@contember/schema-definition 1.4.0-rc.7 → 2.0.0-alpha.10

package/dist/development/src/acl/definition/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sources":["../../../../../../packages/schema-definition/src/acl/definition/index.ts"],"sourcesContent":["import { Acl, Model } from '@contember/schema'\nimport { AclFactory } from './internal/AclFactory'\n\nexport * from './customPrimary'\nexport * from './permissions'\nexport * from './references'\nexport * from './roles'\nexport * from './variables'\n\nexport const createAcl = (\n\texportedDefinitions: Record<string, any>,\n\tmodel: Model.Schema,\n): Acl.Schema => {\n\tconst aclFactory = new AclFactory(model)\n\treturn aclFactory.create(exportedDefinitions)\n}\n"],"names":[],"mappings":";;;;;;AASa,MAAA,YAAY,CACxB,qBACA,UACgB;AACV,QAAA,aAAa,IAAI,WAAW,KAAK;AAChC,SAAA,WAAW,OAAO,mBAAmB;AAC7C;"}

package/dist/development/src/acl/definition/internal/AclFactory.cjs

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const schemaUtils = require("@contember/schema-utils");
+const EntityPredicateResolver = require("./EntityPredicateResolver.cjs");
+const stores = require("./stores.cjs");
+const roles = require("../roles.cjs");
+const variables = require("../variables.cjs");
+const filterEntityDefinition = require("../../../utils/filterEntityDefinition.cjs");
+require("reflect-metadata");
+class AclFactory {
+  constructor(model) {
+    this.model = model;
+  }
+  create(exportedDefinitions) {
+    const entityLikeDefinition = filterEntityDefinition.filterEntityDefinition(exportedDefinitions);
+    const roles$1 = Object.values(exportedDefinitions).filter((it) => it instanceof roles.Role);
+    const variables$1 = Object.values(exportedDefinitions).filter((it) => it instanceof variables.VariableDefinition);
+    const groupedPermissions = AclFactory.groupPermissions(entityLikeDefinition, roles$1);
+    return {
+      roles: Object.fromEntries(roles$1.map((role) => {
+        const rolePermissions = groupedPermissions.get(role);
+        return [
+          role.name,
+          {
+            ...role.options,
+            stages: role.options.stages ?? "*",
+            entities: this.createPermissions(rolePermissions),
+            variables: this.createVariables(role, variables$1)
+          }
+        ];
+      }))
+    };
+  }
+  createPermissions(rolePermissions) {
+    if (!rolePermissions) {
+      return {};
+    }
+    return Object.fromEntries(Array.from(rolePermissions.keys()).map((entityName) => {
+      const entity = schemaUtils.getEntity(this.model, entityName);
+      const predicatesResolver = EntityPredicateResolver.EntityPredicatesResolver.create(rolePermissions, this.model, entity);
+      const entityOperations = {};
+      for (const op of ["create", "update", "read"]) {
+        const fieldPermissions = {};
+        for (const field of Object.keys(entity.fields)) {
+          const predicate = predicatesResolver.createFieldPredicate(op, field, field === entity.primary);
+          if (predicate !== void 0) {
+            fieldPermissions[field] = predicate;
+          }
+        }
+        if (Object.keys(fieldPermissions).length > 0) {
+          entityOperations[op] = fieldPermissions;
+        }
+      }
+      const delPredicate = predicatesResolver.createFieldPredicate("delete", "", false);
+      if (delPredicate !== void 0) {
+        entityOperations.delete = delPredicate;
+      }
+      if (rolePermissions.get(entityName)?.allowCustomPrimary) {
+        entityOperations.customPrimary = true;
+      }
+      return [entityName, {
+        predicates: predicatesResolver.getUsedPredicates(),
+        operations: entityOperations
+      }];
+    }));
+  }
+  createVariables(role, variables2) {
+    const roleVariables = variables2.filter((it) => it.roles.includes(role));
+    return Object.fromEntries(roleVariables.map((variable) => {
+      return [variable.name, variable.variable];
+    }));
+  }
+  static groupPermissions(entityLikeDefinition, roles2) {
+    const groupedPermissions = /* @__PURE__ */ new Map();
+    for (const [name, entity] of entityLikeDefinition) {
+      const initEntityPermissions = (role) => {
+        const rolePermissions = groupedPermissions.get(role) ?? /* @__PURE__ */ new Map();
+        groupedPermissions.set(role, rolePermissions);
+        const entityPermissions = rolePermissions.get(name) ?? {
+          allowCustomPrimary: false,
+          definitions: []
+        };
+        rolePermissions.set(name, entityPermissions);
+        return entityPermissions;
+      };
+      const metadata = stores.allowDefinitionsStore.get(entity);
+      for (const { role, ...definition } of metadata) {
+        if (!roles2.includes(role)) {
+          throw `Role ${role.name} used on entity ${name} is not registered. Have you exported it?`;
+        }
+        const entityPermissions = initEntityPermissions(role);
+        entityPermissions.definitions.push(definition);
+      }
+      const rolesWithCustomPrimary = stores.allowCustomPrimaryAllRolesStore.get(entity) ? roles2 : stores.allowCustomPrimaryStore.get(entity);
+      for (const role of rolesWithCustomPrimary) {
+        initEntityPermissions(role).allowCustomPrimary = true;
+      }
+    }
+    return groupedPermissions;
+  }
+}
+exports.AclFactory = AclFactory;
+//# sourceMappingURL=AclFactory.cjs.map

package/dist/development/src/acl/definition/internal/AclFactory.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AclFactory.cjs","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/AclFactory.ts"],"sourcesContent":["import { Acl, Model, Writable } from '@contember/schema'\nimport { getEntity } from '@contember/schema-utils'\n\nimport { EntityPredicatesResolver } from './EntityPredicateResolver'\nimport { AllowDefinition } from '../permissions'\nimport {\n\tallowCustomPrimaryAllRolesStore,\n\tallowCustomPrimaryStore,\n\tallowDefinitionsStore,\n\tEntityPermissionsDefinition,\n} from './stores'\nimport { Role } from '../roles'\nimport {  VariableDefinition } from '../variables'\nimport { filterEntityDefinition } from '../../../utils'\n\nexport class AclFactory {\n\tconstructor(\n\t\tprivate model: Model.Schema,\n\t) {\n\t}\n\n\tpublic create(\n\t\texportedDefinitions: Record<string, any>,\n\t): Acl.Schema {\n\t\tconst entityLikeDefinition = filterEntityDefinition(exportedDefinitions)\n\t\tconst roles: Role[] = Object.values(exportedDefinitions).filter(it => it instanceof Role)\n\t\tconst variables: VariableDefinition[] = Object.values(exportedDefinitions).filter(it => it instanceof VariableDefinition)\n\n\t\tconst groupedPermissions = AclFactory.groupPermissions(entityLikeDefinition, roles)\n\n\t\treturn {\n\t\t\troles: Object.fromEntries(roles.map((role): [string, Acl.RolePermissions] => {\n\t\t\t\tconst rolePermissions = groupedPermissions.get(role)\n\t\t\t\treturn [\n\t\t\t\t\trole.name,\n\t\t\t\t\t{\n\t\t\t\t\t\t...role.options,\n\t\t\t\t\t\tstages: role.options.stages ?? '*',\n\t\t\t\t\t\tentities: this.createPermissions(rolePermissions),\n\t\t\t\t\t\tvariables: this.createVariables(role, variables),\n\t\t\t\t\t},\n\t\t\t\t]\n\t\t\t})),\n\t\t}\n\t}\n\n\tprivate createPermissions(rolePermissions: PermissionsByEntity | undefined): Acl.Permissions {\n\t\tif (!rolePermissions) {\n\t\t\treturn {}\n\t\t}\n\t\treturn Object.fromEntries(Array.from(rolePermissions.keys()).map((entityName): [string, Acl.EntityPermissions] => {\n\t\t\tconst entity = getEntity(this.model, entityName)\n\n\t\t\tconst predicatesResolver = EntityPredicatesResolver.create(rolePermissions, this.model, entity)\n\n\t\t\tconst entityOperations: Writable<Acl.EntityOperations> = {}\n\t\t\tfor (const op of ['create', 'update', 'read'] as const) {\n\t\t\t\tconst fieldPermissions: Writable<Acl.FieldPermissions> = {}\n\t\t\t\tfor (const field of Object.keys(entity.fields)) {\n\t\t\t\t\tconst predicate = predicatesResolver.createFieldPredicate(op, field, field === entity.primary)\n\t\t\t\t\tif (predicate !== undefined) {\n\t\t\t\t\t\tfieldPermissions[field] = predicate\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tif (Object.keys(fieldPermissions).length > 0) {\n\t\t\t\t\tentityOperations[op] = fieldPermissions\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst delPredicate = predicatesResolver.createFieldPredicate('delete', '', false)\n\t\t\tif (delPredicate !== undefined) {\n\t\t\t\tentityOperations.delete = delPredicate\n\t\t\t}\n\t\t\tif (rolePermissions.get(entityName)?.allowCustomPrimary) {\n\t\t\t\tentityOperations.customPrimary = true\n\t\t\t}\n\t\t\treturn [entityName, {\n\t\t\t\tpredicates: predicatesResolver.getUsedPredicates(),\n\t\t\t\toperations: entityOperations,\n\t\t\t}]\n\t\t}))\n\t}\n\n\tprivate createVariables(role: Role, variables: VariableDefinition[]): Acl.Variables {\n\t\tconst roleVariables = variables.filter(it => it.roles.includes(role))\n\t\treturn Object.fromEntries(roleVariables.map((variable): [string, Acl.Variable] => {\n\t\t\treturn [variable.name, variable.variable]\n\t\t}))\n\t}\n\n\tprivate static groupPermissions(entityLikeDefinition: [string, { new(): any }][], roles: Role[]): PermissionsByRoleAndEntity {\n\t\tconst groupedPermissions: PermissionsByRoleAndEntity = new Map()\n\t\tfor (const [name, entity] of entityLikeDefinition) {\n\t\t\tconst initEntityPermissions = (role: Role): EntityPermissions => {\n\t\t\t\tconst rolePermissions: PermissionsByEntity = groupedPermissions.get(role) ?? new Map()\n\t\t\t\tgroupedPermissions.set(role, rolePermissions)\n\t\t\t\tconst entityPermissions = rolePermissions.get(name) ?? {\n\t\t\t\t\tallowCustomPrimary: false,\n\t\t\t\t\tdefinitions: [],\n\t\t\t\t}\n\t\t\t\trolePermissions.set(name, entityPermissions)\n\t\t\t\treturn entityPermissions\n\t\t\t}\n\t\t\tconst metadata: EntityPermissionsDefinition[] = allowDefinitionsStore.get(entity)\n\t\t\tfor (const { role, ...definition } of metadata) {\n\t\t\t\tif (!roles.includes(role)) {\n\t\t\t\t\tthrow `Role ${role.name} used on entity ${name} is not registered. Have you exported it?`\n\t\t\t\t}\n\t\t\t\tconst entityPermissions = initEntityPermissions(role)\n\t\t\t\tentityPermissions.definitions.push(definition)\n\t\t\t}\n\n\t\t\tconst rolesWithCustomPrimary = allowCustomPrimaryAllRolesStore.get(entity) ? roles : allowCustomPrimaryStore.get(entity)\n\t\t\tfor (const role of rolesWithCustomPrimary) {\n\t\t\t\tinitEntityPermissions(role).allowCustomPrimary = true\n\t\t\t}\n\t\t}\n\n\t\treturn groupedPermissions\n\t}\n}\n\n\nexport type EntityPermissions = { definitions: AllowDefinition<any>[]; allowCustomPrimary: boolean }\nexport type PermissionsByEntity = Map<string, EntityPermissions>\nexport type PermissionsByRoleAndEntity = Map<Role, PermissionsByEntity>\n"],"names":["filterEntityDefinition","roles","Role","variables","VariableDefinition","getEntity","EntityPredicatesResolver","allowDefinitionsStore","allowCustomPrimaryAllRolesStore","allowCustomPrimaryStore"],"mappings":";;;;;;;;;AAeO,MAAM,WAAW;AAAA,EACvB,YACS,OACP;AADO,SAAA,QAAA;AAAA,EAET;AAAA,EAEO,OACN,qBACa;AACP,UAAA,uBAAuBA,8CAAuB,mBAAmB;AACjE,UAAAC,UAAgB,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAcC,MAAAA,IAAI;AAClF,UAAAC,cAAkC,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAcC,UAAAA,kBAAkB;AAExH,UAAM,qBAAqB,WAAW,iBAAiB,sBAAsBH,OAAK;AAE3E,WAAA;AAAA,MACN,OAAO,OAAO,YAAYA,QAAM,IAAI,CAAC,SAAwC;AACtE,cAAA,kBAAkB,mBAAmB,IAAI,IAAI;AAC5C,eAAA;AAAA,UACN,KAAK;AAAA,UACL;AAAA,YACC,GAAG,KAAK;AAAA,YACR,QAAQ,KAAK,QAAQ,UAAU;AAAA,YAC/B,UAAU,KAAK,kBAAkB,eAAe;AAAA,YAChD,WAAW,KAAK,gBAAgB,MAAME,WAAS;AAAA,UAChD;AAAA,QAAA;AAAA,MACD,CACA,CAAC;AAAA,IAAA;AAAA,EAEJ;AAAA,EAEQ,kBAAkB,iBAAmE;AAC5F,QAAI,CAAC,iBAAiB;AACrB,aAAO;IACR;AACO,WAAA,OAAO,YAAY,MAAM,KAAK,gBAAgB,MAAM,EAAE,IAAI,CAAC,eAAgD;AACjH,YAAM,SAASE,YAAA,UAAU,KAAK,OAAO,UAAU;AAE/C,YAAM,qBAAqBC,wBAAAA,yBAAyB,OAAO,iBAAiB,KAAK,OAAO,MAAM;AAE9F,YAAM,mBAAmD,CAAA;AACzD,iBAAW,MAAM,CAAC,UAAU,UAAU,MAAM,GAAY;AACvD,cAAM,mBAAmD,CAAA;AACzD,mBAAW,SAAS,OAAO,KAAK,OAAO,MAAM,GAAG;AAC/C,gBAAM,YAAY,mBAAmB,qBAAqB,IAAI,OAAO,UAAU,OAAO,OAAO;AAC7F,cAAI,cAAc,QAAW;AAC5B,6BAAiB,KAAK,IAAI;AAAA,UAC3B;AAAA,QACD;AACA,YAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,GAAG;AAC7C,2BAAiB,EAAE,IAAI;AAAA,QACxB;AAAA,MACD;AACA,YAAM,eAAe,mBAAmB,qBAAqB,UAAU,IAAI,KAAK;AAChF,UAAI,iBAAiB,QAAW;AAC/B,yBAAiB,SAAS;AAAA,MAC3B;AACA,UAAI,gBAAgB,IAAI,UAAU,GAAG,oBAAoB;AACxD,yBAAiB,gBAAgB;AAAA,MAClC;AACA,aAAO,CAAC,YAAY;AAAA,QACnB,YAAY,mBAAmB,kBAAkB;AAAA,QACjD,YAAY;AAAA,MAAA,CACZ;AAAA,IACD,CAAA,CAAC;AAAA,EACH;AAAA,EAEQ,gBAAgB,MAAYH,YAAgD;AAC7E,UAAA,gBAAgBA,WAAU,OAAO,CAAA,OAAM,GAAG,MAAM,SAAS,IAAI,CAAC;AACpE,WAAO,OAAO,YAAY,cAAc,IAAI,CAAC,aAAqC;AACjF,aAAO,CAAC,SAAS,MAAM,SAAS,QAAQ;AAAA,IACxC,CAAA,CAAC;AAAA,EACH;AAAA,EAEA,OAAe,iBAAiB,sBAAkDF,QAA2C;AACtH,UAAA,yCAAqD;AAC3D,eAAW,CAAC,MAAM,MAAM,KAAK,sBAAsB;AAC5C,YAAA,wBAAwB,CAAC,SAAkC;AAChE,cAAM,kBAAuC,mBAAmB,IAAI,IAAI,yBAAS;AAC9D,2BAAA,IAAI,MAAM,eAAe;AAC5C,cAAM,oBAAoB,gBAAgB,IAAI,IAAI,KAAK;AAAA,UACtD,oBAAoB;AAAA,UACpB,aAAa,CAAC;AAAA,QAAA;AAEC,wBAAA,IAAI,MAAM,iBAAiB;AACpC,eAAA;AAAA,MAAA;AAEF,YAAA,WAA0CM,OAAAA,sBAAsB,IAAI,MAAM;AAChF,iBAAW,EAAE,MAAM,GAAG,WAAA,KAAgB,UAAU;AAC/C,YAAI,CAACN,OAAM,SAAS,IAAI,GAAG;AAC1B,gBAAM,QAAQ,KAAK,IAAI,mBAAmB,IAAI;AAAA,QAC/C;AACM,cAAA,oBAAoB,sBAAsB,IAAI;AAClC,0BAAA,YAAY,KAAK,UAAU;AAAA,MAC9C;AAEM,YAAA,yBAAyBO,uCAAgC,IAAI,MAAM,IAAIP,SAAQQ,OAAA,wBAAwB,IAAI,MAAM;AACvH,iBAAW,QAAQ,wBAAwB;AACpB,8BAAA,IAAI,EAAE,qBAAqB;AAAA,MAClD;AAAA,IACD;AAEO,WAAA;AAAA,EACR;AACD;;"}

package/dist/development/src/acl/definition/internal/AclFactory.js

@@ -0,0 +1,103 @@
+import { getEntity } from "@contember/schema-utils";
+import { EntityPredicatesResolver } from "./EntityPredicateResolver.js";
+import { allowDefinitionsStore, allowCustomPrimaryAllRolesStore, allowCustomPrimaryStore } from "./stores.js";
+import { Role } from "../roles.js";
+import { VariableDefinition } from "../variables.js";
+import { filterEntityDefinition } from "../../../utils/filterEntityDefinition.js";
+import "reflect-metadata";
+class AclFactory {
+  constructor(model) {
+    this.model = model;
+  }
+  create(exportedDefinitions) {
+    const entityLikeDefinition = filterEntityDefinition(exportedDefinitions);
+    const roles = Object.values(exportedDefinitions).filter((it) => it instanceof Role);
+    const variables = Object.values(exportedDefinitions).filter((it) => it instanceof VariableDefinition);
+    const groupedPermissions = AclFactory.groupPermissions(entityLikeDefinition, roles);
+    return {
+      roles: Object.fromEntries(roles.map((role) => {
+        const rolePermissions = groupedPermissions.get(role);
+        return [
+          role.name,
+          {
+            ...role.options,
+            stages: role.options.stages ?? "*",
+            entities: this.createPermissions(rolePermissions),
+            variables: this.createVariables(role, variables)
+          }
+        ];
+      }))
+    };
+  }
+  createPermissions(rolePermissions) {
+    if (!rolePermissions) {
+      return {};
+    }
+    return Object.fromEntries(Array.from(rolePermissions.keys()).map((entityName) => {
+      const entity = getEntity(this.model, entityName);
+      const predicatesResolver = EntityPredicatesResolver.create(rolePermissions, this.model, entity);
+      const entityOperations = {};
+      for (const op of ["create", "update", "read"]) {
+        const fieldPermissions = {};
+        for (const field of Object.keys(entity.fields)) {
+          const predicate = predicatesResolver.createFieldPredicate(op, field, field === entity.primary);
+          if (predicate !== void 0) {
+            fieldPermissions[field] = predicate;
+          }
+        }
+        if (Object.keys(fieldPermissions).length > 0) {
+          entityOperations[op] = fieldPermissions;
+        }
+      }
+      const delPredicate = predicatesResolver.createFieldPredicate("delete", "", false);
+      if (delPredicate !== void 0) {
+        entityOperations.delete = delPredicate;
+      }
+      if (rolePermissions.get(entityName)?.allowCustomPrimary) {
+        entityOperations.customPrimary = true;
+      }
+      return [entityName, {
+        predicates: predicatesResolver.getUsedPredicates(),
+        operations: entityOperations
+      }];
+    }));
+  }
+  createVariables(role, variables) {
+    const roleVariables = variables.filter((it) => it.roles.includes(role));
+    return Object.fromEntries(roleVariables.map((variable) => {
+      return [variable.name, variable.variable];
+    }));
+  }
+  static groupPermissions(entityLikeDefinition, roles) {
+    const groupedPermissions = /* @__PURE__ */ new Map();
+    for (const [name, entity] of entityLikeDefinition) {
+      const initEntityPermissions = (role) => {
+        const rolePermissions = groupedPermissions.get(role) ?? /* @__PURE__ */ new Map();
+        groupedPermissions.set(role, rolePermissions);
+        const entityPermissions = rolePermissions.get(name) ?? {
+          allowCustomPrimary: false,
+          definitions: []
+        };
+        rolePermissions.set(name, entityPermissions);
+        return entityPermissions;
+      };
+      const metadata = allowDefinitionsStore.get(entity);
+      for (const { role, ...definition } of metadata) {
+        if (!roles.includes(role)) {
+          throw `Role ${role.name} used on entity ${name} is not registered. Have you exported it?`;
+        }
+        const entityPermissions = initEntityPermissions(role);
+        entityPermissions.definitions.push(definition);
+      }
+      const rolesWithCustomPrimary = allowCustomPrimaryAllRolesStore.get(entity) ? roles : allowCustomPrimaryStore.get(entity);
+      for (const role of rolesWithCustomPrimary) {
+        initEntityPermissions(role).allowCustomPrimary = true;
+      }
+    }
+    return groupedPermissions;
+  }
+}
+export {
+  AclFactory
+};
+//# sourceMappingURL=AclFactory.js.map

package/dist/development/src/acl/definition/internal/AclFactory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AclFactory.js","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/AclFactory.ts"],"sourcesContent":["import { Acl, Model, Writable } from '@contember/schema'\nimport { getEntity } from '@contember/schema-utils'\n\nimport { EntityPredicatesResolver } from './EntityPredicateResolver'\nimport { AllowDefinition } from '../permissions'\nimport {\n\tallowCustomPrimaryAllRolesStore,\n\tallowCustomPrimaryStore,\n\tallowDefinitionsStore,\n\tEntityPermissionsDefinition,\n} from './stores'\nimport { Role } from '../roles'\nimport {  VariableDefinition } from '../variables'\nimport { filterEntityDefinition } from '../../../utils'\n\nexport class AclFactory {\n\tconstructor(\n\t\tprivate model: Model.Schema,\n\t) {\n\t}\n\n\tpublic create(\n\t\texportedDefinitions: Record<string, any>,\n\t): Acl.Schema {\n\t\tconst entityLikeDefinition = filterEntityDefinition(exportedDefinitions)\n\t\tconst roles: Role[] = Object.values(exportedDefinitions).filter(it => it instanceof Role)\n\t\tconst variables: VariableDefinition[] = Object.values(exportedDefinitions).filter(it => it instanceof VariableDefinition)\n\n\t\tconst groupedPermissions = AclFactory.groupPermissions(entityLikeDefinition, roles)\n\n\t\treturn {\n\t\t\troles: Object.fromEntries(roles.map((role): [string, Acl.RolePermissions] => {\n\t\t\t\tconst rolePermissions = groupedPermissions.get(role)\n\t\t\t\treturn [\n\t\t\t\t\trole.name,\n\t\t\t\t\t{\n\t\t\t\t\t\t...role.options,\n\t\t\t\t\t\tstages: role.options.stages ?? '*',\n\t\t\t\t\t\tentities: this.createPermissions(rolePermissions),\n\t\t\t\t\t\tvariables: this.createVariables(role, variables),\n\t\t\t\t\t},\n\t\t\t\t]\n\t\t\t})),\n\t\t}\n\t}\n\n\tprivate createPermissions(rolePermissions: PermissionsByEntity | undefined): Acl.Permissions {\n\t\tif (!rolePermissions) {\n\t\t\treturn {}\n\t\t}\n\t\treturn Object.fromEntries(Array.from(rolePermissions.keys()).map((entityName): [string, Acl.EntityPermissions] => {\n\t\t\tconst entity = getEntity(this.model, entityName)\n\n\t\t\tconst predicatesResolver = EntityPredicatesResolver.create(rolePermissions, this.model, entity)\n\n\t\t\tconst entityOperations: Writable<Acl.EntityOperations> = {}\n\t\t\tfor (const op of ['create', 'update', 'read'] as const) {\n\t\t\t\tconst fieldPermissions: Writable<Acl.FieldPermissions> = {}\n\t\t\t\tfor (const field of Object.keys(entity.fields)) {\n\t\t\t\t\tconst predicate = predicatesResolver.createFieldPredicate(op, field, field === entity.primary)\n\t\t\t\t\tif (predicate !== undefined) {\n\t\t\t\t\t\tfieldPermissions[field] = predicate\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tif (Object.keys(fieldPermissions).length > 0) {\n\t\t\t\t\tentityOperations[op] = fieldPermissions\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst delPredicate = predicatesResolver.createFieldPredicate('delete', '', false)\n\t\t\tif (delPredicate !== undefined) {\n\t\t\t\tentityOperations.delete = delPredicate\n\t\t\t}\n\t\t\tif (rolePermissions.get(entityName)?.allowCustomPrimary) {\n\t\t\t\tentityOperations.customPrimary = true\n\t\t\t}\n\t\t\treturn [entityName, {\n\t\t\t\tpredicates: predicatesResolver.getUsedPredicates(),\n\t\t\t\toperations: entityOperations,\n\t\t\t}]\n\t\t}))\n\t}\n\n\tprivate createVariables(role: Role, variables: VariableDefinition[]): Acl.Variables {\n\t\tconst roleVariables = variables.filter(it => it.roles.includes(role))\n\t\treturn Object.fromEntries(roleVariables.map((variable): [string, Acl.Variable] => {\n\t\t\treturn [variable.name, variable.variable]\n\t\t}))\n\t}\n\n\tprivate static groupPermissions(entityLikeDefinition: [string, { new(): any }][], roles: Role[]): PermissionsByRoleAndEntity {\n\t\tconst groupedPermissions: PermissionsByRoleAndEntity = new Map()\n\t\tfor (const [name, entity] of entityLikeDefinition) {\n\t\t\tconst initEntityPermissions = (role: Role): EntityPermissions => {\n\t\t\t\tconst rolePermissions: PermissionsByEntity = groupedPermissions.get(role) ?? new Map()\n\t\t\t\tgroupedPermissions.set(role, rolePermissions)\n\t\t\t\tconst entityPermissions = rolePermissions.get(name) ?? {\n\t\t\t\t\tallowCustomPrimary: false,\n\t\t\t\t\tdefinitions: [],\n\t\t\t\t}\n\t\t\t\trolePermissions.set(name, entityPermissions)\n\t\t\t\treturn entityPermissions\n\t\t\t}\n\t\t\tconst metadata: EntityPermissionsDefinition[] = allowDefinitionsStore.get(entity)\n\t\t\tfor (const { role, ...definition } of metadata) {\n\t\t\t\tif (!roles.includes(role)) {\n\t\t\t\t\tthrow `Role ${role.name} used on entity ${name} is not registered. Have you exported it?`\n\t\t\t\t}\n\t\t\t\tconst entityPermissions = initEntityPermissions(role)\n\t\t\t\tentityPermissions.definitions.push(definition)\n\t\t\t}\n\n\t\t\tconst rolesWithCustomPrimary = allowCustomPrimaryAllRolesStore.get(entity) ? roles : allowCustomPrimaryStore.get(entity)\n\t\t\tfor (const role of rolesWithCustomPrimary) {\n\t\t\t\tinitEntityPermissions(role).allowCustomPrimary = true\n\t\t\t}\n\t\t}\n\n\t\treturn groupedPermissions\n\t}\n}\n\n\nexport type EntityPermissions = { definitions: AllowDefinition<any>[]; allowCustomPrimary: boolean }\nexport type PermissionsByEntity = Map<string, EntityPermissions>\nexport type PermissionsByRoleAndEntity = Map<Role, PermissionsByEntity>\n"],"names":[],"mappings":";;;;;;;AAeO,MAAM,WAAW;AAAA,EACvB,YACS,OACP;AADO,SAAA,QAAA;AAAA,EAET;AAAA,EAEO,OACN,qBACa;AACP,UAAA,uBAAuB,uBAAuB,mBAAmB;AACjE,UAAA,QAAgB,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAc,IAAI;AAClF,UAAA,YAAkC,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAc,kBAAkB;AAExH,UAAM,qBAAqB,WAAW,iBAAiB,sBAAsB,KAAK;AAE3E,WAAA;AAAA,MACN,OAAO,OAAO,YAAY,MAAM,IAAI,CAAC,SAAwC;AACtE,cAAA,kBAAkB,mBAAmB,IAAI,IAAI;AAC5C,eAAA;AAAA,UACN,KAAK;AAAA,UACL;AAAA,YACC,GAAG,KAAK;AAAA,YACR,QAAQ,KAAK,QAAQ,UAAU;AAAA,YAC/B,UAAU,KAAK,kBAAkB,eAAe;AAAA,YAChD,WAAW,KAAK,gBAAgB,MAAM,SAAS;AAAA,UAChD;AAAA,QAAA;AAAA,MACD,CACA,CAAC;AAAA,IAAA;AAAA,EAEJ;AAAA,EAEQ,kBAAkB,iBAAmE;AAC5F,QAAI,CAAC,iBAAiB;AACrB,aAAO;IACR;AACO,WAAA,OAAO,YAAY,MAAM,KAAK,gBAAgB,MAAM,EAAE,IAAI,CAAC,eAAgD;AACjH,YAAM,SAAS,UAAU,KAAK,OAAO,UAAU;AAE/C,YAAM,qBAAqB,yBAAyB,OAAO,iBAAiB,KAAK,OAAO,MAAM;AAE9F,YAAM,mBAAmD,CAAA;AACzD,iBAAW,MAAM,CAAC,UAAU,UAAU,MAAM,GAAY;AACvD,cAAM,mBAAmD,CAAA;AACzD,mBAAW,SAAS,OAAO,KAAK,OAAO,MAAM,GAAG;AAC/C,gBAAM,YAAY,mBAAmB,qBAAqB,IAAI,OAAO,UAAU,OAAO,OAAO;AAC7F,cAAI,cAAc,QAAW;AAC5B,6BAAiB,KAAK,IAAI;AAAA,UAC3B;AAAA,QACD;AACA,YAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,GAAG;AAC7C,2BAAiB,EAAE,IAAI;AAAA,QACxB;AAAA,MACD;AACA,YAAM,eAAe,mBAAmB,qBAAqB,UAAU,IAAI,KAAK;AAChF,UAAI,iBAAiB,QAAW;AAC/B,yBAAiB,SAAS;AAAA,MAC3B;AACA,UAAI,gBAAgB,IAAI,UAAU,GAAG,oBAAoB;AACxD,yBAAiB,gBAAgB;AAAA,MAClC;AACA,aAAO,CAAC,YAAY;AAAA,QACnB,YAAY,mBAAmB,kBAAkB;AAAA,QACjD,YAAY;AAAA,MAAA,CACZ;AAAA,IACD,CAAA,CAAC;AAAA,EACH;AAAA,EAEQ,gBAAgB,MAAY,WAAgD;AAC7E,UAAA,gBAAgB,UAAU,OAAO,CAAA,OAAM,GAAG,MAAM,SAAS,IAAI,CAAC;AACpE,WAAO,OAAO,YAAY,cAAc,IAAI,CAAC,aAAqC;AACjF,aAAO,CAAC,SAAS,MAAM,SAAS,QAAQ;AAAA,IACxC,CAAA,CAAC;AAAA,EACH;AAAA,EAEA,OAAe,iBAAiB,sBAAkD,OAA2C;AACtH,UAAA,yCAAqD;AAC3D,eAAW,CAAC,MAAM,MAAM,KAAK,sBAAsB;AAC5C,YAAA,wBAAwB,CAAC,SAAkC;AAChE,cAAM,kBAAuC,mBAAmB,IAAI,IAAI,yBAAS;AAC9D,2BAAA,IAAI,MAAM,eAAe;AAC5C,cAAM,oBAAoB,gBAAgB,IAAI,IAAI,KAAK;AAAA,UACtD,oBAAoB;AAAA,UACpB,aAAa,CAAC;AAAA,QAAA;AAEC,wBAAA,IAAI,MAAM,iBAAiB;AACpC,eAAA;AAAA,MAAA;AAEF,YAAA,WAA0C,sBAAsB,IAAI,MAAM;AAChF,iBAAW,EAAE,MAAM,GAAG,WAAA,KAAgB,UAAU;AAC/C,YAAI,CAAC,MAAM,SAAS,IAAI,GAAG;AAC1B,gBAAM,QAAQ,KAAK,IAAI,mBAAmB,IAAI;AAAA,QAC/C;AACM,cAAA,oBAAoB,sBAAsB,IAAI;AAClC,0BAAA,YAAY,KAAK,UAAU;AAAA,MAC9C;AAEM,YAAA,yBAAyB,gCAAgC,IAAI,MAAM,IAAI,QAAQ,wBAAwB,IAAI,MAAM;AACvH,iBAAW,QAAQ,wBAAwB;AACpB,8BAAA,IAAI,EAAE,qBAAqB;AAAA,MAClD;AAAA,IACD;AAEO,WAAA;AAAA,EACR;AACD;"}

package/dist/development/src/acl/definition/internal/EntityPredicateResolver.cjs

@@ -0,0 +1,151 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const node_util = require("node:util");
+const schemaUtils = require("@contember/schema-utils");
+const createPredicateName = require("./createPredicateName.cjs");
+const references = require("../references.cjs");
+const variables = require("../variables.cjs");
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+class EntityPredicatesResolver {
+  constructor(aclDefinitions, predicates, predicateNamesMap, generatedNames) {
+    this.aclDefinitions = aclDefinitions;
+    this.predicates = predicates;
+    this.predicateNamesMap = predicateNamesMap;
+    this.generatedNames = generatedNames;
+    __publicField(this, "usedPredicates", []);
+  }
+  static create(rolePermissions, model, entity) {
+    const predicates = {};
+    const predicateNamesMap = /* @__PURE__ */ new Map();
+    const aclDefinitions = rolePermissions.get(entity.name)?.definitions ?? [];
+    const generatedNames = /* @__PURE__ */ new Set();
+    const definedNames = new Set(aclDefinitions.map((it) => it.name).filter((it) => it !== void 0));
+    for (const permission of aclDefinitions) {
+      if (!permission.when) {
+        continue;
+      }
+      const resolvedPredicate = EntityPredicatesResolver.resolvePredicate(model, entity, permission.when, rolePermissions);
+      let predicateName = permission.name ?? createPredicateName.createPredicateName(resolvedPredicate);
+      while (predicateName in predicates || definedNames.has(predicateName)) {
+        predicateName += "_";
+      }
+      if (!permission.name) {
+        generatedNames.add(predicateName);
+      }
+      predicates[predicateName] = resolvedPredicate;
+      predicateNamesMap.set(permission.when, predicateName);
+    }
+    for (const op of ["read", "update", "create"]) {
+      for (const definition of aclDefinitions) {
+        const fields = definition[op];
+        if (!Array.isArray(fields)) {
+          continue;
+        }
+        for (const field of fields) {
+          if (!(field in entity.fields)) {
+            throw `Field "${String(field)}" does not exist on entity "${entity.name}" in ${op} ACL definition.`;
+          }
+        }
+      }
+    }
+    return new EntityPredicatesResolver(aclDefinitions, predicates, predicateNamesMap, generatedNames);
+  }
+  createFieldPredicate(op, field, isPrimary) {
+    const fieldWhens = EntityPredicatesResolver.getMatchingWhens(this.aclDefinitions, op, field, isPrimary);
+    if (fieldWhens.length === 0) {
+      return void 0;
+    }
+    if (fieldWhens.includes(true)) {
+      return true;
+    }
+    const predicateNames = fieldWhens.map((it) => {
+      const name = this.predicateNamesMap.get(it);
+      if (!name) throw new Error("implementation error");
+      return name;
+    });
+    if (predicateNames.length === 1) {
+      this.usedPredicates.push(predicateNames[0]);
+      return predicateNames[0];
+    }
+    const predicate = { or: predicateNames.map((it) => this.predicates[it]) };
+    const origName = predicateNames.every((it) => this.generatedNames.has(it)) ? createPredicateName.createPredicateName(predicate) : predicateNames.join("_or_");
+    let predicateName = origName;
+    for (let i = 1; ; i++) {
+      if (!(predicateName in this.predicates)) {
+        this.predicates[predicateName] = predicate;
+        break;
+      } else if (node_util.isDeepStrictEqual(predicate, this.predicates[predicateName])) {
+        break;
+      } else {
+        predicateName = `${origName}_${i}`;
+      }
+    }
+    this.usedPredicates.push(predicateName);
+    return predicateName;
+  }
+  getUsedPredicates() {
+    return Object.fromEntries(Object.entries(this.predicates).filter(([name]) => this.usedPredicates.includes(name)));
+  }
+  static resolvePredicate(model, entity, when, rolePermissionsByEntity) {
+    const processor = new schemaUtils.PredicateDefinitionProcessor(model);
+    return processor.process(entity, when, {
+      handleColumn(ctx) {
+        if (ctx.value instanceof variables.VariableDefinition) {
+          return ctx.value.name;
+        }
+        if (ctx.value instanceof references.PredicateEvaluationReference) {
+          throw `Predicate references are allowed only on relations. 
+You cannot use "can${upperCaseFirst(ctx.value.operation)}(${ctx.value.field ? JSON.stringify(ctx.value.field) : ""})" on a column "${ctx.column.name}" of entity "${ctx.entity.name}".`;
+        }
+        return ctx.value;
+      },
+      handleRelation(ctx) {
+        if (ctx.value instanceof variables.VariableDefinition) {
+          return { [ctx.targetEntity.primary]: ctx.value.name };
+        }
+        if (ctx.value instanceof references.PredicateEvaluationReference) {
+          const targetPermissions = rolePermissionsByEntity.get(ctx.targetEntity.name);
+          if (!targetPermissions) {
+            return { [ctx.targetEntity.primary]: { never: true } };
+          }
+          const ref = ctx.value;
+          const whens = EntityPredicatesResolver.getMatchingWhens(targetPermissions.definitions, ref.operation, ref.field ?? "", false);
+          if (whens.length === 0) {
+            return { [ctx.targetEntity.primary]: { never: true } };
+          }
+          if (whens.includes(true)) {
+            return { [ctx.targetEntity.primary]: { isNull: false } };
+          }
+          const predicates = whens.map(
+            (it) => EntityPredicatesResolver.resolvePredicate(model, ctx.targetEntity, it, rolePermissionsByEntity)
+          );
+          if (predicates.length > 1) {
+            return { or: predicates };
+          }
+          return predicates[0];
+        }
+        return ctx.value;
+      }
+    });
+  }
+  static getMatchingWhens(permissions, operation, field, isPrimary) {
+    return permissions.filter((it) => {
+      if (operation === "delete") {
+        return !!it.delete;
+      }
+      const op = it[operation];
+      if (!op) {
+        return false;
+      }
+      if (op === true) {
+        return !isPrimary;
+      }
+      return op.includes(field);
+    }).map((it) => it.when ?? true);
+  }
+}
+const upperCaseFirst = (string) => `${string.charAt(0).toUpperCase()}${string.substring(1)}`;
+exports.EntityPredicatesResolver = EntityPredicatesResolver;
+//# sourceMappingURL=EntityPredicateResolver.cjs.map

package/dist/development/src/acl/definition/internal/EntityPredicateResolver.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"EntityPredicateResolver.cjs","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/EntityPredicateResolver.ts"],"sourcesContent":["import { isDeepStrictEqual } from 'node:util'\n\nimport { Acl, Input, Model, Writable } from '@contember/schema'\nimport { PredicateDefinitionProcessor } from '@contember/schema-utils'\n\nimport { PermissionsByEntity } from './AclFactory'\nimport { createPredicateName } from './createPredicateName'\nimport { AllowDefinition, PredicateExtra, WhenDefinition } from '../permissions'\nimport { PredicateEvaluationReference } from '../references'\nimport { VariableDefinition } from '../variables'\n\nexport class EntityPredicatesResolver {\n\tprivate usedPredicates: string[] = []\n\n\tprivate constructor(\n\t\tprivate aclDefinitions: AllowDefinition<any>[],\n\t\tprivate predicates: Writable<Acl.PredicateMap>,\n\t\tprivate predicateNamesMap: Map<WhenDefinition, string>,\n\t\tprivate generatedNames: Set<string>,\n\t) {\n\t}\n\n\tpublic static create(\n\t\trolePermissions: PermissionsByEntity,\n\t\tmodel: Model.Schema,\n\t\tentity: Model.Entity,\n\t): EntityPredicatesResolver {\n\t\tconst predicates: Writable<Acl.PredicateMap> = {}\n\t\tconst predicateNamesMap = new Map<WhenDefinition, string>()\n\t\tconst aclDefinitions = rolePermissions.get(entity.name)?.definitions ?? []\n\t\tconst generatedNames = new Set<string>()\n\t\tconst definedNames = new Set<string>(aclDefinitions.map(it => it.name).filter((it): it is string => it !== undefined))\n\t\tfor (const permission of aclDefinitions) {\n\t\t\tif (!permission.when) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst resolvedPredicate = EntityPredicatesResolver.resolvePredicate(model, entity, permission.when, rolePermissions)\n\t\t\tlet predicateName = permission.name ?? createPredicateName(resolvedPredicate)\n\t\t\twhile (predicateName in predicates || definedNames.has(predicateName)) {\n\t\t\t\tpredicateName += '_'\n\t\t\t}\n\t\t\tif (!permission.name) {\n\t\t\t\tgeneratedNames.add(predicateName)\n\t\t\t}\n\t\t\tpredicates[predicateName] = resolvedPredicate\n\t\t\tpredicateNamesMap.set(permission.when, predicateName)\n\t\t}\n\t\tfor (const op of ['read', 'update', 'create'] as const) {\n\t\t\tfor (const definition of aclDefinitions) {\n\t\t\t\tconst fields = definition[op]\n\t\t\t\tif (!Array.isArray(fields)) {\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\t\t\t\tfor (const field of fields) {\n\t\t\t\t\tif (!(field in entity.fields)) {\n\t\t\t\t\t\tthrow `Field \"${String(field)}\" does not exist on entity \"${entity.name}\" in ${op} ACL definition.`\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\treturn new EntityPredicatesResolver(aclDefinitions, predicates, predicateNamesMap, generatedNames)\n\t}\n\n\tcreateFieldPredicate(op: 'create' | 'update' | 'read' | 'delete', field: string, isPrimary: boolean): true | undefined | string {\n\t\tconst fieldWhens = EntityPredicatesResolver.getMatchingWhens(this.aclDefinitions, op, field, isPrimary)\n\t\tif (fieldWhens.length === 0) {\n\t\t\treturn undefined\n\t\t}\n\t\tif (fieldWhens.includes(true)) {\n\t\t\treturn true\n\t\t}\n\t\tconst predicateNames = (fieldWhens as WhenDefinition[]).map(it => {\n\t\t\tconst name = this.predicateNamesMap.get(it)\n\t\t\tif (!name) throw new Error('implementation error')\n\t\t\treturn name\n\t\t})\n\t\tif (predicateNames.length === 1) {\n\t\t\tthis.usedPredicates.push(predicateNames[0])\n\t\t\treturn predicateNames[0]\n\t\t}\n\n\n\t\tconst predicate = { or: predicateNames.map(it => this.predicates[it]) }\n\t\tconst origName = predicateNames.every(it => this.generatedNames.has(it)) ? createPredicateName(predicate) : predicateNames.join('_or_')\n\t\tlet predicateName = origName\n\t\tfor (let i = 1;; i++) {\n\t\t\tif (!(predicateName in this.predicates)) {\n\t\t\t\tthis.predicates[predicateName] = predicate\n\t\t\t\tbreak\n\t\t\t} else if (isDeepStrictEqual(predicate, this.predicates[predicateName])) {\n\t\t\t\tbreak\n\t\t\t} else {\n\t\t\t\tpredicateName = `${origName}_${i}`\n\t\t\t}\n\t\t}\n\t\tthis.usedPredicates.push(predicateName)\n\t\treturn predicateName\n\t}\n\n\tgetUsedPredicates(): Acl.PredicateMap {\n\t\treturn Object.fromEntries(Object.entries(this.predicates).filter(([name]) => this.usedPredicates.includes(name)))\n\t}\n\n\n\tprivate static resolvePredicate(\n\t\tmodel: Model.Schema,\n\t\tentity: Model.Entity,\n\t\twhen: WhenDefinition,\n\t\trolePermissionsByEntity: PermissionsByEntity,\n\t): Acl.PredicateDefinition {\n\t\tconst processor = new PredicateDefinitionProcessor(model)\n\t\treturn processor.process<Acl.PredicateReference | Input.Condition, PredicateExtra>(entity, when, {\n\t\t\thandleColumn(ctx) {\n\t\t\t\tif (ctx.value instanceof VariableDefinition) {\n\t\t\t\t\treturn ctx.value.name\n\t\t\t\t}\n\t\t\t\tif (ctx.value instanceof PredicateEvaluationReference) {\n\t\t\t\t\tthrow `Predicate references are allowed only on relations. \\nYou cannot use \"can${upperCaseFirst(ctx.value.operation)}(${ctx.value.field ? JSON.stringify(ctx.value.field) : ''})\" on a column \"${ctx.column.name}\" of entity \"${ctx.entity.name}\".`\n\t\t\t\t}\n\t\t\t\treturn ctx.value\n\t\t\t},\n\t\t\thandleRelation(ctx) {\n\t\t\t\tif (ctx.value instanceof VariableDefinition) {\n\t\t\t\t\treturn { [ctx.targetEntity.primary]: ctx.value.name }\n\t\t\t\t}\n\t\t\t\tif (ctx.value instanceof PredicateEvaluationReference) {\n\t\t\t\t\tconst targetPermissions = rolePermissionsByEntity.get(ctx.targetEntity.name)\n\t\t\t\t\tif (!targetPermissions) {\n\t\t\t\t\t\treturn { [ctx.targetEntity.primary]: { never: true } }\n\t\t\t\t\t}\n\t\t\t\t\tconst ref = ctx.value\n\t\t\t\t\tconst whens = EntityPredicatesResolver.getMatchingWhens(targetPermissions.definitions, ref.operation, ref.field ?? '', false)\n\t\t\t\t\tif (whens.length === 0) {\n\t\t\t\t\t\treturn { [ctx.targetEntity.primary]: { never: true } }\n\t\t\t\t\t}\n\t\t\t\t\tif (whens.includes(true)) {\n\t\t\t\t\t\treturn { [ctx.targetEntity.primary]: { isNull: false } }\n\t\t\t\t\t}\n\t\t\t\t\tconst predicates = (whens as WhenDefinition[]).map(it =>\n\t\t\t\t\t\tEntityPredicatesResolver.resolvePredicate(model, ctx.targetEntity, it, rolePermissionsByEntity),\n\t\t\t\t\t)\n\t\t\t\t\tif (predicates.length > 1) {\n\t\t\t\t\t\treturn { or: predicates }\n\t\t\t\t\t}\n\t\t\t\t\treturn predicates[0]\n\t\t\t\t}\n\t\t\t\treturn ctx.value\n\t\t\t},\n\t\t})\n\t}\n\n\tprivate static getMatchingWhens(\n\t\tpermissions: AllowDefinition<any>[],\n\t\toperation: 'delete' | 'read' | 'update' | 'create',\n\t\tfield: string,\n\t\tisPrimary: boolean,\n\t) {\n\t\treturn permissions\n\t\t\t.filter(it => {\n\t\t\t\tif (operation === 'delete') {\n\t\t\t\t\treturn !!it.delete\n\t\t\t\t}\n\t\t\t\tconst op = it[operation]\n\t\t\t\tif (!op) {\n\t\t\t\t\treturn false\n\t\t\t\t}\n\t\t\t\tif (op === true) {\n\t\t\t\t\treturn !isPrimary\n\t\t\t\t}\n\t\t\t\treturn op.includes(field)\n\t\t\t})\n\t\t\t.map(it => it.when ?? true)\n\t}\n}\n\nconst upperCaseFirst = (string: string) => `${string.charAt(0).toUpperCase()}${string.substring(1)}`\n"],"names":["createPredicateName","isDeepStrictEqual","PredicateDefinitionProcessor","VariableDefinition","PredicateEvaluationReference"],"mappings":";;;;;;;;;;AAWO,MAAM,yBAAyB;AAAA,EAG7B,YACC,gBACA,YACA,mBACA,gBACP;AAJO,SAAA,iBAAA;AACA,SAAA,aAAA;AACA,SAAA,oBAAA;AACA,SAAA,iBAAA;AANT,kBAAA,MAAQ,kBAA2B,CAAA,CAAC;AAAA,EAQpC;AAAA,EAEA,OAAc,OACb,iBACA,OACA,QAC2B;AAC3B,UAAM,aAAyC,CAAA;AACzC,UAAA,wCAAwB;AAC9B,UAAM,iBAAiB,gBAAgB,IAAI,OAAO,IAAI,GAAG,eAAe;AAClE,UAAA,qCAAqB;AAC3B,UAAM,eAAe,IAAI,IAAY,eAAe,IAAI,CAAM,OAAA,GAAG,IAAI,EAAE,OAAO,CAAC,OAAqB,OAAO,MAAS,CAAC;AACrH,eAAW,cAAc,gBAAgB;AACpC,UAAA,CAAC,WAAW,MAAM;AACrB;AAAA,MACD;AACA,YAAM,oBAAoB,yBAAyB,iBAAiB,OAAO,QAAQ,WAAW,MAAM,eAAe;AACnH,UAAI,gBAAgB,WAAW,QAAQA,oBAAA,oBAAoB,iBAAiB;AAC5E,aAAO,iBAAiB,cAAc,aAAa,IAAI,aAAa,GAAG;AACrD,yBAAA;AAAA,MAClB;AACI,UAAA,CAAC,WAAW,MAAM;AACrB,uBAAe,IAAI,aAAa;AAAA,MACjC;AACA,iBAAW,aAAa,IAAI;AACV,wBAAA,IAAI,WAAW,MAAM,aAAa;AAAA,IACrD;AACA,eAAW,MAAM,CAAC,QAAQ,UAAU,QAAQ,GAAY;AACvD,iBAAW,cAAc,gBAAgB;AAClC,cAAA,SAAS,WAAW,EAAE;AAC5B,YAAI,CAAC,MAAM,QAAQ,MAAM,GAAG;AAC3B;AAAA,QACD;AACA,mBAAW,SAAS,QAAQ;AACvB,cAAA,EAAE,SAAS,OAAO,SAAS;AACxB,kBAAA,UAAU,OAAO,KAAK,CAAC,+BAA+B,OAAO,IAAI,QAAQ,EAAE;AAAA,UAClF;AAAA,QACD;AAAA,MACD;AAAA,IACD;AAEA,WAAO,IAAI,yBAAyB,gBAAgB,YAAY,mBAAmB,cAAc;AAAA,EAClG;AAAA,EAEA,qBAAqB,IAA6C,OAAe,WAA+C;AAC/H,UAAM,aAAa,yBAAyB,iBAAiB,KAAK,gBAAgB,IAAI,OAAO,SAAS;AAClG,QAAA,WAAW,WAAW,GAAG;AACrB,aAAA;AAAA,IACR;AACI,QAAA,WAAW,SAAS,IAAI,GAAG;AACvB,aAAA;AAAA,IACR;AACM,UAAA,iBAAkB,WAAgC,IAAI,CAAM,OAAA;AACjE,YAAM,OAAO,KAAK,kBAAkB,IAAI,EAAE;AAC1C,UAAI,CAAC,KAAY,OAAA,IAAI,MAAM,sBAAsB;AAC1C,aAAA;AAAA,IAAA,CACP;AACG,QAAA,eAAe,WAAW,GAAG;AAChC,WAAK,eAAe,KAAK,eAAe,CAAC,CAAC;AAC1C,aAAO,eAAe,CAAC;AAAA,IACxB;AAGM,UAAA,YAAY,EAAE,IAAI,eAAe,IAAI,QAAM,KAAK,WAAW,EAAE,CAAC,EAAE;AACtE,UAAM,WAAW,eAAe,MAAM,CAAA,OAAM,KAAK,eAAe,IAAI,EAAE,CAAC,IAAIA,oBAAAA,oBAAoB,SAAS,IAAI,eAAe,KAAK,MAAM;AACtI,QAAI,gBAAgB;AACX,aAAA,IAAI,KAAI,KAAK;AACjB,UAAA,EAAE,iBAAiB,KAAK,aAAa;AACnC,aAAA,WAAW,aAAa,IAAI;AACjC;AAAA,MAAA,WACUC,UAAkB,kBAAA,WAAW,KAAK,WAAW,aAAa,CAAC,GAAG;AACxE;AAAA,MAAA,OACM;AACU,wBAAA,GAAG,QAAQ,IAAI,CAAC;AAAA,MACjC;AAAA,IACD;AACK,SAAA,eAAe,KAAK,aAAa;AAC/B,WAAA;AAAA,EACR;AAAA,EAEA,oBAAsC;AACrC,WAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,MAAM,KAAK,eAAe,SAAS,IAAI,CAAC,CAAC;AAAA,EACjH;AAAA,EAGA,OAAe,iBACd,OACA,QACA,MACA,yBAC0B;AACpB,UAAA,YAAY,IAAIC,yCAA6B,KAAK;AACjD,WAAA,UAAU,QAAkE,QAAQ,MAAM;AAAA,MAChG,aAAa,KAAK;AACb,YAAA,IAAI,iBAAiBC,8BAAoB;AAC5C,iBAAO,IAAI,MAAM;AAAA,QAClB;AACI,YAAA,IAAI,iBAAiBC,yCAA8B;AAChD,gBAAA;AAAA,qBAA4E,eAAe,IAAI,MAAM,SAAS,CAAC,IAAI,IAAI,MAAM,QAAQ,KAAK,UAAU,IAAI,MAAM,KAAK,IAAI,EAAE,mBAAmB,IAAI,OAAO,IAAI,gBAAgB,IAAI,OAAO,IAAI;AAAA,QACjP;AACA,eAAO,IAAI;AAAA,MACZ;AAAA,MACA,eAAe,KAAK;AACf,YAAA,IAAI,iBAAiBD,8BAAoB;AACrC,iBAAA,EAAE,CAAC,IAAI,aAAa,OAAO,GAAG,IAAI,MAAM;QAChD;AACI,YAAA,IAAI,iBAAiBC,yCAA8B;AACtD,gBAAM,oBAAoB,wBAAwB,IAAI,IAAI,aAAa,IAAI;AAC3E,cAAI,CAAC,mBAAmB;AAChB,mBAAA,EAAE,CAAC,IAAI,aAAa,OAAO,GAAG,EAAE,OAAO,KAAA;UAC/C;AACA,gBAAM,MAAM,IAAI;AACV,gBAAA,QAAQ,yBAAyB,iBAAiB,kBAAkB,aAAa,IAAI,WAAW,IAAI,SAAS,IAAI,KAAK;AACxH,cAAA,MAAM,WAAW,GAAG;AAChB,mBAAA,EAAE,CAAC,IAAI,aAAa,OAAO,GAAG,EAAE,OAAO,KAAA;UAC/C;AACI,cAAA,MAAM,SAAS,IAAI,GAAG;AAClB,mBAAA,EAAE,CAAC,IAAI,aAAa,OAAO,GAAG,EAAE,QAAQ,MAAA;UAChD;AACA,gBAAM,aAAc,MAA2B;AAAA,YAAI,QAClD,yBAAyB,iBAAiB,OAAO,IAAI,cAAc,IAAI,uBAAuB;AAAA,UAAA;AAE3F,cAAA,WAAW,SAAS,GAAG;AACnB,mBAAA,EAAE,IAAI;UACd;AACA,iBAAO,WAAW,CAAC;AAAA,QACpB;AACA,eAAO,IAAI;AAAA,MACZ;AAAA,IAAA,CACA;AAAA,EACF;AAAA,EAEA,OAAe,iBACd,aACA,WACA,OACA,WACC;AACM,WAAA,YACL,OAAO,CAAM,OAAA;AACb,UAAI,cAAc,UAAU;AACpB,eAAA,CAAC,CAAC,GAAG;AAAA,MACb;AACM,YAAA,KAAK,GAAG,SAAS;AACvB,UAAI,CAAC,IAAI;AACD,eAAA;AAAA,MACR;AACA,UAAI,OAAO,MAAM;AAChB,eAAO,CAAC;AAAA,MACT;AACO,aAAA,GAAG,SAAS,KAAK;AAAA,IAAA,CACxB,EACA,IAAI,CAAM,OAAA,GAAG,QAAQ,IAAI;AAAA,EAC5B;AACD;AAEA,MAAM,iBAAiB,CAAC,WAAmB,GAAG,OAAO,OAAO,CAAC,EAAE,YAAa,CAAA,GAAG,OAAO,UAAU,CAAC,CAAC;;"}

package/dist/development/src/acl/definition/internal/EntityPredicateResolver.js

@@ -0,0 +1,151 @@
+import { isDeepStrictEqual } from "node:util";
+import { PredicateDefinitionProcessor } from "@contember/schema-utils";
+import { createPredicateName } from "./createPredicateName.js";
+import { PredicateEvaluationReference } from "../references.js";
+import { VariableDefinition } from "../variables.js";
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+class EntityPredicatesResolver {
+  constructor(aclDefinitions, predicates, predicateNamesMap, generatedNames) {
+    this.aclDefinitions = aclDefinitions;
+    this.predicates = predicates;
+    this.predicateNamesMap = predicateNamesMap;
+    this.generatedNames = generatedNames;
+    __publicField(this, "usedPredicates", []);
+  }
+  static create(rolePermissions, model, entity) {
+    const predicates = {};
+    const predicateNamesMap = /* @__PURE__ */ new Map();
+    const aclDefinitions = rolePermissions.get(entity.name)?.definitions ?? [];
+    const generatedNames = /* @__PURE__ */ new Set();
+    const definedNames = new Set(aclDefinitions.map((it) => it.name).filter((it) => it !== void 0));
+    for (const permission of aclDefinitions) {
+      if (!permission.when) {
+        continue;
+      }
+      const resolvedPredicate = EntityPredicatesResolver.resolvePredicate(model, entity, permission.when, rolePermissions);
+      let predicateName = permission.name ?? createPredicateName(resolvedPredicate);
+      while (predicateName in predicates || definedNames.has(predicateName)) {
+        predicateName += "_";
+      }
+      if (!permission.name) {
+        generatedNames.add(predicateName);
+      }
+      predicates[predicateName] = resolvedPredicate;
+      predicateNamesMap.set(permission.when, predicateName);
+    }
+    for (const op of ["read", "update", "create"]) {
+      for (const definition of aclDefinitions) {
+        const fields = definition[op];
+        if (!Array.isArray(fields)) {
+          continue;
+        }
+        for (const field of fields) {
+          if (!(field in entity.fields)) {
+            throw `Field "${String(field)}" does not exist on entity "${entity.name}" in ${op} ACL definition.`;
+          }
+        }
+      }
+    }
+    return new EntityPredicatesResolver(aclDefinitions, predicates, predicateNamesMap, generatedNames);
+  }
+  createFieldPredicate(op, field, isPrimary) {
+    const fieldWhens = EntityPredicatesResolver.getMatchingWhens(this.aclDefinitions, op, field, isPrimary);
+    if (fieldWhens.length === 0) {
+      return void 0;
+    }
+    if (fieldWhens.includes(true)) {
+      return true;
+    }
+    const predicateNames = fieldWhens.map((it) => {
+      const name = this.predicateNamesMap.get(it);
+      if (!name) throw new Error("implementation error");
+      return name;
+    });
+    if (predicateNames.length === 1) {
+      this.usedPredicates.push(predicateNames[0]);
+      return predicateNames[0];
+    }
+    const predicate = { or: predicateNames.map((it) => this.predicates[it]) };
+    const origName = predicateNames.every((it) => this.generatedNames.has(it)) ? createPredicateName(predicate) : predicateNames.join("_or_");
+    let predicateName = origName;
+    for (let i = 1; ; i++) {
+      if (!(predicateName in this.predicates)) {
+        this.predicates[predicateName] = predicate;
+        break;
+      } else if (isDeepStrictEqual(predicate, this.predicates[predicateName])) {
+        break;
+      } else {
+        predicateName = `${origName}_${i}`;
+      }
+    }
+    this.usedPredicates.push(predicateName);
+    return predicateName;
+  }
+  getUsedPredicates() {
+    return Object.fromEntries(Object.entries(this.predicates).filter(([name]) => this.usedPredicates.includes(name)));
+  }
+  static resolvePredicate(model, entity, when, rolePermissionsByEntity) {
+    const processor = new PredicateDefinitionProcessor(model);
+    return processor.process(entity, when, {
+      handleColumn(ctx) {
+        if (ctx.value instanceof VariableDefinition) {
+          return ctx.value.name;
+        }
+        if (ctx.value instanceof PredicateEvaluationReference) {
+          throw `Predicate references are allowed only on relations. 
+You cannot use "can${upperCaseFirst(ctx.value.operation)}(${ctx.value.field ? JSON.stringify(ctx.value.field) : ""})" on a column "${ctx.column.name}" of entity "${ctx.entity.name}".`;
+        }
+        return ctx.value;
+      },
+      handleRelation(ctx) {
+        if (ctx.value instanceof VariableDefinition) {
+          return { [ctx.targetEntity.primary]: ctx.value.name };
+        }
+        if (ctx.value instanceof PredicateEvaluationReference) {
+          const targetPermissions = rolePermissionsByEntity.get(ctx.targetEntity.name);
+          if (!targetPermissions) {
+            return { [ctx.targetEntity.primary]: { never: true } };
+          }
+          const ref = ctx.value;
+          const whens = EntityPredicatesResolver.getMatchingWhens(targetPermissions.definitions, ref.operation, ref.field ?? "", false);
+          if (whens.length === 0) {
+            return { [ctx.targetEntity.primary]: { never: true } };
+          }
+          if (whens.includes(true)) {
+            return { [ctx.targetEntity.primary]: { isNull: false } };
+          }
+          const predicates = whens.map(
+            (it) => EntityPredicatesResolver.resolvePredicate(model, ctx.targetEntity, it, rolePermissionsByEntity)
+          );
+          if (predicates.length > 1) {
+            return { or: predicates };
+          }
+          return predicates[0];
+        }
+        return ctx.value;
+      }
+    });
+  }
+  static getMatchingWhens(permissions, operation, field, isPrimary) {
+    return permissions.filter((it) => {
+      if (operation === "delete") {
+        return !!it.delete;
+      }
+      const op = it[operation];
+      if (!op) {
+        return false;
+      }
+      if (op === true) {
+        return !isPrimary;
+      }
+      return op.includes(field);
+    }).map((it) => it.when ?? true);
+  }
+}
+const upperCaseFirst = (string) => `${string.charAt(0).toUpperCase()}${string.substring(1)}`;
+export {
+  EntityPredicatesResolver
+};
+//# sourceMappingURL=EntityPredicateResolver.js.map

package/dist/development/src/acl/definition/internal/EntityPredicateResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EntityPredicateResolver.js","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/EntityPredicateResolver.ts"],"sourcesContent":["import { isDeepStrictEqual } from 'node:util'\n\nimport { Acl, Input, Model, Writable } from '@contember/schema'\nimport { PredicateDefinitionProcessor } from '@contember/schema-utils'\n\nimport { PermissionsByEntity } from './AclFactory'\nimport { createPredicateName } from './createPredicateName'\nimport { AllowDefinition, PredicateExtra, WhenDefinition } from '../permissions'\nimport { PredicateEvaluationReference } from '../references'\nimport { VariableDefinition } from '../variables'\n\nexport class EntityPredicatesResolver {\n\tprivate usedPredicates: string[] = []\n\n\tprivate constructor(\n\t\tprivate aclDefinitions: AllowDefinition<any>[],\n\t\tprivate predicates: Writable<Acl.PredicateMap>,\n\t\tprivate predicateNamesMap: Map<WhenDefinition, string>,\n\t\tprivate generatedNames: Set<string>,\n\t) {\n\t}\n\n\tpublic static create(\n\t\trolePermissions: PermissionsByEntity,\n\t\tmodel: Model.Schema,\n\t\tentity: Model.Entity,\n\t): EntityPredicatesResolver {\n\t\tconst predicates: Writable<Acl.PredicateMap> = {}\n\t\tconst predicateNamesMap = new Map<WhenDefinition, string>()\n\t\tconst aclDefinitions = rolePermissions.get(entity.name)?.definitions ?? []\n\t\tconst generatedNames = new Set<string>()\n\t\tconst definedNames = new Set<string>(aclDefinitions.map(it => it.name).filter((it): it is string => it !== undefined))\n\t\tfor (const permission of aclDefinitions) {\n\t\t\tif (!permission.when) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst resolvedPredicate = EntityPredicatesResolver.resolvePredicate(model, entity, permission.when, rolePermissions)\n\t\t\tlet predicateName = permission.name ?? createPredicateName(resolvedPredicate)\n\t\t\twhile (predicateName in predicates || definedNames.has(predicateName)) {\n\t\t\t\tpredicateName += '_'\n\t\t\t}\n\t\t\tif (!permission.name) {\n\t\t\t\tgeneratedNames.add(predicateName)\n\t\t\t}\n\t\t\tpredicates[predicateName] = resolvedPredicate\n\t\t\tpredicateNamesMap.set(permission.when, predicateName)\n\t\t}\n\t\tfor (const op of ['read', 'update', 'create'] as const) {\n\t\t\tfor (const definition of aclDefinitions) {\n\t\t\t\tconst fields = definition[op]\n\t\t\t\tif (!Array.isArray(fields)) {\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\t\t\t\tfor (const field of fields) {\n\t\t\t\t\tif (!(field in entity.fields)) {\n\t\t\t\t\t\tthrow `Field \"${String(field)}\" does not exist on entity \"${entity.name}\" in ${op} ACL definition.`\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\treturn new EntityPredicatesResolver(aclDefinitions, predicates, predicateNamesMap, generatedNames)\n\t}\n\n\tcreateFieldPredicate(op: 'create' | 'update' | 'read' | 'delete', field: string, isPrimary: boolean): true | undefined | string {\n\t\tconst fieldWhens = EntityPredicatesResolver.getMatchingWhens(this.aclDefinitions, op, field, isPrimary)\n\t\tif (fieldWhens.length === 0) {\n\t\t\treturn undefined\n\t\t}\n\t\tif (fieldWhens.includes(true)) {\n\t\t\treturn true\n\t\t}\n\t\tconst predicateNames = (fieldWhens as WhenDefinition[]).map(it => {\n\t\t\tconst name = this.predicateNamesMap.get(it)\n\t\t\tif (!name) throw new Error('implementation error')\n\t\t\treturn name\n\t\t})\n\t\tif (predicateNames.length === 1) {\n\t\t\tthis.usedPredicates.push(predicateNames[0])\n\t\t\treturn predicateNames[0]\n\t\t}\n\n\n\t\tconst predicate = { or: predicateNames.map(it => this.predicates[it]) }\n\t\tconst origName = predicateNames.every(it => this.generatedNames.has(it)) ? createPredicateName(predicate) : predicateNames.join('_or_')\n\t\tlet predicateName = origName\n\t\tfor (let i = 1;; i++) {\n\t\t\tif (!(predicateName in this.predicates)) {\n\t\t\t\tthis.predicates[predicateName] = predicate\n\t\t\t\tbreak\n\t\t\t} else if (isDeepStrictEqual(predicate, this.predicates[predicateName])) {\n\t\t\t\tbreak\n\t\t\t} else {\n\t\t\t\tpredicateName = `${origName}_${i}`\n\t\t\t}\n\t\t}\n\t\tthis.usedPredicates.push(predicateName)\n\t\treturn predicateName\n\t}\n\n\tgetUsedPredicates(): Acl.PredicateMap {\n\t\treturn Object.fromEntries(Object.entries(this.predicates).filter(([name]) => this.usedPredicates.includes(name)))\n\t}\n\n\n\tprivate static resolvePredicate(\n\t\tmodel: Model.Schema,\n\t\tentity: Model.Entity,\n\t\twhen: WhenDefinition,\n\t\trolePermissionsByEntity: PermissionsByEntity,\n\t): Acl.PredicateDefinition {\n\t\tconst processor = new PredicateDefinitionProcessor(model)\n\t\treturn processor.process<Acl.PredicateReference | Input.Condition, PredicateExtra>(entity, when, {\n\t\t\thandleColumn(ctx) {\n\t\t\t\tif (ctx.value instanceof VariableDefinition) {\n\t\t\t\t\treturn ctx.value.name\n\t\t\t\t}\n\t\t\t\tif (ctx.value instanceof PredicateEvaluationReference) {\n\t\t\t\t\tthrow `Predicate references are allowed only on relations. \\nYou cannot use \"can${upperCaseFirst(ctx.value.operation)}(${ctx.value.field ? JSON.stringify(ctx.value.field) : ''})\" on a column \"${ctx.column.name}\" of entity \"${ctx.entity.name}\".`\n\t\t\t\t}\n\t\t\t\treturn ctx.value\n\t\t\t},\n\t\t\thandleRelation(ctx) {\n\t\t\t\tif (ctx.value instanceof VariableDefinition) {\n\t\t\t\t\treturn { [ctx.targetEntity.primary]: ctx.value.name }\n\t\t\t\t}\n\t\t\t\tif (ctx.value instanceof PredicateEvaluationReference) {\n\t\t\t\t\tconst targetPermissions = rolePermissionsByEntity.get(ctx.targetEntity.name)\n\t\t\t\t\tif (!targetPermissions) {\n\t\t\t\t\t\treturn { [ctx.targetEntity.primary]: { never: true } }\n\t\t\t\t\t}\n\t\t\t\t\tconst ref = ctx.value\n\t\t\t\t\tconst whens = EntityPredicatesResolver.getMatchingWhens(targetPermissions.definitions, ref.operation, ref.field ?? '', false)\n\t\t\t\t\tif (whens.length === 0) {\n\t\t\t\t\t\treturn { [ctx.targetEntity.primary]: { never: true } }\n\t\t\t\t\t}\n\t\t\t\t\tif (whens.includes(true)) {\n\t\t\t\t\t\treturn { [ctx.targetEntity.primary]: { isNull: false } }\n\t\t\t\t\t}\n\t\t\t\t\tconst predicates = (whens as WhenDefinition[]).map(it =>\n\t\t\t\t\t\tEntityPredicatesResolver.resolvePredicate(model, ctx.targetEntity, it, rolePermissionsByEntity),\n\t\t\t\t\t)\n\t\t\t\t\tif (predicates.length > 1) {\n\t\t\t\t\t\treturn { or: predicates }\n\t\t\t\t\t}\n\t\t\t\t\treturn predicates[0]\n\t\t\t\t}\n\t\t\t\treturn ctx.value\n\t\t\t},\n\t\t})\n\t}\n\n\tprivate static getMatchingWhens(\n\t\tpermissions: AllowDefinition<any>[],\n\t\toperation: 'delete' | 'read' | 'update' | 'create',\n\t\tfield: string,\n\t\tisPrimary: boolean,\n\t) {\n\t\treturn permissions\n\t\t\t.filter(it => {\n\t\t\t\tif (operation === 'delete') {\n\t\t\t\t\treturn !!it.delete\n\t\t\t\t}\n\t\t\t\tconst op = it[operation]\n\t\t\t\tif (!op) {\n\t\t\t\t\treturn false\n\t\t\t\t}\n\t\t\t\tif (op === true) {\n\t\t\t\t\treturn !isPrimary\n\t\t\t\t}\n\t\t\t\treturn op.includes(field)\n\t\t\t})\n\t\t\t.map(it => it.when ?? true)\n\t}\n}\n\nconst upperCaseFirst = (string: string) => `${string.charAt(0).toUpperCase()}${string.substring(1)}`\n"],"names":[],"mappings":";;;;;;;;AAWO,MAAM,yBAAyB;AAAA,EAG7B,YACC,gBACA,YACA,mBACA,gBACP;AAJO,SAAA,iBAAA;AACA,SAAA,aAAA;AACA,SAAA,oBAAA;AACA,SAAA,iBAAA;AANT,kBAAA,MAAQ,kBAA2B,CAAA,CAAC;AAAA,EAQpC;AAAA,EAEA,OAAc,OACb,iBACA,OACA,QAC2B;AAC3B,UAAM,aAAyC,CAAA;AACzC,UAAA,wCAAwB;AAC9B,UAAM,iBAAiB,gBAAgB,IAAI,OAAO,IAAI,GAAG,eAAe;AAClE,UAAA,qCAAqB;AAC3B,UAAM,eAAe,IAAI,IAAY,eAAe,IAAI,CAAM,OAAA,GAAG,IAAI,EAAE,OAAO,CAAC,OAAqB,OAAO,MAAS,CAAC;AACrH,eAAW,cAAc,gBAAgB;AACpC,UAAA,CAAC,WAAW,MAAM;AACrB;AAAA,MACD;AACA,YAAM,oBAAoB,yBAAyB,iBAAiB,OAAO,QAAQ,WAAW,MAAM,eAAe;AACnH,UAAI,gBAAgB,WAAW,QAAQ,oBAAoB,iBAAiB;AAC5E,aAAO,iBAAiB,cAAc,aAAa,IAAI,aAAa,GAAG;AACrD,yBAAA;AAAA,MAClB;AACI,UAAA,CAAC,WAAW,MAAM;AACrB,uBAAe,IAAI,aAAa;AAAA,MACjC;AACA,iBAAW,aAAa,IAAI;AACV,wBAAA,IAAI,WAAW,MAAM,aAAa;AAAA,IACrD;AACA,eAAW,MAAM,CAAC,QAAQ,UAAU,QAAQ,GAAY;AACvD,iBAAW,cAAc,gBAAgB;AAClC,cAAA,SAAS,WAAW,EAAE;AAC5B,YAAI,CAAC,MAAM,QAAQ,MAAM,GAAG;AAC3B;AAAA,QACD;AACA,mBAAW,SAAS,QAAQ;AACvB,cAAA,EAAE,SAAS,OAAO,SAAS;AACxB,kBAAA,UAAU,OAAO,KAAK,CAAC,+BAA+B,OAAO,IAAI,QAAQ,EAAE;AAAA,UAClF;AAAA,QACD;AAAA,MACD;AAAA,IACD;AAEA,WAAO,IAAI,yBAAyB,gBAAgB,YAAY,mBAAmB,cAAc;AAAA,EAClG;AAAA,EAEA,qBAAqB,IAA6C,OAAe,WAA+C;AAC/H,UAAM,aAAa,yBAAyB,iBAAiB,KAAK,gBAAgB,IAAI,OAAO,SAAS;AAClG,QAAA,WAAW,WAAW,GAAG;AACrB,aAAA;AAAA,IACR;AACI,QAAA,WAAW,SAAS,IAAI,GAAG;AACvB,aAAA;AAAA,IACR;AACM,UAAA,iBAAkB,WAAgC,IAAI,CAAM,OAAA;AACjE,YAAM,OAAO,KAAK,kBAAkB,IAAI,EAAE;AAC1C,UAAI,CAAC,KAAY,OAAA,IAAI,MAAM,sBAAsB;AAC1C,aAAA;AAAA,IAAA,CACP;AACG,QAAA,eAAe,WAAW,GAAG;AAChC,WAAK,eAAe,KAAK,eAAe,CAAC,CAAC;AAC1C,aAAO,eAAe,CAAC;AAAA,IACxB;AAGM,UAAA,YAAY,EAAE,IAAI,eAAe,IAAI,QAAM,KAAK,WAAW,EAAE,CAAC,EAAE;AACtE,UAAM,WAAW,eAAe,MAAM,CAAA,OAAM,KAAK,eAAe,IAAI,EAAE,CAAC,IAAI,oBAAoB,SAAS,IAAI,eAAe,KAAK,MAAM;AACtI,QAAI,gBAAgB;AACX,aAAA,IAAI,KAAI,KAAK;AACjB,UAAA,EAAE,iBAAiB,KAAK,aAAa;AACnC,aAAA,WAAW,aAAa,IAAI;AACjC;AAAA,MAAA,WACU,kBAAkB,WAAW,KAAK,WAAW,aAAa,CAAC,GAAG;AACxE;AAAA,MAAA,OACM;AACU,wBAAA,GAAG,QAAQ,IAAI,CAAC;AAAA,MACjC;AAAA,IACD;AACK,SAAA,eAAe,KAAK,aAAa;AAC/B,WAAA;AAAA,EACR;AAAA,EAEA,oBAAsC;AACrC,WAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,MAAM,KAAK,eAAe,SAAS,IAAI,CAAC,CAAC;AAAA,EACjH;AAAA,EAGA,OAAe,iBACd,OACA,QACA,MACA,yBAC0B;AACpB,UAAA,YAAY,IAAI,6BAA6B,KAAK;AACjD,WAAA,UAAU,QAAkE,QAAQ,MAAM;AAAA,MAChG,aAAa,KAAK;AACb,YAAA,IAAI,iBAAiB,oBAAoB;AAC5C,iBAAO,IAAI,MAAM;AAAA,QAClB;AACI,YAAA,IAAI,iBAAiB,8BAA8B;AAChD,gBAAA;AAAA,qBAA4E,eAAe,IAAI,MAAM,SAAS,CAAC,IAAI,IAAI,MAAM,QAAQ,KAAK,UAAU,IAAI,MAAM,KAAK,IAAI,EAAE,mBAAmB,IAAI,OAAO,IAAI,gBAAgB,IAAI,OAAO,IAAI;AAAA,QACjP;AACA,eAAO,IAAI;AAAA,MACZ;AAAA,MACA,eAAe,KAAK;AACf,YAAA,IAAI,iBAAiB,oBAAoB;AACrC,iBAAA,EAAE,CAAC,IAAI,aAAa,OAAO,GAAG,IAAI,MAAM;QAChD;AACI,YAAA,IAAI,iBAAiB,8BAA8B;AACtD,gBAAM,oBAAoB,wBAAwB,IAAI,IAAI,aAAa,IAAI;AAC3E,cAAI,CAAC,mBAAmB;AAChB,mBAAA,EAAE,CAAC,IAAI,aAAa,OAAO,GAAG,EAAE,OAAO,KAAA;UAC/C;AACA,gBAAM,MAAM,IAAI;AACV,gBAAA,QAAQ,yBAAyB,iBAAiB,kBAAkB,aAAa,IAAI,WAAW,IAAI,SAAS,IAAI,KAAK;AACxH,cAAA,MAAM,WAAW,GAAG;AAChB,mBAAA,EAAE,CAAC,IAAI,aAAa,OAAO,GAAG,EAAE,OAAO,KAAA;UAC/C;AACI,cAAA,MAAM,SAAS,IAAI,GAAG;AAClB,mBAAA,EAAE,CAAC,IAAI,aAAa,OAAO,GAAG,EAAE,QAAQ,MAAA;UAChD;AACA,gBAAM,aAAc,MAA2B;AAAA,YAAI,QAClD,yBAAyB,iBAAiB,OAAO,IAAI,cAAc,IAAI,uBAAuB;AAAA,UAAA;AAE3F,cAAA,WAAW,SAAS,GAAG;AACnB,mBAAA,EAAE,IAAI;UACd;AACA,iBAAO,WAAW,CAAC;AAAA,QACpB;AACA,eAAO,IAAI;AAAA,MACZ;AAAA,IAAA,CACA;AAAA,EACF;AAAA,EAEA,OAAe,iBACd,aACA,WACA,OACA,WACC;AACM,WAAA,YACL,OAAO,CAAM,OAAA;AACb,UAAI,cAAc,UAAU;AACpB,eAAA,CAAC,CAAC,GAAG;AAAA,MACb;AACM,YAAA,KAAK,GAAG,SAAS;AACvB,UAAI,CAAC,IAAI;AACD,eAAA;AAAA,MACR;AACA,UAAI,OAAO,MAAM;AAChB,eAAO,CAAC;AAAA,MACT;AACO,aAAA,GAAG,SAAS,KAAK;AAAA,IAAA,CACxB,EACA,IAAI,CAAM,OAAA,GAAG,QAAQ,IAAI;AAAA,EAC5B;AACD;AAEA,MAAM,iBAAiB,CAAC,WAAmB,GAAG,OAAO,OAAO,CAAC,EAAE,YAAa,CAAA,GAAG,OAAO,UAAU,CAAC,CAAC;"}

package/dist/development/src/acl/definition/internal/createPredicateName.cjs

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const createPredicateName = (when) => {
+  const json = JSON.stringify(when);
+  return json.replace(/[^A-Za-z0-9]+/g, "_").slice(0, 30).replace(/^_|_$/g, "");
+};
+exports.createPredicateName = createPredicateName;
+//# sourceMappingURL=createPredicateName.cjs.map

package/dist/development/src/acl/definition/internal/createPredicateName.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"createPredicateName.cjs","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/createPredicateName.ts"],"sourcesContent":["import { WhenDefinition } from '../permissions'\n\nexport const createPredicateName = (when: WhenDefinition) => {\n\tconst json = JSON.stringify(when)\n\treturn json.replace(/[^A-Za-z0-9]+/g, '_').slice(0, 30).replace(/^_|_$/g, '')\n}\n"],"names":[],"mappings":";;AAEa,MAAA,sBAAsB,CAAC,SAAyB;AACtD,QAAA,OAAO,KAAK,UAAU,IAAI;AACzB,SAAA,KAAK,QAAQ,kBAAkB,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE,QAAQ,UAAU,EAAE;AAC7E;;"}

package/dist/development/src/acl/definition/internal/createPredicateName.js

@@ -0,0 +1,8 @@
+const createPredicateName = (when) => {
+  const json = JSON.stringify(when);
+  return json.replace(/[^A-Za-z0-9]+/g, "_").slice(0, 30).replace(/^_|_$/g, "");
+};
+export {
+  createPredicateName
+};
+//# sourceMappingURL=createPredicateName.js.map

package/dist/development/src/acl/definition/internal/createPredicateName.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createPredicateName.js","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/createPredicateName.ts"],"sourcesContent":["import { WhenDefinition } from '../permissions'\n\nexport const createPredicateName = (when: WhenDefinition) => {\n\tconst json = JSON.stringify(when)\n\treturn json.replace(/[^A-Za-z0-9]+/g, '_').slice(0, 30).replace(/^_|_$/g, '')\n}\n"],"names":[],"mappings":"AAEa,MAAA,sBAAsB,CAAC,SAAyB;AACtD,QAAA,OAAO,KAAK,UAAU,IAAI;AACzB,SAAA,KAAK,QAAQ,kBAAkB,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE,QAAQ,UAAU,EAAE;AAC7E;"}

package/dist/development/src/acl/definition/internal/stores.cjs

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const MetadataStore = require("../../../utils/MetadataStore.cjs");
+const allowCustomPrimaryStore = MetadataStore.createMetadataStore([]);
+const allowCustomPrimaryAllRolesStore = MetadataStore.createMetadataStore(false);
+const allowDefinitionsStore = MetadataStore.createMetadataStore([]);
+exports.allowCustomPrimaryAllRolesStore = allowCustomPrimaryAllRolesStore;
+exports.allowCustomPrimaryStore = allowCustomPrimaryStore;
+exports.allowDefinitionsStore = allowDefinitionsStore;
+//# sourceMappingURL=stores.cjs.map

package/dist/development/src/acl/definition/internal/stores.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"stores.cjs","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/stores.ts"],"sourcesContent":["import { createMetadataStore } from '../../../utils/MetadataStore'\nimport { Role } from '../roles'\nimport { AllowDefinition } from '../permissions'\n\nexport const allowCustomPrimaryStore = createMetadataStore<Role[]>([])\nexport const allowCustomPrimaryAllRolesStore = createMetadataStore<boolean>(false)\n\nexport type EntityPermissionsDefinition =\n\t& AllowDefinition<any>\n\t& {\n\t\trole: Role<string>\n\t}\nexport const allowDefinitionsStore = createMetadataStore<EntityPermissionsDefinition[]>([])\n"],"names":["createMetadataStore"],"mappings":";;;AAIa,MAAA,0BAA0BA,cAA4B,oBAAA,EAAE;AACxD,MAAA,kCAAkCA,kCAA6B,KAAK;AAOpE,MAAA,wBAAwBA,cAAmD,oBAAA,CAAE,CAAA;;;;"}