@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/dist/types/TenantContainer.d.ts

@@ -1,7 +1,8 @@
+import { Logger } from '@contember/logger';
 import { AccessEvaluator, Authorizator } from '@contember/authorization';
 import { Connection, DatabaseConfig } from '@contember/database';
 import { Builder } from '@contember/dic';
-import { ApiKeyManager, ApiKeyService, AuthPolicyManager, AuthPolicyResolver, BackchannelLogoutManager, BackupCodeManager, CaptchaValidator, DatabaseContext, EmailChangeManager, EmailOtpManager, EmailValidator, EmailVerificationManager, Identity, IdentityFactory, IDPHandlerRegistry, IDPManager, IdpSessionRevalidator, IDPSignInManager, InviteManager, LoginRiskAnalyzer, MailTemplateManager, MembershipValidator, OtpAuthenticator, OtpManager, PasswordChangeManager, PasswordResetManager, PermissionContextFactory, PersonAccessManager, PersonIdentityProviderManager, PersonManager, ProjectInitializer, ProjectManager, ProjectMemberManager, ProjectSchemaResolver, ProjectScopeFactory, Providers, RateLimiter, RolesManager, SecretsManager, SignInManager, SignOutManager, SignUpManager, UnpersistedApiKeyManager, UserMailer } from './model/index.js';
+import { ApiKeyManager, ApiKeyService, AuthPolicyManager, AuthPolicyResolver, BackchannelLogoutManager, BackupCodeManager, CaptchaValidator, CustomRoleManager, DatabaseContext, EmailChangeManager, EmailOtpManager, EmailValidator, EmailVerificationManager, GlobalRoleValidator, Identity, IdentityFactory, IDPClaimSyncService, IDPHandlerRegistry, IDPManager, IdpSessionRevalidator, IDPSignInManager, InviteManager, LoginRiskAnalyzer, MailTemplateManager, MembershipValidator, OtpAuthenticator, OtpManager, PanelAccessResolver, PasswordChangeManager, PasswordResetManager, PermissionContextFactory, PersonAccessManager, PersonIdentityProviderManager, PersonManager, ProjectInitializer, ProjectManager, ProjectMemberManager, ProjectSchemaResolver, ProjectScopeFactory, Providers, RateLimiter, RolesManager, SecretsManager, SignInManager, SignOutManager, SignUpManager, UnpersistedApiKeyManager, UserMailer } from './model/index.js';
 import { HibpChecker } from './model/service/HibpChecker.js';
 import { AddIDPMutationResolver, AddProjectMemberMutationResolver, ChangePasswordMutationResolver, ChangeProfileMutationResolver, CreateApiKeyMutationResolver, CreateProjectMutationResolver, DisableApiKeyMutationResolver, DisableIDPMutationResolver, DisconnectMyIdentityProviderMutationResolver, EmailOtpMutationResolver, EmailVerificationMutationResolver, EnableIDPMutationResolver, IdentityGlobalRolesMutationResolver, IdentityTypeResolver, IDPMutationResolver, InviteMutationResolver, MailTemplateMutationResolver, MeQueryResolver, OtpMutationResolver, PersonQueryResolver, PersonTypeResolver, ProjectMembersQueryResolver, ProjectQueryResolver, ProjectTypeResolver, RegenerateBackupCodesMutationResolver, RemoveProjectMemberMutationResolver, ResetPasswordMutationResolver, SetProjectSecretMutationResolver, SignInMutationResolver, SignOutMutationResolver, SignUpMutationResolver, TenantResolverContextFactory, UpdateProjectMemberMutationResolver, UpdateProjectMutationResolver } from './resolvers/index.js';
 import * as Schema from './schema/index.js';
@@ -12,6 +13,7 @@ import { IDPQueryResolver } from './resolvers/query/IDPQueryResolver.js';
 import { UpdateIDPMutationResolver } from './resolvers/mutation/idp/UpdateIDPMutationResolver.js';
 import { TenantCredentials, TenantMigrationsRunner } from './migrations/index.js';
 import { DisablePersonMutationResolver } from './resolvers/mutation/person/DisablePersonMutationResolver.js';
+import { EnablePersonMutationResolver } from './resolvers/mutation/person/EnablePersonMutationResolver.js';
 import { ForceSignOutMutationResolver } from './resolvers/mutation/person/ForceSignOutMutationResolver.js';
 import { RevokeSessionMutationResolver } from './resolvers/mutation/person/RevokeSessionMutationResolver.js';
 import { MailTemplateQueryResolver } from './resolvers/query/MailTemplateQueryResolver.js';
@@ -19,6 +21,8 @@ import { ConfigurationManager } from './model/service/ConfigurationManager.js';
 import { ConfigurationMutationResolver } from './resolvers/mutation/configuration/ConfigurationMutationResolver.js';
 import { ConfigurationQueryResolver } from './resolvers/query/ConfigurationQueryResolver.js';
 import { AuthPolicyMutationResolver } from './resolvers/mutation/configuration/AuthPolicyMutationResolver.js';
+import { CustomRoleMutationResolver } from './resolvers/mutation/customRole/CustomRoleMutationResolver.js';
+import { CustomRoleQueryResolver } from './resolvers/query/CustomRoleQueryResolver.js';
 import { AuthPolicyQueryResolver } from './resolvers/query/AuthPolicyQueryResolver.js';
 import { ResetPersonMfaMutationResolver } from './resolvers/mutation/person/ResetPersonMfaMutationResolver.js';
 import { AuthLogQueryResolver } from './resolvers/query/AuthLogQueryResolver.js';
@@ -34,9 +38,11 @@ export interface TenantContainer {
     backchannelLogoutManager: BackchannelLogoutManager;
     signUpManager: SignUpManager;
     projectManager: ProjectManager;
+    panelAccessResolver: PanelAccessResolver;
     resolvers: Schema.Resolvers;
     resolverContextFactory: TenantResolverContextFactory;
     authorizator: Authorizator<Identity>;
+    permissionContextFactory: PermissionContextFactory;
     identityFetcher: IdentityFetcher;
     databaseContext: DatabaseContext;
     readDatabaseContext: DatabaseContext;
@@ -53,6 +59,7 @@ export interface TenantContainerArgs {
     projectInitializer: ProjectInitializer;
     tenantCredentials: TenantCredentials;
     cryptoProviders: Pick<Providers, 'encrypt' | 'decrypt' | 'encryptionEnabled'>;
+    logger: Logger;
 }
 export declare class TenantContainerFactory {
     private readonly providers;
@@ -60,21 +67,21 @@ export declare class TenantContainerFactory {
     create(args: TenantContainerArgs): TenantContainer;
     createBuilder(args: TenantContainerArgs): Builder<{
         providers: {
-            decrypt: (value: Buffer, version: number) => Promise<{
-                value: Buffer;
-                needsReEncrypt: boolean;
-            }>;
+            uuid: () => string;
+            now: () => Date;
+            randomBytes: (bytes: number) => Promise<Buffer>;
+            bcrypt: (value: string) => Promise<string>;
+            bcryptCompare: (data: any, encrypted: string) => Promise<boolean>;
+            hash: (value: import("crypto").BinaryLike, algo: string) => Buffer;
             encrypt: (value: Buffer) => Promise<{
                 value: Buffer;
                 version: number;
             }>;
+            decrypt: (value: Buffer, version: number) => Promise<{
+                value: Buffer;
+                needsReEncrypt: boolean;
+            }>;
             encryptionEnabled: boolean;
-            now: () => Date;
-            hash: (value: import("crypto").BinaryLike, algo: string) => Buffer;
-            uuid: () => string;
-            randomBytes: (bytes: number) => Promise<Buffer>;
-            bcrypt: (value: string) => Promise<string>;
-            bcryptCompare: (data: any, encrypted: string) => Promise<boolean>;
         };
     } & {
         mailer: import("./index.js").Mailer;
@@ -82,6 +89,8 @@ export declare class TenantContainerFactory {
         projectSchemaResolver: ProjectSchemaResolver;
     } & {
         templateRenderer: TemplateRenderer;
+    } & {
+        permissions: import("@contember/authorization").Permissions;
     } & {
         accessEvaluator: AccessEvaluator.PermissionEvaluator;
     } & {
@@ -92,12 +101,18 @@ export declare class TenantContainerFactory {
         apiKeyService: ApiKeyService;
     } & {
         authPolicyResolver: AuthPolicyResolver;
+    } & {
+        panelAccessResolver: PanelAccessResolver;
     } & {
         authLogService: AuthLogService;
+    } & {
+        globalRoleValidator: GlobalRoleValidator;
     } & {
         loginRiskAnalyzer: LoginRiskAnalyzer;
     } & {
         idpRegistry: IDPHandlerRegistry;
+    } & {
+        idpClaimSyncService: IDPClaimSyncService;
     } & {
         idpSessionRevalidator: IdpSessionRevalidator;
     } & {
@@ -162,6 +177,8 @@ export declare class TenantContainerFactory {
         emailOtpManager: EmailOtpManager;
     } & {
         authPolicyManager: AuthPolicyManager;
+    } & {
+        customRoleManager: CustomRoleManager;
     } & {
         signInManager: SignInManager;
     } & {
@@ -246,6 +263,8 @@ export declare class TenantContainerFactory {
         createProjectMutationResolver: CreateProjectMutationResolver;
     } & {
         disablePersonMutationResolver: DisablePersonMutationResolver;
+    } & {
+        enablePersonMutationResolver: EnablePersonMutationResolver;
     } & {
         forceSignOutMutationResolver: ForceSignOutMutationResolver;
     } & {
@@ -266,6 +285,10 @@ export declare class TenantContainerFactory {
         authPolicyMutationResolver: AuthPolicyMutationResolver;
     } & {
         authPolicyQueryResolver: AuthPolicyQueryResolver;
+    } & {
+        customRoleMutationResolver: CustomRoleMutationResolver;
+    } & {
+        customRoleQueryResolver: CustomRoleQueryResolver;
     } & {
         authLogQueryResolver: AuthLogQueryResolver;
     } & {
@@ -278,9 +301,9 @@ export declare class TenantContainerFactory {
         resolverContextFactory: TenantResolverContextFactory;
     } & {
         resolvers: Schema.Resolvers & {
-            Mutation: Required<Schema.Resolvers["Mutation"]>;
+            Mutation: Required<Schema.Resolvers['Mutation']>;
         } & {
-            Query: Required<Schema.Resolvers["Query"]>;
+            Query: Required<Schema.Resolvers['Query']>;
         };
     } & {
         connection: Connection.ConnectionType;

package/dist/types/TenantContainer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TenantContainer.d.ts","sourceRoot":"","sources":["../../src/TenantContainer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACxE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AACxC,OAAO,EAEN,aAAa,EACb,aAAa,EAEb,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,wBAAwB,EAGxB,QAAQ,EACR,eAAe,EACf,kBAAkB,EAClB,UAAU,EACV,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EAEnB,gBAAgB,EAChB,UAAU,EACV,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EAExB,mBAAmB,EACnB,6BAA6B,EAC7B,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,SAAS,EACT,WAAW,EAEX,YAAY,EACZ,cAAc,EACd,aAAa,EACb,cAAc,EACd,aAAa,EAEb,wBAAwB,EACxB,UAAU,EACV,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,WAAW,EAAoC,MAAM,gCAAgC,CAAA;AAC9F,OAAO,EACN,sBAAsB,EACtB,gCAAgC,EAChC,8BAA8B,EAC9B,6BAA6B,EAC7B,4BAA4B,EAC5B,6BAA6B,EAC7B,6BAA6B,EAC7B,0BAA0B,EAC1B,4CAA4C,EAC5C,wBAAwB,EACxB,iCAAiC,EACjC,yBAAyB,EACzB,mCAAmC,EACnC,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,4BAA4B,EAC5B,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EACnB,qCAAqC,EACrC,mCAAmC,EACnC,6BAA6B,EAE7B,gCAAgC,EAChC,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,EAC5B,mCAAmC,EACnC,6BAA6B,EAC7B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAA;AAC3C,OAAO,EAAgB,aAAa,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAA;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sDAAsD,CAAA;AAC5F,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAA;AACxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,uDAAuD,CAAA;AACjG,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,8DAA8D,CAAA;AAC5G,OAAO,EAAE,4BAA4B,EAAE,MAAM,6DAA6D,CAAA;AAC1G,OAAO,EAAE,6BAA6B,EAAE,MAAM,8DAA8D,CAAA;AAC5G,OAAO,EAAE,yBAAyB,EAAE,MAAM,gDAAgD,CAAA;AAC1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAA;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,qEAAqE,CAAA;AACnH,OAAO,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAA;AAC5F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAA;AAC7G,OAAO,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAA;AACtF,OAAO,EAAE,8BAA8B,EAAE,MAAM,+DAA+D,CAAA;AAC9G,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAA;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAA;AAC9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,6DAA6D,CAAA;AAC1G,OAAO,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAA;AACxF,OAAO,EAAE,kCAAkC,EAAE,MAAM,mEAAmE,CAAA;AACtH,OAAO,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAA;AACxF,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAA;AAElE,MAAM,WAAW,eAAe;IAC/B,oBAAoB,EAAE,oBAAoB,CAAA;IAC1C,aAAa,EAAE,aAAa,CAAA;IAC5B,wBAAwB,EAAE,wBAAwB,CAAA;IAClD,aAAa,EAAE,aAAa,CAAA;IAC5B,cAAc,EAAE,cAAc,CAAA;IAC9B,SAAS,EAAE,MAAM,CAAC,SAAS,CAAA;IAC3B,sBAAsB,EAAE,4BAA4B,CAAA;IACpD,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAA;IACpC,eAAe,EAAE,eAAe,CAAA;IAChC,eAAe,EAAE,eAAe,CAAA;IAChC,mBAAmB,EAAE,eAAe,CAAA;IACpC,gBAAgB,EAAE,sBAAsB,CAAA;IACxC,UAAU,EAAE,UAAU,CAAC,cAAc,CAAA;IACrC,cAAc,EAAE,UAAU,CAAC,cAAc,CAAA;CACzC;AAED,MAAM,WAAW,mBAAmB;IACnC,UAAU,EAAE,UAAU,CAAC,cAAc,CAAA;IACrC,cAAc,EAAE,UAAU,CAAC,cAAc,CAAA;IACzC,aAAa,EAAE,cAAc,CAAA;IAC7B,WAAW,EAAE,aAAa,CAAA;IAC1B,qBAAqB,EAAE,qBAAqB,CAAA;IAC5C,kBAAkB,EAAE,kBAAkB,CAAA;IACtC,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,eAAe,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,GAAG,mBAAmB,CAAC,CAAA;CAC7E;AAED,qBAAa,sBAAsB;IAEjC,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,GAAG,mBAAmB,CAAC;IAGzF,MAAM,CAAC,IAAI,EAAE,mBAAmB,GAAG,eAAe;IAqBlD,aAAa,CAAC,IAAI,EAAE,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4QvC"}
+{"version":3,"file":"TenantContainer.d.ts","sourceRoot":"","sources":["../../src/TenantContainer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACxE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AACxC,OAAO,EAEN,aAAa,EACb,aAAa,EAEb,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,wBAAwB,EAExB,mBAAmB,EAEnB,QAAQ,EACR,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,UAAU,EACV,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EAEnB,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EAExB,mBAAmB,EACnB,6BAA6B,EAC7B,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,SAAS,EACT,WAAW,EAEX,YAAY,EACZ,cAAc,EACd,aAAa,EACb,cAAc,EACd,aAAa,EAEb,wBAAwB,EACxB,UAAU,EACV,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,WAAW,EAAoC,MAAM,gCAAgC,CAAA;AAC9F,OAAO,EACN,sBAAsB,EACtB,gCAAgC,EAChC,8BAA8B,EAC9B,6BAA6B,EAC7B,4BAA4B,EAC5B,6BAA6B,EAC7B,6BAA6B,EAC7B,0BAA0B,EAC1B,4CAA4C,EAC5C,wBAAwB,EACxB,iCAAiC,EACjC,yBAAyB,EACzB,mCAAmC,EACnC,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,4BAA4B,EAC5B,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EACnB,qCAAqC,EACrC,mCAAmC,EACnC,6BAA6B,EAE7B,gCAAgC,EAChC,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,EAC5B,mCAAmC,EACnC,6BAA6B,EAC7B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAA;AAC3C,OAAO,EAAgB,aAAa,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAA;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sDAAsD,CAAA;AAC5F,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAA;AACxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,uDAAuD,CAAA;AACjG,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,8DAA8D,CAAA;AAC5G,OAAO,EAAE,4BAA4B,EAAE,MAAM,6DAA6D,CAAA;AAC1G,OAAO,EAAE,4BAA4B,EAAE,MAAM,6DAA6D,CAAA;AAC1G,OAAO,EAAE,6BAA6B,EAAE,MAAM,8DAA8D,CAAA;AAC5G,OAAO,EAAE,yBAAyB,EAAE,MAAM,gDAAgD,CAAA;AAC1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAA;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,qEAAqE,CAAA;AACnH,OAAO,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAA;AAC5F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAA;AAC7G,OAAO,EAAE,0BAA0B,EAAE,MAAM,+DAA+D,CAAA;AAC1G,OAAO,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAA;AACtF,OAAO,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAA;AACtF,OAAO,EAAE,8BAA8B,EAAE,MAAM,+DAA+D,CAAA;AAC9G,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAA;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAA;AAC9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,6DAA6D,CAAA;AAC1G,OAAO,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAA;AACxF,OAAO,EAAE,kCAAkC,EAAE,MAAM,mEAAmE,CAAA;AACtH,OAAO,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAA;AACxF,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAA;AAElE,MAAM,WAAW,eAAe;IAC/B,oBAAoB,EAAE,oBAAoB,CAAA;IAC1C,aAAa,EAAE,aAAa,CAAA;IAC5B,wBAAwB,EAAE,wBAAwB,CAAA;IAClD,aAAa,EAAE,aAAa,CAAA;IAC5B,cAAc,EAAE,cAAc,CAAA;IAC9B,mBAAmB,EAAE,mBAAmB,CAAA;IACxC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAA;IAC3B,sBAAsB,EAAE,4BAA4B,CAAA;IACpD,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAA;IACpC,wBAAwB,EAAE,wBAAwB,CAAA;IAClD,eAAe,EAAE,eAAe,CAAA;IAChC,eAAe,EAAE,eAAe,CAAA;IAChC,mBAAmB,EAAE,eAAe,CAAA;IACpC,gBAAgB,EAAE,sBAAsB,CAAA;IACxC,UAAU,EAAE,UAAU,CAAC,cAAc,CAAA;IACrC,cAAc,EAAE,UAAU,CAAC,cAAc,CAAA;CACzC;AAED,MAAM,WAAW,mBAAmB;IACnC,UAAU,EAAE,UAAU,CAAC,cAAc,CAAA;IACrC,cAAc,EAAE,UAAU,CAAC,cAAc,CAAA;IACzC,aAAa,EAAE,cAAc,CAAA;IAC7B,WAAW,EAAE,aAAa,CAAA;IAC1B,qBAAqB,EAAE,qBAAqB,CAAA;IAC5C,kBAAkB,EAAE,kBAAkB,CAAA;IACtC,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,eAAe,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,GAAG,mBAAmB,CAAC,CAAA;IAC7E,MAAM,EAAE,MAAM,CAAA;CACd;AAED,qBAAa,sBAAsB;IAEjC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAD3B,YACkB,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,GAAG,mBAAmB,CAAC,EACrF;IAEJ,MAAM,CAAC,IAAI,EAAE,mBAAmB,GAAG,eAAe,CAqBjD;IAED,aAAa,CAAC,IAAI,EAAE,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoStC;CACD"}

package/dist/types/bridges/system/IdentityFetcher.d.ts

@@ -11,7 +11,7 @@ export declare class PersonIdentity {
         id: string;
         name: string;
     };
-    readonly type: "person";
+    readonly type: 'person';
     constructor(identityId: string, person: {
         id: string;
         name: string;
@@ -20,7 +20,7 @@ export declare class PersonIdentity {
 export declare class ApiKeyIdentity {
     readonly identityId: string;
     readonly description: string;
-    readonly type: "apiKey";
+    readonly type: 'apiKey';
     constructor(identityId: string, description: string);
 }
 //# sourceMappingURL=IdentityFetcher.d.ts.map

package/dist/types/bridges/system/IdentityFetcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityFetcher.d.ts","sourceRoot":"","sources":["../../../../src/bridges/system/IdentityFetcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAG5C,qBAAa,eAAe;IAE1B,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAIV,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;CAkBhE;AAED,MAAM,MAAM,QAAQ,GAAG,cAAc,GAAG,cAAc,CAAA;AAEtD,qBAAa,cAAc;aAIT,UAAU,EAAE,MAAM;aAClB,MAAM,EAAE;QACvB,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;KACZ;IAPF,SAAgB,IAAI,EAAG,QAAQ,CAAS;gBAGvB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;QACvB,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;KACZ;CAEF;AAED,qBAAa,cAAc;aAGE,UAAU,EAAE,MAAM;aAAkB,WAAW,EAAE,MAAM;IAFnF,SAAgB,IAAI,EAAG,QAAQ,CAAS;gBAEZ,UAAU,EAAE,MAAM,EAAkB,WAAW,EAAE,MAAM;CACnF"}
+{"version":3,"file":"IdentityFetcher.d.ts","sourceRoot":"","sources":["../../../../src/bridges/system/IdentityFetcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAG5C,qBAAa,eAAe;IAE1B,OAAO,CAAC,MAAM;IADf,YACS,MAAM,EAAE,MAAM,EAEtB;IAEY,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAiB/D;CACD;AAED,MAAM,MAAM,QAAQ,GAAG,cAAc,GAAG,cAAc,CAAA;AAEtD,qBAAa,cAAc;aAIT,UAAU,EAAE,MAAM;aAClB,MAAM,EAAE;QACvB,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;KACZ;IAPF,SAAgB,IAAI,EAAG,QAAQ,CAAS;IAExC,YACiB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE;QACvB,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;KACZ,EACE;CACJ;AAED,qBAAa,cAAc;aAGE,UAAU,EAAE,MAAM;aAAkB,WAAW,EAAE,MAAM;IAFnF,SAAgB,IAAI,EAAG,QAAQ,CAAS;IAExC,YAA4B,UAAU,EAAE,MAAM,EAAkB,WAAW,EAAE,MAAM,EAAI;CACvF"}

package/dist/types/exceptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exceptions.d.ts","sourceRoot":"","sources":["../../src/exceptions.ts"],"names":[],"mappings":"AAAA,qBAAa,uBAAwB,SAAQ,KAAK;gBACrC,OAAO,GAAE,MAAW;CAGhC"}
+{"version":3,"file":"exceptions.d.ts","sourceRoot":"","sources":["../../src/exceptions.ts"],"names":[],"mappings":"AAAA,qBAAa,uBAAwB,SAAQ,KAAK;IACjD,YAAY,OAAO,GAAE,MAAW,EAE/B;CACD"}

package/dist/types/migrations/2026-06-18-120000-idp-claim-mapping.d.ts

@@ -0,0 +1,3 @@
+import { MigrationBuilder } from '@contember/database-migrations';
+export default function (builder: MigrationBuilder): Promise<void>;
+//# sourceMappingURL=2026-06-18-120000-idp-claim-mapping.d.ts.map

package/dist/types/migrations/2026-06-18-120000-idp-claim-mapping.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-06-18-120000-idp-claim-mapping.d.ts","sourceRoot":"","sources":["../../../src/migrations/2026-06-18-120000-idp-claim-mapping.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAYjE,yBAA8B,OAAO,EAAE,gBAAgB,iBAEtD"}

package/dist/types/migrations/2026-08-03-120000-person-enable-auth-log.d.ts

@@ -0,0 +1,3 @@
+import { MigrationBuilder } from '@contember/database-migrations';
+export default function (builder: MigrationBuilder): Promise<void>;
+//# sourceMappingURL=2026-08-03-120000-person-enable-auth-log.d.ts.map

package/dist/types/migrations/2026-08-03-120000-person-enable-auth-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-08-03-120000-person-enable-auth-log.d.ts","sourceRoot":"","sources":["../../../src/migrations/2026-08-03-120000-person-enable-auth-log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AASjE,yBAA8B,OAAO,EAAE,gBAAgB,iBAEtD"}

package/dist/types/migrations/2026-08-04-120000-config-panel.d.ts

@@ -0,0 +1,3 @@
+import { MigrationBuilder } from '@contember/database-migrations';
+export default function (builder: MigrationBuilder): Promise<void>;
+//# sourceMappingURL=2026-08-04-120000-config-panel.d.ts.map

package/dist/types/migrations/2026-08-04-120000-config-panel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-08-04-120000-config-panel.d.ts","sourceRoot":"","sources":["../../../src/migrations/2026-08-04-120000-config-panel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAUjE,yBAA8B,OAAO,EAAE,gBAAgB,iBAEtD"}

package/dist/types/migrations/2026-09-04-120000-idp-disable-local-authentication.d.ts

@@ -0,0 +1,3 @@
+import { MigrationBuilder } from '@contember/database-migrations';
+export default function (builder: MigrationBuilder): Promise<void>;
+//# sourceMappingURL=2026-09-04-120000-idp-disable-local-authentication.d.ts.map

package/dist/types/migrations/2026-09-04-120000-idp-disable-local-authentication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-09-04-120000-idp-disable-local-authentication.d.ts","sourceRoot":"","sources":["../../../src/migrations/2026-09-04-120000-idp-disable-local-authentication.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAejE,yBAA8B,OAAO,EAAE,gBAAgB,iBAEtD"}

package/dist/types/migrations/2026-09-11-120000-custom-role.d.ts

@@ -0,0 +1,3 @@
+import { MigrationBuilder } from '@contember/database-migrations';
+export default function (builder: MigrationBuilder): Promise<void>;
+//# sourceMappingURL=2026-09-11-120000-custom-role.d.ts.map

package/dist/types/migrations/2026-09-11-120000-custom-role.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-09-11-120000-custom-role.d.ts","sourceRoot":"","sources":["../../../src/migrations/2026-09-11-120000-custom-role.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAgBjE,yBAA8B,OAAO,EAAE,gBAAgB,iBAEtD"}

package/dist/types/migrations/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../../src/migrations/runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyC,cAAc,EAAgB,MAAM,qBAAqB,CAAA;AAiEzG,OAAO,EAAoB,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAC/D,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAE1C,MAAM,WAAW,iBAAiB;IACjC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9B;;;OAGG;IACH,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAkED,qBAAa,sBAAsB;IAEjC,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAHT,EAAE,EAAE,cAAc,EAClB,MAAM,EAAE,MAAM,EACd,iBAAiB,EAAE,iBAAiB,EACpC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,GAAG,MAAM,CAAC;IAIlD,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAqB7D"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../../src/migrations/runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyC,cAAc,EAAgB,MAAM,qBAAqB,CAAA;AAsEzG,OAAO,EAAoB,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAC/D,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAE1C,MAAM,WAAW,iBAAiB;IACjC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9B;;;OAGG;IACH,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAuED,qBAAa,sBAAsB;IAEjC,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAJ3B,YACkB,EAAE,EAAE,cAAc,EAClB,MAAM,EAAE,MAAM,EACd,iBAAiB,EAAE,iBAAiB,EACpC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,GAAG,MAAM,CAAC,EAE9D;IAEY,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAoB5D;CACD"}

package/dist/types/migrations/snapshot-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"snapshot-factory.d.ts","sourceRoot":"","sources":["../../../src/migrations/snapshot-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;yBAG1B,YAAY,MAAM,MAAM,uBACtB,gBAAgB,QAAQ,aAAa,CAAC,mBAAmB,CAAC;AADlF,wBAeC"}
+{"version":3,"file":"snapshot-factory.d.ts","sourceRoot":"","sources":["../../../src/migrations/snapshot-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;qCAGd,MAAM,MAAM,uBACtB,gBAAgB,QAAQ,aAAa,CAAC,mBAAmB,CAAC"}

package/dist/types/migrations/snapshot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../../src/migrations/snapshot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAGhD,yBAA8B,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,mBAAmB,iBAmcjF"}
+{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../../src/migrations/snapshot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAGhD,yBAA8B,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,mBAAmB,iBAudjF"}

package/dist/types/migrations/tenantCredentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenantCredentials.d.ts","sourceRoot":"","sources":["../../../src/migrations/tenantCredentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAEhD,eAAO,MAAM,iBAAiB,GAAU,SAAS,gBAAgB,EAAE,MAAM,mBAAmB,kBAsD3F,CAAA"}
+{"version":3,"file":"tenantCredentials.d.ts","sourceRoot":"","sources":["../../../src/migrations/tenantCredentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAEhD,eAAO,MAAM,iBAAiB,YAAmB,gBAAgB,QAAQ,mBAAmB,kBAsD3F,CAAA"}

package/dist/types/model/authorization/AclSchemaAccessNodeFactory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AclSchemaAccessNodeFactory.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/AclSchemaAccessNodeFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAErD,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAIvC,qBAAa,0BAA0B;IACtC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,GAAG,UAAU;CAwC9E"}
+{"version":3,"file":"AclSchemaAccessNodeFactory.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/AclSchemaAccessNodeFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAErD,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAIvC,qBAAa,0BAA0B;IACtC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,GAAG,UAAU,CAuC7E;CACD"}

package/dist/types/model/authorization/CustomRoleAuthorizator.d.ts

@@ -0,0 +1,29 @@
+import { Authorizator, Permissions } from '@contember/authorization';
+import { DatabaseContext } from '../utils/index.js';
+import { Identity } from './Identity.js';
+export declare class CustomRolePermissionCache {
+    private readonly db;
+    private loading;
+    constructor(db: DatabaseContext);
+    /**
+     * One query, two maps. `projectScoped` holds only the grants that carry their own project
+     * filter, because the scope itself is not passed down to `Permissions.isAllowed`.
+     */
+    load(): Promise<{
+        readonly global: Permissions;
+        readonly projectScoped: Permissions;
+    }>;
+}
+export declare class CustomRoleAuthorizator implements Authorizator<Identity> {
+    private readonly inner;
+    readonly customRoleCache: CustomRolePermissionCache;
+    constructor(inner: Authorizator<Identity>, db: DatabaseContext, customRoleCache?: CustomRolePermissionCache);
+    /**
+     * Loads the definitions up front so no later check has to query mid-transaction —
+     * that would need a second pooled connection while the first one is pinned. No-op
+     * for identities carrying only built-in roles.
+     */
+    preload(roles: readonly string[]): Promise<void>;
+    isAllowed(identity: Identity, scope: Parameters<Authorizator<Identity>['isAllowed']>[1], action: Authorizator.Action): Promise<boolean>;
+}
+//# sourceMappingURL=CustomRoleAuthorizator.d.ts.map

package/dist/types/model/authorization/CustomRoleAuthorizator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CustomRoleAuthorizator.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/CustomRoleAuthorizator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,YAAY,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AACxF,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAIxC,qBAAa,yBAAyB;IAGzB,OAAO,CAAC,QAAQ,CAAC,EAAE;IAF/B,OAAO,CAAC,OAAO,CAA4F;IAE3G,YAA6B,EAAE,EAAE,eAAe,EAAI;IAEpD;;;OAGG;IACH,IAAI,IAAI,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;QAAC,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAA;KAAE,CAAC,CAMrF;CACD;AAWD,qBAAa,sBAAuB,YAAW,YAAY,CAAC,QAAQ,CAAC;IAEnE,OAAO,CAAC,QAAQ,CAAC,KAAK;aAEN,eAAe;IAHhC,YACkB,KAAK,EAAE,YAAY,CAAC,QAAQ,CAAC,EAC9C,EAAE,EAAE,eAAe,EACH,eAAe,4BAAoC,EAEnE;IAED;;;;OAIG;IACG,OAAO,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAIrD;IAEK,SAAS,CACd,QAAQ,EAAE,QAAQ,EAClB,KAAK,EAAE,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EACzD,MAAM,EAAE,YAAY,CAAC,MAAM,GACzB,OAAO,CAAC,OAAO,CAAC,CAalB;CACD"}

package/dist/types/model/authorization/CustomRolePermissions.d.ts

@@ -0,0 +1,45 @@
+import { Permissions } from '@contember/authorization';
+import * as Typesafe from '@contember/typesafe';
+import { CustomRoleRow } from '../type/CustomRole.js';
+export type CustomRoleConfigurationKind = 'NONE' | 'ROLE_INPUT' | 'TARGET_IDENTITY' | 'ROLE_MUTATION' | 'GLOBAL_API_KEY' | 'CHANGE_PROFILE' | 'CREATE_SESSION_TOKEN' | 'MAIL_TEMPLATE_SCOPE';
+export type CustomRolePermissionDefinition = {
+    readonly name: string;
+    readonly configurationKind: CustomRoleConfigurationKind;
+    readonly defaultConfig: Typesafe.Json;
+    readonly decode: (raw: Typesafe.Json, path: PropertyKey[]) => DecodedGrant;
+};
+export type CanonicalCustomRoleGrant = {
+    readonly permission: string;
+    readonly config: Typesafe.Json;
+};
+export type ParsedCustomRoleGrants = {
+    readonly grants: readonly CanonicalCustomRoleGrant[];
+    readonly referencedRoles: readonly string[];
+    readonly referencedProjects: readonly string[];
+};
+type DecodedGrant = {
+    readonly canonicalConfig: Typesafe.Json;
+    readonly referencedRoles: readonly string[];
+    readonly referencedProjects: readonly string[];
+    readonly install: (permissions: Permissions, role: string) => void;
+};
+export declare const BUILTIN_TENANT_ROLES: ReadonlySet<string>;
+export declare const GLOBALLY_ASSIGNABLE_BUILTIN_ROLES: ReadonlySet<string>;
+export declare const getGrantablePermissions: () => ReadonlyMap<string, CustomRolePermissionDefinition>;
+export type CustomRoleGrantValidationErrorCode = 'UNKNOWN_PERMISSION' | 'DUPLICATE_PERMISSION' | 'INVALID_PERMISSION_CONFIGURATION';
+export declare class CustomRoleGrantValidationError extends Error {
+    readonly code: CustomRoleGrantValidationErrorCode;
+    constructor(code: CustomRoleGrantValidationErrorCode, message: string);
+}
+export declare const parseCustomRoleGrants: (raw: unknown) => ParsedCustomRoleGrants;
+/** Fail-closed view of a persisted row, shared by evaluation and by the read API. */
+export declare const parsePersistedCustomRoleGrants: (raw: unknown) => readonly CanonicalCustomRoleGrant[];
+/** Role slugs a persisted row's configuration names. An undecodable row is wholly inert, so it references nothing. */
+export declare const parsePersistedCustomRoleReferences: (raw: unknown) => readonly string[];
+export declare const buildCustomRolePermissions: (rows: readonly CustomRoleRow[], { projectScoped }?: {
+    readonly projectScoped?: boolean;
+}) => Permissions;
+/** Every kind but `NONE` carries a required config object; there is nothing else to store. */
+export declare const isConfigurationRequired: (definition: CustomRolePermissionDefinition) => boolean;
+export {};
+//# sourceMappingURL=CustomRolePermissions.d.ts.map

package/dist/types/model/authorization/CustomRolePermissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CustomRolePermissions.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/CustomRolePermissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,WAAW,EAAE,MAAM,0BAA0B,CAAA;AACpE,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAW/C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAGrD,MAAM,MAAM,2BAA2B,GACpC,MAAM,GACN,YAAY,GACZ,iBAAiB,GACjB,eAAe,GACf,gBAAgB,GAChB,gBAAgB,GAChB,sBAAsB,GACtB,qBAAqB,CAAA;AAExB,MAAM,MAAM,8BAA8B,GAAG;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,iBAAiB,EAAE,2BAA2B,CAAA;IACvD,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAA;IACrC,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,YAAY,CAAA;CAC1E,CAAA;AAED,MAAM,MAAM,wBAAwB,GAAG;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAA;CAC9B,CAAA;AAED,MAAM,MAAM,sBAAsB,GAAG;IACpC,QAAQ,CAAC,MAAM,EAAE,SAAS,wBAAwB,EAAE,CAAA;IACpD,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;CAC9C,CAAA;AAED,KAAK,YAAY,GAAG;IACnB,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAA;IACvC,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9C,QAAQ,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAClE,CAAA;AAiBD,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAAsC,CAAA;AAE3F,eAAO,MAAM,iCAAiC,EAAE,WAAW,CAAC,MAAM,CAOhE,CAAA;AAoWF,eAAO,MAAM,uBAAuB,QAAO,WAAW,CAAC,MAAM,EAAE,8BAA8B,CAAY,CAAA;AAEzG,MAAM,MAAM,kCAAkC,GAC3C,oBAAoB,GACpB,sBAAsB,GACtB,kCAAkC,CAAA;AAErC,qBAAa,8BAA+B,SAAQ,KAAK;aAEvC,IAAI,EAAE,kCAAkC;IADzD,YACiB,IAAI,EAAE,kCAAkC,EACxD,OAAO,EAAE,MAAM,EAGf;CACD;AA8DD,eAAO,MAAM,qBAAqB,QAAS,OAAO,KAAG,sBAOpD,CAAA;AAWD,qFAAqF;AACrF,eAAO,MAAM,8BAA8B,QAAS,OAAO,KAAG,SAAS,wBAAwB,EACe,CAAA;AAE9G,sHAAsH;AACtH,eAAO,MAAM,kCAAkC,QAAS,OAAO,KAAG,SAAS,MAAM,EACW,CAAA;AAU5F,eAAO,MAAM,0BAA0B,SAChC,SAAS,aAAa,EAAE,sBACH;IAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,KAC7D,WAWF,CAAA;AAED,8FAA8F;AAC9F,eAAO,MAAM,uBAAuB,eAAgB,8BAA8B,KAAG,OAAkD,CAAA"}

package/dist/types/model/authorization/DirectPermissionsAccessNode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DirectPermissionsAccessNode.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/DirectPermissionsAccessNode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAQpF,qBAAa,2BAA4B,YAAW,UAAU;IAC7D,OAAO,CAAC,WAAW,CAAqB;IAEjC,KAAK,CAAC,IAAI,SAAS,EAAE,GAAG,SAAS,GAAG,SAAS,EACnD,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAClD,QAAQ,GAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAoB;IAM/C,SAAS,CAAC,eAAe,EAAE,eAAe,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,YAAY,CAAC,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAGjH"}
+{"version":3,"file":"DirectPermissionsAccessNode.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/DirectPermissionsAccessNode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAQpF,qBAAa,2BAA4B,YAAW,UAAU;IAC7D,OAAO,CAAC,WAAW,CAAqB;IAEjC,KAAK,CAAC,IAAI,SAAS,EAAE,GAAG,SAAS,GAAG,SAAS,EACnD,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAClD,QAAQ,GAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAoB,QAI9C;IAED,SAAS,CAAC,eAAe,EAAE,eAAe,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,YAAY,CAAC,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEhH;CACD"}

package/dist/types/model/authorization/Identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Identity.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/Identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,MAAM,WAAW,QAAQ;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IAEjC,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;CAC9E;AAED,qBAAa,cAAe,YAAW,QAAQ;aAE7B,EAAE,EAAE,MAAM;aACV,KAAK,EAAE,MAAM,EAAE;IAC/B,OAAO,CAAC,kBAAkB;gBAFV,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EAAE,EACvB,kBAAkB,GAAE,MAAM,CAAC,MAAM,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,CAAM;IAG3E,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,CAAC,UAAU,EAAE,CAAC;CAG9E;AAED,qBAAa,oBAAqB,YAAW,QAAQ;aAInC,EAAE,EAAE,MAAM;aACV,KAAK,EAAE,SAAS,MAAM,EAAE;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAN/B,OAAO,CAAC,sBAAsB,CAAyD;gBAGtE,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,SAAS,MAAM,EAAE,EACvB,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE,oBAAoB;IAG/C,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,CAAC,UAAU,EAAE,CAAC;CAIpF"}
+{"version":3,"file":"Identity.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/Identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,MAAM,WAAW,QAAQ;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IAEjC,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;CAC9E;AAED,qBAAa,cAAe,YAAW,QAAQ;aAE7B,EAAE,EAAE,MAAM;aACV,KAAK,EAAE,MAAM,EAAE;IAC/B,OAAO,CAAC,kBAAkB;IAH3B,YACiB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EAAE,EACvB,kBAAkB,GAAE,MAAM,CAAC,MAAM,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,CAAM,EACvE;IAEJ,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,CAAC,UAAU,EAAE,CAAC,CAE7E;CACD;AAED,qBAAa,oBAAqB,YAAW,QAAQ;aAInC,EAAE,EAAE,MAAM;aACV,KAAK,EAAE,SAAS,MAAM,EAAE;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAN/B,OAAO,CAAC,sBAAsB,CAAyD;IAEvF,YACiB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,SAAS,MAAM,EAAE,EACvB,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE,oBAAoB,EACjD;IAEE,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,CAAC,UAAU,EAAE,CAAC,CAGnF;CACD"}

package/dist/types/model/authorization/IdentityFactory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityFactory.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/IdentityFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,QAAQ,EAAwB,MAAM,eAAe,CAAA;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,qBAAa,eAAe;IACf,OAAO,CAAC,QAAQ,CAAC,oBAAoB;gBAApB,oBAAoB,EAAE,oBAAoB;IAEhE,MAAM,CAAC,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAAG,QAAQ;CAGnG"}
+{"version":3,"file":"IdentityFactory.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/IdentityFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,QAAQ,EAAwB,MAAM,eAAe,CAAA;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,qBAAa,eAAe;IACf,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAAjD,YAA6B,oBAAoB,EAAE,oBAAoB,EAAI;IAEpE,MAAM,CAAC,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAAG,QAAQ,CAElG;CACD"}

package/dist/types/model/authorization/IdentityScope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityScope.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/IdentityScope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAEzE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,cAAM,aAAc,YAAW,kBAAkB,CAAC,QAAQ,CAAC;IAC9C,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,MAAM;IAEzC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;CAGhE;AAED,OAAO,EAAE,aAAa,EAAE,CAAA"}
+{"version":3,"file":"IdentityScope.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/IdentityScope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAEzE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,cAAM,aAAc,YAAW,kBAAkB,CAAC,QAAQ,CAAC;IAC9C,OAAO,CAAC,QAAQ,CAAC,UAAU;IAAvC,YAA6B,UAAU,EAAE,MAAM,EAAI;IAE7C,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAE/D;CACD;AAED,OAAO,EAAE,aAAa,EAAE,CAAA"}

package/dist/types/model/authorization/MembershipMatcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MembershipMatcher.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/MembershipMatcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,MAAM,MAAM,qCAAqC,GAC9C,GAAG,CAAC,UAAU,GACd;IACD,SAAS,EAAE,GAAG,CAAC,mBAAmB,CAAA;CAClC,CAAA;AAEF,qBAAa,iBAAiB;IACjB,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAAX,WAAW,EAAE,SAAS,qCAAqC,EAAE;IAG1F,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,GAAG,OAAO;CAoC5C"}
+{"version":3,"file":"MembershipMatcher.d.ts","sourceRoot":"","sources":["../../../../src/model/authorization/MembershipMatcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,MAAM,MAAM,qCAAqC,GAC9C,GAAG,CAAC,UAAU,GACd;IACD,SAAS,EAAE,GAAG,CAAC,mBAAmB,CAAA;CAClC,CAAA;AAEF,qBAAa,iBAAiB;IACjB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAAxC,YAA6B,WAAW,EAAE,SAAS,qCAAqC,EAAE,EACzF;IAED,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,GAAG,OAAO,CAmC3C;CACD"}