@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/dist/production/src/model/authorization/PermissionActions.js

@@ -10,37 +10,38 @@ var PermissionActions;
     Resources2["apiKey"] = "apiKey";
     Resources2["mailTemplate"] = "mailTemplate";
     Resources2["idp"] = "idp";
+    Resources2["customRole"] = "customRole";
   })(PermissionActions2.Resources || (PermissionActions2.Resources = {}));
   PermissionActions2.CONFIGURE = Authorizator.createAction("system", "configure");
   PermissionActions2.CONFIG_VIEW = Authorizator.createAction("system", "viewConfig");
   PermissionActions2.AUTH_LOG_VIEW = Authorizator.createAction("system", "viewAuthLog");
   PermissionActions2.IDENTITY_VIEW_PERMISSIONS = Authorizator.createAction("identity", "viewPermissions");
-  PermissionActions2.IDENTITY_ADD_GLOBAL_ROLES = (roles) => Authorizator.createAction("identity", "addGlobalRoles", { roles });
-  PermissionActions2.IDENTITY_REMOVE_GLOBAL_ROLES = (roles) => Authorizator.createAction("identity", "removeGlobalRoles", { roles });
-  PermissionActions2.PERSON_DISABLE = (roles) => Authorizator.createAction("person", "disable", { roles });
-  PermissionActions2.PERSON_FORCE_SIGN_OUT = (roles) => Authorizator.createAction("person", "forceSignOut", { roles });
-  PermissionActions2.PERSON_RESET_MFA = (roles) => Authorizator.createAction("person", "resetMfa", { roles });
+  PermissionActions2.IDENTITY_ADD_GLOBAL_ROLES = (meta) => Authorizator.createAction("identity", "addGlobalRoles", meta);
+  PermissionActions2.IDENTITY_REMOVE_GLOBAL_ROLES = (meta) => Authorizator.createAction("identity", "removeGlobalRoles", meta);
+  PermissionActions2.PERSON_DISABLE = (target) => Authorizator.createAction("person", "disable", { target });
+  PermissionActions2.PERSON_FORCE_SIGN_OUT = (target) => Authorizator.createAction("person", "forceSignOut", { target });
+  PermissionActions2.PERSON_RESET_MFA = (target) => Authorizator.createAction("person", "resetMfa", { target });
   PermissionActions2.PERSON_REVOKE_SESSION = Authorizator.createAction("person", "revokeSession");
-  PermissionActions2.PERSON_VIEW_SESSIONS = (roles) => Authorizator.createAction("person", "viewSessions", { roles });
+  PermissionActions2.PERSON_VIEW_SESSIONS = (target) => Authorizator.createAction("person", "viewSessions", { target });
   PermissionActions2.PERSON_VIEW = Authorizator.createAction("person", "view");
   PermissionActions2.PERSON_LIST = Authorizator.createAction("person", "list");
   PermissionActions2.PERSON_SIGN_IN = Authorizator.createAction("person", "signIn");
-  PermissionActions2.PERSON_SIGN_UP = (roles) => Authorizator.createAction("person", "signUp", { roles });
+  PermissionActions2.PERSON_SIGN_UP = (requestedRoles) => Authorizator.createAction("person", "signUp", { requestedRoles });
   PermissionActions2.PERSON_SIGN_OUT = Authorizator.createAction("person", "signOut");
   PermissionActions2.PERSON_SETUP_OTP = Authorizator.createAction("person", "setupOtp");
-  PermissionActions2.PERSON_CHANGE_PROFILE = (roles) => Authorizator.createAction("person", "changeProfile", { roles });
+  PermissionActions2.PERSON_CHANGE_PROFILE = (target, fields) => Authorizator.createAction("person", "changeProfile", { target, fields });
   PermissionActions2.PERSON_CHANGE_MY_PROFILE = Authorizator.createAction("person", "changeMyProfile");
   PermissionActions2.PERSON_TOGGLE_PASSWORDLESS = Authorizator.createAction("person", "togglePasswordless");
-  PermissionActions2.PERSON_CHANGE_PASSWORD = (roles) => Authorizator.createAction("person", "changePassword", { roles });
+  PermissionActions2.PERSON_CHANGE_PASSWORD = (target) => Authorizator.createAction("person", "changePassword", { target });
   PermissionActions2.PERSON_CHANGE_MY_PASSWORD = Authorizator.createAction("person", "changeMyPassword");
   PermissionActions2.PERSON_RESET_PASSWORD = Authorizator.createAction("person", "resetPassword");
   PermissionActions2.PERSON_CREATE_IDP_URL = Authorizator.createAction("person", "createIdPUrl");
   PermissionActions2.PERSON_SIGN_IN_IDP = Authorizator.createAction("person", "signInIdp");
-  PermissionActions2.PERSON_VIEW_IDP = (roles) => Authorizator.createAction("person", "viewIdp", { roles });
+  PermissionActions2.PERSON_VIEW_IDP = (target) => Authorizator.createAction("person", "viewIdp", { target });
   PermissionActions2.PERSON_DISCONNECT_MY_IDP = Authorizator.createAction("person", "disconnectMyIdp");
   PermissionActions2.PERSON_REQUEST_PASSWORDLESS_SIGN_IN = Authorizator.createAction("person", "requestPasswordlessSignIn");
   PermissionActions2.PERSON_PASSWORDLESS_SIGN_IN = Authorizator.createAction("person", "passwordlessSignIn");
-  PermissionActions2.PERSON_CREATE_SESSION_KEY = (roles) => Authorizator.createAction("person", "createSessionToken", { roles });
+  PermissionActions2.PERSON_CREATE_SESSION_KEY = (meta) => Authorizator.createAction("person", "createSessionToken", meta);
   PermissionActions2.PERSON_INVITE = (memberships) => Authorizator.createAction("person", "invite", { memberships });
   PermissionActions2.PERSON_INVITE_UNMANAGED = (memberships) => Authorizator.createAction("person", "invite_unmanaged", { memberships });
   PermissionActions2.PROJECT_VIEW = Authorizator.createAction("project", "view");
@@ -53,18 +54,20 @@ var PermissionActions;
   PermissionActions2.PROJECT_ADD_MEMBER = (memberships) => Authorizator.createAction("project", "addMember", { memberships });
   PermissionActions2.PROJECT_REMOVE_MEMBER = (memberships) => Authorizator.createAction("project", "removeMember", { memberships });
   PermissionActions2.PROJECT_UPDATE_MEMBER = (memberships) => Authorizator.createAction("project", "updateMember", { memberships });
-  PermissionActions2.API_KEY_CREATE = Authorizator.createAction("apiKey", "create");
-  PermissionActions2.API_KEY_CREATE_GLOBAL = (roles) => Authorizator.createAction("apiKey", "createGlobal", { roles });
+  PermissionActions2.API_KEY_CREATE = (meta) => Authorizator.createAction("apiKey", "create", meta);
+  PermissionActions2.API_KEY_CREATE_GLOBAL = (meta) => Authorizator.createAction("apiKey", "createGlobal", meta);
   PermissionActions2.API_KEY_DISABLE = Authorizator.createAction("apiKey", "disable");
   PermissionActions2.API_KEY_LIST = Authorizator.createAction("apiKey", "list");
-  PermissionActions2.MAIL_TEMPLATE_ADD = Authorizator.createAction("mailTemplate", "add");
-  PermissionActions2.MAIL_TEMPLATE_REMOVE = Authorizator.createAction("mailTemplate", "remove");
-  PermissionActions2.MAIL_TEMPLATE_LIST = Authorizator.createAction("mailTemplate", "list");
+  PermissionActions2.MAIL_TEMPLATE_ADD = (meta) => Authorizator.createAction("mailTemplate", "add", meta);
+  PermissionActions2.MAIL_TEMPLATE_REMOVE = (meta) => Authorizator.createAction("mailTemplate", "remove", meta);
+  PermissionActions2.MAIL_TEMPLATE_LIST = (meta) => Authorizator.createAction("mailTemplate", "list", meta);
   PermissionActions2.IDP_ADD = Authorizator.createAction("idp", "add");
   PermissionActions2.IDP_UPDATE = Authorizator.createAction("idp", "update");
   PermissionActions2.IDP_DISABLE = Authorizator.createAction("idp", "disable");
   PermissionActions2.IDP_ENABLE = Authorizator.createAction("idp", "enable");
   PermissionActions2.IDP_LIST = Authorizator.createAction("idp", "list");
+  PermissionActions2.CUSTOM_ROLE_MANAGE = Authorizator.createAction("customRole", "manage");
+  PermissionActions2.CUSTOM_ROLE_VIEW = Authorizator.createAction("customRole", "view");
 })(PermissionActions || (PermissionActions = {}));
 export {
   PermissionActions

package/dist/production/src/model/authorization/PermissionActions.js.map

@@ -1 +1 @@
-{"version":3,"file":"PermissionActions.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionActions.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { Acl } from '@contember/schema'\n\nnamespace PermissionActions {\n\texport enum Resources {\n\t\tsystem = 'system',\n\t\tentrypoint = 'entrypoint',\n\t\tperson = 'person',\n\t\tidentity = 'identity',\n\t\tproject = 'project',\n\t\tapiKey = 'apiKey',\n\t\tmailTemplate = 'mailTemplate',\n\t\tidp = 'idp',\n\t}\n\n\texport const CONFIGURE = Authorizator.createAction(Resources.system, 'configure')\n\texport const CONFIG_VIEW = Authorizator.createAction(Resources.system, 'viewConfig')\n\texport const AUTH_LOG_VIEW = Authorizator.createAction(Resources.system, 'viewAuthLog')\n\n\texport const IDENTITY_VIEW_PERMISSIONS = Authorizator.createAction(Resources.identity, 'viewPermissions')\n\texport const IDENTITY_ADD_GLOBAL_ROLES = (roles?: readonly string[]) => Authorizator.createAction(Resources.identity, 'addGlobalRoles', { roles })\n\texport const IDENTITY_REMOVE_GLOBAL_ROLES = (roles?: readonly string[]) =>\n\t\tAuthorizator.createAction(Resources.identity, 'removeGlobalRoles', { roles })\n\n\texport const PERSON_DISABLE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'disable', { roles })\n\texport const PERSON_FORCE_SIGN_OUT = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'forceSignOut', { roles })\n\texport const PERSON_RESET_MFA = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'resetMfa', { roles })\n\texport const PERSON_REVOKE_SESSION = Authorizator.createAction(Resources.person, 'revokeSession')\n\texport const PERSON_VIEW_SESSIONS = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'viewSessions', { roles })\n\n\texport const PERSON_VIEW = Authorizator.createAction(Resources.person, 'view')\n\texport const PERSON_LIST = Authorizator.createAction(Resources.person, 'list')\n\texport const PERSON_SIGN_IN = Authorizator.createAction(Resources.person, 'signIn')\n\texport const PERSON_SIGN_UP = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'signUp', { roles })\n\texport const PERSON_SIGN_OUT = Authorizator.createAction(Resources.person, 'signOut')\n\texport const PERSON_SETUP_OTP = Authorizator.createAction(Resources.person, 'setupOtp')\n\texport const PERSON_CHANGE_PROFILE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'changeProfile', { roles })\n\texport const PERSON_CHANGE_MY_PROFILE = Authorizator.createAction(Resources.person, 'changeMyProfile')\n\texport const PERSON_TOGGLE_PASSWORDLESS = Authorizator.createAction(Resources.person, 'togglePasswordless')\n\texport const PERSON_CHANGE_PASSWORD = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'changePassword', { roles })\n\texport const PERSON_CHANGE_MY_PASSWORD = Authorizator.createAction(Resources.person, 'changeMyPassword')\n\texport const PERSON_RESET_PASSWORD = Authorizator.createAction(Resources.person, 'resetPassword')\n\texport const PERSON_CREATE_IDP_URL = Authorizator.createAction(Resources.person, 'createIdPUrl')\n\texport const PERSON_SIGN_IN_IDP = Authorizator.createAction(Resources.person, 'signInIdp')\n\texport const PERSON_VIEW_IDP = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'viewIdp', { roles })\n\texport const PERSON_DISCONNECT_MY_IDP = Authorizator.createAction(Resources.person, 'disconnectMyIdp')\n\texport const PERSON_REQUEST_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'requestPasswordlessSignIn')\n\texport const PERSON_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'passwordlessSignIn')\n\texport const PERSON_CREATE_SESSION_KEY = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'createSessionToken', { roles })\n\n\texport const PERSON_INVITE = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.person, 'invite', { memberships })\n\texport const PERSON_INVITE_UNMANAGED = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.person, 'invite_unmanaged', { memberships })\n\n\texport const PROJECT_VIEW = Authorizator.createAction(Resources.project, 'view')\n\texport const PROJECT_SET_SECRET = Authorizator.createAction(Resources.project, 'setSecret')\n\texport const PROJECT_VIEW_SECRETS = Authorizator.createAction(Resources.project, 'viewSecrets')\n\texport const PROJECT_UPDATE = Authorizator.createAction(Resources.project, 'update')\n\n\texport const PROJECT_CREATE = Authorizator.createAction(Resources.project, 'create')\n\texport const ENTRYPOINT_DEPLOY = Authorizator.createAction(Resources.entrypoint, 'deployEntrypoint')\n\n\texport const PROJECT_VIEW_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'viewMembers', { memberships })\n\texport const PROJECT_ADD_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'addMember', { memberships })\n\texport const PROJECT_REMOVE_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'removeMember', { memberships })\n\texport const PROJECT_UPDATE_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'updateMember', { memberships })\n\n\texport const API_KEY_CREATE = Authorizator.createAction(Resources.apiKey, 'create')\n\texport const API_KEY_CREATE_GLOBAL = (roles?: readonly string[]) => Authorizator.createAction(Resources.apiKey, 'createGlobal', { roles })\n\texport const API_KEY_DISABLE = Authorizator.createAction(Resources.apiKey, 'disable')\n\texport const API_KEY_LIST = Authorizator.createAction(Resources.apiKey, 'list')\n\n\texport const MAIL_TEMPLATE_ADD = Authorizator.createAction(Resources.mailTemplate, 'add')\n\texport const MAIL_TEMPLATE_REMOVE = Authorizator.createAction(Resources.mailTemplate, 'remove')\n\texport const MAIL_TEMPLATE_LIST = Authorizator.createAction(Resources.mailTemplate, 'list')\n\n\texport const IDP_ADD = Authorizator.createAction(Resources.idp, 'add')\n\texport const IDP_UPDATE = Authorizator.createAction(Resources.idp, 'update')\n\texport const IDP_DISABLE = Authorizator.createAction(Resources.idp, 'disable')\n\texport const IDP_ENABLE = Authorizator.createAction(Resources.idp, 'enable')\n\texport const IDP_LIST = Authorizator.createAction(Resources.idp, 'list')\n}\n\nexport { PermissionActions }\n"],"names":["PermissionActions","Resources"],"mappings":";AAGA,IAAU;AAAA,CAAV,CAAUA,uBAAV;AACQ,GAAA,CAAKC,eAAL;AACNA,eAAA,QAAA,IAAS;AACTA,eAAA,YAAA,IAAa;AACbA,eAAA,QAAA,IAAS;AACTA,eAAA,UAAA,IAAW;AACXA,eAAA,SAAA,IAAU;AACVA,eAAA,QAAA,IAAS;AACTA,eAAA,cAAA,IAAe;AACfA,eAAA,KAAA,IAAM;AAAA,EAAA,GARKD,mBAAA,cAAAA,mBAAA,YAAA,CAAA,EAAA;AAWCA,qBAAA,YAAY,aAAa,aAAa,UAAkB,WAAW;AACnEA,qBAAA,cAAc,aAAa,aAAa,UAAkB,YAAY;AACtEA,qBAAA,gBAAgB,aAAa,aAAa,UAAkB,aAAa;AAEzEA,qBAAA,4BAA4B,aAAa,aAAa,YAAoB,iBAAiB;AAC3FA,qBAAA,4BAA4B,CAAC,UAA8B,aAAa,aAAa,YAAoB,kBAAkB,EAAE,OAAO;AACpIA,qBAAA,+BAA+B,CAAC,UAC5C,aAAa,aAAa,YAAoB,qBAAqB,EAAE,OAAO;AAEhEA,qBAAA,iBAAiB,CAAC,UAA8B,aAAa,aAAa,UAAkB,WAAW,EAAE,OAAO;AAChHA,qBAAA,wBAAwB,CAAC,UAA8B,aAAa,aAAa,UAAkB,gBAAgB,EAAE,OAAO;AAC5HA,qBAAA,mBAAmB,CAAC,UAA8B,aAAa,aAAa,UAAkB,YAAY,EAAE,OAAO;AACnHA,qBAAA,wBAAwB,aAAa,aAAa,UAAkB,eAAe;AACnFA,qBAAA,uBAAuB,CAAC,UAA8B,aAAa,aAAa,UAAkB,gBAAgB,EAAE,OAAO;AAE3HA,qBAAA,cAAc,aAAa,aAAa,UAAkB,MAAM;AAChEA,qBAAA,cAAc,aAAa,aAAa,UAAkB,MAAM;AAChEA,qBAAA,iBAAiB,aAAa,aAAa,UAAkB,QAAQ;AACrEA,qBAAA,iBAAiB,CAAC,UAA8B,aAAa,aAAa,UAAkB,UAAU,EAAE,OAAO;AAC/GA,qBAAA,kBAAkB,aAAa,aAAa,UAAkB,SAAS;AACvEA,qBAAA,mBAAmB,aAAa,aAAa,UAAkB,UAAU;AACzEA,qBAAA,wBAAwB,CAAC,UAA8B,aAAa,aAAa,UAAkB,iBAAiB,EAAE,OAAO;AAC7HA,qBAAA,2BAA2B,aAAa,aAAa,UAAkB,iBAAiB;AACxFA,qBAAA,6BAA6B,aAAa,aAAa,UAAkB,oBAAoB;AAC7FA,qBAAA,yBAAyB,CAAC,UAA8B,aAAa,aAAa,UAAkB,kBAAkB,EAAE,OAAO;AAC/HA,qBAAA,4BAA4B,aAAa,aAAa,UAAkB,kBAAkB;AAC1FA,qBAAA,wBAAwB,aAAa,aAAa,UAAkB,eAAe;AACnFA,qBAAA,wBAAwB,aAAa,aAAa,UAAkB,cAAc;AAClFA,qBAAA,qBAAqB,aAAa,aAAa,UAAkB,WAAW;AAC5EA,qBAAA,kBAAkB,CAAC,UAA8B,aAAa,aAAa,UAAkB,WAAW,EAAE,OAAO;AACjHA,qBAAA,2BAA2B,aAAa,aAAa,UAAkB,iBAAiB;AACxFA,qBAAA,sCAAsC,aAAa,aAAa,UAAkB,2BAA2B;AAC7GA,qBAAA,8BAA8B,aAAa,aAAa,UAAkB,oBAAoB;AAC9FA,qBAAA,4BAA4B,CAAC,UAA8B,aAAa,aAAa,UAAkB,sBAAsB,EAAE,OAAO;AAEtIA,qBAAA,gBAAgB,CAAC,gBAA2C,aAAa,aAAa,UAAkB,UAAU,EAAE,aAAa;AACjIA,qBAAA,0BAA0B,CAAC,gBACvC,aAAa,aAAa,UAAkB,oBAAoB,EAAE,aAAa;AAEnEA,qBAAA,eAAe,aAAa,aAAa,WAAmB,MAAM;AAClEA,qBAAA,qBAAqB,aAAa,aAAa,WAAmB,WAAW;AAC7EA,qBAAA,uBAAuB,aAAa,aAAa,WAAmB,aAAa;AACjFA,qBAAA,iBAAiB,aAAa,aAAa,WAAmB,QAAQ;AAEtEA,qBAAA,iBAAiB,aAAa,aAAa,WAAmB,QAAQ;AACtEA,qBAAA,oBAAoB,aAAa,aAAa,cAAsB,kBAAkB;AAEtFA,qBAAA,sBAAsB,CAAC,gBACnC,aAAa,aAAa,WAAmB,eAAe,EAAE,aAAa;AAC/DA,qBAAA,qBAAqB,CAAC,gBAClC,aAAa,aAAa,WAAmB,aAAa,EAAE,aAAa;AAC7DA,qBAAA,wBAAwB,CAAC,gBACrC,aAAa,aAAa,WAAmB,gBAAgB,EAAE,aAAa;AAChEA,qBAAA,wBAAwB,CAAC,gBACrC,aAAa,aAAa,WAAmB,gBAAgB,EAAE,aAAa;AAEhEA,qBAAA,iBAAiB,aAAa,aAAa,UAAkB,QAAQ;AACrEA,qBAAA,wBAAwB,CAAC,UAA8B,aAAa,aAAa,UAAkB,gBAAgB,EAAE,OAAO;AAC5HA,qBAAA,kBAAkB,aAAa,aAAa,UAAkB,SAAS;AACvEA,qBAAA,eAAe,aAAa,aAAa,UAAkB,MAAM;AAEjEA,qBAAA,oBAAoB,aAAa,aAAa,gBAAwB,KAAK;AAC3EA,qBAAA,uBAAuB,aAAa,aAAa,gBAAwB,QAAQ;AACjFA,qBAAA,qBAAqB,aAAa,aAAa,gBAAwB,MAAM;AAE7EA,qBAAA,UAAU,aAAa,aAAa,OAAe,KAAK;AACxDA,qBAAA,aAAa,aAAa,aAAa,OAAe,QAAQ;AAC9DA,qBAAA,cAAc,aAAa,aAAa,OAAe,SAAS;AAChEA,qBAAA,aAAa,aAAa,aAAa,OAAe,QAAQ;AAC9DA,qBAAA,WAAW,aAAa,aAAa,OAAe,MAAM;AAAA,GAjF9D,sBAAA,oBAAA,CAAA,EAAA;"}
+{"version":3,"file":"PermissionActions.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionActions.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { Acl } from '@contember/schema'\n\nexport type TargetIdentityPermissionTarget = {\n\treadonly id: string\n\treadonly globalRoles: readonly string[]\n\treadonly hasProjectMemberships: boolean\n}\n\nexport type TargetIdentityPermissionMeta = {\n\treadonly target: TargetIdentityPermissionTarget | null\n}\n\nexport type ProfileField = 'name' | 'email'\n\nexport type ChangeProfilePermissionMeta = TargetIdentityPermissionMeta & {\n\treadonly fields: readonly ProfileField[]\n}\n\nexport type CreateSessionTokenPermissionMeta = {\n\treadonly phase: 'preflight' | 'target'\n\treadonly target?: TargetIdentityPermissionTarget\n\treadonly requestedExpirationMinutes?: number | null\n\treadonly trustForwardedClientInfo?: boolean\n}\n\nexport type GlobalRoleMutationPermissionMeta = {\n\treadonly requestedRoles: readonly string[]\n\treadonly target: TargetIdentityPermissionTarget\n\treadonly self: boolean\n}\n\nexport type GlobalApiKeyPermissionMeta = {\n\treadonly requestedRoles: readonly string[]\n\treadonly trustForwardedClientInfo: boolean\n}\n\nexport type ApiKeyPermissionMeta = {\n\treadonly trustForwardedClientInfo: boolean\n}\n\nexport type MailTemplatePermissionMeta = {\n\treadonly kind: 'global' | 'project'\n\treadonly projectSlug: string | null\n\treadonly type: string\n}\n\nnamespace PermissionActions {\n\texport enum Resources {\n\t\tsystem = 'system',\n\t\tentrypoint = 'entrypoint',\n\t\tperson = 'person',\n\t\tidentity = 'identity',\n\t\tproject = 'project',\n\t\tapiKey = 'apiKey',\n\t\tmailTemplate = 'mailTemplate',\n\t\tidp = 'idp',\n\t\tcustomRole = 'customRole',\n\t}\n\n\texport const CONFIGURE = Authorizator.createAction(Resources.system, 'configure')\n\texport const CONFIG_VIEW = Authorizator.createAction(Resources.system, 'viewConfig')\n\texport const AUTH_LOG_VIEW = Authorizator.createAction(Resources.system, 'viewAuthLog')\n\n\texport const IDENTITY_VIEW_PERMISSIONS = Authorizator.createAction(Resources.identity, 'viewPermissions')\n\texport const IDENTITY_ADD_GLOBAL_ROLES = (meta?: GlobalRoleMutationPermissionMeta) =>\n\t\tAuthorizator.createAction(Resources.identity, 'addGlobalRoles', meta)\n\texport const IDENTITY_REMOVE_GLOBAL_ROLES = (meta?: GlobalRoleMutationPermissionMeta) =>\n\t\tAuthorizator.createAction(Resources.identity, 'removeGlobalRoles', meta)\n\n\texport const PERSON_DISABLE = (target: TargetIdentityPermissionTarget | null) => Authorizator.createAction(Resources.person, 'disable', { target })\n\texport const PERSON_FORCE_SIGN_OUT = (target: TargetIdentityPermissionTarget | null) =>\n\t\tAuthorizator.createAction(Resources.person, 'forceSignOut', { target })\n\texport const PERSON_RESET_MFA = (target: TargetIdentityPermissionTarget | null) =>\n\t\tAuthorizator.createAction(Resources.person, 'resetMfa', { target })\n\texport const PERSON_REVOKE_SESSION = Authorizator.createAction(Resources.person, 'revokeSession')\n\texport const PERSON_VIEW_SESSIONS = (target: TargetIdentityPermissionTarget | null) =>\n\t\tAuthorizator.createAction(Resources.person, 'viewSessions', { target })\n\n\texport const PERSON_VIEW = Authorizator.createAction(Resources.person, 'view')\n\texport const PERSON_LIST = Authorizator.createAction(Resources.person, 'list')\n\texport const PERSON_SIGN_IN = Authorizator.createAction(Resources.person, 'signIn')\n\texport const PERSON_SIGN_UP = (requestedRoles?: readonly string[]) => Authorizator.createAction(Resources.person, 'signUp', { requestedRoles })\n\texport const PERSON_SIGN_OUT = Authorizator.createAction(Resources.person, 'signOut')\n\texport const PERSON_SETUP_OTP = Authorizator.createAction(Resources.person, 'setupOtp')\n\texport const PERSON_CHANGE_PROFILE = (target: TargetIdentityPermissionTarget | null, fields: readonly ProfileField[]) =>\n\t\tAuthorizator.createAction(Resources.person, 'changeProfile', { target, fields })\n\texport const PERSON_CHANGE_MY_PROFILE = Authorizator.createAction(Resources.person, 'changeMyProfile')\n\texport const PERSON_TOGGLE_PASSWORDLESS = Authorizator.createAction(Resources.person, 'togglePasswordless')\n\texport const PERSON_CHANGE_PASSWORD = (target: TargetIdentityPermissionTarget | null) =>\n\t\tAuthorizator.createAction(Resources.person, 'changePassword', { target })\n\texport const PERSON_CHANGE_MY_PASSWORD = Authorizator.createAction(Resources.person, 'changeMyPassword')\n\texport const PERSON_RESET_PASSWORD = Authorizator.createAction(Resources.person, 'resetPassword')\n\texport const PERSON_CREATE_IDP_URL = Authorizator.createAction(Resources.person, 'createIdPUrl')\n\texport const PERSON_SIGN_IN_IDP = Authorizator.createAction(Resources.person, 'signInIdp')\n\texport const PERSON_VIEW_IDP = (target: TargetIdentityPermissionTarget | null) => Authorizator.createAction(Resources.person, 'viewIdp', { target })\n\texport const PERSON_DISCONNECT_MY_IDP = Authorizator.createAction(Resources.person, 'disconnectMyIdp')\n\texport const PERSON_REQUEST_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'requestPasswordlessSignIn')\n\texport const PERSON_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'passwordlessSignIn')\n\texport const PERSON_CREATE_SESSION_KEY = (meta: CreateSessionTokenPermissionMeta) =>\n\t\tAuthorizator.createAction(Resources.person, 'createSessionToken', meta)\n\n\texport const PERSON_INVITE = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.person, 'invite', { memberships })\n\texport const PERSON_INVITE_UNMANAGED = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.person, 'invite_unmanaged', { memberships })\n\n\texport const PROJECT_VIEW = Authorizator.createAction(Resources.project, 'view')\n\texport const PROJECT_SET_SECRET = Authorizator.createAction(Resources.project, 'setSecret')\n\texport const PROJECT_VIEW_SECRETS = Authorizator.createAction(Resources.project, 'viewSecrets')\n\texport const PROJECT_UPDATE = Authorizator.createAction(Resources.project, 'update')\n\n\texport const PROJECT_CREATE = Authorizator.createAction(Resources.project, 'create')\n\texport const ENTRYPOINT_DEPLOY = Authorizator.createAction(Resources.entrypoint, 'deployEntrypoint')\n\n\texport const PROJECT_VIEW_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'viewMembers', { memberships })\n\texport const PROJECT_ADD_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'addMember', { memberships })\n\texport const PROJECT_REMOVE_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'removeMember', { memberships })\n\texport const PROJECT_UPDATE_MEMBER = (memberships: readonly Acl.Membership[]) =>\n\t\tAuthorizator.createAction(Resources.project, 'updateMember', { memberships })\n\n\texport const API_KEY_CREATE = (meta?: ApiKeyPermissionMeta) => Authorizator.createAction(Resources.apiKey, 'create', meta)\n\texport const API_KEY_CREATE_GLOBAL = (meta?: GlobalApiKeyPermissionMeta) => Authorizator.createAction(Resources.apiKey, 'createGlobal', meta)\n\texport const API_KEY_DISABLE = Authorizator.createAction(Resources.apiKey, 'disable')\n\texport const API_KEY_LIST = Authorizator.createAction(Resources.apiKey, 'list')\n\n\t// meta is optional only so a grant can be registered without one — `Permissions.allow`\n\t// keys on resource + privilege and never reads it. Every check site passes it.\n\texport const MAIL_TEMPLATE_ADD = (meta?: MailTemplatePermissionMeta) => Authorizator.createAction(Resources.mailTemplate, 'add', meta)\n\texport const MAIL_TEMPLATE_REMOVE = (meta?: MailTemplatePermissionMeta) => Authorizator.createAction(Resources.mailTemplate, 'remove', meta)\n\texport const MAIL_TEMPLATE_LIST = (meta?: MailTemplatePermissionMeta) => Authorizator.createAction(Resources.mailTemplate, 'list', meta)\n\n\texport const IDP_ADD = Authorizator.createAction(Resources.idp, 'add')\n\texport const IDP_UPDATE = Authorizator.createAction(Resources.idp, 'update')\n\texport const IDP_DISABLE = Authorizator.createAction(Resources.idp, 'disable')\n\texport const IDP_ENABLE = Authorizator.createAction(Resources.idp, 'enable')\n\texport const IDP_LIST = Authorizator.createAction(Resources.idp, 'list')\n\n\texport const CUSTOM_ROLE_MANAGE = Authorizator.createAction(Resources.customRole, 'manage')\n\texport const CUSTOM_ROLE_VIEW = Authorizator.createAction(Resources.customRole, 'view')\n}\n\nexport { PermissionActions }\n"],"names":["PermissionActions","Resources"],"mappings":";AA+CA,IAAU;AAAA,CAAV,CAAUA,uBAAV;AACQ,GAAA,CAAKC,eAAL;AACNA,eAAA,QAAA,IAAS;AACTA,eAAA,YAAA,IAAa;AACbA,eAAA,QAAA,IAAS;AACTA,eAAA,UAAA,IAAW;AACXA,eAAA,SAAA,IAAU;AACVA,eAAA,QAAA,IAAS;AACTA,eAAA,cAAA,IAAe;AACfA,eAAA,KAAA,IAAM;AACNA,eAAA,YAAA,IAAa;AAAA,EAAA,GATFD,mBAAA,cAAAA,mBAAA,YAAA,CAAA,EAAA;AAYCA,qBAAA,YAAY,aAAa,aAAa,UAAkB,WAAW;AACnEA,qBAAA,cAAc,aAAa,aAAa,UAAkB,YAAY;AACtEA,qBAAA,gBAAgB,aAAa,aAAa,UAAkB,aAAa;AAEzEA,qBAAA,4BAA4B,aAAa,aAAa,YAAoB,iBAAiB;AAC3FA,qBAAA,4BAA4B,CAAC,SACzC,aAAa,aAAa,YAAoB,kBAAkB,IAAI;AACxDA,qBAAA,+BAA+B,CAAC,SAC5C,aAAa,aAAa,YAAoB,qBAAqB,IAAI;AAE3DA,qBAAA,iBAAiB,CAAC,WAAkD,aAAa,aAAa,UAAkB,WAAW,EAAE,QAAQ;AACrIA,qBAAA,wBAAwB,CAAC,WACrC,aAAa,aAAa,UAAkB,gBAAgB,EAAE,QAAQ;AAC1DA,qBAAA,mBAAmB,CAAC,WAChC,aAAa,aAAa,UAAkB,YAAY,EAAE,QAAQ;AACtDA,qBAAA,wBAAwB,aAAa,aAAa,UAAkB,eAAe;AACnFA,qBAAA,uBAAuB,CAAC,WACpC,aAAa,aAAa,UAAkB,gBAAgB,EAAE,QAAQ;AAE1DA,qBAAA,cAAc,aAAa,aAAa,UAAkB,MAAM;AAChEA,qBAAA,cAAc,aAAa,aAAa,UAAkB,MAAM;AAChEA,qBAAA,iBAAiB,aAAa,aAAa,UAAkB,QAAQ;AACrEA,qBAAA,iBAAiB,CAAC,mBAAuC,aAAa,aAAa,UAAkB,UAAU,EAAE,gBAAgB;AACjIA,qBAAA,kBAAkB,aAAa,aAAa,UAAkB,SAAS;AACvEA,qBAAA,mBAAmB,aAAa,aAAa,UAAkB,UAAU;AACzEA,qBAAA,wBAAwB,CAAC,QAA+C,WACpF,aAAa,aAAa,UAAkB,iBAAiB,EAAE,QAAQ,OAAA,CAAQ;AACnEA,qBAAA,2BAA2B,aAAa,aAAa,UAAkB,iBAAiB;AACxFA,qBAAA,6BAA6B,aAAa,aAAa,UAAkB,oBAAoB;AAC7FA,qBAAA,yBAAyB,CAAC,WACtC,aAAa,aAAa,UAAkB,kBAAkB,EAAE,QAAQ;AAC5DA,qBAAA,4BAA4B,aAAa,aAAa,UAAkB,kBAAkB;AAC1FA,qBAAA,wBAAwB,aAAa,aAAa,UAAkB,eAAe;AACnFA,qBAAA,wBAAwB,aAAa,aAAa,UAAkB,cAAc;AAClFA,qBAAA,qBAAqB,aAAa,aAAa,UAAkB,WAAW;AAC5EA,qBAAA,kBAAkB,CAAC,WAAkD,aAAa,aAAa,UAAkB,WAAW,EAAE,QAAQ;AACtIA,qBAAA,2BAA2B,aAAa,aAAa,UAAkB,iBAAiB;AACxFA,qBAAA,sCAAsC,aAAa,aAAa,UAAkB,2BAA2B;AAC7GA,qBAAA,8BAA8B,aAAa,aAAa,UAAkB,oBAAoB;AAC9FA,qBAAA,4BAA4B,CAAC,SACzC,aAAa,aAAa,UAAkB,sBAAsB,IAAI;AAE1DA,qBAAA,gBAAgB,CAAC,gBAA2C,aAAa,aAAa,UAAkB,UAAU,EAAE,aAAa;AACjIA,qBAAA,0BAA0B,CAAC,gBACvC,aAAa,aAAa,UAAkB,oBAAoB,EAAE,aAAa;AAEnEA,qBAAA,eAAe,aAAa,aAAa,WAAmB,MAAM;AAClEA,qBAAA,qBAAqB,aAAa,aAAa,WAAmB,WAAW;AAC7EA,qBAAA,uBAAuB,aAAa,aAAa,WAAmB,aAAa;AACjFA,qBAAA,iBAAiB,aAAa,aAAa,WAAmB,QAAQ;AAEtEA,qBAAA,iBAAiB,aAAa,aAAa,WAAmB,QAAQ;AACtEA,qBAAA,oBAAoB,aAAa,aAAa,cAAsB,kBAAkB;AAEtFA,qBAAA,sBAAsB,CAAC,gBACnC,aAAa,aAAa,WAAmB,eAAe,EAAE,aAAa;AAC/DA,qBAAA,qBAAqB,CAAC,gBAClC,aAAa,aAAa,WAAmB,aAAa,EAAE,aAAa;AAC7DA,qBAAA,wBAAwB,CAAC,gBACrC,aAAa,aAAa,WAAmB,gBAAgB,EAAE,aAAa;AAChEA,qBAAA,wBAAwB,CAAC,gBACrC,aAAa,aAAa,WAAmB,gBAAgB,EAAE,aAAa;AAEhEA,qBAAA,iBAAiB,CAAC,SAAgC,aAAa,aAAa,UAAkB,UAAU,IAAI;AAC5GA,qBAAA,wBAAwB,CAAC,SAAsC,aAAa,aAAa,UAAkB,gBAAgB,IAAI;AAC/HA,qBAAA,kBAAkB,aAAa,aAAa,UAAkB,SAAS;AACvEA,qBAAA,eAAe,aAAa,aAAa,UAAkB,MAAM;AAIjEA,qBAAA,oBAAoB,CAAC,SAAsC,aAAa,aAAa,gBAAwB,OAAO,IAAI;AACxHA,qBAAA,uBAAuB,CAAC,SAAsC,aAAa,aAAa,gBAAwB,UAAU,IAAI;AAC9HA,qBAAA,qBAAqB,CAAC,SAAsC,aAAa,aAAa,gBAAwB,QAAQ,IAAI;AAE1HA,qBAAA,UAAU,aAAa,aAAa,OAAe,KAAK;AACxDA,qBAAA,aAAa,aAAa,aAAa,OAAe,QAAQ;AAC9DA,qBAAA,cAAc,aAAa,aAAa,OAAe,SAAS;AAChEA,qBAAA,aAAa,aAAa,aAAa,OAAe,QAAQ;AAC9DA,qBAAA,WAAW,aAAa,aAAa,OAAe,MAAM;AAE1DA,qBAAA,qBAAqB,aAAa,aAAa,cAAsB,QAAQ;AAC7EA,qBAAA,mBAAmB,aAAa,aAAa,cAAsB,MAAM;AAAA,GA9F7E,sBAAA,oBAAA,CAAA,EAAA;"}

package/dist/production/src/model/authorization/PermissionContextFactory.cjs

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionContext = require("./PermissionContext.cjs");
+const CustomRoleAuthorizator = require("./CustomRoleAuthorizator.cjs");
 class PermissionContextFactory {
   constructor(authorizator, identityFactory, projectScopeFactory, schemaResolver) {
     this.authorizator = authorizator;
@@ -8,9 +9,26 @@ class PermissionContextFactory {
     this.projectScopeFactory = projectScopeFactory;
     this.schemaResolver = schemaResolver;
   }
-  create(db, args) {
+  create(db, args, requestAuthorizator) {
+    const authorizator = this.createAuthorizator(db, requestAuthorizator);
+    return this.buildContext(db, args, authorizator);
+  }
+  /**
+   * Same as `create`, but resolves the custom-role definitions before returning, so
+   * the request never has to query for them while holding a transaction open.
+   */
+  async createPreloaded(db, args, requestAuthorizator) {
+    const authorizator = this.createAuthorizator(db, requestAuthorizator);
+    await authorizator.preload(args.roles);
+    return this.buildContext(db, args, authorizator);
+  }
+  createAuthorizator(db, requestAuthorizator) {
+    const customRoleCache = requestAuthorizator instanceof CustomRoleAuthorizator.CustomRoleAuthorizator ? requestAuthorizator.customRoleCache : void 0;
+    return new CustomRoleAuthorizator.CustomRoleAuthorizator(this.authorizator, db, customRoleCache);
+  }
+  buildContext(db, args, authorizator) {
     const identity = this.identityFactory.create(db, args);
-    return new PermissionContext.PermissionContext(identity, this.authorizator, this.projectScopeFactory, this.schemaResolver);
+    return new PermissionContext.PermissionContext(identity, authorizator, this.projectScopeFactory, this.schemaResolver);
   }
 }
 exports.PermissionContextFactory = PermissionContextFactory;

package/dist/production/src/model/authorization/PermissionContextFactory.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PermissionContextFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionContextFactory.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { IdentityFactory } from './IdentityFactory.js'\nimport { PermissionContext } from './PermissionContext.js'\nimport { ProjectScopeFactory } from './ProjectScopeFactory.js'\nimport { ProjectSchemaResolver } from '../type/index.js'\nimport { DatabaseContext } from '../utils/index.js'\n\nexport class PermissionContextFactory {\n\tconstructor(\n\t\tprivate readonly authorizator: Authorizator,\n\t\tprivate readonly identityFactory: IdentityFactory,\n\t\tprivate readonly projectScopeFactory: ProjectScopeFactory,\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tpublic create(db: DatabaseContext, args: { id: string; roles: readonly string[] }): PermissionContext {\n\t\tconst identity = this.identityFactory.create(db, args)\n\t\treturn new PermissionContext(identity, this.authorizator, this.projectScopeFactory, this.schemaResolver)\n\t}\n}\n"],"names":["PermissionContext"],"mappings":";;;AAOO,MAAM,yBAAyB;AAAA,EACrC,YACkB,cACA,iBACA,qBACA,gBAChB;AAJgB,SAAA,eAAA;AACA,SAAA,kBAAA;AACA,SAAA,sBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEI,OAAO,IAAqB,MAAmE;AACrG,UAAM,WAAW,KAAK,gBAAgB,OAAO,IAAI,IAAI;AACrD,WAAO,IAAIA,kBAAAA,kBAAkB,UAAU,KAAK,cAAc,KAAK,qBAAqB,KAAK,cAAc;AAAA,EACxG;AACD;;"}
+{"version":3,"file":"PermissionContextFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionContextFactory.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { IdentityFactory } from './IdentityFactory.js'\nimport { PermissionContext } from './PermissionContext.js'\nimport { ProjectScopeFactory } from './ProjectScopeFactory.js'\nimport { ProjectSchemaResolver } from '../type/index.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { CustomRoleAuthorizator } from './CustomRoleAuthorizator.js'\nimport { Identity } from './Identity.js'\n\nexport class PermissionContextFactory {\n\tconstructor(\n\t\tprivate readonly authorizator: Authorizator<Identity>,\n\t\tprivate readonly identityFactory: IdentityFactory,\n\t\tprivate readonly projectScopeFactory: ProjectScopeFactory,\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tpublic create(\n\t\tdb: DatabaseContext,\n\t\targs: { id: string; roles: readonly string[] },\n\t\trequestAuthorizator?: Authorizator<Identity>,\n\t): PermissionContext {\n\t\tconst authorizator = this.createAuthorizator(db, requestAuthorizator)\n\t\treturn this.buildContext(db, args, authorizator)\n\t}\n\n\t/**\n\t * Same as `create`, but resolves the custom-role definitions before returning, so\n\t * the request never has to query for them while holding a transaction open.\n\t */\n\tpublic async createPreloaded(\n\t\tdb: DatabaseContext,\n\t\targs: { id: string; roles: readonly string[] },\n\t\trequestAuthorizator?: Authorizator<Identity>,\n\t): Promise<PermissionContext> {\n\t\tconst authorizator = this.createAuthorizator(db, requestAuthorizator)\n\t\tawait authorizator.preload(args.roles)\n\t\treturn this.buildContext(db, args, authorizator)\n\t}\n\n\tprivate createAuthorizator(db: DatabaseContext, requestAuthorizator?: Authorizator<Identity>): CustomRoleAuthorizator {\n\t\tconst customRoleCache = requestAuthorizator instanceof CustomRoleAuthorizator\n\t\t\t? requestAuthorizator.customRoleCache\n\t\t\t: undefined\n\t\treturn new CustomRoleAuthorizator(this.authorizator, db, customRoleCache)\n\t}\n\n\tprivate buildContext(\n\t\tdb: DatabaseContext,\n\t\targs: { id: string; roles: readonly string[] },\n\t\tauthorizator: CustomRoleAuthorizator,\n\t): PermissionContext {\n\t\tconst identity = this.identityFactory.create(db, args)\n\t\treturn new PermissionContext(identity, authorizator, this.projectScopeFactory, this.schemaResolver)\n\t}\n}\n"],"names":["CustomRoleAuthorizator","PermissionContext"],"mappings":";;;;AASO,MAAM,yBAAyB;AAAA,EACrC,YACkB,cACA,iBACA,qBACA,gBAChB;AAJgB,SAAA,eAAA;AACA,SAAA,kBAAA;AACA,SAAA,sBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEI,OACN,IACA,MACA,qBACoB;AACpB,UAAM,eAAe,KAAK,mBAAmB,IAAI,mBAAmB;AACpE,WAAO,KAAK,aAAa,IAAI,MAAM,YAAY;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,gBACZ,IACA,MACA,qBAC6B;AAC7B,UAAM,eAAe,KAAK,mBAAmB,IAAI,mBAAmB;AACpE,UAAM,aAAa,QAAQ,KAAK,KAAK;AACrC,WAAO,KAAK,aAAa,IAAI,MAAM,YAAY;AAAA,EAChD;AAAA,EAEQ,mBAAmB,IAAqB,qBAAsE;AACrH,UAAM,kBAAkB,+BAA+BA,uBAAAA,yBACpD,oBAAoB,kBACpB;AACH,WAAO,IAAIA,uBAAAA,uBAAuB,KAAK,cAAc,IAAI,eAAe;AAAA,EACzE;AAAA,EAEQ,aACP,IACA,MACA,cACoB;AACpB,UAAM,WAAW,KAAK,gBAAgB,OAAO,IAAI,IAAI;AACrD,WAAO,IAAIC,kBAAAA,kBAAkB,UAAU,cAAc,KAAK,qBAAqB,KAAK,cAAc;AAAA,EACnG;AACD;;"}

package/dist/production/src/model/authorization/PermissionContextFactory.js

@@ -1,4 +1,5 @@
 import { PermissionContext } from "./PermissionContext.js";
+import { CustomRoleAuthorizator } from "./CustomRoleAuthorizator.js";
 class PermissionContextFactory {
   constructor(authorizator, identityFactory, projectScopeFactory, schemaResolver) {
     this.authorizator = authorizator;
@@ -6,9 +7,26 @@ class PermissionContextFactory {
     this.projectScopeFactory = projectScopeFactory;
     this.schemaResolver = schemaResolver;
   }
-  create(db, args) {
+  create(db, args, requestAuthorizator) {
+    const authorizator = this.createAuthorizator(db, requestAuthorizator);
+    return this.buildContext(db, args, authorizator);
+  }
+  /**
+   * Same as `create`, but resolves the custom-role definitions before returning, so
+   * the request never has to query for them while holding a transaction open.
+   */
+  async createPreloaded(db, args, requestAuthorizator) {
+    const authorizator = this.createAuthorizator(db, requestAuthorizator);
+    await authorizator.preload(args.roles);
+    return this.buildContext(db, args, authorizator);
+  }
+  createAuthorizator(db, requestAuthorizator) {
+    const customRoleCache = requestAuthorizator instanceof CustomRoleAuthorizator ? requestAuthorizator.customRoleCache : void 0;
+    return new CustomRoleAuthorizator(this.authorizator, db, customRoleCache);
+  }
+  buildContext(db, args, authorizator) {
     const identity = this.identityFactory.create(db, args);
-    return new PermissionContext(identity, this.authorizator, this.projectScopeFactory, this.schemaResolver);
+    return new PermissionContext(identity, authorizator, this.projectScopeFactory, this.schemaResolver);
   }
 }
 export {

package/dist/production/src/model/authorization/PermissionContextFactory.js.map

@@ -1 +1 @@
-{"version":3,"file":"PermissionContextFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionContextFactory.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { IdentityFactory } from './IdentityFactory.js'\nimport { PermissionContext } from './PermissionContext.js'\nimport { ProjectScopeFactory } from './ProjectScopeFactory.js'\nimport { ProjectSchemaResolver } from '../type/index.js'\nimport { DatabaseContext } from '../utils/index.js'\n\nexport class PermissionContextFactory {\n\tconstructor(\n\t\tprivate readonly authorizator: Authorizator,\n\t\tprivate readonly identityFactory: IdentityFactory,\n\t\tprivate readonly projectScopeFactory: ProjectScopeFactory,\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tpublic create(db: DatabaseContext, args: { id: string; roles: readonly string[] }): PermissionContext {\n\t\tconst identity = this.identityFactory.create(db, args)\n\t\treturn new PermissionContext(identity, this.authorizator, this.projectScopeFactory, this.schemaResolver)\n\t}\n}\n"],"names":[],"mappings":";AAOO,MAAM,yBAAyB;AAAA,EACrC,YACkB,cACA,iBACA,qBACA,gBAChB;AAJgB,SAAA,eAAA;AACA,SAAA,kBAAA;AACA,SAAA,sBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEI,OAAO,IAAqB,MAAmE;AACrG,UAAM,WAAW,KAAK,gBAAgB,OAAO,IAAI,IAAI;AACrD,WAAO,IAAI,kBAAkB,UAAU,KAAK,cAAc,KAAK,qBAAqB,KAAK,cAAc;AAAA,EACxG;AACD;"}
+{"version":3,"file":"PermissionContextFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionContextFactory.ts"],"sourcesContent":["import { Authorizator } from '@contember/authorization'\nimport { IdentityFactory } from './IdentityFactory.js'\nimport { PermissionContext } from './PermissionContext.js'\nimport { ProjectScopeFactory } from './ProjectScopeFactory.js'\nimport { ProjectSchemaResolver } from '../type/index.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { CustomRoleAuthorizator } from './CustomRoleAuthorizator.js'\nimport { Identity } from './Identity.js'\n\nexport class PermissionContextFactory {\n\tconstructor(\n\t\tprivate readonly authorizator: Authorizator<Identity>,\n\t\tprivate readonly identityFactory: IdentityFactory,\n\t\tprivate readonly projectScopeFactory: ProjectScopeFactory,\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tpublic create(\n\t\tdb: DatabaseContext,\n\t\targs: { id: string; roles: readonly string[] },\n\t\trequestAuthorizator?: Authorizator<Identity>,\n\t): PermissionContext {\n\t\tconst authorizator = this.createAuthorizator(db, requestAuthorizator)\n\t\treturn this.buildContext(db, args, authorizator)\n\t}\n\n\t/**\n\t * Same as `create`, but resolves the custom-role definitions before returning, so\n\t * the request never has to query for them while holding a transaction open.\n\t */\n\tpublic async createPreloaded(\n\t\tdb: DatabaseContext,\n\t\targs: { id: string; roles: readonly string[] },\n\t\trequestAuthorizator?: Authorizator<Identity>,\n\t): Promise<PermissionContext> {\n\t\tconst authorizator = this.createAuthorizator(db, requestAuthorizator)\n\t\tawait authorizator.preload(args.roles)\n\t\treturn this.buildContext(db, args, authorizator)\n\t}\n\n\tprivate createAuthorizator(db: DatabaseContext, requestAuthorizator?: Authorizator<Identity>): CustomRoleAuthorizator {\n\t\tconst customRoleCache = requestAuthorizator instanceof CustomRoleAuthorizator\n\t\t\t? requestAuthorizator.customRoleCache\n\t\t\t: undefined\n\t\treturn new CustomRoleAuthorizator(this.authorizator, db, customRoleCache)\n\t}\n\n\tprivate buildContext(\n\t\tdb: DatabaseContext,\n\t\targs: { id: string; roles: readonly string[] },\n\t\tauthorizator: CustomRoleAuthorizator,\n\t): PermissionContext {\n\t\tconst identity = this.identityFactory.create(db, args)\n\t\treturn new PermissionContext(identity, authorizator, this.projectScopeFactory, this.schemaResolver)\n\t}\n}\n"],"names":[],"mappings":";;AASO,MAAM,yBAAyB;AAAA,EACrC,YACkB,cACA,iBACA,qBACA,gBAChB;AAJgB,SAAA,eAAA;AACA,SAAA,kBAAA;AACA,SAAA,sBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEI,OACN,IACA,MACA,qBACoB;AACpB,UAAM,eAAe,KAAK,mBAAmB,IAAI,mBAAmB;AACpE,WAAO,KAAK,aAAa,IAAI,MAAM,YAAY;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,gBACZ,IACA,MACA,qBAC6B;AAC7B,UAAM,eAAe,KAAK,mBAAmB,IAAI,mBAAmB;AACpE,UAAM,aAAa,QAAQ,KAAK,KAAK;AACrC,WAAO,KAAK,aAAa,IAAI,MAAM,YAAY;AAAA,EAChD;AAAA,EAEQ,mBAAmB,IAAqB,qBAAsE;AACrH,UAAM,kBAAkB,+BAA+B,yBACpD,oBAAoB,kBACpB;AACH,WAAO,IAAI,uBAAuB,KAAK,cAAc,IAAI,eAAe;AAAA,EACzE;AAAA,EAEQ,aACP,IACA,MACA,cACoB;AACpB,UAAM,WAAW,KAAK,gBAAgB,OAAO,IAAI,IAAI;AACrD,WAAO,IAAI,kBAAkB,UAAU,cAAc,KAAK,qBAAqB,KAAK,cAAc;AAAA,EACnG;AACD;"}

package/dist/production/src/model/authorization/PermissionsFactory.cjs

@@ -3,14 +3,14 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const authorization = require("@contember/authorization");
 const PermissionActions = require("./PermissionActions.cjs");
 const Roles = require("./Roles.cjs");
-const allowedRoles = /* @__PURE__ */ new Set([Roles.TenantRole.LOGIN, Roles.TenantRole.PROJECT_ADMIN, Roles.TenantRole.ENTRYPOINT_DEPLOYER]);
-const projectAdminAllowedInputRoles = ({ roles }) => {
-  return roles === void 0 || roles.every((it) => allowedRoles.has(it));
-};
-const forbiddenRoles = /* @__PURE__ */ new Set([Roles.TenantRole.SUPER_ADMIN, Roles.TenantRole.PROJECT_CREATOR]);
-const projectAdminUseRolesVerifier = ({ roles }) => {
-  return roles === void 0 || roles.every((it) => !forbiddenRoles.has(it));
-};
+const projectAdminAllowsRoles = (roles) => roles === void 0 || roles.every((role) => !Roles.NON_DELEGABLE_TENANT_ROLES.has(role));
+const projectAdminAllowedSignUpRoles = (meta) => projectAdminAllowsRoles(meta.requestedRoles);
+const projectAdminAllowsTrustForwardedClientInfo = (meta) => meta?.trustForwardedClientInfo !== true;
+const projectAdminAllowedApiKey = (meta) => projectAdminAllowsTrustForwardedClientInfo(meta);
+const projectAdminAllowedGlobalApiKeyRoles = (meta) => projectAdminAllowsRoles(meta?.requestedRoles) && projectAdminAllowsTrustForwardedClientInfo(meta);
+const projectAdminAllowedRoleMutation = (meta) => meta === void 0 || projectAdminAllowsRoles(meta.requestedRoles) && meta.target.globalRoles.every((role) => !Roles.NON_DELEGABLE_TENANT_ROLES.has(role));
+const projectAdminMayTarget = (meta) => meta.target === null || meta.target.globalRoles.every((role) => !Roles.NON_DELEGABLE_TENANT_ROLES.has(role));
+const projectAdminMayCreateSession = (meta) => meta.phase === "preflight" || meta.target?.globalRoles.every((role) => !Roles.NON_DELEGABLE_TENANT_ROLES.has(role)) === true;
 class PermissionsFactory {
   create() {
     const permissions = new authorization.Permissions();
@@ -33,20 +33,26 @@ class PermissionsFactory {
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PROJECT_VIEW);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDENTITY_VIEW_PERMISSIONS);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_VIEW);
-    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.API_KEY_CREATE);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_LIST);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.API_KEY_CREATE(), projectAdminAllowedApiKey);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.API_KEY_DISABLE);
-    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles);
-    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedInputRoles);
-    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedInputRoles);
-    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedInputRoles);
-    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_CREATE_SESSION_KEY(), projectAdminUseRolesVerifier);
-    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_DISABLE(), projectAdminUseRolesVerifier);
-    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_FORCE_SIGN_OUT(), projectAdminUseRolesVerifier);
-    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_RESET_MFA(), projectAdminUseRolesVerifier);
-    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_VIEW_SESSIONS(), projectAdminUseRolesVerifier);
-    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_VIEW_IDP(), projectAdminUseRolesVerifier);
-    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_CHANGE_PROFILE(), projectAdminUseRolesVerifier);
-    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_CHANGE_PASSWORD(), projectAdminUseRolesVerifier);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.API_KEY_LIST);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedGlobalApiKeyRoles);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedSignUpRoles);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedRoleMutation);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedRoleMutation);
+    permissions.allow(
+      Roles.TenantRole.PROJECT_ADMIN,
+      PermissionActions.PermissionActions.PERSON_CREATE_SESSION_KEY({ phase: "preflight" }),
+      projectAdminMayCreateSession
+    );
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_DISABLE(null), projectAdminMayTarget);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_FORCE_SIGN_OUT(null), projectAdminMayTarget);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_RESET_MFA(null), projectAdminMayTarget);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_VIEW_SESSIONS(null), projectAdminMayTarget);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_VIEW_IDP(null), projectAdminMayTarget);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_CHANGE_PROFILE(null, []), projectAdminMayTarget);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_CHANGE_PASSWORD(null), projectAdminMayTarget);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PROJECT_VIEW_MEMBER([]));
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PROJECT_ADD_MEMBER([]));
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PROJECT_UPDATE_MEMBER([]));
@@ -54,14 +60,16 @@ class PermissionsFactory {
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PROJECT_VIEW_SECRETS);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_INVITE([]));
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.PERSON_INVITE_UNMANAGED([]));
-    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.MAIL_TEMPLATE_ADD);
-    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.MAIL_TEMPLATE_REMOVE);
-    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.MAIL_TEMPLATE_LIST);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.MAIL_TEMPLATE_ADD());
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.MAIL_TEMPLATE_REMOVE());
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.MAIL_TEMPLATE_LIST());
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDP_ADD);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDP_UPDATE);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDP_DISABLE);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDP_ENABLE);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.IDP_LIST);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.AUTH_LOG_VIEW);
+    permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.CUSTOM_ROLE_VIEW);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.ENTRYPOINT_DEPLOY);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.CONFIGURE);
     permissions.allow(Roles.TenantRole.PROJECT_ADMIN, PermissionActions.PermissionActions.CONFIG_VIEW);

package/dist/production/src/model/authorization/PermissionsFactory.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PermissionsFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionsFactory.ts"],"sourcesContent":["import { Permissions } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions.js'\nimport { TenantRole } from './Roles.js'\n\nconst allowedRoles = new Set<string>([TenantRole.LOGIN, TenantRole.PROJECT_ADMIN, TenantRole.ENTRYPOINT_DEPLOYER])\n\nconst projectAdminAllowedInputRoles = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined || roles.every(it => allowedRoles.has(it))\n}\n\nconst forbiddenRoles = new Set<string>([TenantRole.SUPER_ADMIN, TenantRole.PROJECT_CREATOR])\n\nconst projectAdminUseRolesVerifier = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined || roles.every(it => !forbiddenRoles.has(it))\n}\n\nclass PermissionsFactory {\n\tpublic create(): Permissions {\n\t\tconst permissions = new Permissions()\n\n\t\tpermissions.allow(TenantRole.SUPER_ADMIN, { resource: Permissions.ALL, privilege: Permissions.ALL })\n\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_RESET_PASSWORD)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_CREATE_IDP_URL)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN_IDP)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_PASSWORDLESS_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN)\n\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PASSWORD)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PROFILE)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_TOGGLE_PASSWORDLESS)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SIGN_OUT)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_REVOKE_SESSION)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_DISCONNECT_MY_IDP)\n\n\t\tpermissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_VIEW_PERMISSIONS)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CREATE_SESSION_KEY(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_FORCE_SIGN_OUT(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_RESET_MFA(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW_SESSIONS(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW_IDP(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(), projectAdminUseRolesVerifier)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_ADD_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_UPDATE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_REMOVE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_SECRETS)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE_UNMANAGED([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_UPDATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ENABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.ENTRYPOINT_DEPLOY)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIGURE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIG_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_CREATOR, PermissionActions.PROJECT_CREATE)\n\t\tpermissions.allow(TenantRole.ENTRYPOINT_DEPLOYER, PermissionActions.ENTRYPOINT_DEPLOY)\n\n\t\treturn permissions\n\t}\n}\n\nexport { PermissionsFactory }\n"],"names":["TenantRole","Permissions","PermissionActions"],"mappings":";;;;;AAIA,MAAM,eAAe,oBAAI,IAAY,CAACA,iBAAW,OAAOA,MAAAA,WAAW,eAAeA,iBAAW,mBAAmB,CAAC;AAEjH,MAAM,gCAAgC,CAAC,EAAE,YAA2C;AACnF,SAAO,UAAU,UAAa,MAAM,MAAM,QAAM,aAAa,IAAI,EAAE,CAAC;AACrE;AAEA,MAAM,qCAAqB,IAAY,CAACA,MAAAA,WAAW,aAAaA,MAAAA,WAAW,eAAe,CAAC;AAE3F,MAAM,+BAA+B,CAAC,EAAE,YAA2C;AAClF,SAAO,UAAU,UAAa,MAAM,MAAM,QAAM,CAAC,eAAe,IAAI,EAAE,CAAC;AACxE;AAEA,MAAM,mBAAmB;AAAA,EACjB,SAAsB;AAC5B,UAAM,cAAc,IAAIC,0BAAA;AAExB,gBAAY,MAAMD,iBAAW,aAAa,EAAE,UAAUC,cAAAA,YAAY,KAAK,WAAWA,cAAAA,YAAY,IAAA,CAAK;AAEnG,gBAAY,MAAMD,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,cAAc;AACpE,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,kBAAkB;AACxE,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,2BAA2B;AACjF,gBAAY,MAAMF,MAAAA,WAAW,OAAOE,kBAAAA,kBAAkB,mCAAmC;AAEzF,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,WAAW;AAClE,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,yBAAyB;AAChF,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,wBAAwB;AAC/E,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,0BAA0B;AACjF,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,eAAe;AACtE,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,gBAAgB;AACvE,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,qBAAqB;AAC5E,gBAAY,MAAMF,MAAAA,WAAW,QAAQE,kBAAAA,kBAAkB,wBAAwB;AAE/E,gBAAY,MAAMF,MAAAA,WAAW,gBAAgBE,kBAAAA,kBAAkB,YAAY;AAE3E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,YAAY;AAC1E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,yBAAyB;AACvF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,WAAW;AACzE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,cAAc;AAC5E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,eAAe;AAC7E,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,sBAAA,GAAyB,6BAA6B;AAEpH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,eAAA,GAAkB,6BAA6B;AAC7G,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,0BAAA,GAA6B,6BAA6B;AACxH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,6BAAA,GAAgC,6BAA6B;AAC3H,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,0BAAA,GAA6B,4BAA4B;AACvH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,eAAA,GAAkB,4BAA4B;AAC5G,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,sBAAA,GAAyB,4BAA4B;AACnH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,iBAAA,GAAoB,4BAA4B;AAC9G,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,qBAAA,GAAwB,4BAA4B;AAClH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,gBAAA,GAAmB,4BAA4B;AAC7G,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,sBAAA,GAAyB,4BAA4B;AACnH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,uBAAA,GAA0B,4BAA4B;AAEpH,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,CAAC;AACrF,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,mBAAmB,CAAA,CAAE,CAAC;AACpF,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AACvF,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AACvF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,oBAAoB;AAElF,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,cAAc,CAAA,CAAE,CAAC;AAC/E,gBAAY,MAAMF,iBAAW,eAAeE,kBAAAA,kBAAkB,wBAAwB,CAAA,CAAE,CAAC;AAEzF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,oBAAoB;AAClF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,kBAAkB;AAEhF,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,OAAO;AACrE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,UAAU;AACxE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,WAAW;AACzE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,UAAU;AACxE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,QAAQ;AAEtE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,SAAS;AACvE,gBAAY,MAAMF,MAAAA,WAAW,eAAeE,kBAAAA,kBAAkB,WAAW;AAEzE,gBAAY,MAAMF,MAAAA,WAAW,iBAAiBE,kBAAAA,kBAAkB,cAAc;AAC9E,gBAAY,MAAMF,MAAAA,WAAW,qBAAqBE,kBAAAA,kBAAkB,iBAAiB;AAErF,WAAO;AAAA,EACR;AACD;;"}
+{"version":3,"file":"PermissionsFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionsFactory.ts"],"sourcesContent":["import { Permissions } from '@contember/authorization'\nimport {\n\tApiKeyPermissionMeta,\n\tChangeProfilePermissionMeta,\n\tCreateSessionTokenPermissionMeta,\n\tGlobalApiKeyPermissionMeta,\n\tGlobalRoleMutationPermissionMeta,\n\tPermissionActions,\n\tTargetIdentityPermissionMeta,\n} from './PermissionActions.js'\nimport { NON_DELEGABLE_TENANT_ROLES, TenantRole } from './Roles.js'\n\nconst projectAdminAllowsRoles = (roles: readonly string[] | undefined): boolean =>\n\troles === undefined || roles.every(role => !NON_DELEGABLE_TENANT_ROLES.has(role))\n\nconst projectAdminAllowedSignUpRoles = (meta: { readonly requestedRoles?: readonly string[] }) => projectAdminAllowsRoles(meta.requestedRoles)\n\n/**\n * A key minted with trust-forwarded-info decides what lands in the audit log and what per-IP rate limits key on,\n * so delegated authority may not mint one — same rule the custom-role grants apply via `allowTrustForwardedClientInfo`.\n */\nconst projectAdminAllowsTrustForwardedClientInfo = (meta: { readonly trustForwardedClientInfo?: boolean } | undefined) =>\n\tmeta?.trustForwardedClientInfo !== true\n\nconst projectAdminAllowedApiKey = (meta: ApiKeyPermissionMeta | undefined) => projectAdminAllowsTrustForwardedClientInfo(meta)\n\nconst projectAdminAllowedGlobalApiKeyRoles = (meta: GlobalApiKeyPermissionMeta | undefined) =>\n\tprojectAdminAllowsRoles(meta?.requestedRoles) && projectAdminAllowsTrustForwardedClientInfo(meta)\n\nconst projectAdminAllowedRoleMutation = (meta: GlobalRoleMutationPermissionMeta | undefined) =>\n\tmeta === undefined\n\t|| (\n\t\tprojectAdminAllowsRoles(meta.requestedRoles)\n\t\t&& meta.target.globalRoles.every(role => !NON_DELEGABLE_TENANT_ROLES.has(role))\n\t)\n\nconst projectAdminMayTarget = (meta: TargetIdentityPermissionMeta) =>\n\tmeta.target === null || meta.target.globalRoles.every(role => !NON_DELEGABLE_TENANT_ROLES.has(role))\n\nconst projectAdminMayCreateSession = (meta: CreateSessionTokenPermissionMeta) =>\n\tmeta.phase === 'preflight' || meta.target?.globalRoles.every(role => !NON_DELEGABLE_TENANT_ROLES.has(role)) === true\n\nclass PermissionsFactory {\n\tpublic create(): Permissions {\n\t\tconst permissions = new Permissions()\n\n\t\tpermissions.allow(TenantRole.SUPER_ADMIN, { resource: Permissions.ALL, privilege: Permissions.ALL })\n\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_RESET_PASSWORD)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_CREATE_IDP_URL)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN_IDP)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_PASSWORDLESS_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN)\n\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PASSWORD)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PROFILE)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_TOGGLE_PASSWORDLESS)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SIGN_OUT)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_REVOKE_SESSION)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_DISCONNECT_MY_IDP)\n\n\t\tpermissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_VIEW_PERMISSIONS)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_LIST)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE(), projectAdminAllowedApiKey)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_LIST)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedGlobalApiKeyRoles)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedSignUpRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedRoleMutation)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedRoleMutation)\n\t\tpermissions.allow(\n\t\t\tTenantRole.PROJECT_ADMIN,\n\t\t\tPermissionActions.PERSON_CREATE_SESSION_KEY({ phase: 'preflight' }),\n\t\t\tprojectAdminMayCreateSession,\n\t\t)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(null), projectAdminMayTarget)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_FORCE_SIGN_OUT(null), projectAdminMayTarget)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_RESET_MFA(null), projectAdminMayTarget)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW_SESSIONS(null), projectAdminMayTarget)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW_IDP(null), projectAdminMayTarget)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(null, []), projectAdminMayTarget)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(null), projectAdminMayTarget)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_ADD_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_UPDATE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_REMOVE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_SECRETS)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE_UNMANAGED([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD())\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE())\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_LIST())\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_UPDATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ENABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.AUTH_LOG_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CUSTOM_ROLE_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.ENTRYPOINT_DEPLOY)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIGURE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIG_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_CREATOR, PermissionActions.PROJECT_CREATE)\n\t\tpermissions.allow(TenantRole.ENTRYPOINT_DEPLOYER, PermissionActions.ENTRYPOINT_DEPLOY)\n\n\t\treturn permissions\n\t}\n}\n\nexport { PermissionsFactory }\n"],"names":["NON_DELEGABLE_TENANT_ROLES","Permissions","TenantRole","PermissionActions"],"mappings":";;;;;AAYA,MAAM,0BAA0B,CAAC,UAChC,UAAU,UAAa,MAAM,MAAM,CAAA,SAAQ,CAACA,MAAAA,2BAA2B,IAAI,IAAI,CAAC;AAEjF,MAAM,iCAAiC,CAAC,SAA0D,wBAAwB,KAAK,cAAc;AAM7I,MAAM,6CAA6C,CAAC,SACnD,MAAM,6BAA6B;AAEpC,MAAM,4BAA4B,CAAC,SAA2C,2CAA2C,IAAI;AAE7H,MAAM,uCAAuC,CAAC,SAC7C,wBAAwB,MAAM,cAAc,KAAK,2CAA2C,IAAI;AAEjG,MAAM,kCAAkC,CAAC,SACxC,SAAS,UAER,wBAAwB,KAAK,cAAc,KACxC,KAAK,OAAO,YAAY,MAAM,CAAA,SAAQ,CAACA,iCAA2B,IAAI,IAAI,CAAC;AAGhF,MAAM,wBAAwB,CAAC,SAC9B,KAAK,WAAW,QAAQ,KAAK,OAAO,YAAY,MAAM,CAAA,SAAQ,CAACA,MAAAA,2BAA2B,IAAI,IAAI,CAAC;AAEpG,MAAM,+BAA+B,CAAC,SACrC,KAAK,UAAU,eAAe,KAAK,QAAQ,YAAY,MAAM,UAAQ,CAACA,MAAAA,2BAA2B,IAAI,IAAI,CAAC,MAAM;AAEjH,MAAM,mBAAmB;AAAA,EACjB,SAAsB;AAC5B,UAAM,cAAc,IAAIC,0BAAA;AAExB,gBAAY,MAAMC,iBAAW,aAAa,EAAE,UAAUD,cAAAA,YAAY,KAAK,WAAWA,cAAAA,YAAY,IAAA,CAAK;AAEnG,gBAAY,MAAMC,MAAAA,WAAW,OAAOC,kBAAAA,kBAAkB,cAAc;AACpE,gBAAY,MAAMD,MAAAA,WAAW,OAAOC,kBAAAA,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAMD,MAAAA,WAAW,OAAOC,kBAAAA,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAMD,MAAAA,WAAW,OAAOC,kBAAAA,kBAAkB,kBAAkB;AACxE,gBAAY,MAAMD,MAAAA,WAAW,OAAOC,kBAAAA,kBAAkB,2BAA2B;AACjF,gBAAY,MAAMD,MAAAA,WAAW,OAAOC,kBAAAA,kBAAkB,mCAAmC;AAEzF,gBAAY,MAAMD,MAAAA,WAAW,QAAQC,kBAAAA,kBAAkB,WAAW;AAClE,gBAAY,MAAMD,MAAAA,WAAW,QAAQC,kBAAAA,kBAAkB,yBAAyB;AAChF,gBAAY,MAAMD,MAAAA,WAAW,QAAQC,kBAAAA,kBAAkB,wBAAwB;AAC/E,gBAAY,MAAMD,MAAAA,WAAW,QAAQC,kBAAAA,kBAAkB,0BAA0B;AACjF,gBAAY,MAAMD,MAAAA,WAAW,QAAQC,kBAAAA,kBAAkB,eAAe;AACtE,gBAAY,MAAMD,MAAAA,WAAW,QAAQC,kBAAAA,kBAAkB,gBAAgB;AACvE,gBAAY,MAAMD,MAAAA,WAAW,QAAQC,kBAAAA,kBAAkB,qBAAqB;AAC5E,gBAAY,MAAMD,MAAAA,WAAW,QAAQC,kBAAAA,kBAAkB,wBAAwB;AAE/E,gBAAY,MAAMD,MAAAA,WAAW,gBAAgBC,kBAAAA,kBAAkB,YAAY;AAE3E,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,YAAY;AAC1E,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,yBAAyB;AACvF,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,WAAW;AACzE,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,WAAW;AACzE,gBAAY,MAAMD,iBAAW,eAAeC,kBAAAA,kBAAkB,eAAA,GAAkB,yBAAyB;AACzG,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,eAAe;AAC7E,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,YAAY;AAC1E,gBAAY,MAAMD,iBAAW,eAAeC,kBAAAA,kBAAkB,sBAAA,GAAyB,oCAAoC;AAE3H,gBAAY,MAAMD,iBAAW,eAAeC,kBAAAA,kBAAkB,eAAA,GAAkB,8BAA8B;AAC9G,gBAAY,MAAMD,iBAAW,eAAeC,kBAAAA,kBAAkB,0BAAA,GAA6B,+BAA+B;AAC1H,gBAAY,MAAMD,iBAAW,eAAeC,kBAAAA,kBAAkB,6BAAA,GAAgC,+BAA+B;AAC7H,gBAAY;AAAA,MACXD,MAAAA,WAAW;AAAA,MACXC,kBAAAA,kBAAkB,0BAA0B,EAAE,OAAO,aAAa;AAAA,MAClE;AAAA,IAAA;AAED,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,eAAe,IAAI,GAAG,qBAAqB;AACzG,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,sBAAsB,IAAI,GAAG,qBAAqB;AAChH,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,iBAAiB,IAAI,GAAG,qBAAqB;AAC3G,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,qBAAqB,IAAI,GAAG,qBAAqB;AAC/G,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,gBAAgB,IAAI,GAAG,qBAAqB;AAC1G,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,sBAAsB,MAAM,EAAE,GAAG,qBAAqB;AACpH,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,uBAAuB,IAAI,GAAG,qBAAqB;AAEjH,gBAAY,MAAMD,iBAAW,eAAeC,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,CAAC;AACrF,gBAAY,MAAMD,iBAAW,eAAeC,kBAAAA,kBAAkB,mBAAmB,CAAA,CAAE,CAAC;AACpF,gBAAY,MAAMD,iBAAW,eAAeC,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AACvF,gBAAY,MAAMD,iBAAW,eAAeC,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AACvF,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,oBAAoB;AAElF,gBAAY,MAAMD,iBAAW,eAAeC,kBAAAA,kBAAkB,cAAc,CAAA,CAAE,CAAC;AAC/E,gBAAY,MAAMD,iBAAW,eAAeC,kBAAAA,kBAAkB,wBAAwB,CAAA,CAAE,CAAC;AAEzF,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,mBAAmB;AACjF,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,sBAAsB;AACpF,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,oBAAoB;AAElF,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,OAAO;AACrE,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,UAAU;AACxE,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,WAAW;AACzE,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,UAAU;AACxE,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,QAAQ;AAEtE,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,aAAa;AAC3E,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,gBAAgB;AAC9E,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,SAAS;AACvE,gBAAY,MAAMD,MAAAA,WAAW,eAAeC,kBAAAA,kBAAkB,WAAW;AAEzE,gBAAY,MAAMD,MAAAA,WAAW,iBAAiBC,kBAAAA,kBAAkB,cAAc;AAC9E,gBAAY,MAAMD,MAAAA,WAAW,qBAAqBC,kBAAAA,kBAAkB,iBAAiB;AAErF,WAAO;AAAA,EACR;AACD;;"}

package/dist/production/src/model/authorization/PermissionsFactory.js

@@ -1,14 +1,14 @@
 import { Permissions } from "@contember/authorization";
 import { PermissionActions } from "./PermissionActions.js";
-import { TenantRole } from "./Roles.js";
-const allowedRoles = /* @__PURE__ */ new Set([TenantRole.LOGIN, TenantRole.PROJECT_ADMIN, TenantRole.ENTRYPOINT_DEPLOYER]);
-const projectAdminAllowedInputRoles = ({ roles }) => {
-  return roles === void 0 || roles.every((it) => allowedRoles.has(it));
-};
-const forbiddenRoles = /* @__PURE__ */ new Set([TenantRole.SUPER_ADMIN, TenantRole.PROJECT_CREATOR]);
-const projectAdminUseRolesVerifier = ({ roles }) => {
-  return roles === void 0 || roles.every((it) => !forbiddenRoles.has(it));
-};
+import { TenantRole, NON_DELEGABLE_TENANT_ROLES } from "./Roles.js";
+const projectAdminAllowsRoles = (roles) => roles === void 0 || roles.every((role) => !NON_DELEGABLE_TENANT_ROLES.has(role));
+const projectAdminAllowedSignUpRoles = (meta) => projectAdminAllowsRoles(meta.requestedRoles);
+const projectAdminAllowsTrustForwardedClientInfo = (meta) => meta?.trustForwardedClientInfo !== true;
+const projectAdminAllowedApiKey = (meta) => projectAdminAllowsTrustForwardedClientInfo(meta);
+const projectAdminAllowedGlobalApiKeyRoles = (meta) => projectAdminAllowsRoles(meta?.requestedRoles) && projectAdminAllowsTrustForwardedClientInfo(meta);
+const projectAdminAllowedRoleMutation = (meta) => meta === void 0 || projectAdminAllowsRoles(meta.requestedRoles) && meta.target.globalRoles.every((role) => !NON_DELEGABLE_TENANT_ROLES.has(role));
+const projectAdminMayTarget = (meta) => meta.target === null || meta.target.globalRoles.every((role) => !NON_DELEGABLE_TENANT_ROLES.has(role));
+const projectAdminMayCreateSession = (meta) => meta.phase === "preflight" || meta.target?.globalRoles.every((role) => !NON_DELEGABLE_TENANT_ROLES.has(role)) === true;
 class PermissionsFactory {
   create() {
     const permissions = new Permissions();
@@ -31,20 +31,26 @@ class PermissionsFactory {
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_VIEW_PERMISSIONS);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW);
-    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_LIST);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE(), projectAdminAllowedApiKey);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE);
-    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles);
-    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedInputRoles);
-    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedInputRoles);
-    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedInputRoles);
-    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CREATE_SESSION_KEY(), projectAdminUseRolesVerifier);
-    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(), projectAdminUseRolesVerifier);
-    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_FORCE_SIGN_OUT(), projectAdminUseRolesVerifier);
-    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_RESET_MFA(), projectAdminUseRolesVerifier);
-    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW_SESSIONS(), projectAdminUseRolesVerifier);
-    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW_IDP(), projectAdminUseRolesVerifier);
-    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(), projectAdminUseRolesVerifier);
-    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(), projectAdminUseRolesVerifier);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_LIST);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedGlobalApiKeyRoles);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedSignUpRoles);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedRoleMutation);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedRoleMutation);
+    permissions.allow(
+      TenantRole.PROJECT_ADMIN,
+      PermissionActions.PERSON_CREATE_SESSION_KEY({ phase: "preflight" }),
+      projectAdminMayCreateSession
+    );
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(null), projectAdminMayTarget);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_FORCE_SIGN_OUT(null), projectAdminMayTarget);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_RESET_MFA(null), projectAdminMayTarget);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW_SESSIONS(null), projectAdminMayTarget);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW_IDP(null), projectAdminMayTarget);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(null, []), projectAdminMayTarget);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(null), projectAdminMayTarget);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_MEMBER([]));
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_ADD_MEMBER([]));
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_UPDATE_MEMBER([]));
@@ -52,14 +58,16 @@ class PermissionsFactory {
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_SECRETS);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE([]));
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE_UNMANAGED([]));
-    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD);
-    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE);
-    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_LIST);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD());
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE());
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_LIST());
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ADD);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_UPDATE);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_DISABLE);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ENABLE);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_LIST);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.AUTH_LOG_VIEW);
+    permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CUSTOM_ROLE_VIEW);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.ENTRYPOINT_DEPLOY);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIGURE);
     permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIG_VIEW);

package/dist/production/src/model/authorization/PermissionsFactory.js.map

@@ -1 +1 @@
-{"version":3,"file":"PermissionsFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionsFactory.ts"],"sourcesContent":["import { Permissions } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions.js'\nimport { TenantRole } from './Roles.js'\n\nconst allowedRoles = new Set<string>([TenantRole.LOGIN, TenantRole.PROJECT_ADMIN, TenantRole.ENTRYPOINT_DEPLOYER])\n\nconst projectAdminAllowedInputRoles = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined || roles.every(it => allowedRoles.has(it))\n}\n\nconst forbiddenRoles = new Set<string>([TenantRole.SUPER_ADMIN, TenantRole.PROJECT_CREATOR])\n\nconst projectAdminUseRolesVerifier = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined || roles.every(it => !forbiddenRoles.has(it))\n}\n\nclass PermissionsFactory {\n\tpublic create(): Permissions {\n\t\tconst permissions = new Permissions()\n\n\t\tpermissions.allow(TenantRole.SUPER_ADMIN, { resource: Permissions.ALL, privilege: Permissions.ALL })\n\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_RESET_PASSWORD)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_CREATE_IDP_URL)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN_IDP)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_PASSWORDLESS_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN)\n\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PASSWORD)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PROFILE)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_TOGGLE_PASSWORDLESS)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SIGN_OUT)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_REVOKE_SESSION)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_DISCONNECT_MY_IDP)\n\n\t\tpermissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_VIEW_PERMISSIONS)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CREATE_SESSION_KEY(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_FORCE_SIGN_OUT(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_RESET_MFA(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW_SESSIONS(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW_IDP(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(), projectAdminUseRolesVerifier)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_ADD_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_UPDATE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_REMOVE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_SECRETS)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE_UNMANAGED([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_UPDATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ENABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.ENTRYPOINT_DEPLOY)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIGURE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIG_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_CREATOR, PermissionActions.PROJECT_CREATE)\n\t\tpermissions.allow(TenantRole.ENTRYPOINT_DEPLOYER, PermissionActions.ENTRYPOINT_DEPLOY)\n\n\t\treturn permissions\n\t}\n}\n\nexport { PermissionsFactory }\n"],"names":[],"mappings":";;;AAIA,MAAM,eAAe,oBAAI,IAAY,CAAC,WAAW,OAAO,WAAW,eAAe,WAAW,mBAAmB,CAAC;AAEjH,MAAM,gCAAgC,CAAC,EAAE,YAA2C;AACnF,SAAO,UAAU,UAAa,MAAM,MAAM,QAAM,aAAa,IAAI,EAAE,CAAC;AACrE;AAEA,MAAM,qCAAqB,IAAY,CAAC,WAAW,aAAa,WAAW,eAAe,CAAC;AAE3F,MAAM,+BAA+B,CAAC,EAAE,YAA2C;AAClF,SAAO,UAAU,UAAa,MAAM,MAAM,QAAM,CAAC,eAAe,IAAI,EAAE,CAAC;AACxE;AAEA,MAAM,mBAAmB;AAAA,EACjB,SAAsB;AAC5B,UAAM,cAAc,IAAI,YAAA;AAExB,gBAAY,MAAM,WAAW,aAAa,EAAE,UAAU,YAAY,KAAK,WAAW,YAAY,IAAA,CAAK;AAEnG,gBAAY,MAAM,WAAW,OAAO,kBAAkB,cAAc;AACpE,gBAAY,MAAM,WAAW,OAAO,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAM,WAAW,OAAO,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAM,WAAW,OAAO,kBAAkB,kBAAkB;AACxE,gBAAY,MAAM,WAAW,OAAO,kBAAkB,2BAA2B;AACjF,gBAAY,MAAM,WAAW,OAAO,kBAAkB,mCAAmC;AAEzF,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,WAAW;AAClE,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,yBAAyB;AAChF,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,wBAAwB;AAC/E,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,0BAA0B;AACjF,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,eAAe;AACtE,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,gBAAgB;AACvE,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,qBAAqB;AAC5E,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,wBAAwB;AAE/E,gBAAY,MAAM,WAAW,gBAAgB,kBAAkB,YAAY;AAE3E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,YAAY;AAC1E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,yBAAyB;AACvF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,WAAW;AACzE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,cAAc;AAC5E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,eAAe;AAC7E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAA,GAAyB,6BAA6B;AAEpH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,eAAA,GAAkB,6BAA6B;AAC7G,gBAAY,MAAM,WAAW,eAAe,kBAAkB,0BAAA,GAA6B,6BAA6B;AACxH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,6BAAA,GAAgC,6BAA6B;AAC3H,gBAAY,MAAM,WAAW,eAAe,kBAAkB,0BAAA,GAA6B,4BAA4B;AACvH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,eAAA,GAAkB,4BAA4B;AAC5G,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAA,GAAyB,4BAA4B;AACnH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,iBAAA,GAAoB,4BAA4B;AAC9G,gBAAY,MAAM,WAAW,eAAe,kBAAkB,qBAAA,GAAwB,4BAA4B;AAClH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,gBAAA,GAAmB,4BAA4B;AAC7G,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAA,GAAyB,4BAA4B;AACnH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,uBAAA,GAA0B,4BAA4B;AAEpH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,oBAAoB,CAAA,CAAE,CAAC;AACrF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,mBAAmB,CAAA,CAAE,CAAC;AACpF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AACvF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AACvF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,oBAAoB;AAElF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,cAAc,CAAA,CAAE,CAAC;AAC/E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,wBAAwB,CAAA,CAAE,CAAC;AAEzF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,oBAAoB;AAClF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,kBAAkB;AAEhF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,OAAO;AACrE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,UAAU;AACxE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,WAAW;AACzE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,UAAU;AACxE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,QAAQ;AAEtE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,SAAS;AACvE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,WAAW;AAEzE,gBAAY,MAAM,WAAW,iBAAiB,kBAAkB,cAAc;AAC9E,gBAAY,MAAM,WAAW,qBAAqB,kBAAkB,iBAAiB;AAErF,WAAO;AAAA,EACR;AACD;"}
+{"version":3,"file":"PermissionsFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionsFactory.ts"],"sourcesContent":["import { Permissions } from '@contember/authorization'\nimport {\n\tApiKeyPermissionMeta,\n\tChangeProfilePermissionMeta,\n\tCreateSessionTokenPermissionMeta,\n\tGlobalApiKeyPermissionMeta,\n\tGlobalRoleMutationPermissionMeta,\n\tPermissionActions,\n\tTargetIdentityPermissionMeta,\n} from './PermissionActions.js'\nimport { NON_DELEGABLE_TENANT_ROLES, TenantRole } from './Roles.js'\n\nconst projectAdminAllowsRoles = (roles: readonly string[] | undefined): boolean =>\n\troles === undefined || roles.every(role => !NON_DELEGABLE_TENANT_ROLES.has(role))\n\nconst projectAdminAllowedSignUpRoles = (meta: { readonly requestedRoles?: readonly string[] }) => projectAdminAllowsRoles(meta.requestedRoles)\n\n/**\n * A key minted with trust-forwarded-info decides what lands in the audit log and what per-IP rate limits key on,\n * so delegated authority may not mint one — same rule the custom-role grants apply via `allowTrustForwardedClientInfo`.\n */\nconst projectAdminAllowsTrustForwardedClientInfo = (meta: { readonly trustForwardedClientInfo?: boolean } | undefined) =>\n\tmeta?.trustForwardedClientInfo !== true\n\nconst projectAdminAllowedApiKey = (meta: ApiKeyPermissionMeta | undefined) => projectAdminAllowsTrustForwardedClientInfo(meta)\n\nconst projectAdminAllowedGlobalApiKeyRoles = (meta: GlobalApiKeyPermissionMeta | undefined) =>\n\tprojectAdminAllowsRoles(meta?.requestedRoles) && projectAdminAllowsTrustForwardedClientInfo(meta)\n\nconst projectAdminAllowedRoleMutation = (meta: GlobalRoleMutationPermissionMeta | undefined) =>\n\tmeta === undefined\n\t|| (\n\t\tprojectAdminAllowsRoles(meta.requestedRoles)\n\t\t&& meta.target.globalRoles.every(role => !NON_DELEGABLE_TENANT_ROLES.has(role))\n\t)\n\nconst projectAdminMayTarget = (meta: TargetIdentityPermissionMeta) =>\n\tmeta.target === null || meta.target.globalRoles.every(role => !NON_DELEGABLE_TENANT_ROLES.has(role))\n\nconst projectAdminMayCreateSession = (meta: CreateSessionTokenPermissionMeta) =>\n\tmeta.phase === 'preflight' || meta.target?.globalRoles.every(role => !NON_DELEGABLE_TENANT_ROLES.has(role)) === true\n\nclass PermissionsFactory {\n\tpublic create(): Permissions {\n\t\tconst permissions = new Permissions()\n\n\t\tpermissions.allow(TenantRole.SUPER_ADMIN, { resource: Permissions.ALL, privilege: Permissions.ALL })\n\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_RESET_PASSWORD)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_CREATE_IDP_URL)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN_IDP)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_PASSWORDLESS_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN)\n\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PASSWORD)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PROFILE)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_TOGGLE_PASSWORDLESS)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SIGN_OUT)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_REVOKE_SESSION)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_DISCONNECT_MY_IDP)\n\n\t\tpermissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_VIEW_PERMISSIONS)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_LIST)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE(), projectAdminAllowedApiKey)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_LIST)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedGlobalApiKeyRoles)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedSignUpRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedRoleMutation)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedRoleMutation)\n\t\tpermissions.allow(\n\t\t\tTenantRole.PROJECT_ADMIN,\n\t\t\tPermissionActions.PERSON_CREATE_SESSION_KEY({ phase: 'preflight' }),\n\t\t\tprojectAdminMayCreateSession,\n\t\t)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(null), projectAdminMayTarget)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_FORCE_SIGN_OUT(null), projectAdminMayTarget)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_RESET_MFA(null), projectAdminMayTarget)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW_SESSIONS(null), projectAdminMayTarget)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW_IDP(null), projectAdminMayTarget)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(null, []), projectAdminMayTarget)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(null), projectAdminMayTarget)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_ADD_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_UPDATE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_REMOVE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_SECRETS)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE_UNMANAGED([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD())\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE())\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_LIST())\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_UPDATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ENABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.AUTH_LOG_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CUSTOM_ROLE_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.ENTRYPOINT_DEPLOY)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIGURE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIG_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_CREATOR, PermissionActions.PROJECT_CREATE)\n\t\tpermissions.allow(TenantRole.ENTRYPOINT_DEPLOYER, PermissionActions.ENTRYPOINT_DEPLOY)\n\n\t\treturn permissions\n\t}\n}\n\nexport { PermissionsFactory }\n"],"names":[],"mappings":";;;AAYA,MAAM,0BAA0B,CAAC,UAChC,UAAU,UAAa,MAAM,MAAM,CAAA,SAAQ,CAAC,2BAA2B,IAAI,IAAI,CAAC;AAEjF,MAAM,iCAAiC,CAAC,SAA0D,wBAAwB,KAAK,cAAc;AAM7I,MAAM,6CAA6C,CAAC,SACnD,MAAM,6BAA6B;AAEpC,MAAM,4BAA4B,CAAC,SAA2C,2CAA2C,IAAI;AAE7H,MAAM,uCAAuC,CAAC,SAC7C,wBAAwB,MAAM,cAAc,KAAK,2CAA2C,IAAI;AAEjG,MAAM,kCAAkC,CAAC,SACxC,SAAS,UAER,wBAAwB,KAAK,cAAc,KACxC,KAAK,OAAO,YAAY,MAAM,CAAA,SAAQ,CAAC,2BAA2B,IAAI,IAAI,CAAC;AAGhF,MAAM,wBAAwB,CAAC,SAC9B,KAAK,WAAW,QAAQ,KAAK,OAAO,YAAY,MAAM,CAAA,SAAQ,CAAC,2BAA2B,IAAI,IAAI,CAAC;AAEpG,MAAM,+BAA+B,CAAC,SACrC,KAAK,UAAU,eAAe,KAAK,QAAQ,YAAY,MAAM,UAAQ,CAAC,2BAA2B,IAAI,IAAI,CAAC,MAAM;AAEjH,MAAM,mBAAmB;AAAA,EACjB,SAAsB;AAC5B,UAAM,cAAc,IAAI,YAAA;AAExB,gBAAY,MAAM,WAAW,aAAa,EAAE,UAAU,YAAY,KAAK,WAAW,YAAY,IAAA,CAAK;AAEnG,gBAAY,MAAM,WAAW,OAAO,kBAAkB,cAAc;AACpE,gBAAY,MAAM,WAAW,OAAO,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAM,WAAW,OAAO,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAM,WAAW,OAAO,kBAAkB,kBAAkB;AACxE,gBAAY,MAAM,WAAW,OAAO,kBAAkB,2BAA2B;AACjF,gBAAY,MAAM,WAAW,OAAO,kBAAkB,mCAAmC;AAEzF,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,WAAW;AAClE,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,yBAAyB;AAChF,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,wBAAwB;AAC/E,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,0BAA0B;AACjF,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,eAAe;AACtE,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,gBAAgB;AACvE,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,qBAAqB;AAC5E,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,wBAAwB;AAE/E,gBAAY,MAAM,WAAW,gBAAgB,kBAAkB,YAAY;AAE3E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,YAAY;AAC1E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,yBAAyB;AACvF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,WAAW;AACzE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,WAAW;AACzE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,eAAA,GAAkB,yBAAyB;AACzG,gBAAY,MAAM,WAAW,eAAe,kBAAkB,eAAe;AAC7E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,YAAY;AAC1E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAA,GAAyB,oCAAoC;AAE3H,gBAAY,MAAM,WAAW,eAAe,kBAAkB,eAAA,GAAkB,8BAA8B;AAC9G,gBAAY,MAAM,WAAW,eAAe,kBAAkB,0BAAA,GAA6B,+BAA+B;AAC1H,gBAAY,MAAM,WAAW,eAAe,kBAAkB,6BAAA,GAAgC,+BAA+B;AAC7H,gBAAY;AAAA,MACX,WAAW;AAAA,MACX,kBAAkB,0BAA0B,EAAE,OAAO,aAAa;AAAA,MAClE;AAAA,IAAA;AAED,gBAAY,MAAM,WAAW,eAAe,kBAAkB,eAAe,IAAI,GAAG,qBAAqB;AACzG,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAsB,IAAI,GAAG,qBAAqB;AAChH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,iBAAiB,IAAI,GAAG,qBAAqB;AAC3G,gBAAY,MAAM,WAAW,eAAe,kBAAkB,qBAAqB,IAAI,GAAG,qBAAqB;AAC/G,gBAAY,MAAM,WAAW,eAAe,kBAAkB,gBAAgB,IAAI,GAAG,qBAAqB;AAC1G,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAsB,MAAM,EAAE,GAAG,qBAAqB;AACpH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,uBAAuB,IAAI,GAAG,qBAAqB;AAEjH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,oBAAoB,CAAA,CAAE,CAAC;AACrF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,mBAAmB,CAAA,CAAE,CAAC;AACpF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AACvF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AACvF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,oBAAoB;AAElF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,cAAc,CAAA,CAAE,CAAC;AAC/E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,wBAAwB,CAAA,CAAE,CAAC;AAEzF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,mBAAmB;AACjF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAsB;AACpF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,oBAAoB;AAElF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,OAAO;AACrE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,UAAU;AACxE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,WAAW;AACzE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,UAAU;AACxE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,QAAQ;AAEtE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,aAAa;AAC3E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,gBAAgB;AAC9E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,SAAS;AACvE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,WAAW;AAEzE,gBAAY,MAAM,WAAW,iBAAiB,kBAAkB,cAAc;AAC9E,gBAAY,MAAM,WAAW,qBAAqB,kBAAkB,iBAAiB;AAErF,WAAO;AAAA,EACR;AACD;"}

package/dist/production/src/model/authorization/Roles.cjs

@@ -11,5 +11,13 @@ var TenantRole = /* @__PURE__ */ ((TenantRole2) => {
   TenantRole2["ENTRYPOINT_DEPLOYER"] = "entrypoint_deployer";
   return TenantRole2;
 })(TenantRole || {});
+const NON_DELEGABLE_TENANT_ROLES = /* @__PURE__ */ new Set([
+  "super_admin",
+  "project_creator"
+  /* PROJECT_CREATOR */
+]);
+const ROLE_SLUG_PATTERN = /^[a-z][a-z0-9_]*$/;
+exports.NON_DELEGABLE_TENANT_ROLES = NON_DELEGABLE_TENANT_ROLES;
+exports.ROLE_SLUG_PATTERN = ROLE_SLUG_PATTERN;
 exports.TenantRole = TenantRole;
 //# sourceMappingURL=Roles.cjs.map

package/dist/production/src/model/authorization/Roles.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"Roles.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/Roles.ts"],"sourcesContent":["export enum TenantRole {\n\tLOGIN = 'login',\n\tSELF = 'self',\n\tPERSON = 'person',\n\tSUPER_ADMIN = 'super_admin',\n\tPROJECT_CREATOR = 'project_creator',\n\tPROJECT_MEMBER = 'project_member',\n\tPROJECT_ADMIN = 'project_admin',\n\tENTRYPOINT_DEPLOYER = 'entrypoint_deployer',\n}\n"],"names":["TenantRole"],"mappings":";;AAAO,IAAK,+BAAAA,gBAAL;AACNA,cAAA,OAAA,IAAQ;AACRA,cAAA,MAAA,IAAO;AACPA,cAAA,QAAA,IAAS;AACTA,cAAA,aAAA,IAAc;AACdA,cAAA,iBAAA,IAAkB;AAClBA,cAAA,gBAAA,IAAiB;AACjBA,cAAA,eAAA,IAAgB;AAChBA,cAAA,qBAAA,IAAsB;AARX,SAAAA;AAAA,GAAA,cAAA,CAAA,CAAA;;"}
+{"version":3,"file":"Roles.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/Roles.ts"],"sourcesContent":["export enum TenantRole {\n\tLOGIN = 'login',\n\tSELF = 'self',\n\tPERSON = 'person',\n\tSUPER_ADMIN = 'super_admin',\n\tPROJECT_CREATOR = 'project_creator',\n\tPROJECT_MEMBER = 'project_member',\n\tPROJECT_ADMIN = 'project_admin',\n\tENTRYPOINT_DEPLOYER = 'entrypoint_deployer',\n}\n\n/**\n * Roles no delegated authority may ever grant, hold as a target, or impersonate.\n * Enforced by the static PROJECT_ADMIN verifiers and by custom-role grants alike —\n * keep it the single source, so a newly protected role cannot be added to one path only.\n */\nexport const NON_DELEGABLE_TENANT_ROLES: ReadonlySet<string> = new Set([\n\tTenantRole.SUPER_ADMIN,\n\tTenantRole.PROJECT_CREATOR,\n])\n\n/** Shared by custom-role slug validation and by role references inside grant configuration. */\nexport const ROLE_SLUG_PATTERN = /^[a-z][a-z0-9_]*$/\n"],"names":["TenantRole"],"mappings":";;AAAO,IAAK,+BAAAA,gBAAL;AACNA,cAAA,OAAA,IAAQ;AACRA,cAAA,MAAA,IAAO;AACPA,cAAA,QAAA,IAAS;AACTA,cAAA,aAAA,IAAc;AACdA,cAAA,iBAAA,IAAkB;AAClBA,cAAA,gBAAA,IAAiB;AACjBA,cAAA,eAAA,IAAgB;AAChBA,cAAA,qBAAA,IAAsB;AARX,SAAAA;AAAA,GAAA,cAAA,CAAA,CAAA;AAgBL,MAAM,iDAAsD,IAAI;AAAA,EACtE;AAAA,EACA;AAAA;AACD,CAAC;AAGM,MAAM,oBAAoB;;;;"}

package/dist/production/src/model/authorization/Roles.js

@@ -9,7 +9,15 @@ var TenantRole = /* @__PURE__ */ ((TenantRole2) => {
   TenantRole2["ENTRYPOINT_DEPLOYER"] = "entrypoint_deployer";
   return TenantRole2;
 })(TenantRole || {});
+const NON_DELEGABLE_TENANT_ROLES = /* @__PURE__ */ new Set([
+  "super_admin",
+  "project_creator"
+  /* PROJECT_CREATOR */
+]);
+const ROLE_SLUG_PATTERN = /^[a-z][a-z0-9_]*$/;
 export {
+  NON_DELEGABLE_TENANT_ROLES,
+  ROLE_SLUG_PATTERN,
   TenantRole
 };
 //# sourceMappingURL=Roles.js.map

package/dist/production/src/model/authorization/Roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"Roles.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/Roles.ts"],"sourcesContent":["export enum TenantRole {\n\tLOGIN = 'login',\n\tSELF = 'self',\n\tPERSON = 'person',\n\tSUPER_ADMIN = 'super_admin',\n\tPROJECT_CREATOR = 'project_creator',\n\tPROJECT_MEMBER = 'project_member',\n\tPROJECT_ADMIN = 'project_admin',\n\tENTRYPOINT_DEPLOYER = 'entrypoint_deployer',\n}\n"],"names":["TenantRole"],"mappings":"AAAO,IAAK,+BAAAA,gBAAL;AACNA,cAAA,OAAA,IAAQ;AACRA,cAAA,MAAA,IAAO;AACPA,cAAA,QAAA,IAAS;AACTA,cAAA,aAAA,IAAc;AACdA,cAAA,iBAAA,IAAkB;AAClBA,cAAA,gBAAA,IAAiB;AACjBA,cAAA,eAAA,IAAgB;AAChBA,cAAA,qBAAA,IAAsB;AARX,SAAAA;AAAA,GAAA,cAAA,CAAA,CAAA;"}
+{"version":3,"file":"Roles.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/Roles.ts"],"sourcesContent":["export enum TenantRole {\n\tLOGIN = 'login',\n\tSELF = 'self',\n\tPERSON = 'person',\n\tSUPER_ADMIN = 'super_admin',\n\tPROJECT_CREATOR = 'project_creator',\n\tPROJECT_MEMBER = 'project_member',\n\tPROJECT_ADMIN = 'project_admin',\n\tENTRYPOINT_DEPLOYER = 'entrypoint_deployer',\n}\n\n/**\n * Roles no delegated authority may ever grant, hold as a target, or impersonate.\n * Enforced by the static PROJECT_ADMIN verifiers and by custom-role grants alike —\n * keep it the single source, so a newly protected role cannot be added to one path only.\n */\nexport const NON_DELEGABLE_TENANT_ROLES: ReadonlySet<string> = new Set([\n\tTenantRole.SUPER_ADMIN,\n\tTenantRole.PROJECT_CREATOR,\n])\n\n/** Shared by custom-role slug validation and by role references inside grant configuration. */\nexport const ROLE_SLUG_PATTERN = /^[a-z][a-z0-9_]*$/\n"],"names":["TenantRole"],"mappings":"AAAO,IAAK,+BAAAA,gBAAL;AACNA,cAAA,OAAA,IAAQ;AACRA,cAAA,MAAA,IAAO;AACPA,cAAA,QAAA,IAAS;AACTA,cAAA,aAAA,IAAc;AACdA,cAAA,iBAAA,IAAkB;AAClBA,cAAA,gBAAA,IAAiB;AACjBA,cAAA,eAAA,IAAgB;AAChBA,cAAA,qBAAA,IAAsB;AARX,SAAAA;AAAA,GAAA,cAAA,CAAA,CAAA;AAgBL,MAAM,iDAAsD,IAAI;AAAA,EACtE;AAAA,EACA;AAAA;AACD,CAAC;AAGM,MAAM,oBAAoB;"}