA6D,IAAI;AAAA,EAC7E,WAAW;AAAA,EACX,WAAW;AAAA,EACX,WAAW;AAAA,EACX,WAAW;AAAA,EACX,WAAW;AAAA,EACX,WAAW;AACZ,CAAC;AAED,MAAM,uBAAuB,SAAS,aAAa,SAAS,OAAO;AAAA,EAClE,SAAS,SAAS,MAAM,SAAS,MAAM;AACxC,CAAC,CAAC;AAEF,MAAM,uBAAuB,SAAS,aAAa,SAAS,OAAO;AAAA,EAClE,aAAa;AAAA,EACb,oBAAoB,SAAS,YAAY,QAAQ,KAAK;AACvD,CAAC,CAAC;AAEF,MAAM,wBAAwB,SAAS,aAAa,SAAS,OAAO;AAAA,EACnE,OAAO;AACR,CAAC,CAAC;AAEF,MAAM,6BAA6B,SAAS,aAAa,SAAS,OAAO;AAAA,EACxE,QAAQ;AACT,CAAC,CAAC;AAEF,MAAM,2BAA2B,SAAS,aAAa,SAAS,OAAO;AAAA,EACtE,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,WAAW,SAAS;AACrB,CAAC,CAAC;AAEF,MAAM,2BAA2B,SAAS,aAAa,SAAS,OAAO;AAAA,EACtE,OAAO;AAAA,EACP,+BAA+B,SAAS;AACzC,CAAC,CAAC;AAEF,MAAM,4BAA4B,SAAS,aAAa,SAAS,OAAO;AAAA,EACvE,QAAQ;AAAA,EACR,QAAQ,SAAS,aAAa,SAAS,OAAO;AAAA,IAC7C,SAAS,SAAS,MAAM,SAAS,YAAY,QAAQ,OAAO,CAAC;AAAA,EAAA,CAC7D,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,iCAAiC,SAAS,aAAa,SAAS,OAAO;AAAA,EAC5E,QAAQ;AAAA,EACR,SAAS,SAAS,aAAa,SAAS,OAAO;AAAA,IAC9C,sBAAsB,SAAS;AAAA,IAC/B,+BAA+B,SAAS;AAAA,EAAA,CACxC,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,gCAAgC,SAAS,aAAa,SAAS,OAAO;AAAA,EAC3E,QAAQ,SAAS;AAAA,EACjB,UAAU,SAAS,MAAM,SAAS,MAAM;AAAA,EACxC,OAAO,SAAS,MAAM,SAAS,MAAM;AACtC,CAAC,CAAC;AAEF,MAAM,sBAAsB,CAC3B,QACA,MACA,UACA,UACc;AACd,WAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS;AACnD,QAAI,CAAC,SAAS,OAAO,KAAK,CAAC,GAAG;AAC7B,YAAM,IAAI,SAAS,WAAW,CAAC,GAAG,MAAM,KAAK,GAAG,mBAAmB,KAAK,EAAE;AAAA,IAC3E;AAAA,EACD;AACA,SAAO,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAA;AAC7B;AAEA,MAAM,6BAA6B,CAAC,YAAqD,SAAiD;AACzI,QAAM,UAAU,oBAAoB,WAAW,SAAS,CAAC,GAAG,MAAM,SAAS,GAAG,CAAA,SAAQ,kBAAkB,KAAK,IAAI,GAAG,kBAAkB;AACtI,QAAM,YAAY,QAAQ,KAAK,UAAQ,2BAA2B,IAAI,IAAI,CAAC;AAC3E,MAAI,cAAc,QAAW;AAC5B,UAAM,IAAI,SAAS,WAAW,CAAC,GAAG,MAAM,SAAS,GAAG,QAAQ,SAAS,uCAAuC;AAAA,EAC7G;AACA,SAAO,EAAE,QAAA;AACV;AAEA,MAAM,uBAAuB,CAAC,UAA6B,SAC1D,oBAAoB,UAAU,MAAM,CAAA,YAAW,qBAAqB,KAAK,OAAO,GAAG,cAAc;AAElG,MAAM,wBAAwB,CAAC,OAA0B,SACxD,oBAAoB,OAAO,MAAM,CAAA,SAAQ,WAAW,IAAI,IAAI,GAAG,oBAAoB;AAEpF,MAAM,wBAAwB,CAAC,QAAwB,UAAyB;AAAA,EAC/E,aAAa,2BAA2B,OAAO,aAAa,CAAC,GAAG,MAAM,aAAa,CAAC;AAAA,EACpF,oBAAoB,OAAO;AAC5B;AAEA,MAAM,qBAAqB,IAAI,gBAC9B,CAAC,GAAG,IAAI,IAAI,YAAY,QAAQ,gBAAc,WAAW,OAAO,CAAC,CAAC,EAAE,KAAA;AAOrE,MAAM,eAAe,CACpB,UACA,WACa,SAAS,MAAM,CAAA,SAAQ,OAAO,QAAQ,SAAS,IAAI,KAAK,CAAC,2BAA2B,IAAI,IAAI,CAAC;AAE3G,MAAM,gBAAgB,CACrB,QACA,WAKA,aAAa,OAAO,aAAa,OAAO,WAAW,MAC/C,OAAO,uBAAuB,SAAS,CAAC,OAAO;AAEpD,MAAM,qBAAqB,CAAC,MAAc,YAAiE;AAAA,EAC1G;AAAA,EACA,mBAAmB;AAAA,EACnB,eAAe;AAAA,EACf,QAAQ,CAAC,KAAK,SAAS;AACtB,QAAI,QAAQ,MAAM;AACjB,YAAM,IAAI,SAAS,WAAW,MAAM,oDAAoD;AAAA,IACzF;AACA,WAAO;AAAA,MACN,iBAAiB;AAAA,MACjB,iBAAiB,CAAA;AAAA,MACjB,oBAAoB,CAAA;AAAA,MACpB,SAAS,CAAC,aAAa,SAAS,YAAY,MAAM,MAAM,MAAM;AAAA,IAAA;AAAA,EAEhE;AACD;AAEA,MAAM,sBAAsB,CAC3B,MACA,YACqC;AAAA,EACrC;AAAA,EACA,mBAAmB;AAAA,EACnB,eAAe;AAAA,EACf,QAAQ,CAAC,KAAK,SAAS;AACtB,UAAM,SAAS,sBAAsB,KAAK,IAAI;AAC9C,UAAM,QAAQ,2BAA2B,OAAO,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC;AACzE,WAAO;AAAA,MACN,iBAAiB,EAAE,MAAA;AAAA,MACnB,iBAAiB,mBAAmB,KAAK;AAAA,MACzC,oBAAoB,CAAA;AAAA,MACpB,SAAS,CAAC,aAAa,SAAS,YAAY,MAAM,MAAM,OAAA,GAAU,CAAA,SAAQ,SAAS,UAAa,aAAa,KAAK,kBAAkB,CAAA,GAAI,KAAK,CAAC;AAAA,IAAA;AAAA,EAEhJ;AACD;AAEA,MAAM,2BAA2B,CAChC,MACA,YACqC;AAAA,EACrC;AAAA,EACA,mBAAmB;AAAA,EACnB,eAAe;AAAA,EACf,QAAQ,CAAC,KAAK,SAAS;AACtB,UAAM,SAAS,2BAA2B,KAAK,IAAI;AACnD,UAAM,SAAS,sBAAsB,OAAO,QAAQ,CAAC,GAAG,MAAM,QAAQ,CAAC;AACvE,WAAO;AAAA,MACN,iBAAiB,EAAE,OAAA;AAAA,MACnB,iBAAiB,mBAAmB,OAAO,WAAW;AAAA,MACtD,oBAAoB,CAAA;AAAA,MACpB,SAAS,CAAC,aAAa,SACtB,YAAY,MAAM,MAAM,OAAO,IAAI,GAAG,UAAQ,SAAS,WAAc,KAAK,WAAW,QAAQ,cAAc,KAAK,QAAQ,MAAM,EAAE;AAAA,IAAA;AAAA,EAEnI;AACD;AAEA,MAAM,yBAAyB,CAC9B,MACA,YACqC;AAAA,EACrC;AAAA,EACA,mBAAmB;AAAA,EACnB,eAAe;AAAA,EACf,QAAQ,CAAC,KAAK,SAAS;AACtB,UAAM,SAAS,yBAAyB,KAAK,IAAI;AACjD,UAAM,QAAQ,2BAA2B,OAAO,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC;AACzE,UAAM,SAAS,sBAAsB,OAAO,QAAQ,CAAC,GAAG,MAAM,QAAQ,CAAC;AACvE,UAAM,YAAY,OAAO;AACzB,WAAO;AAAA,MACN,iBAAiB,EAAE,OAAO,QAAQ,UAAA;AAAA,MAClC,iBAAiB,mBAAmB,OAAO,OAAO,WAAW;AAAA,MAC7D,oBAAoB,CAAA;AAAA,MACpB,SAAS,CAAC,aAAa,SACtB,YAAY;AAAA,QACX;AAAA,QACA,OAAA;AAAA,QACA,CAAA,SACC,SAAS,WACJ,aAAa,CAAC,KAAK,SACpB,aAAa,KAAK,gBAAgB,KAAK,KACvC,cAAc,KAAK,QAAQ,MAAM;AAAA,MAAA;AAAA,IACvC;AAAA,EAEH;AACD;AAEA,MAAM,yBAAyB,OAAuC;AAAA,EACrE,MAAM;AAAA,EACN,mBAAmB;AAAA,EACnB,eAAe;AAAA,EACf,QAAQ,CAAC,KAAK,SAAS;AACtB,UAAM,SAAS,yBAAyB,KAAK,IAAI;AACjD,UAAM,QAAQ,2BAA2B,OAAO,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC;AAEzE,QAAI,OAAO,+BAA+B;AACzC,YAAM,IAAI,SAAS;AAAA,QAClB,CAAC,GAAG,MAAM,+BAA+B;AAAA,QACzC;AAAA,MAAA;AAAA,IAEF;AACA,WAAO;AAAA,MACN,iBAAiB,EAAE,OAAO,+BAA+B,MAAA;AAAA,MACzD,iBAAiB,mBAAmB,KAAK;AAAA,MACzC,oBAAoB,CAAA;AAAA,MACpB,SAAS,CAAC,aAAa,SACtB,YAAY;AAAA,QACX;AAAA,QACA,kBAAkB,sBAAA;AAAA,QAClB,CAAA,SACC,SAAS,UACN,KAAK,6BAA6B,QAClC,aAAa,KAAK,gBAAgB,KAAK;AAAA,MAAA;AAAA,IAC5C;AAAA,EAEH;AACD;AAEA,MAAM,0BAA0B,OAAuC;AAAA,EACtE,MAAM;AAAA,EACN,mBAAmB;AAAA,EACnB,eAAe;AAAA,EACf,QAAQ,CAAC,KAAK,SAAS;AACtB,UAAM,SAAS,0BAA0B,KAAK,IAAI;AAClD,UAAM,SAAS,sBAAsB,OAAO,QAAQ,CAAC,GAAG,MAAM,QAAQ,CAAC;AACvE,UAAM,SAAyB,CAAC,GAAG,IAAI,IAAI,OAAO,OAAO,OAAO,CAAC,EAAE,KAAA;AACnE,QAAI,OAAO,WAAW,GAAG;AACxB,YAAM,IAAI,SAAS,WAAW,CAAC,GAAG,MAAM,UAAU,SAAS,GAAG,iCAAiC;AAAA,IAChG;AACA,WAAO;AAAA,MACN,iBAAiB,EAAE,QAAQ,QAAQ,EAAE,SAAS,SAAO;AAAA,MACrD,iBAAiB,mBAAmB,OAAO,WAAW;AAAA,MACtD,oBAAoB,CAAA;AAAA,MACpB,SAAS,CAAC,aAAa,SACtB,YAAY;AAAA,QACX;AAAA,QACA,kBAAkB,sBAAsB,MAAM,EAAE;AAAA,QAChD,UACC,SAAS,WACL,KAAK,WAAW,QAAQ,cAAc,KAAK,QAAQ,MAAM,MAC1D,KAAK,OAAO,MAAM,WAAS,OAAO,SAAS,KAAK,CAAC;AAAA,MAAA;AAAA,IACtD;AAAA,EAEH;AACD;AAEA,MAAM,+BAA+B,OAAuC;AAAA,EAC3E,MAAM;AAAA,EACN,mBAAmB;AAAA,EACnB,eAAe;AAAA,EACf,QAAQ,CAAC,KAAK,SAAS;AACtB,UAAM,SAAS,+BAA+B,KAAK,IAAI;AACvD,UAAM,SAAS,sBAAsB,OAAO,QAAQ,CAAC,GAAG,MAAM,QAAQ,CAAC;AACvE,UAAM,uBAAuB,OAAO,QAAQ;AAC5C,QAAI,wBAAwB,GAAG;AAC9B,YAAM,IAAI,SAAS,WAAW,CAAC,GAAG,MAAM,WAAW,sBAAsB,GAAG,2BAA2B;AAAA,IACxG;AACA,UAAM,gCAAgC,OAAO,QAAQ;AACrD,WAAO;AAAA,MACN,iBAAiB;AAAA,QAChB;AAAA,QACA,SAAS,EAAE,sBAAsB,8BAAA;AAAA,MAA8B;AAAA,MAEhE,iBAAiB,mBAAmB,OAAO,WAAW;AAAA,MACtD,oBAAoB,CAAA;AAAA,MACpB,SAAS,CAAC,aAAa,SACtB,YAAY,MAAM,MAAM,kBAAkB,0BAA0B,EAAE,OAAO,YAAA,CAAa,GAAG,CAAA,SAAQ;AACpG,YAAI,KAAK,UAAU,aAAa;AAC/B,iBAAO;AAAA,QACR;AACA,eAAO,KAAK,WAAW,UACnB,cAAc,KAAK,QAAQ,MAAM,MAChC,CAAC,KAAK,4BAA4B,kCACnC,KAAK,+BAA+B,QACpC,KAAK,+BAA+B,UACpC,KAAK,6BAA6B,KAClC,KAAK,8BAA8B;AAAA,MACxC,CAAC;AAAA,IAAA;AAAA,EAEJ;AACD;AAEA,MAAM,yBAAyB,CAC9B,MACA,YACqC;AAAA,EACrC;AAAA,EACA,mBAAmB;AAAA,EACnB,eAAe;AAAA,EACf,QAAQ,CAAC,KAAK,SAAS;AACtB,UAAM,SAAS,8BAA8B,KAAK,IAAI;AACtD,UAAM,WAAW,qBAAqB,OAAO,UAAU,CAAC,GAAG,MAAM,UAAU,CAAC;AAC5E,UAAM,QAAQ,sBAAsB,OAAO,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC;AACpE,QAAI,CAAC,OAAO,UAAU,SAAS,WAAW,GAAG;AAC5C,YAAM,IAAI,SAAS,WAAW,MAAM,iDAAiD;AAAA,IACtF;AACA,QAAI,MAAM,WAAW,GAAG;AACvB,YAAM,IAAI,SAAS,WAAW,CAAC,GAAG,MAAM,OAAO,GAAG,8CAA8C;AAAA,IACjG;AACA,UAAM,SAAS,OAAO;AACtB,WAAO;AAAA,MACN,iBAAiB,EAAE,QAAQ,UAAU,MAAA;AAAA,MACrC,iBAAiB,CAAA;AAAA,MACjB,oBAAoB;AAAA,MACpB,SAAS,CAAC,aAAa,SACtB,YAAY,MAAM,MAAM,UAAU,CAAA,SAAQ;AACzC,YAAI,SAAS,UAAa,CAAC,MAAM,SAAS,KAAK,IAAI,GAAG;AACrD,iBAAO;AAAA,QACR;AACA,eAAO,KAAK,SAAS,WAAW,SAAS,KAAK,gBAAgB,QAAQ,SAAS,SAAS,KAAK,WAAW;AAAA,MACzG,CAAC;AAAA,IAAA;AAAA,EAEJ;AACD;AAEA,MAAM,cAAyD;AAAA,EAC9D,mBAAmB,oBAAoB,kBAAkB,SAAS;AAAA,EAClE,mBAAmB,qBAAqB,kBAAkB,WAAW;AAAA,EACrE,mBAAmB,sBAAsB,kBAAkB,aAAa;AAAA,EACxE,mBAAmB,eAAe,kBAAkB,WAAW;AAAA,EAC/D,mBAAmB,eAAe,kBAAkB,WAAW;AAAA,EAC/D,mBAAmB,+BAA+B,kBAAkB,iBAAiB;AAAA,EACrF,mBAAmB,eAAe,kBAAkB,YAAY;AAAA,EAChE,mBAAmB,eAAe,kBAAkB,WAAW;AAAA,EAC/D,mBAAmB,cAAc,kBAAkB,UAAU;AAAA,EAC7D,mBAAmB,YAAY,kBAAkB,QAAQ;AAAA,EACzD,mBAAmB,mBAAmB,kBAAkB,gBAAgB;AAAA;AAAA;AAAA,EAGxE,mBAAmB,4BAA4B,kBAAkB,yBAAyB;AAAA,EAC1F,oBAAoB,iBAAiB,kBAAkB,cAAc;AAAA,EACrE,yBAAyB,kBAAkB,kBAAkB,cAAc;AAAA,EAC3E,yBAAyB,uBAAuB,kBAAkB,qBAAqB;AAAA,EACvF,yBAAyB,mBAAmB,kBAAkB,gBAAgB;AAAA,EAC9E,yBAAyB,uBAAuB,kBAAkB,oBAAoB;AAAA,EACtF,yBAAyB,kBAAkB,kBAAkB,eAAe;AAAA,EAC5E,yBAAyB,yBAAyB,kBAAkB,sBAAsB;AAAA,EAC1F,wBAAA;AAAA,EACA,6BAAA;AAAA,EACA,uBAAuB,2BAA2B,kBAAkB,yBAAyB;AAAA,EAC7F,uBAAuB,8BAA8B,kBAAkB,4BAA4B;AAAA,EACnG,uBAAA;AAAA,EACA,uBAAuB,oBAAoB,kBAAkB,iBAAiB;AAAA,EAC9E,uBAAuB,uBAAuB,kBAAkB,oBAAoB;AAAA,EACpF,uBAAuB,qBAAqB,kBAAkB,kBAAkB;AACjF;AAEA,MAAM,UAA+D,IAAI,IAAI,YAAY,IAAI,CAAA,eAAc,CAAC,WAAW,MAAM,UAAU,CAAC,CAAC;AAElI,MAAM,0BAA0B,MAA2D;AAO3F,MAAM,uCAAuC,MAAM;AAAA,EACzD,YACiB,MAChB,SACC;AACD,UAAM,OAAO;AAHG,SAAA,OAAA;AAAA,EAIjB;AACD;AAEA,MAAM,gBAAgB,CACrB,KACA,SACqE;AACrE,QAAM,SAAS,SAAS,cAAc,KAAK,IAAI;AAC/C,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACtC,QAAI,QAAQ,gBAAgB,QAAQ,UAAU;AAC7C,YAAM,IAAI,SAAS,WAAW,MAAM,kBAAkB,GAAG,QAAQ;AAAA,IAClE;AAAA,EACD;AACA,QAAM,aAAa,SAAS,OAAO,OAAO,YAAY,CAAC,GAAG,MAAM,YAAY,CAAC;AAC7E,QAAM,SAAS,OAAO,WAAW,SAAY,OAAO,SAAS,QAAQ,OAAO,QAAQ,CAAC,GAAG,MAAM,QAAQ,CAAC;AACvG,SAAO,EAAE,YAAY,OAAA;AACtB;AAEA,MAAM,yBAAyB,CAC9B,QAC0H;AAC1H,MAAI,CAAC,MAAM,QAAQ,GAAG,GAAG;AACxB,UAAM,IAAI,+BAA+B,oCAAoC,qCAAqC;AAAA,EACnH;AACA,QAAM,UAAgI,CAAA;AACtI,QAAM,2BAAW,IAAA;AACjB,WAAS,QAAQ,GAAG,QAAQ,IAAI,QAAQ,SAAS;AAChD,QAAI;AACJ,QAAI;AACH,iBAAW,cAAc,IAAI,KAAK,GAAG,CAAC,KAAK,CAAC;AAAA,IAC7C,SAAS,OAAO;AACf,YAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,YAAM,IAAI,+BAA+B,oCAAoC,SAAS,KAAK,KAAK,OAAO,EAAE;AAAA,IAC1G;AACA,QAAI,KAAK,IAAI,SAAS,UAAU,GAAG;AAClC,YAAM,IAAI,+BAA+B,wBAAwB,cAAc,SAAS,UAAU,4BAA4B;AAAA,IAC/H;AACA,SAAK,IAAI,SAAS,UAAU;AAC5B,UAAM,aAAa,QAAQ,IAAI,SAAS,UAAU;AAClD,QAAI,eAAe,QAAW;AAC7B,YAAM,IAAI;AAAA,QACT;AAAA,QACA,cAAc,SAAS,UAAU;AAAA,MAAA;AAAA,IAEnC;AACA,QAAI;AACH,cAAQ,KAAK;AAAA,QACZ,YAAY,SAAS;AAAA,QACrB;AAAA,QACA,OAAO,WAAW,OAAO,SAAS,QAAQ,CAAC,OAAO,QAAQ,CAAC;AAAA,MAAA,CAC3D;AAAA,IACF,SAAS,OAAO;AACf,YAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,YAAM,IAAI;AAAA,QACT;AAAA,QACA,SAAS,SAAS,UAAU,KAAK,OAAO;AAAA,MAAA;AAAA,IAE1C;AAAA,EACD;AACA,UAAQ,KAAK,CAAC,MAAM,UAAU,KAAK,WAAW,cAAc,MAAM,UAAU,CAAC;AAC7E,SAAO;AACR;AAEO,MAAM,wBAAwB,CAAC,QAAyC;AAC9E,QAAM,UAAU,uBAAuB,GAAG;AAC1C,SAAO;AAAA,IACN,QAAQ,QAAQ,IAAI,CAAA,UAAS,EAAE,YAAY,KAAK,YAAY,QAAQ,KAAK,MAAM,gBAAA,EAAkB;AAAA,IACjG,iBAAiB,CAAC,GAAG,IAAI,IAAI,QAAQ,QAAQ,CAAA,SAAQ,KAAK,MAAM,eAAe,CAAC,CAAC,EAAE,KAAA;AAAA,IACnF,oBAAoB,CAAC,GAAG,IAAI,IAAI,QAAQ,QAAQ,CAAA,SAAQ,KAAK,MAAM,kBAAkB,CAAC,CAAC,EAAE,KAAA;AAAA,EAAK;AAEhG;AAGA,MAAM,wBAAwB,CAAC,QAA4D;AAC1F,MAAI;AACH,WAAO,uBAAuB,GAAG;AAAA,EAClC,QAAQ;AACP,WAAO,CAAA;AAAA,EACR;AACD;AAGO,MAAM,iCAAiC,CAAC,QAC9C,sBAAsB,GAAG,EAAE,IAAI,CAAA,UAAS,EAAE,YAAY,KAAK,YAAY,QAAQ,KAAK,MAAM,kBAAkB;AAGtG,MAAM,qCAAqC,CAAC,QAClD,CAAC,GAAG,IAAI,IAAI,sBAAsB,GAAG,EAAE,QAAQ,UAAQ,KAAK,MAAM,eAAe,CAAC,CAAC,EAAE,KAAA;AAQtF,MAAM,wBAAkE,oBAAI,IAAiC,CAAC,qBAAqB,CAAC;AAE7H,MAAM,6BAA6B,CACzC,MACA,EAAE,gBAAgB,MAAA,IAAgD,CAAA,MACjD;AACjB,QAAM,cAAc,IAAI,YAAA;AACxB,aAAW,OAAO,MAAM;AACvB,eAAW,QAAQ,sBAAsB,IAAI,MAAM,GAAG;AACrD,UAAI,iBAAiB,CAAC,sBAAsB,IAAI,KAAK,WAAW,iBAAiB,GAAG;AACnF;AAAA,MACD;AACA,WAAK,MAAM,QAAQ,aAAa,IAAI,IAAI;AAAA,IACzC;AAAA,EACD;AACA,SAAO;AACR;AAGO,MAAM,0BAA0B,CAAC,eAAwD,WAAW,sBAAsB;"}

package/dist/production/src/model/authorization/PermissionActions.cjs

@@ -12,37 +12,38 @@ exports.PermissionActions = void 0;
     Resources2["apiKey"] = "apiKey";
     Resources2["mailTemplate"] = "mailTemplate";
     Resources2["idp"] = "idp";
+    Resources2["customRole"] = "customRole";
   })(PermissionActions2.Resources || (PermissionActions2.Resources = {}));
   PermissionActions2.CONFIGURE = authorization.Authorizator.createAction("system", "configure");
   PermissionActions2.CONFIG_VIEW = authorization.Authorizator.createAction("system", "viewConfig");
   PermissionActions2.AUTH_LOG_VIEW = authorization.Authorizator.createAction("system", "viewAuthLog");
   PermissionActions2.IDENTITY_VIEW_PERMISSIONS = authorization.Authorizator.createAction("identity", "viewPermissions");
-  PermissionActions2.IDENTITY_ADD_GLOBAL_ROLES = (roles) => authorization.Authorizator.createAction("identity", "addGlobalRoles", { roles });
-  PermissionActions2.IDENTITY_REMOVE_GLOBAL_ROLES = (roles) => authorization.Authorizator.createAction("identity", "removeGlobalRoles", { roles });
-  PermissionActions2.PERSON_DISABLE = (roles) => authorization.Authorizator.createAction("person", "disable", { roles });
-  PermissionActions2.PERSON_FORCE_SIGN_OUT = (roles) => authorization.Authorizator.createAction("person", "forceSignOut", { roles });
-  PermissionActions2.PERSON_RESET_MFA = (roles) => authorization.Authorizator.createAction("person", "resetMfa", { roles });
+  PermissionActions2.IDENTITY_ADD_GLOBAL_ROLES = (meta) => authorization.Authorizator.createAction("identity", "addGlobalRoles", meta);
+  PermissionActions2.IDENTITY_REMOVE_GLOBAL_ROLES = (meta) => authorization.Authorizator.createAction("identity", "removeGlobalRoles", meta);
+  PermissionActions2.PERSON_DISABLE = (target) => authorization.Authorizator.createAction("person", "disable", { target });
+  PermissionActions2.PERSON_FORCE_SIGN_OUT = (target) => authorization.Authorizator.createAction("person", "forceSignOut", { target });
+  PermissionActions2.PERSON_RESET_MFA = (target) => authorization.Authorizator.createAction("person", "resetMfa", { target });
   PermissionActions2.PERSON_REVOKE_SESSION = authorization.Authorizator.createAction("person", "revokeSession");
-  PermissionActions2.PERSON_VIEW_SESSIONS = (roles) => authorization.Authorizator.createAction("person", "viewSessions", { roles });
+  PermissionActions2.PERSON_VIEW_SESSIONS = (target) => authorization.Authorizator.createAction("person", "viewSessions", { target });
   PermissionActions2.PERSON_VIEW = authorization.Authorizator.createAction("person", "view");
   PermissionActions2.PERSON_LIST = authorization.Authorizator.createAction("person", "list");
   PermissionActions2.PERSON_SIGN_IN = authorization.Authorizator.createAction("person", "signIn");
-  PermissionActions2.PERSON_SIGN_UP = (roles) => authorization.Authorizator.createAction("person", "signUp", { roles });
+  PermissionActions2.PERSON_SIGN_UP = (requestedRoles) => authorization.Authorizator.createAction("person", "signUp", { requestedRoles });
   PermissionActions2.PERSON_SIGN_OUT = authorization.Authorizator.createAction("person", "signOut");
   PermissionActions2.PERSON_SETUP_OTP = authorization.Authorizator.createAction("person", "setupOtp");
-  PermissionActions2.PERSON_CHANGE_PROFILE = (roles) => authorization.Authorizator.createAction("person", "changeProfile", { roles });
+  PermissionActions2.PERSON_CHANGE_PROFILE = (target, fields) => authorization.Authorizator.createAction("person", "changeProfile", { target, fields });
   PermissionActions2.PERSON_CHANGE_MY_PROFILE = authorization.Authorizator.createAction("person", "changeMyProfile");
   PermissionActions2.PERSON_TOGGLE_PASSWORDLESS = authorization.Authorizator.createAction("person", "togglePasswordless");
-  PermissionActions2.PERSON_CHANGE_PASSWORD = (roles) => authorization.Authorizator.createAction("person", "changePassword", { roles });
+  PermissionActions2.PERSON_CHANGE_PASSWORD = (target) => authorization.Authorizator.createAction("person", "changePassword", { target });
   PermissionActions2.PERSON_CHANGE_MY_PASSWORD = authorization.Authorizator.createAction("person", "changeMyPassword");
   PermissionActions2.PERSON_RESET_PASSWORD = authorization.Authorizator.createAction("person", "resetPassword");
   PermissionActions2.PERSON_CREATE_IDP_URL = authorization.Authorizator.createAction("person", "createIdPUrl");
   PermissionActions2.PERSON_SIGN_IN_IDP = authorization.Authorizator.createAction("person", "signInIdp");
-  PermissionActions2.PERSON_VIEW_IDP = (roles) => authorization.Authorizator.createAction("person", "viewIdp", { roles });
+  PermissionActions2.PERSON_VIEW_IDP = (target) => authorization.Authorizator.createAction("person", "viewIdp", { target });
   PermissionActions2.PERSON_DISCONNECT_MY_IDP = authorization.Authorizator.createAction("person", "disconnectMyIdp");
   PermissionActions2.PERSON_REQUEST_PASSWORDLESS_SIGN_IN = authorization.Authorizator.createAction("person", "requestPasswordlessSignIn");
   PermissionActions2.PERSON_PASSWORDLESS_SIGN_IN = authorization.Authorizator.createAction("person", "passwordlessSignIn");
-  PermissionActions2.PERSON_CREATE_SESSION_KEY = (roles) => authorization.Authorizator.createAction("person", "createSessionToken", { roles });
+  PermissionActions2.PERSON_CREATE_SESSION_KEY = (meta) => authorization.Authorizator.createAction("person", "createSessionToken", meta);
   PermissionActions2.PERSON_INVITE = (memberships) => authorization.Authorizator.createAction("person", "invite", { memberships });
   PermissionActions2.PERSON_INVITE_UNMANAGED = (memberships) => authorization.Authorizator.createAction("person", "invite_unmanaged", { memberships });
   PermissionActions2.PROJECT_VIEW = authorization.Authorizator.createAction("project", "view");
@@ -55,17 +56,19 @@ exports.PermissionActions = void 0;
   PermissionActions2.PROJECT_ADD_MEMBER = (memberships) => authorization.Authorizator.createAction("project", "addMember", { memberships });
   PermissionActions2.PROJECT_REMOVE_MEMBER = (memberships) => authorization.Authorizator.createAction("project", "removeMember", { memberships });
   PermissionActions2.PROJECT_UPDATE_MEMBER = (memberships) => authorization.Authorizator.createAction("project", "updateMember", { memberships });
-  PermissionActions2.API_KEY_CREATE = authorization.Authorizator.createAction("apiKey", "create");
-  PermissionActions2.API_KEY_CREATE_GLOBAL = (roles) => authorization.Authorizator.createAction("apiKey", "createGlobal", { roles });
+  PermissionActions2.API_KEY_CREATE = (meta) => authorization.Authorizator.createAction("apiKey", "create", meta);
+  PermissionActions2.API_KEY_CREATE_GLOBAL = (meta) => authorization.Authorizator.createAction("apiKey", "createGlobal", meta);
   PermissionActions2.API_KEY_DISABLE = authorization.Authorizator.createAction("apiKey", "disable");
   PermissionActions2.API_KEY_LIST = authorization.Authorizator.createAction("apiKey", "list");
-  PermissionActions2.MAIL_TEMPLATE_ADD = authorization.Authorizator.createAction("mailTemplate", "add");
-  PermissionActions2.MAIL_TEMPLATE_REMOVE = authorization.Authorizator.createAction("mailTemplate", "remove");
-  PermissionActions2.MAIL_TEMPLATE_LIST = authorization.Authorizator.createAction("mailTemplate", "list");
+  PermissionActions2.MAIL_TEMPLATE_ADD = (meta) => authorization.Authorizator.createAction("mailTemplate", "add", meta);
+  PermissionActions2.MAIL_TEMPLATE_REMOVE = (meta) => authorization.Authorizator.createAction("mailTemplate", "remove", meta);
+  PermissionActions2.MAIL_TEMPLATE_LIST = (meta) => authorization.Authorizator.createAction("mailTemplate", "list", meta);
   PermissionActions2.IDP_ADD = authorization.Authorizator.createAction("idp", "add");
   PermissionActions2.IDP_UPDATE = authorization.Authorizator.createAction("idp", "update");
   PermissionActions2.IDP_DISABLE = authorization.Authorizator.createAction("idp", "disable");
   PermissionActions2.IDP_ENABLE = authorization.Authorizator.createAction("idp", "enable");
   PermissionActions2.IDP_LIST = authorization.Authorizator.createAction("idp", "list");
+  PermissionActions2.CUSTOM_ROLE_MANAGE = authorization.Authorizator.createAction("customRole", "manage");
+  PermissionActions2.CUSTOM_ROLE_VIEW = authorization.Authorizator.createAction("customRole", "view");
 })(exports.PermissionActions || (exports.PermissionActions = {}));
 //# sourceMappingURL=PermissionActions.cjs.map

package/dist/production/src/model/authorization/PermissionActions.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PermissionActions.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionActions.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { Acl } from '@contember/schema'\n\nnamespace PermissionActions {\n\texport enum Resources {\n\t\tsystem = 'system',\n\t\tentrypoint = 'entrypoint',\n\t\tperson = 'person',\n\t\tidentity = 'identity',\n\t\tproject = 'project',\n\t\tapiKey = 'apiKey',\n\t\tmailTemplate = 'mailTemplate',\n\t\tidp = 'idp',\n\t}\n\n\texport const CONFIGURE = Authorizator.createAction(Resources.system, 'configure')\n\texport const CONFIG_VIEW = Authorizator.createAction(Resources.system, 'viewConfig')\n\texport const AUTH_LOG_VIEW = Authorizator.createAction(Resources.system, 'viewAuthLog')\n\n\texport const IDENTITY_VIEW_PERMISSIONS = Authorizator.createAction(Resources.identity, 'viewPermissions')\n\texport const IDENTITY_ADD_GLOBAL_ROLES = (roles?: readonly string[]) => Authorizator.createAction(Resources.identity, 'addGlobalRoles', { roles })\n\texport const IDENTITY_REMOVE_GLOBAL_ROLES = (roles?: readonly string[]) =>\n\t\tAuthorizator.createAction(Resources.identity, 'removeGlobalRoles', { roles })\n\n\texport const PERSON_DISABLE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'disable', { roles })\n\texport const PERSON_FORCE_SIGN_OUT = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'forceSignOut', { roles })\n\texport const PERSON_RESET_MFA = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'resetMfa', { roles })\n\texport const PERSON_REVOKE_SESSION = Authorizator.createAction(Resources.person, 'revokeSession')\n\texport const PERSON_VIEW_SESSIONS = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'viewSessions', { roles })\n\n\texport const PERSON_VIEW = Authorizator.createAction(Resources.person, 'view')\n\texport const PERSON_LIST = Authorizator.createAction(Resources.person, 'list')\n\texport const PERSON_SIGN_IN = Authorizator.createAction(Resources.person, 'signIn')\n\texport const PERSON_SIGN_UP = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'signUp', { roles })\n\texport const PERSON_SIGN_OUT = Authorizator.createAction(Resources.person, 'signOut')\n\texport const PERSON_SETUP_OTP = Authorizator.createAction(Resources.person, 'setupOtp')\n\texport const PERSON_CHANGE_PROFILE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'changeProfile', { roles })\n\texport const PERSON_CHANGE_MY_PROFILE = Authorizator.createAction(Resources.person, 'changeMyProfile')\n\texport const PERSON_TOGGLE_PASSWORDLESS = Authorizator.createAction(Resources.person, 'togglePasswordless')\n\texport const PERSON_CHANGE_PASSWORD = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'changePassword', { roles })\n\texport const PERSON_CHANGE_MY_PASSWORD = Authorizator.createAction(Resources.person, 'changeMyPassword')\n\texport const PERSON_RESET_PASSWORD = Authorizator.createAction(Resources.person, 'resetPassword')\n\texport const PERSON_CREATE_IDP_URL = Authorizator.createAction(Resources.person, 'createIdPUrl')\n\texport const PERSON_SIGN_IN_IDP = Authorizator.createAction(Resources.person, 'signInIdp')\n\texport const PERSON_VIEW_IDP = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'viewIdp', { roles })\n\texport const PERSON_DISCONNECT_MY_IDP = Authorizator.createAction(Resources.person, 'disconnectMyIdp')\n\texport const PERSON_REQUEST_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'requestPasswordlessSignIn')\n\texport const PERSON_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'passwordlessSignIn')\n\texport const PERSON_CREATE_SESSION_KEY = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'createSessionToken', { roles })\n\n\texport const PERSON_INVITE = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.person, 'invite', { memberships })\n\texport const PERSON_INVITE_UNMANAGED = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.person, 'invite_unmanaged', { memberships })\n\n\texport const PROJECT_VIEW = Authorizator.createAction(Resources.project, 'view')\n\texport const PROJECT_SET_SECRET = Authorizator.createAction(Resources.project, 'setSecret')\n\texport const PROJECT_VIEW_SECRETS = Authorizator.createAction(Resources.project, 'viewSecrets')\n\texport const PROJECT_UPDATE = Authorizator.createAction(Resources.project, 'update')\n\n\texport const PROJECT_CREATE = Authorizator.createAction(Resources.project, 'create')\n\texport const ENTRYPOINT_DEPLOY = Authorizator.createAction(Resources.entrypoint, 'deployEntrypoint')\n\n\texport const PROJECT_VIEW_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'viewMembers', { memberships })\n\texport const PROJECT_ADD_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'addMember', { memberships })\n\texport const PROJECT_REMOVE_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'removeMember', { memberships })\n\texport const PROJECT_UPDATE_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'updateMember', { memberships })\n\n\texport const API_KEY_CREATE = Authorizator.createAction(Resources.apiKey, 'create')\n\texport const API_KEY_CREATE_GLOBAL = (roles?: readonly string[]) => Authorizator.createAction(Resources.apiKey, 'createGlobal', { roles })\n\texport const API_KEY_DISABLE = Authorizator.createAction(Resources.apiKey, 'disable')\n\texport const API_KEY_LIST = Authorizator.createAction(Resources.apiKey, 'list')\n\n\texport const MAIL_TEMPLATE_ADD = Authorizator.createAction(Resources.mailTemplate, 'add')\n\texport const MAIL_TEMPLATE_REMOVE = Authorizator.createAction(Resources.mailTemplate, 'remove')\n\texport const MAIL_TEMPLATE_LIST = Authorizator.createAction(Resources.mailTemplate, 'list')\n\n\texport const IDP_ADD = Authorizator.createAction(Resources.idp, 'add')\n\texport const IDP_UPDATE = Authorizator.createAction(Resources.idp, 'update')\n\texport const IDP_DISABLE = Authorizator.createAction(Resources.idp, 'disable')\n\texport const IDP_ENABLE = Authorizator.createAction(Resources.idp, 'enable')\n\texport const IDP_LIST = Authorizator.createAction(Resources.idp, 'list')\n}\n\nexport { PermissionActions }\n"],"names":["PermissionActions","Resources","Authorizator"],"mappings":";;;AAGUA,QAAAA,oBAAAA;AAAAA,CAAV,CAAUA,uBAAV;AACQ,GAAA,CAAKC,eAAL;AACNA,eAAA,QAAA,IAAS;AACTA,eAAA,YAAA,IAAa;AACbA,eAAA,QAAA,IAAS;AACTA,eAAA,UAAA,IAAW;AACXA,eAAA,SAAA,IAAU;AACVA,eAAA,QAAA,IAAS;AACTA,eAAA,cAAA,IAAe;AACfA,eAAA,KAAA,IAAM;AAAA,EAAA,GARKD,mBAAA,cAAAA,mBAAA,YAAA,CAAA,EAAA;AAWCA,qBAAA,YAAYE,cAAAA,aAAa,aAAa,UAAkB,WAAW;AACnEF,qBAAA,cAAcE,cAAAA,aAAa,aAAa,UAAkB,YAAY;AACtEF,qBAAA,gBAAgBE,cAAAA,aAAa,aAAa,UAAkB,aAAa;AAEzEF,qBAAA,4BAA4BE,cAAAA,aAAa,aAAa,YAAoB,iBAAiB;AAC3FF,qBAAA,4BAA4B,CAAC,UAA8BE,cAAAA,aAAa,aAAa,YAAoB,kBAAkB,EAAE,OAAO;AACpIF,qBAAA,+BAA+B,CAAC,UAC5CE,cAAAA,aAAa,aAAa,YAAoB,qBAAqB,EAAE,OAAO;AAEhEF,qBAAA,iBAAiB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,WAAW,EAAE,OAAO;AAChHF,qBAAA,wBAAwB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,gBAAgB,EAAE,OAAO;AAC5HF,qBAAA,mBAAmB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,YAAY,EAAE,OAAO;AACnHF,qBAAA,wBAAwBE,cAAAA,aAAa,aAAa,UAAkB,eAAe;AACnFF,qBAAA,uBAAuB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,gBAAgB,EAAE,OAAO;AAE3HF,qBAAA,cAAcE,cAAAA,aAAa,aAAa,UAAkB,MAAM;AAChEF,qBAAA,cAAcE,cAAAA,aAAa,aAAa,UAAkB,MAAM;AAChEF,qBAAA,iBAAiBE,cAAAA,aAAa,aAAa,UAAkB,QAAQ;AACrEF,qBAAA,iBAAiB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,UAAU,EAAE,OAAO;AAC/GF,qBAAA,kBAAkBE,cAAAA,aAAa,aAAa,UAAkB,SAAS;AACvEF,qBAAA,mBAAmBE,cAAAA,aAAa,aAAa,UAAkB,UAAU;AACzEF,qBAAA,wBAAwB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,iBAAiB,EAAE,OAAO;AAC7HF,qBAAA,2BAA2BE,cAAAA,aAAa,aAAa,UAAkB,iBAAiB;AACxFF,qBAAA,6BAA6BE,cAAAA,aAAa,aAAa,UAAkB,oBAAoB;AAC7FF,qBAAA,yBAAyB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,kBAAkB,EAAE,OAAO;AAC/HF,qBAAA,4BAA4BE,cAAAA,aAAa,aAAa,UAAkB,kBAAkB;AAC1FF,qBAAA,wBAAwBE,cAAAA,aAAa,aAAa,UAAkB,eAAe;AACnFF,qBAAA,wBAAwBE,cAAAA,aAAa,aAAa,UAAkB,cAAc;AAClFF,qBAAA,qBAAqBE,cAAAA,aAAa,aAAa,UAAkB,WAAW;AAC5EF,qBAAA,kBAAkB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,WAAW,EAAE,OAAO;AACjHF,qBAAA,2BAA2BE,cAAAA,aAAa,aAAa,UAAkB,iBAAiB;AACxFF,qBAAA,sCAAsCE,cAAAA,aAAa,aAAa,UAAkB,2BAA2B;AAC7GF,qBAAA,8BAA8BE,cAAAA,aAAa,aAAa,UAAkB,oBAAoB;AAC9FF,qBAAA,4BAA4B,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,sBAAsB,EAAE,OAAO;AAEtIF,qBAAA,gBAAgB,CAAC,gBAA2CE,cAAAA,aAAa,aAAa,UAAkB,UAAU,EAAE,aAAa;AACjIF,qBAAA,0BAA0B,CAAC,gBACvCE,cAAAA,aAAa,aAAa,UAAkB,oBAAoB,EAAE,aAAa;AAEnEF,qBAAA,eAAeE,cAAAA,aAAa,aAAa,WAAmB,MAAM;AAClEF,qBAAA,qBAAqBE,cAAAA,aAAa,aAAa,WAAmB,WAAW;AAC7EF,qBAAA,uBAAuBE,cAAAA,aAAa,aAAa,WAAmB,aAAa;AACjFF,qBAAA,iBAAiBE,cAAAA,aAAa,aAAa,WAAmB,QAAQ;AAEtEF,qBAAA,iBAAiBE,cAAAA,aAAa,aAAa,WAAmB,QAAQ;AACtEF,qBAAA,oBAAoBE,cAAAA,aAAa,aAAa,cAAsB,kBAAkB;AAEtFF,qBAAA,sBAAsB,CAAC,gBACnCE,cAAAA,aAAa,aAAa,WAAmB,eAAe,EAAE,aAAa;AAC/DF,qBAAA,qBAAqB,CAAC,gBAClCE,cAAAA,aAAa,aAAa,WAAmB,aAAa,EAAE,aAAa;AAC7DF,qBAAA,wBAAwB,CAAC,gBACrCE,cAAAA,aAAa,aAAa,WAAmB,gBAAgB,EAAE,aAAa;AAChEF,qBAAA,wBAAwB,CAAC,gBACrCE,cAAAA,aAAa,aAAa,WAAmB,gBAAgB,EAAE,aAAa;AAEhEF,qBAAA,iBAAiBE,cAAAA,aAAa,aAAa,UAAkB,QAAQ;AACrEF,qBAAA,wBAAwB,CAAC,UAA8BE,cAAAA,aAAa,aAAa,UAAkB,gBAAgB,EAAE,OAAO;AAC5HF,qBAAA,kBAAkBE,cAAAA,aAAa,aAAa,UAAkB,SAAS;AACvEF,qBAAA,eAAeE,cAAAA,aAAa,aAAa,UAAkB,MAAM;AAEjEF,qBAAA,oBAAoBE,cAAAA,aAAa,aAAa,gBAAwB,KAAK;AAC3EF,qBAAA,uBAAuBE,cAAAA,aAAa,aAAa,gBAAwB,QAAQ;AACjFF,qBAAA,qBAAqBE,cAAAA,aAAa,aAAa,gBAAwB,MAAM;AAE7EF,qBAAA,UAAUE,cAAAA,aAAa,aAAa,OAAe,KAAK;AACxDF,qBAAA,aAAaE,cAAAA,aAAa,aAAa,OAAe,QAAQ;AAC9DF,qBAAA,cAAcE,cAAAA,aAAa,aAAa,OAAe,SAAS;AAChEF,qBAAA,aAAaE,cAAAA,aAAa,aAAa,OAAe,QAAQ;AAC9DF,qBAAA,WAAWE,cAAAA,aAAa,aAAa,OAAe,MAAM;AAAA,GAjF9DF,QAAAA,sBAAAA,4BAAA,CAAA,EAAA;"}
+{"version":3,"file":"PermissionActions.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionActions.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { Acl } from '@contember/schema'\n\nexport type TargetIdentityPermissionTarget = {\n\treadonly id: string\n\treadonly globalRoles: readonly string[]\n\treadonly hasProjectMemberships: boolean\n}\n\nexport type TargetIdentityPermissionMeta = {\n\treadonly target: TargetIdentityPermissionTarget | null\n}\n\nexport type ProfileField = 'name' | 'email'\n\nexport type ChangeProfilePermissionMeta = TargetIdentityPermissionMeta & {\n\treadonly fields: readonly ProfileField[]\n}\n\nexport type CreateSessionTokenPermissionMeta = {\n\treadonly phase: 'preflight' | 'target'\n\treadonly target?: TargetIdentityPermissionTarget\n\treadonly requestedExpirationMinutes?: number | null\n\treadonly trustForwardedClientInfo?: boolean\n}\n\nexport type GlobalRoleMutationPermissionMeta = {\n\treadonly requestedRoles: readonly string[]\n\treadonly target: TargetIdentityPermissionTarget\n\treadonly self: boolean\n}\n\nexport type GlobalApiKeyPermissionMeta = {\n\treadonly requestedRoles: readonly string[]\n\treadonly trustForwardedClientInfo: boolean\n}\n\nexport type ApiKeyPermissionMeta = {\n\treadonly trustForwardedClientInfo: boolean\n}\n\nexport type MailTemplatePermissionMeta = {\n\treadonly kind: 'global' | 'project'\n\treadonly projectSlug: string | null\n\treadonly type: string\n}\n\nnamespace PermissionActions {\n\texport enum Resources {\n\t\tsystem = 'system',\n\t\tentrypoint = 'entrypoint',\n\t\tperson = 'person',\n\t\tidentity = 'identity',\n\t\tproject = 'project',\n\t\tapiKey = 'apiKey',\n\t\tmailTemplate = 'mailTemplate',\n\t\tidp = 'idp',\n\t\tcustomRole = 'customRole',\n\t}\n\n\texport const CONFIGURE = Authorizator.createAction(Resources.system, 'configure')\n\texport const CONFIG_VIEW = Authorizator.createAction(Resources.system, 'viewConfig')\n\texport const AUTH_LOG_VIEW = Authorizator.createAction(Resources.system, 'viewAuthLog')\n\n\texport const IDENTITY_VIEW_PERMISSIONS = Authorizator.createAction(Resources.identity, 'viewPermissions')\n\texport const IDENTITY_ADD_GLOBAL_ROLES = (meta?: GlobalRoleMutationPermissionMeta) =>\n\t\tAuthorizator.createAction(Resources.identity, 'addGlobalRoles', meta)\n\texport const IDENTITY_REMOVE_GLOBAL_ROLES = (meta?: GlobalRoleMutationPermissionMeta) =>\n\t\tAuthorizator.createAction(Resources.identity, 'removeGlobalRoles', meta)\n\n\texport const PERSON_DISABLE = (target: TargetIdentityPermissionTarget | null) => Authorizator.createAction(Resources.person, 'disable', { target })\n\texport const PERSON_FORCE_SIGN_OUT = (target: TargetIdentityPermissionTarget | null) =>\n\t\tAuthorizator.createAction(Resources.person, 'forceSignOut', { target })\n\texport const PERSON_RESET_MFA = (target: TargetIdentityPermissionTarget | null) =>\n\t\tAuthorizator.createAction(Resources.person, 'resetMfa', { target })\n\texport const PERSON_REVOKE_SESSION = Authorizator.createAction(Resources.person, 'revokeSession')\n\texport const PERSON_VIEW_SESSIONS = (target: TargetIdentityPermissionTarget | null) =>\n\t\tAuthorizator.createAction(Resources.person, 'viewSessions', { target })\n\n\texport const PERSON_VIEW = Authorizator.createAction(Resources.person, 'view')\n\texport const PERSON_LIST = Authorizator.createAction(Resources.person, 'list')\n\texport const PERSON_SIGN_IN = Authorizator.createAction(Resources.person, 'signIn')\n\texport const PERSON_SIGN_UP = (requestedRoles?: readonly string[]) => Authorizator.createAction(Resources.person, 'signUp', { requestedRoles })\n\texport const PERSON_SIGN_OUT = Authorizator.createAction(Resources.person, 'signOut')\n\texport const PERSON_SETUP_OTP = Authorizator.createAction(Resources.person, 'setupOtp')\n\texport const PERSON_CHANGE_PROFILE = (target: TargetIdentityPermissionTarget | null, fields: readonly ProfileField[]) =>\n\t\tAuthorizator.createAction(Resources.person, 'changeProfile', { target, fields })\n\texport const PERSON_CHANGE_MY_PROFILE = Authorizator.createAction(Resources.person, 'changeMyProfile')\n\texport const PERSON_TOGGLE_PASSWORDLESS = Authorizator.createAction(Resources.person, 'togglePasswordless')\n\texport const PERSON_CHANGE_PASSWORD = (target: TargetIdentityPermissionTarget | null) =>\n\t\tAuthorizator.createAction(Resources.person, 'changePassword', { target })\n\texport const PERSON_CHANGE_MY_PASSWORD = Authorizator.createAction(Resources.person, 'changeMyPassword')\n\texport const PERSON_RESET_PASSWORD = Authorizator.createAction(Resources.person, 'resetPassword')\n\texport const PERSON_CREATE_IDP_URL = Authorizator.createAction(Resources.person, 'createIdPUrl')\n\texport const PERSON_SIGN_IN_IDP = Authorizator.createAction(Resources.person, 'signInIdp')\n\texport const PERSON_VIEW_IDP = (target: TargetIdentityPermissionTarget | null) => Authorizator.createAction(Resources.person, 'viewIdp', { target })\n\texport const PERSON_DISCONNECT_MY_IDP = Authorizator.createAction(Resources.person, 'disconnectMyIdp')\n\texport const PERSON_REQUEST_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'requestPasswordlessSignIn')\n\texport const PERSON_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'passwordlessSignIn')\n\texport const PERSON_CREATE_SESSION_KEY = (meta: CreateSessionTokenPermissionMeta) =>\n\t\tAuthorizator.createAction(Resources.person, 'createSessionToken', meta)\n\n\texport const PERSON_INVITE = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.person, 'invite', { memberships })\n\texport const PERSON_INVITE_UNMANAGED = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.person, 'invite_unmanaged', { memberships })\n\n\texport const PROJECT_VIEW = Authorizator.createAction(Resources.project, 'view')\n\texport const PROJECT_SET_SECRET = Authorizator.createAction(Resources.project, 'setSecret')\n\texport const PROJECT_VIEW_SECRETS = Authorizator.createAction(Resources.project, 'viewSecrets')\n\texport const PROJECT_UPDATE = Authorizator.createAction(Resources.project, 'update')\n\n\texport const PROJECT_CREATE = Authorizator.createAction(Resources.project, 'create')\n\texport const ENTRYPOINT_DEPLOY = Authorizator.createAction(Resources.entrypoint, 'deployEntrypoint')\n\n\texport const PROJECT_VIEW_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'viewMembers', { memberships })\n\texport const PROJECT_ADD_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'addMember', { memberships })\n\texport const PROJECT_REMOVE_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'removeMember', { memberships })\n\texport const PROJECT_UPDATE_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'updateMember', { memberships })\n\n\texport const API_KEY_CREATE = (meta?: ApiKeyPermissionMeta) => Authorizator.createAction(Resources.apiKey, 'create', meta)\n\texport const API_KEY_CREATE_GLOBAL = (meta?: GlobalApiKeyPermissionMeta) => Authorizator.createAction(Resources.apiKey, 'createGlobal', meta)\n\texport const API_KEY_DISABLE = Authorizator.createAction(Resources.apiKey, 'disable')\n\texport const API_KEY_LIST = Authorizator.createAction(Resources.apiKey, 'list')\n\n\t// meta is optional only so a grant can be registered without one — `Permissions.allow`\n\t// keys on resource + privilege and never reads it. Every check site passes it.\n\texport const MAIL_TEMPLATE_ADD = (meta?: MailTemplatePermissionMeta) => Authorizator.createAction(Resources.mailTemplate, 'add', meta)\n\texport const MAIL_TEMPLATE_REMOVE = (meta?: MailTemplatePermissionMeta) => Authorizator.createAction(Resources.mailTemplate, 'remove', meta)\n\texport const MAIL_TEMPLATE_LIST = (meta?: MailTemplatePermissionMeta) => Authorizator.createAction(Resources.mailTemplate, 'list', meta)\n\n\texport const IDP_ADD = Authorizator.createAction(Resources.idp, 'add')\n\texport const IDP_UPDATE = Authorizator.createAction(Resources.idp, 'update')\n\texport const IDP_DISABLE = Authorizator.createAction(Resources.idp, 'disable')\n\texport const IDP_ENABLE = Authorizator.createAction(Resources.idp, 'enable')\n\texport const IDP_LIST = Authorizator.createAction(Resources.idp, 'list')\n\n\texport const CUSTOM_ROLE_MANAGE = Authorizator.createAction(Resources.customRole, 'manage')\n\texport const CUSTOM_ROLE_VIEW = Authorizator.createAction(Resources.customRole, 'view')\n}\n\nexport { PermissionActions }\n"],"names":["PermissionActions","Resources","Authorizator"],"mappings":";;;AA+CUA,QAAAA,oBAAAA;AAAAA,CAAV,CAAUA,uBAAV;AACQ,GAAA,CAAKC,eAAL;AACNA,eAAA,QAAA,IAAS;AACTA,eAAA,YAAA,IAAa;AACbA,eAAA,QAAA,IAAS;AACTA,eAAA,UAAA,IAAW;AACXA,eAAA,SAAA,IAAU;AACVA,eAAA,QAAA,IAAS;AACTA,eAAA,cAAA,IAAe;AACfA,eAAA,KAAA,IAAM;AACNA,eAAA,YAAA,IAAa;AAAA,EAAA,GATFD,mBAAA,cAAAA,mBAAA,YAAA,CAAA,EAAA;AAYCA,qBAAA,YAAYE,cAAAA,aAAa,aAAa,UAAkB,WAAW;AACnEF,qBAAA,cAAcE,cAAAA,aAAa,aAAa,UAAkB,YAAY;AACtEF,qBAAA,gBAAgBE,cAAAA,aAAa,aAAa,UAAkB,aAAa;AAEzEF,qBAAA,4BAA4BE,cAAAA,aAAa,aAAa,YAAoB,iBAAiB;AAC3FF,qBAAA,4BAA4B,CAAC,SACzCE,cAAAA,aAAa,aAAa,YAAoB,kBAAkB,IAAI;AACxDF,qBAAA,+BAA+B,CAAC,SAC5CE,cAAAA,aAAa,aAAa,YAAoB,qBAAqB,IAAI;AAE3DF,qBAAA,iBAAiB,CAAC,WAAkDE,cAAAA,aAAa,aAAa,UAAkB,WAAW,EAAE,QAAQ;AACrIF,qBAAA,wBAAwB,CAAC,WACrCE,cAAAA,aAAa,aAAa,UAAkB,gBAAgB,EAAE,QAAQ;AAC1DF,qBAAA,mBAAmB,CAAC,WAChCE,cAAAA,aAAa,aAAa,UAAkB,YAAY,EAAE,QAAQ;AACtDF,qBAAA,wBAAwBE,cAAAA,aAAa,aAAa,UAAkB,eAAe;AACnFF,qBAAA,uBAAuB,CAAC,WACpCE,cAAAA,aAAa,aAAa,UAAkB,gBAAgB,EAAE,QAAQ;AAE1DF,qBAAA,cAAcE,cAAAA,aAAa,aAAa,UAAkB,MAAM;AAChEF,qBAAA,cAAcE,cAAAA,aAAa,aAAa,UAAkB,MAAM;AAChEF,qBAAA,iBAAiBE,cAAAA,aAAa,aAAa,UAAkB,QAAQ;AACrEF,qBAAA,iBAAiB,CAAC,mBAAuCE,cAAAA,aAAa,aAAa,UAAkB,UAAU,EAAE,gBAAgB;AACjIF,qBAAA,kBAAkBE,cAAAA,aAAa,aAAa,UAAkB,SAAS;AACvEF,qBAAA,mBAAmBE,cAAAA,aAAa,aAAa,UAAkB,UAAU;AACzEF,qBAAA,wBAAwB,CAAC,QAA+C,WACpFE,cAAAA,aAAa,aAAa,UAAkB,iBAAiB,EAAE,QAAQ,OAAA,CAAQ;AACnEF,qBAAA,2BAA2BE,cAAAA,aAAa,aAAa,UAAkB,iBAAiB;AACxFF,qBAAA,6BAA6BE,cAAAA,aAAa,aAAa,UAAkB,oBAAoB;AAC7FF,qBAAA,yBAAyB,CAAC,WACtCE,cAAAA,aAAa,aAAa,UAAkB,kBAAkB,EAAE,QAAQ;AAC5DF,qBAAA,4BAA4BE,cAAAA,aAAa,aAAa,UAAkB,kBAAkB;AAC1FF,qBAAA,wBAAwBE,cAAAA,aAAa,aAAa,UAAkB,eAAe;AACnFF,qBAAA,wBAAwBE,cAAAA,aAAa,aAAa,UAAkB,cAAc;AAClFF,qBAAA,qBAAqBE,cAAAA,aAAa,aAAa,UAAkB,WAAW;AAC5EF,qBAAA,kBAAkB,CAAC,WAAkDE,cAAAA,aAAa,aAAa,UAAkB,WAAW,EAAE,QAAQ;AACtIF,qBAAA,2BAA2BE,cAAAA,aAAa,aAAa,UAAkB,iBAAiB;AACxFF,qBAAA,sCAAsCE,cAAAA,aAAa,aAAa,UAAkB,2BAA2B;AAC7GF,qBAAA,8BAA8BE,cAAAA,aAAa,aAAa,UAAkB,oBAAoB;AAC9FF,qBAAA,4BAA4B,CAAC,SACzCE,cAAAA,aAAa,aAAa,UAAkB,sBAAsB,IAAI;AAE1DF,qBAAA,gBAAgB,CAAC,gBAA2CE,cAAAA,aAAa,aAAa,UAAkB,UAAU,EAAE,aAAa;AACjIF,qBAAA,0BAA0B,CAAC,gBACvCE,cAAAA,aAAa,aAAa,UAAkB,oBAAoB,EAAE,aAAa;AAEnEF,qBAAA,eAAeE,cAAAA,aAAa,aAAa,WAAmB,MAAM;AAClEF,qBAAA,qBAAqBE,cAAAA,aAAa,aAAa,WAAmB,WAAW;AAC7EF,qBAAA,uBAAuBE,cAAAA,aAAa,aAAa,WAAmB,aAAa;AACjFF,qBAAA,iBAAiBE,cAAAA,aAAa,aAAa,WAAmB,QAAQ;AAEtEF,qBAAA,iBAAiBE,cAAAA,aAAa,aAAa,WAAmB,QAAQ;AACtEF,qBAAA,oBAAoBE,cAAAA,aAAa,aAAa,cAAsB,kBAAkB;AAEtFF,qBAAA,sBAAsB,CAAC,gBACnCE,cAAAA,aAAa,aAAa,WAAmB,eAAe,EAAE,aAAa;AAC/DF,qBAAA,qBAAqB,CAAC,gBAClCE,cAAAA,aAAa,aAAa,WAAmB,aAAa,EAAE,aAAa;AAC7DF,qBAAA,wBAAwB,CAAC,gBACrCE,cAAAA,aAAa,aAAa,WAAmB,gBAAgB,EAAE,aAAa;AAChEF,qBAAA,wBAAwB,CAAC,gBACrCE,cAAAA,aAAa,aAAa,WAAmB,gBAAgB,EAAE,aAAa;AAEhEF,qBAAA,iBAAiB,CAAC,SAAgCE,cAAAA,aAAa,aAAa,UAAkB,UAAU,IAAI;AAC5GF,qBAAA,wBAAwB,CAAC,SAAsCE,cAAAA,aAAa,aAAa,UAAkB,gBAAgB,IAAI;AAC/HF,qBAAA,kBAAkBE,cAAAA,aAAa,aAAa,UAAkB,SAAS;AACvEF,qBAAA,eAAeE,cAAAA,aAAa,aAAa,UAAkB,MAAM;AAIjEF,qBAAA,oBAAoB,CAAC,SAAsCE,cAAAA,aAAa,aAAa,gBAAwB,OAAO,IAAI;AACxHF,qBAAA,uBAAuB,CAAC,SAAsCE,cAAAA,aAAa,aAAa,gBAAwB,UAAU,IAAI;AAC9HF,qBAAA,qBAAqB,CAAC,SAAsCE,cAAAA,aAAa,aAAa,gBAAwB,QAAQ,IAAI;AAE1HF,qBAAA,UAAUE,cAAAA,aAAa,aAAa,OAAe,KAAK;AACxDF,qBAAA,aAAaE,cAAAA,aAAa,aAAa,OAAe,QAAQ;AAC9DF,qBAAA,cAAcE,cAAAA,aAAa,aAAa,OAAe,SAAS;AAChEF,qBAAA,aAAaE,cAAAA,aAAa,aAAa,OAAe,QAAQ;AAC9DF,qBAAA,WAAWE,cAAAA,aAAa,aAAa,OAAe,MAAM;AAE1DF,qBAAA,qBAAqBE,cAAAA,aAAa,aAAa,cAAsB,QAAQ;AAC7EF,qBAAA,mBAAmBE,cAAAA,aAAa,aAAa,cAAsB,MAAM;AAAA,GA9F7EF,QAAAA,sBAAAA,4BAAA,CAAA,EAAA;"}