npm - @contember/schema-definition - Versions diffs - 2.0.0-beta.3 → 2.0.0-beta.5 - Mend

@contember/schema-definition 2.0.0-beta.3 → 2.0.0-beta.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (32) hide show

package/dist/development/src/acl/builder/PermissionOverrider.cjs CHANGED Viewed

@@ -22,7 +22,13 @@ class PermissionOverrider {
         },
         ...original.operations.customPrimary === void 0 && overrides.operations.customPrimary === void 0 ? {} : {
           customPrimary: overrides.operations.customPrimary ?? original.operations.customPrimary
-        }
+        },
+        ...original.operations.noRoot || overrides.operations.noRoot ? {
+          noRoot: [
+            ...original.operations.noRoot || [],
+            ...overrides.operations.noRoot || []
+          ]
+        } : {}
       }
     };
   }

package/dist/development/src/acl/builder/PermissionOverrider.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"PermissionOverrider.cjs","sources":["../../../../../../packages/schema-definition/src/acl/builder/PermissionOverrider.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\nimport { tuple } from '../../utils'\n\nexport default class PermissionOverrider {\n\tpublic override(original: Acl.Permissions, overrides: Acl.Permissions): Acl.Permissions {\n\t\treturn Object.entries({ ...overrides, ...original })\n\t\t\t.map(([key, value]) => {\n\t\t\t\tif (overrides[key]) {\n\t\t\t\t\treturn tuple(key, this.overrideEntityPermissions(value, overrides[key]))\n\t\t\t\t}\n\t\t\t\treturn tuple(key, value)\n\t\t\t})\n\t\t\t.reduce((acc, [key, value]) => ({ ...acc, [key]: value }), {})\n\t}\n\n\tprivate overrideEntityPermissions(\n\t\toriginal: Acl.EntityPermissions,\n\t\toverrides: Acl.EntityPermissions,\n\t): Acl.EntityPermissions {\n\t\treturn {\n\t\t\tpredicates: { ...original.predicates, ...overrides.predicates },\n\t\t\toperations: {\n\t\t\t\tcreate: { ...(original.operations.create \|\| {}), ...(overrides.operations.create \|\| {}) },\n\t\t\t\tread: { ...(original.operations.read \|\| {}), ...(overrides.operations.read \|\| {}) },\n\t\t\t\tupdate: { ...(original.operations.update \|\| {}), ...(overrides.operations.update \|\| {}) },\n\t\t\t\t...(original.operations.delete === undefined && overrides.operations.delete === undefined\n\t\t\t\t\t? {}\n\t\t\t\t\t: {\n\t\t\t\t\t\tdelete: overrides.operations.delete ?? original.operations.delete,\n\t\t\t\t\t }),\n\t\t\t\t...(original.operations.customPrimary === undefined && overrides.operations.customPrimary === undefined\n\t\t\t\t\t? {}\n\t\t\t\t\t: {\n\t\t\t\t\t\tcustomPrimary: overrides.operations.customPrimary ?? original.operations.customPrimary,\n\t\t\t\t\t }),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["tuple"],"mappings":";;;AAGA,MAAqB,oBAAoB;AAAA,EACjC,SAAS,UAA2B,WAA6C;AACvF,WAAO,OAAO,QAAQ,EAAE,GAAG,WAAW,GAAG,UAAU,EACjD,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;AAClB,UAAA,UAAU,GAAG,GAAG;AACZ,eAAAA,MAAA,MAAM,KAAK,KAAK,0BAA0B,OAAO,UAAU,GAAG,CAAC,CAAC;AAAA,MAAA;AAEjE,aAAAA,MAAA,MAAM,KAAK,KAAK;AAAA,IACvB,CAAA,EACA,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,GAAG,MAAM,IAAI,CAAA,CAAE;AAAA,EAAA;AAAA,EAGvD,0BACP,UACA,WACwB;AACjB,WAAA;AAAA,MACN,YAAY,EAAE,GAAG,SAAS,YAAY,GAAG,UAAU,WAAW;AAAA,MAC9D,YAAY;AAAA,QACX,QAAQ,EAAE,GAAI,SAAS,WAAW,UAAU,IAAK,GAAI,UAAU,WAAW,UAAU,GAAI;AAAA,QACxF,MAAM,EAAE,GAAI,SAAS,WAAW,QAAQ,IAAK,GAAI,UAAU,WAAW,QAAQ,GAAI;AAAA,QAClF,QAAQ,EAAE,GAAI,SAAS,WAAW,UAAU,IAAK,GAAI,UAAU,WAAW,UAAU,GAAI;AAAA,QACxF,GAAI,SAAS,WAAW,WAAW,UAAa,UAAU,WAAW,WAAW,SAC7E,KACA;AAAA,UACD,QAAQ,UAAU,WAAW,UAAU,SAAS,WAAW;AAAA,QAC1D;AAAA,QACH,GAAI,SAAS,WAAW,kBAAkB,UAAa,UAAU,WAAW,kBAAkB,SAC3F,KACA;AAAA,UACD,eAAe,UAAU,WAAW,iBAAiB,SAAS,WAAW;AAAA,~~QAAA~~;AAAA,~~MACxE~~;AAAA,~~IAEL~~;AAAA,EAAA;AAEF;;"}
1	+ {"version":3,"file":"PermissionOverrider.cjs","sources":["../../../../../../packages/schema-definition/src/acl/builder/PermissionOverrider.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\nimport { tuple } from '../../utils'\n\nexport default class PermissionOverrider {\n\tpublic override(original: Acl.Permissions, overrides: Acl.Permissions): Acl.Permissions {\n\t\treturn Object.entries({ ...overrides, ...original })\n\t\t\t.map(([key, value]) => {\n\t\t\t\tif (overrides[key]) {\n\t\t\t\t\treturn tuple(key, this.overrideEntityPermissions(value, overrides[key]))\n\t\t\t\t}\n\t\t\t\treturn tuple(key, value)\n\t\t\t})\n\t\t\t.reduce((acc, [key, value]) => ({ ...acc, [key]: value }), {})\n\t}\n\n\tprivate overrideEntityPermissions(\n\t\toriginal: Acl.EntityPermissions,\n\t\toverrides: Acl.EntityPermissions,\n\t): Acl.EntityPermissions {\n\t\treturn {\n\t\t\tpredicates: { ...original.predicates, ...overrides.predicates },\n\t\t\toperations: {\n\t\t\t\tcreate: { ...(original.operations.create \|\| {}), ...(overrides.operations.create \|\| {}) },\n\t\t\t\tread: { ...(original.operations.read \|\| {}), ...(overrides.operations.read \|\| {}) },\n\t\t\t\tupdate: { ...(original.operations.update \|\| {}), ...(overrides.operations.update \|\| {}) },\n\t\t\t\t...(original.operations.delete === undefined && overrides.operations.delete === undefined\n\t\t\t\t\t? {}\n\t\t\t\t\t: {\n\t\t\t\t\t\tdelete: overrides.operations.delete ?? original.operations.delete,\n\t\t\t\t\t }),\n\t\t\t\t...(original.operations.customPrimary === undefined && overrides.operations.customPrimary === undefined\n\t\t\t\t\t? {}\n\t\t\t\t\t: {\n\t\t\t\t\t\tcustomPrimary: overrides.operations.customPrimary ?? original.operations.customPrimary,\n\t\t\t\t\t }),\n\t\t\t\t...(original.operations.noRoot \|\| overrides.operations.noRoot ? {\n\t\t\t\t\tnoRoot: [\n\t\t\t\t\t\t...(original.operations.noRoot \|\| []),\n\t\t\t\t\t\t...(overrides.operations.noRoot \|\| []),\n\t\t\t\t\t],\n\t\t\t\t} : {}),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["tuple"],"mappings":";;;AAGA,MAAqB,oBAAoB;AAAA,EACjC,SAAS,UAA2B,WAA6C;AACvF,WAAO,OAAO,QAAQ,EAAE,GAAG,WAAW,GAAG,UAAU,EACjD,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;AAClB,UAAA,UAAU,GAAG,GAAG;AACZ,eAAAA,MAAA,MAAM,KAAK,KAAK,0BAA0B,OAAO,UAAU,GAAG,CAAC,CAAC;AAAA,MAAA;AAEjE,aAAAA,MAAA,MAAM,KAAK,KAAK;AAAA,IACvB,CAAA,EACA,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,GAAG,MAAM,IAAI,CAAA,CAAE;AAAA,EAAA;AAAA,EAGvD,0BACP,UACA,WACwB;AACjB,WAAA;AAAA,MACN,YAAY,EAAE,GAAG,SAAS,YAAY,GAAG,UAAU,WAAW;AAAA,MAC9D,YAAY;AAAA,QACX,QAAQ,EAAE,GAAI,SAAS,WAAW,UAAU,IAAK,GAAI,UAAU,WAAW,UAAU,GAAI;AAAA,QACxF,MAAM,EAAE,GAAI,SAAS,WAAW,QAAQ,IAAK,GAAI,UAAU,WAAW,QAAQ,GAAI;AAAA,QAClF,QAAQ,EAAE,GAAI,SAAS,WAAW,UAAU,IAAK,GAAI,UAAU,WAAW,UAAU,GAAI;AAAA,QACxF,GAAI,SAAS,WAAW,WAAW,UAAa,UAAU,WAAW,WAAW,SAC7E,KACA;AAAA,UACD,QAAQ,UAAU,WAAW,UAAU,SAAS,WAAW;AAAA,QAC1D;AAAA,QACH,GAAI,SAAS,WAAW,kBAAkB,UAAa,UAAU,WAAW,kBAAkB,SAC3F,KACA;AAAA,UACD,eAAe,UAAU,WAAW,iBAAiB,SAAS,WAAW;AAAA,QACxE;AAAA,QACH,GAAI,SAAS,WAAW,UAAU,UAAU,WAAW,SAAS;AAAA,UAC/D,QAAQ;AAAA,YACP,GAAI,SAAS,WAAW,UAAU,CAAC;AAAA,YACnC,GAAI,UAAU,WAAW,UAAU,CAAA;AAAA,UAAC;AAAA,QACrC,IACG,CAAA;AAAA,MAAC;AAAA,IAEP;AAAA,EAAA;AAEF;;"}

package/dist/development/src/acl/builder/PermissionOverrider.js CHANGED Viewed

@@ -21,7 +21,13 @@ class PermissionOverrider {
         },
         ...original.operations.customPrimary === void 0 && overrides.operations.customPrimary === void 0 ? {} : {
           customPrimary: overrides.operations.customPrimary ?? original.operations.customPrimary
-        }
+        },
+        ...original.operations.noRoot || overrides.operations.noRoot ? {
+          noRoot: [
+            ...original.operations.noRoot || [],
+            ...overrides.operations.noRoot || []
+          ]
+        } : {}
       }
     };
   }

package/dist/development/src/acl/builder/PermissionOverrider.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"PermissionOverrider.js","sources":["../../../../../../packages/schema-definition/src/acl/builder/PermissionOverrider.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\nimport { tuple } from '../../utils'\n\nexport default class PermissionOverrider {\n\tpublic override(original: Acl.Permissions, overrides: Acl.Permissions): Acl.Permissions {\n\t\treturn Object.entries({ ...overrides, ...original })\n\t\t\t.map(([key, value]) => {\n\t\t\t\tif (overrides[key]) {\n\t\t\t\t\treturn tuple(key, this.overrideEntityPermissions(value, overrides[key]))\n\t\t\t\t}\n\t\t\t\treturn tuple(key, value)\n\t\t\t})\n\t\t\t.reduce((acc, [key, value]) => ({ ...acc, [key]: value }), {})\n\t}\n\n\tprivate overrideEntityPermissions(\n\t\toriginal: Acl.EntityPermissions,\n\t\toverrides: Acl.EntityPermissions,\n\t): Acl.EntityPermissions {\n\t\treturn {\n\t\t\tpredicates: { ...original.predicates, ...overrides.predicates },\n\t\t\toperations: {\n\t\t\t\tcreate: { ...(original.operations.create \|\| {}), ...(overrides.operations.create \|\| {}) },\n\t\t\t\tread: { ...(original.operations.read \|\| {}), ...(overrides.operations.read \|\| {}) },\n\t\t\t\tupdate: { ...(original.operations.update \|\| {}), ...(overrides.operations.update \|\| {}) },\n\t\t\t\t...(original.operations.delete === undefined && overrides.operations.delete === undefined\n\t\t\t\t\t? {}\n\t\t\t\t\t: {\n\t\t\t\t\t\tdelete: overrides.operations.delete ?? original.operations.delete,\n\t\t\t\t\t }),\n\t\t\t\t...(original.operations.customPrimary === undefined && overrides.operations.customPrimary === undefined\n\t\t\t\t\t? {}\n\t\t\t\t\t: {\n\t\t\t\t\t\tcustomPrimary: overrides.operations.customPrimary ?? original.operations.customPrimary,\n\t\t\t\t\t }),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;AAGA,MAAqB,oBAAoB;AAAA,EACjC,SAAS,UAA2B,WAA6C;AACvF,WAAO,OAAO,QAAQ,EAAE,GAAG,WAAW,GAAG,UAAU,EACjD,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;AAClB,UAAA,UAAU,GAAG,GAAG;AACZ,eAAA,MAAM,KAAK,KAAK,0BAA0B,OAAO,UAAU,GAAG,CAAC,CAAC;AAAA,MAAA;AAEjE,aAAA,MAAM,KAAK,KAAK;AAAA,IACvB,CAAA,EACA,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,GAAG,MAAM,IAAI,CAAA,CAAE;AAAA,EAAA;AAAA,EAGvD,0BACP,UACA,WACwB;AACjB,WAAA;AAAA,MACN,YAAY,EAAE,GAAG,SAAS,YAAY,GAAG,UAAU,WAAW;AAAA,MAC9D,YAAY;AAAA,QACX,QAAQ,EAAE,GAAI,SAAS,WAAW,UAAU,IAAK,GAAI,UAAU,WAAW,UAAU,GAAI;AAAA,QACxF,MAAM,EAAE,GAAI,SAAS,WAAW,QAAQ,IAAK,GAAI,UAAU,WAAW,QAAQ,GAAI;AAAA,QAClF,QAAQ,EAAE,GAAI,SAAS,WAAW,UAAU,IAAK,GAAI,UAAU,WAAW,UAAU,GAAI;AAAA,QACxF,GAAI,SAAS,WAAW,WAAW,UAAa,UAAU,WAAW,WAAW,SAC7E,KACA;AAAA,UACD,QAAQ,UAAU,WAAW,UAAU,SAAS,WAAW;AAAA,QAC1D;AAAA,QACH,GAAI,SAAS,WAAW,kBAAkB,UAAa,UAAU,WAAW,kBAAkB,SAC3F,KACA;AAAA,UACD,eAAe,UAAU,WAAW,iBAAiB,SAAS,WAAW;AAAA,~~QAAA~~;AAAA,~~MACxE~~;AAAA,~~IAEL~~;AAAA,EAAA;AAEF;"}
1	+ {"version":3,"file":"PermissionOverrider.js","sources":["../../../../../../packages/schema-definition/src/acl/builder/PermissionOverrider.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\nimport { tuple } from '../../utils'\n\nexport default class PermissionOverrider {\n\tpublic override(original: Acl.Permissions, overrides: Acl.Permissions): Acl.Permissions {\n\t\treturn Object.entries({ ...overrides, ...original })\n\t\t\t.map(([key, value]) => {\n\t\t\t\tif (overrides[key]) {\n\t\t\t\t\treturn tuple(key, this.overrideEntityPermissions(value, overrides[key]))\n\t\t\t\t}\n\t\t\t\treturn tuple(key, value)\n\t\t\t})\n\t\t\t.reduce((acc, [key, value]) => ({ ...acc, [key]: value }), {})\n\t}\n\n\tprivate overrideEntityPermissions(\n\t\toriginal: Acl.EntityPermissions,\n\t\toverrides: Acl.EntityPermissions,\n\t): Acl.EntityPermissions {\n\t\treturn {\n\t\t\tpredicates: { ...original.predicates, ...overrides.predicates },\n\t\t\toperations: {\n\t\t\t\tcreate: { ...(original.operations.create \|\| {}), ...(overrides.operations.create \|\| {}) },\n\t\t\t\tread: { ...(original.operations.read \|\| {}), ...(overrides.operations.read \|\| {}) },\n\t\t\t\tupdate: { ...(original.operations.update \|\| {}), ...(overrides.operations.update \|\| {}) },\n\t\t\t\t...(original.operations.delete === undefined && overrides.operations.delete === undefined\n\t\t\t\t\t? {}\n\t\t\t\t\t: {\n\t\t\t\t\t\tdelete: overrides.operations.delete ?? original.operations.delete,\n\t\t\t\t\t }),\n\t\t\t\t...(original.operations.customPrimary === undefined && overrides.operations.customPrimary === undefined\n\t\t\t\t\t? {}\n\t\t\t\t\t: {\n\t\t\t\t\t\tcustomPrimary: overrides.operations.customPrimary ?? original.operations.customPrimary,\n\t\t\t\t\t }),\n\t\t\t\t...(original.operations.noRoot \|\| overrides.operations.noRoot ? {\n\t\t\t\t\tnoRoot: [\n\t\t\t\t\t\t...(original.operations.noRoot \|\| []),\n\t\t\t\t\t\t...(overrides.operations.noRoot \|\| []),\n\t\t\t\t\t],\n\t\t\t\t} : {}),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;AAGA,MAAqB,oBAAoB;AAAA,EACjC,SAAS,UAA2B,WAA6C;AACvF,WAAO,OAAO,QAAQ,EAAE,GAAG,WAAW,GAAG,UAAU,EACjD,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;AAClB,UAAA,UAAU,GAAG,GAAG;AACZ,eAAA,MAAM,KAAK,KAAK,0BAA0B,OAAO,UAAU,GAAG,CAAC,CAAC;AAAA,MAAA;AAEjE,aAAA,MAAM,KAAK,KAAK;AAAA,IACvB,CAAA,EACA,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,GAAG,MAAM,IAAI,CAAA,CAAE;AAAA,EAAA;AAAA,EAGvD,0BACP,UACA,WACwB;AACjB,WAAA;AAAA,MACN,YAAY,EAAE,GAAG,SAAS,YAAY,GAAG,UAAU,WAAW;AAAA,MAC9D,YAAY;AAAA,QACX,QAAQ,EAAE,GAAI,SAAS,WAAW,UAAU,IAAK,GAAI,UAAU,WAAW,UAAU,GAAI;AAAA,QACxF,MAAM,EAAE,GAAI,SAAS,WAAW,QAAQ,IAAK,GAAI,UAAU,WAAW,QAAQ,GAAI;AAAA,QAClF,QAAQ,EAAE,GAAI,SAAS,WAAW,UAAU,IAAK,GAAI,UAAU,WAAW,UAAU,GAAI;AAAA,QACxF,GAAI,SAAS,WAAW,WAAW,UAAa,UAAU,WAAW,WAAW,SAC7E,KACA;AAAA,UACD,QAAQ,UAAU,WAAW,UAAU,SAAS,WAAW;AAAA,QAC1D;AAAA,QACH,GAAI,SAAS,WAAW,kBAAkB,UAAa,UAAU,WAAW,kBAAkB,SAC3F,KACA;AAAA,UACD,eAAe,UAAU,WAAW,iBAAiB,SAAS,WAAW;AAAA,QACxE;AAAA,QACH,GAAI,SAAS,WAAW,UAAU,UAAU,WAAW,SAAS;AAAA,UAC/D,QAAQ;AAAA,YACP,GAAI,SAAS,WAAW,UAAU,CAAC;AAAA,YACnC,GAAI,UAAU,WAAW,UAAU,CAAA;AAAA,UAAC;AAAA,QACrC,IACG,CAAA;AAAA,MAAC;AAAA,IAEP;AAAA,EAAA;AAEF;"}

package/dist/development/src/acl/definition/internal/AclFactory.cjs CHANGED Viewed

@@ -39,6 +39,10 @@ class AclFactory {
       const entity = schemaUtils.getEntity(this.model, entityName);
       const predicatesResolver = EntityPredicateResolver.EntityPredicatesResolver.create(rolePermissions, this.model, entity);
       const entityOperations = {};
+      const noRootOptions = this.getNoRootOptions(entity, rolePermissions.get(entityName));
+      if (noRootOptions?.length) {
+        entityOperations.noRoot = noRootOptions;
+      }
       for (const op of ["create", "update", "read"]) {
         const fieldPermissions = {};
         for (const field of Object.keys(entity.fields)) {
@@ -64,6 +68,24 @@ class AclFactory {
       }];
     }));
   }
+  getNoRootOptions(entity, permissions) {
+    const allowedRoot = /* @__PURE__ */ new Set();
+    const disallowedRoot = /* @__PURE__ */ new Set();
+    for (const def of permissions?.definitions ?? []) {
+      const noRoot = def.through === true;
+      for (const op of ["create", "read", "update", "delete"]) {
+        if (def[op]) {
+          const currentSet = noRoot ? disallowedRoot : allowedRoot;
+          currentSet.add(op);
+          const otherSet = noRoot ? allowedRoot : disallowedRoot;
+          if (otherSet.has(op)) {
+            throw new Error(`Operation ${op} cannot be both allowed and disallowed on root on entity ${entity.name}`);
+          }
+        }
+      }
+    }
+    return [...disallowedRoot.values()];
+  }
   createVariables(role, variables2) {
     const roleVariables = variables2.filter((it) => it.roles.includes(role));
     return Object.fromEntries(roleVariables.map((variable) => {

package/dist/development/src/acl/definition/internal/AclFactory.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"AclFactory.cjs","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/AclFactory.ts"],"sourcesContent":["import { Acl, Model, Writable } from '@contember/schema'\nimport { getEntity } from '@contember/schema-utils'\n\nimport { EntityPredicatesResolver } from './EntityPredicateResolver'\nimport { AllowDefinition } from '../permissions'\nimport {\n\tallowCustomPrimaryAllRolesStore,\n\tallowCustomPrimaryStore,\n\tallowDefinitionsStore,\n\tEntityPermissionsDefinition,\n} from './stores'\nimport { Role } from '../roles'\nimport { VariableDefinition } from '../variables'\nimport { filterEntityDefinition } from '../../../utils'\n\nexport class AclFactory {\n\tconstructor(\n\t\tprivate model: Model.Schema,\n\t) {\n\t}\n\n\tpublic create(\n\t\texportedDefinitions: Record<string, any>,\n\t): Acl.Schema {\n\t\tconst entityLikeDefinition = filterEntityDefinition(exportedDefinitions)\n\t\tconst roles: Role[] = Object.values(exportedDefinitions).filter(it => it instanceof Role)\n\t\tconst variables: VariableDefinition[] = Object.values(exportedDefinitions).filter(it => it instanceof VariableDefinition)\n\n\t\tconst groupedPermissions = AclFactory.groupPermissions(entityLikeDefinition, roles)\n\n\t\treturn {\n\t\t\troles: Object.fromEntries(roles.map((role): [string, Acl.RolePermissions] => {\n\t\t\t\tconst rolePermissions = groupedPermissions.get(role)\n\t\t\t\treturn [\n\t\t\t\t\trole.name,\n\t\t\t\t\t{\n\t\t\t\t\t\t...role.options,\n\t\t\t\t\t\tstages: role.options.stages ?? '*',\n\t\t\t\t\t\tentities: this.createPermissions(rolePermissions),\n\t\t\t\t\t\tvariables: this.createVariables(role, variables),\n\t\t\t\t\t},\n\t\t\t\t]\n\t\t\t})),\n\t\t}\n\t}\n\n\tprivate createPermissions(rolePermissions: PermissionsByEntity \| undefined): Acl.Permissions {\n\t\tif (!rolePermissions) {\n\t\t\treturn {}\n\t\t}\n\t\treturn Object.fromEntries(Array.from(rolePermissions.keys()).map((entityName): [string, Acl.EntityPermissions] => {\n\t\t\tconst entity = getEntity(this.model, entityName)\n\n\t\t\tconst predicatesResolver = EntityPredicatesResolver.create(rolePermissions, this.model, entity)\n\n\t\t\tconst entityOperations: Writable<Acl.EntityOperations> = {}\n\t\t\tfor (const op of ['create', 'update', 'read'] as const) {\n\t\t\t\tconst fieldPermissions: Writable<Acl.FieldPermissions> = {}\n\t\t\t\tfor (const field of Object.keys(entity.fields)) {\n\t\t\t\t\tconst predicate = predicatesResolver.createFieldPredicate(op, field, field === entity.primary)\n\t\t\t\t\tif (predicate !== undefined) {\n\t\t\t\t\t\tfieldPermissions[field] = predicate\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tif (Object.keys(fieldPermissions).length > 0) {\n\t\t\t\t\tentityOperations[op] = fieldPermissions\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst delPredicate = predicatesResolver.createFieldPredicate('delete', '', false)\n\t\t\tif (delPredicate !== undefined) {\n\t\t\t\tentityOperations.delete = delPredicate\n\t\t\t}\n\t\t\tif (rolePermissions.get(entityName)?.allowCustomPrimary) {\n\t\t\t\tentityOperations.customPrimary = true\n\t\t\t}\n\t\t\treturn [entityName, {\n\t\t\t\tpredicates: predicatesResolver.getUsedPredicates(),\n\t\t\t\toperations: entityOperations,\n\t\t\t}]\n\t\t}))\n\t}\n\n\tprivate createVariables(role: Role, variables: VariableDefinition[]): Acl.Variables {\n\t\tconst roleVariables = variables.filter(it => it.roles.includes(role))\n\t\treturn Object.fromEntries(roleVariables.map((variable): [string, Acl.Variable] => {\n\t\t\treturn [variable.name, variable.variable]\n\t\t}))\n\t}\n\n\tprivate static groupPermissions(entityLikeDefinition: [string, { new(): any }][], roles: Role[]): PermissionsByRoleAndEntity {\n\t\tconst groupedPermissions: PermissionsByRoleAndEntity = new Map()\n\t\tfor (const [name, entity] of entityLikeDefinition) {\n\t\t\tconst initEntityPermissions = (role: Role): EntityPermissions => {\n\t\t\t\tconst rolePermissions: PermissionsByEntity = groupedPermissions.get(role) ?? new Map()\n\t\t\t\tgroupedPermissions.set(role, rolePermissions)\n\t\t\t\tconst entityPermissions = rolePermissions.get(name) ?? {\n\t\t\t\t\tallowCustomPrimary: false,\n\t\t\t\t\tdefinitions: [],\n\t\t\t\t}\n\t\t\t\trolePermissions.set(name, entityPermissions)\n\t\t\t\treturn entityPermissions\n\t\t\t}\n\t\t\tconst metadata: EntityPermissionsDefinition[] = allowDefinitionsStore.get(entity)\n\t\t\tfor (const { role, ...definition } of metadata) {\n\t\t\t\tif (!roles.includes(role)) {\n\t\t\t\t\tthrow `Role ${role.name} used on entity ${name} is not registered. Have you exported it?`\n\t\t\t\t}\n\t\t\t\tconst entityPermissions = initEntityPermissions(role)\n\t\t\t\tentityPermissions.definitions.push(definition)\n\t\t\t}\n\n\t\t\tconst rolesWithCustomPrimary = allowCustomPrimaryAllRolesStore.get(entity) ? roles : allowCustomPrimaryStore.get(entity)\n\t\t\tfor (const role of rolesWithCustomPrimary) {\n\t\t\t\tinitEntityPermissions(role).allowCustomPrimary = true\n\t\t\t}\n\t\t}\n\n\t\treturn groupedPermissions\n\t}\n}\n\n\nexport type EntityPermissions = { definitions: AllowDefinition<any>[]; allowCustomPrimary: boolean }\nexport type PermissionsByEntity = Map<string, EntityPermissions>\nexport type PermissionsByRoleAndEntity = Map<Role, PermissionsByEntity>\n"],"names":["filterEntityDefinition","roles","Role","variables","VariableDefinition","getEntity","EntityPredicatesResolver","allowDefinitionsStore","allowCustomPrimaryAllRolesStore","allowCustomPrimaryStore"],"mappings":";;;;;;;;;AAeO,MAAM,WAAW;AAAA,EACvB,YACS,OACP;AADO,SAAA,QAAA;AAAA,EAAA;AAAA,EAIF,OACN,qBACa;AACP,UAAA,uBAAuBA,8CAAuB,mBAAmB;AACjE,UAAAC,UAAgB,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAcC,UAAI;AAClF,UAAAC,cAAkC,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAcC,4BAAkB;AAExH,UAAM,qBAAqB,WAAW,iBAAiB,sBAAsBH,OAAK;AAE3E,WAAA;AAAA,MACN,OAAO,OAAO,YAAYA,QAAM,IAAI,CAAC,SAAwC;AACtE,cAAA,kBAAkB,mBAAmB,IAAI,IAAI;AAC5C,eAAA;AAAA,UACN,KAAK;AAAA,UACL;AAAA,YACC,GAAG,KAAK;AAAA,YACR,QAAQ,KAAK,QAAQ,UAAU;AAAA,YAC/B,UAAU,KAAK,kBAAkB,eAAe;AAAA,YAChD,WAAW,KAAK,gBAAgB,MAAME,WAAS;AAAA,UAAA;AAAA,QAEjD;AAAA,MAAA,CACA,CAAC;AAAA,IACH;AAAA,EAAA;AAAA,EAGO,kBAAkB,iBAAmE;AAC5F,QAAI,CAAC,iBAAiB;AACrB,aAAO,CAAC;AAAA,IAAA;AAEF,WAAA,OAAO,YAAY,MAAM,KAAK,gBAAgB,MAAM,EAAE,IAAI,CAAC,eAAgD;AACjH,YAAM,SAASE,YAAA,UAAU,KAAK,OAAO,UAAU;AAE/C,YAAM,qBAAqBC,wBAAAA,yBAAyB,OAAO,iBAAiB,KAAK,OAAO,MAAM;AAE9F,YAAM,mBAAmD,CAAC;~~AAC1D~~,iBAAW,MAAM,CAAC,UAAU,UAAU,MAAM,GAAY;AACvD,cAAM,mBAAmD,CAAC;AAC1D,mBAAW,SAAS,OAAO,KAAK,OAAO,MAAM,GAAG;AAC/C,gBAAM,YAAY,mBAAmB,qBAAqB,IAAI,OAAO,UAAU,OAAO,OAAO;AAC7F,cAAI,cAAc,QAAW;AAC5B,6BAAiB,KAAK,IAAI;AAAA,UAAA;AAAA,QAC3B;AAED,YAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,GAAG;AAC7C,2BAAiB,EAAE,IAAI;AAAA,QAAA;AAAA,MACxB;AAED,YAAM,eAAe,mBAAmB,qBAAqB,UAAU,IAAI,KAAK;AAChF,UAAI,iBAAiB,QAAW;AAC/B,yBAAiB,SAAS;AAAA,MAAA;AAE3B,UAAI,gBAAgB,IAAI,UAAU,GAAG,oBAAoB;AACxD,yBAAiB,gBAAgB;AAAA,MAAA;AAElC,aAAO,CAAC,YAAY;AAAA,QACnB,YAAY,mBAAmB,kBAAkB;AAAA,QACjD,YAAY;AAAA,MAAA,~~CACZ~~;AAAA,IAAA,CACD,CAAC;AAAA,EAAA;AAAA,~~EAGK~~,gBAAgB,MAAYH,YAAgD;AAC7E,UAAA,gBAAgBA,WAAU,OAAO,CAAA,OAAM,GAAG,MAAM,SAAS,IAAI,CAAC;AACpE,WAAO,OAAO,YAAY,cAAc,IAAI,CAAC,aAAqC;AACjF,aAAO,CAAC,SAAS,MAAM,SAAS,QAAQ;AAAA,IAAA,CACxC,CAAC;AAAA,EAAA;AAAA,EAGH,OAAe,iBAAiB,sBAAkDF,QAA2C;AACtH,UAAA,yCAAqD,IAAI;AAC/D,eAAW,CAAC,MAAM,MAAM,KAAK,sBAAsB;AAC5C,YAAA,wBAAwB,CAAC,SAAkC;AAChE,cAAM,kBAAuC,mBAAmB,IAAI,IAAI,yBAAS,IAAI;AAClE,2BAAA,IAAI,MAAM,eAAe;AAC5C,cAAM,oBAAoB,gBAAgB,IAAI,IAAI,KAAK;AAAA,UACtD,oBAAoB;AAAA,UACpB,aAAa,CAAA;AAAA,QACd;AACgB,wBAAA,IAAI,MAAM,iBAAiB;AACpC,eAAA;AAAA,MACR;AACM,YAAA,WAA0CM,OAAAA,sBAAsB,IAAI,MAAM;AAChF,iBAAW,EAAE,MAAM,GAAG,WAAA,KAAgB,UAAU;AAC/C,YAAI,CAACN,OAAM,SAAS,IAAI,GAAG;AAC1B,gBAAM,QAAQ,KAAK,IAAI,mBAAmB,IAAI;AAAA,QAAA;AAEzC,cAAA,oBAAoB,sBAAsB,IAAI;AAClC,0BAAA,YAAY,KAAK,UAAU;AAAA,MAAA;AAGxC,YAAA,yBAAyBO,uCAAgC,IAAI,MAAM,IAAIP,SAAQQ,OAAAA,wBAAwB,IAAI,MAAM;AACvH,iBAAW,QAAQ,wBAAwB;AACpB,8BAAA,IAAI,EAAE,qBAAqB;AAAA,MAAA;AAAA,IAClD;AAGM,WAAA;AAAA,EAAA;AAET;;"}
1	+ {"version":3,"file":"AclFactory.cjs","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/AclFactory.ts"],"sourcesContent":["import { Acl, Model, Writable } from '@contember/schema'\nimport { getEntity } from '@contember/schema-utils'\n\nimport { EntityPredicatesResolver } from './EntityPredicateResolver'\nimport { AllowDefinition } from '../permissions'\nimport {\n\tallowCustomPrimaryAllRolesStore,\n\tallowCustomPrimaryStore,\n\tallowDefinitionsStore,\n\tEntityPermissionsDefinition,\n} from './stores'\nimport { Role } from '../roles'\nimport { VariableDefinition } from '../variables'\nimport { filterEntityDefinition } from '../../../utils'\n\nexport class AclFactory {\n\tconstructor(\n\t\tprivate model: Model.Schema,\n\t) {\n\t}\n\n\tpublic create(\n\t\texportedDefinitions: Record<string, any>,\n\t): Acl.Schema {\n\t\tconst entityLikeDefinition = filterEntityDefinition(exportedDefinitions)\n\t\tconst roles: Role[] = Object.values(exportedDefinitions).filter(it => it instanceof Role)\n\t\tconst variables: VariableDefinition[] = Object.values(exportedDefinitions).filter(it => it instanceof VariableDefinition)\n\n\t\tconst groupedPermissions = AclFactory.groupPermissions(entityLikeDefinition, roles)\n\n\t\treturn {\n\t\t\troles: Object.fromEntries(roles.map((role): [string, Acl.RolePermissions] => {\n\t\t\t\tconst rolePermissions = groupedPermissions.get(role)\n\t\t\t\treturn [\n\t\t\t\t\trole.name,\n\t\t\t\t\t{\n\t\t\t\t\t\t...role.options,\n\t\t\t\t\t\tstages: role.options.stages ?? '*',\n\t\t\t\t\t\tentities: this.createPermissions(rolePermissions),\n\t\t\t\t\t\tvariables: this.createVariables(role, variables),\n\t\t\t\t\t},\n\t\t\t\t]\n\t\t\t})),\n\t\t}\n\t}\n\n\tprivate createPermissions(rolePermissions: PermissionsByEntity \| undefined): Acl.Permissions {\n\t\tif (!rolePermissions) {\n\t\t\treturn {}\n\t\t}\n\t\treturn Object.fromEntries(Array.from(rolePermissions.keys()).map((entityName): [string, Acl.EntityPermissions] => {\n\t\t\tconst entity = getEntity(this.model, entityName)\n\n\t\t\tconst predicatesResolver = EntityPredicatesResolver.create(rolePermissions, this.model, entity)\n\n\t\t\tconst entityOperations: Writable<Acl.EntityOperations> = {\n\t\t\t}\n\t\t\tconst noRootOptions = this.getNoRootOptions(entity, rolePermissions.get(entityName))\n\t\t\tif (noRootOptions?.length) {\n\t\t\t\tentityOperations.noRoot = noRootOptions\n\t\t\t}\n\t\t\tfor (const op of ['create', 'update', 'read'] as const) {\n\t\t\t\tconst fieldPermissions: Writable<Acl.FieldPermissions> = {}\n\t\t\t\tfor (const field of Object.keys(entity.fields)) {\n\t\t\t\t\tconst predicate = predicatesResolver.createFieldPredicate(op, field, field === entity.primary)\n\t\t\t\t\tif (predicate !== undefined) {\n\t\t\t\t\t\tfieldPermissions[field] = predicate\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tif (Object.keys(fieldPermissions).length > 0) {\n\t\t\t\t\tentityOperations[op] = fieldPermissions\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst delPredicate = predicatesResolver.createFieldPredicate('delete', '', false)\n\t\t\tif (delPredicate !== undefined) {\n\t\t\t\tentityOperations.delete = delPredicate\n\t\t\t}\n\t\t\tif (rolePermissions.get(entityName)?.allowCustomPrimary) {\n\t\t\t\tentityOperations.customPrimary = true\n\t\t\t}\n\t\t\treturn [entityName, {\n\t\t\t\tpredicates: predicatesResolver.getUsedPredicates(),\n\t\t\t\toperations: entityOperations,\n\n\t\t\t}]\n\t\t}))\n\t}\n\n\n\tgetNoRootOptions(entity: Model.Entity, permissions?: EntityPermissions): Acl.EntityOperations['noRoot'] {\n\t\tconst allowedRoot = new Set<Acl.Operation>()\n\t\tconst disallowedRoot = new Set<Acl.Operation>()\n\t\tfor (const def of permissions?.definitions ?? []) {\n\t\t\tconst noRoot = def.through === true\n\t\t\tfor (const op of ['create', 'read', 'update', 'delete'] as const) {\n\t\t\t\tif (def[op]) {\n\t\t\t\t\tconst currentSet = noRoot ? disallowedRoot : allowedRoot\n\t\t\t\t\tcurrentSet.add(op as Acl.Operation)\n\n\t\t\t\t\tconst otherSet = noRoot ? allowedRoot : disallowedRoot\n\n\t\t\t\t\tif (otherSet.has(op as Acl.Operation)) {\n\t\t\t\t\t\tthrow new Error(`Operation ${op} cannot be both allowed and disallowed on root on entity ${entity.name}`)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t}\n\t\treturn [...disallowedRoot.values()]\n\t}\n\n\tprivate createVariables(role: Role, variables: VariableDefinition[]): Acl.Variables {\n\t\tconst roleVariables = variables.filter(it => it.roles.includes(role))\n\t\treturn Object.fromEntries(roleVariables.map((variable): [string, Acl.Variable] => {\n\t\t\treturn [variable.name, variable.variable]\n\t\t}))\n\t}\n\n\tprivate static groupPermissions(entityLikeDefinition: [string, { new(): any }][], roles: Role[]): PermissionsByRoleAndEntity {\n\t\tconst groupedPermissions: PermissionsByRoleAndEntity = new Map()\n\t\tfor (const [name, entity] of entityLikeDefinition) {\n\t\t\tconst initEntityPermissions = (role: Role): EntityPermissions => {\n\t\t\t\tconst rolePermissions: PermissionsByEntity = groupedPermissions.get(role) ?? new Map()\n\t\t\t\tgroupedPermissions.set(role, rolePermissions)\n\t\t\t\tconst entityPermissions = rolePermissions.get(name) ?? {\n\t\t\t\t\tallowCustomPrimary: false,\n\t\t\t\t\tdefinitions: [],\n\t\t\t\t}\n\t\t\t\trolePermissions.set(name, entityPermissions)\n\t\t\t\treturn entityPermissions\n\t\t\t}\n\t\t\tconst metadata: EntityPermissionsDefinition[] = allowDefinitionsStore.get(entity)\n\t\t\tfor (const { role, ...definition } of metadata) {\n\t\t\t\tif (!roles.includes(role)) {\n\t\t\t\t\tthrow `Role ${role.name} used on entity ${name} is not registered. Have you exported it?`\n\t\t\t\t}\n\t\t\t\tconst entityPermissions = initEntityPermissions(role)\n\t\t\t\tentityPermissions.definitions.push(definition)\n\t\t\t}\n\n\t\t\tconst rolesWithCustomPrimary = allowCustomPrimaryAllRolesStore.get(entity) ? roles : allowCustomPrimaryStore.get(entity)\n\t\t\tfor (const role of rolesWithCustomPrimary) {\n\t\t\t\tinitEntityPermissions(role).allowCustomPrimary = true\n\t\t\t}\n\t\t}\n\n\t\treturn groupedPermissions\n\t}\n}\n\n\nexport type EntityPermissions = { definitions: AllowDefinition<any>[]; allowCustomPrimary: boolean }\nexport type PermissionsByEntity = Map<string, EntityPermissions>\nexport type PermissionsByRoleAndEntity = Map<Role, PermissionsByEntity>\n"],"names":["filterEntityDefinition","roles","Role","variables","VariableDefinition","getEntity","EntityPredicatesResolver","allowDefinitionsStore","allowCustomPrimaryAllRolesStore","allowCustomPrimaryStore"],"mappings":";;;;;;;;;AAeO,MAAM,WAAW;AAAA,EACvB,YACS,OACP;AADO,SAAA,QAAA;AAAA,EAAA;AAAA,EAIF,OACN,qBACa;AACP,UAAA,uBAAuBA,8CAAuB,mBAAmB;AACjE,UAAAC,UAAgB,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAcC,UAAI;AAClF,UAAAC,cAAkC,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAcC,4BAAkB;AAExH,UAAM,qBAAqB,WAAW,iBAAiB,sBAAsBH,OAAK;AAE3E,WAAA;AAAA,MACN,OAAO,OAAO,YAAYA,QAAM,IAAI,CAAC,SAAwC;AACtE,cAAA,kBAAkB,mBAAmB,IAAI,IAAI;AAC5C,eAAA;AAAA,UACN,KAAK;AAAA,UACL;AAAA,YACC,GAAG,KAAK;AAAA,YACR,QAAQ,KAAK,QAAQ,UAAU;AAAA,YAC/B,UAAU,KAAK,kBAAkB,eAAe;AAAA,YAChD,WAAW,KAAK,gBAAgB,MAAME,WAAS;AAAA,UAAA;AAAA,QAEjD;AAAA,MAAA,CACA,CAAC;AAAA,IACH;AAAA,EAAA;AAAA,EAGO,kBAAkB,iBAAmE;AAC5F,QAAI,CAAC,iBAAiB;AACrB,aAAO,CAAC;AAAA,IAAA;AAEF,WAAA,OAAO,YAAY,MAAM,KAAK,gBAAgB,MAAM,EAAE,IAAI,CAAC,eAAgD;AACjH,YAAM,SAASE,YAAA,UAAU,KAAK,OAAO,UAAU;AAE/C,YAAM,qBAAqBC,wBAAAA,yBAAyB,OAAO,iBAAiB,KAAK,OAAO,MAAM;AAE9F,YAAM,mBAAmD,CACzD;AACA,YAAM,gBAAgB,KAAK,iBAAiB,QAAQ,gBAAgB,IAAI,UAAU,CAAC;AACnF,UAAI,eAAe,QAAQ;AAC1B,yBAAiB,SAAS;AAAA,MAAA;AAE3B,iBAAW,MAAM,CAAC,UAAU,UAAU,MAAM,GAAY;AACvD,cAAM,mBAAmD,CAAC;AAC1D,mBAAW,SAAS,OAAO,KAAK,OAAO,MAAM,GAAG;AAC/C,gBAAM,YAAY,mBAAmB,qBAAqB,IAAI,OAAO,UAAU,OAAO,OAAO;AAC7F,cAAI,cAAc,QAAW;AAC5B,6BAAiB,KAAK,IAAI;AAAA,UAAA;AAAA,QAC3B;AAED,YAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,GAAG;AAC7C,2BAAiB,EAAE,IAAI;AAAA,QAAA;AAAA,MACxB;AAED,YAAM,eAAe,mBAAmB,qBAAqB,UAAU,IAAI,KAAK;AAChF,UAAI,iBAAiB,QAAW;AAC/B,yBAAiB,SAAS;AAAA,MAAA;AAE3B,UAAI,gBAAgB,IAAI,UAAU,GAAG,oBAAoB;AACxD,yBAAiB,gBAAgB;AAAA,MAAA;AAElC,aAAO,CAAC,YAAY;AAAA,QACnB,YAAY,mBAAmB,kBAAkB;AAAA,QACjD,YAAY;AAAA,MAAA,CAEZ;AAAA,IAAA,CACD,CAAC;AAAA,EAAA;AAAA,EAIH,iBAAiB,QAAsB,aAAiE;AACjG,UAAA,kCAAkB,IAAmB;AACrC,UAAA,qCAAqB,IAAmB;AAC9C,eAAW,OAAO,aAAa,eAAe,CAAA,GAAI;AAC3C,YAAA,SAAS,IAAI,YAAY;AAC/B,iBAAW,MAAM,CAAC,UAAU,QAAQ,UAAU,QAAQ,GAAY;AAC7D,YAAA,IAAI,EAAE,GAAG;AACN,gBAAA,aAAa,SAAS,iBAAiB;AAC7C,qBAAW,IAAI,EAAmB;AAE5B,gBAAA,WAAW,SAAS,cAAc;AAEpC,cAAA,SAAS,IAAI,EAAmB,GAAG;AACtC,kBAAM,IAAI,MAAM,aAAa,EAAE,4DAA4D,OAAO,IAAI,EAAE;AAAA,UAAA;AAAA,QACzG;AAAA,MACD;AAAA,IACD;AAGD,WAAO,CAAC,GAAG,eAAe,QAAQ;AAAA,EAAA;AAAA,EAG3B,gBAAgB,MAAYH,YAAgD;AAC7E,UAAA,gBAAgBA,WAAU,OAAO,CAAA,OAAM,GAAG,MAAM,SAAS,IAAI,CAAC;AACpE,WAAO,OAAO,YAAY,cAAc,IAAI,CAAC,aAAqC;AACjF,aAAO,CAAC,SAAS,MAAM,SAAS,QAAQ;AAAA,IAAA,CACxC,CAAC;AAAA,EAAA;AAAA,EAGH,OAAe,iBAAiB,sBAAkDF,QAA2C;AACtH,UAAA,yCAAqD,IAAI;AAC/D,eAAW,CAAC,MAAM,MAAM,KAAK,sBAAsB;AAC5C,YAAA,wBAAwB,CAAC,SAAkC;AAChE,cAAM,kBAAuC,mBAAmB,IAAI,IAAI,yBAAS,IAAI;AAClE,2BAAA,IAAI,MAAM,eAAe;AAC5C,cAAM,oBAAoB,gBAAgB,IAAI,IAAI,KAAK;AAAA,UACtD,oBAAoB;AAAA,UACpB,aAAa,CAAA;AAAA,QACd;AACgB,wBAAA,IAAI,MAAM,iBAAiB;AACpC,eAAA;AAAA,MACR;AACM,YAAA,WAA0CM,OAAAA,sBAAsB,IAAI,MAAM;AAChF,iBAAW,EAAE,MAAM,GAAG,WAAA,KAAgB,UAAU;AAC/C,YAAI,CAACN,OAAM,SAAS,IAAI,GAAG;AAC1B,gBAAM,QAAQ,KAAK,IAAI,mBAAmB,IAAI;AAAA,QAAA;AAEzC,cAAA,oBAAoB,sBAAsB,IAAI;AAClC,0BAAA,YAAY,KAAK,UAAU;AAAA,MAAA;AAGxC,YAAA,yBAAyBO,uCAAgC,IAAI,MAAM,IAAIP,SAAQQ,OAAAA,wBAAwB,IAAI,MAAM;AACvH,iBAAW,QAAQ,wBAAwB;AACpB,8BAAA,IAAI,EAAE,qBAAqB;AAAA,MAAA;AAAA,IAClD;AAGM,WAAA;AAAA,EAAA;AAET;;"}

package/dist/development/src/acl/definition/internal/AclFactory.js CHANGED Viewed

@@ -37,6 +37,10 @@ class AclFactory {
       const entity = getEntity(this.model, entityName);
       const predicatesResolver = EntityPredicatesResolver.create(rolePermissions, this.model, entity);
       const entityOperations = {};
+      const noRootOptions = this.getNoRootOptions(entity, rolePermissions.get(entityName));
+      if (noRootOptions?.length) {
+        entityOperations.noRoot = noRootOptions;
+      }
       for (const op of ["create", "update", "read"]) {
         const fieldPermissions = {};
         for (const field of Object.keys(entity.fields)) {
@@ -62,6 +66,24 @@ class AclFactory {
       }];
     }));
   }
+  getNoRootOptions(entity, permissions) {
+    const allowedRoot = /* @__PURE__ */ new Set();
+    const disallowedRoot = /* @__PURE__ */ new Set();
+    for (const def of permissions?.definitions ?? []) {
+      const noRoot = def.through === true;
+      for (const op of ["create", "read", "update", "delete"]) {
+        if (def[op]) {
+          const currentSet = noRoot ? disallowedRoot : allowedRoot;
+          currentSet.add(op);
+          const otherSet = noRoot ? allowedRoot : disallowedRoot;
+          if (otherSet.has(op)) {
+            throw new Error(`Operation ${op} cannot be both allowed and disallowed on root on entity ${entity.name}`);
+          }
+        }
+      }
+    }
+    return [...disallowedRoot.values()];
+  }
   createVariables(role, variables) {
     const roleVariables = variables.filter((it) => it.roles.includes(role));
     return Object.fromEntries(roleVariables.map((variable) => {

package/dist/development/src/acl/definition/internal/AclFactory.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"AclFactory.js","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/AclFactory.ts"],"sourcesContent":["import { Acl, Model, Writable } from '@contember/schema'\nimport { getEntity } from '@contember/schema-utils'\n\nimport { EntityPredicatesResolver } from './EntityPredicateResolver'\nimport { AllowDefinition } from '../permissions'\nimport {\n\tallowCustomPrimaryAllRolesStore,\n\tallowCustomPrimaryStore,\n\tallowDefinitionsStore,\n\tEntityPermissionsDefinition,\n} from './stores'\nimport { Role } from '../roles'\nimport { VariableDefinition } from '../variables'\nimport { filterEntityDefinition } from '../../../utils'\n\nexport class AclFactory {\n\tconstructor(\n\t\tprivate model: Model.Schema,\n\t) {\n\t}\n\n\tpublic create(\n\t\texportedDefinitions: Record<string, any>,\n\t): Acl.Schema {\n\t\tconst entityLikeDefinition = filterEntityDefinition(exportedDefinitions)\n\t\tconst roles: Role[] = Object.values(exportedDefinitions).filter(it => it instanceof Role)\n\t\tconst variables: VariableDefinition[] = Object.values(exportedDefinitions).filter(it => it instanceof VariableDefinition)\n\n\t\tconst groupedPermissions = AclFactory.groupPermissions(entityLikeDefinition, roles)\n\n\t\treturn {\n\t\t\troles: Object.fromEntries(roles.map((role): [string, Acl.RolePermissions] => {\n\t\t\t\tconst rolePermissions = groupedPermissions.get(role)\n\t\t\t\treturn [\n\t\t\t\t\trole.name,\n\t\t\t\t\t{\n\t\t\t\t\t\t...role.options,\n\t\t\t\t\t\tstages: role.options.stages ?? '*',\n\t\t\t\t\t\tentities: this.createPermissions(rolePermissions),\n\t\t\t\t\t\tvariables: this.createVariables(role, variables),\n\t\t\t\t\t},\n\t\t\t\t]\n\t\t\t})),\n\t\t}\n\t}\n\n\tprivate createPermissions(rolePermissions: PermissionsByEntity \| undefined): Acl.Permissions {\n\t\tif (!rolePermissions) {\n\t\t\treturn {}\n\t\t}\n\t\treturn Object.fromEntries(Array.from(rolePermissions.keys()).map((entityName): [string, Acl.EntityPermissions] => {\n\t\t\tconst entity = getEntity(this.model, entityName)\n\n\t\t\tconst predicatesResolver = EntityPredicatesResolver.create(rolePermissions, this.model, entity)\n\n\t\t\tconst entityOperations: Writable<Acl.EntityOperations> = {}\n\t\t\tfor (const op of ['create', 'update', 'read'] as const) {\n\t\t\t\tconst fieldPermissions: Writable<Acl.FieldPermissions> = {}\n\t\t\t\tfor (const field of Object.keys(entity.fields)) {\n\t\t\t\t\tconst predicate = predicatesResolver.createFieldPredicate(op, field, field === entity.primary)\n\t\t\t\t\tif (predicate !== undefined) {\n\t\t\t\t\t\tfieldPermissions[field] = predicate\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tif (Object.keys(fieldPermissions).length > 0) {\n\t\t\t\t\tentityOperations[op] = fieldPermissions\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst delPredicate = predicatesResolver.createFieldPredicate('delete', '', false)\n\t\t\tif (delPredicate !== undefined) {\n\t\t\t\tentityOperations.delete = delPredicate\n\t\t\t}\n\t\t\tif (rolePermissions.get(entityName)?.allowCustomPrimary) {\n\t\t\t\tentityOperations.customPrimary = true\n\t\t\t}\n\t\t\treturn [entityName, {\n\t\t\t\tpredicates: predicatesResolver.getUsedPredicates(),\n\t\t\t\toperations: entityOperations,\n\t\t\t}]\n\t\t}))\n\t}\n\n\tprivate createVariables(role: Role, variables: VariableDefinition[]): Acl.Variables {\n\t\tconst roleVariables = variables.filter(it => it.roles.includes(role))\n\t\treturn Object.fromEntries(roleVariables.map((variable): [string, Acl.Variable] => {\n\t\t\treturn [variable.name, variable.variable]\n\t\t}))\n\t}\n\n\tprivate static groupPermissions(entityLikeDefinition: [string, { new(): any }][], roles: Role[]): PermissionsByRoleAndEntity {\n\t\tconst groupedPermissions: PermissionsByRoleAndEntity = new Map()\n\t\tfor (const [name, entity] of entityLikeDefinition) {\n\t\t\tconst initEntityPermissions = (role: Role): EntityPermissions => {\n\t\t\t\tconst rolePermissions: PermissionsByEntity = groupedPermissions.get(role) ?? new Map()\n\t\t\t\tgroupedPermissions.set(role, rolePermissions)\n\t\t\t\tconst entityPermissions = rolePermissions.get(name) ?? {\n\t\t\t\t\tallowCustomPrimary: false,\n\t\t\t\t\tdefinitions: [],\n\t\t\t\t}\n\t\t\t\trolePermissions.set(name, entityPermissions)\n\t\t\t\treturn entityPermissions\n\t\t\t}\n\t\t\tconst metadata: EntityPermissionsDefinition[] = allowDefinitionsStore.get(entity)\n\t\t\tfor (const { role, ...definition } of metadata) {\n\t\t\t\tif (!roles.includes(role)) {\n\t\t\t\t\tthrow `Role ${role.name} used on entity ${name} is not registered. Have you exported it?`\n\t\t\t\t}\n\t\t\t\tconst entityPermissions = initEntityPermissions(role)\n\t\t\t\tentityPermissions.definitions.push(definition)\n\t\t\t}\n\n\t\t\tconst rolesWithCustomPrimary = allowCustomPrimaryAllRolesStore.get(entity) ? roles : allowCustomPrimaryStore.get(entity)\n\t\t\tfor (const role of rolesWithCustomPrimary) {\n\t\t\t\tinitEntityPermissions(role).allowCustomPrimary = true\n\t\t\t}\n\t\t}\n\n\t\treturn groupedPermissions\n\t}\n}\n\n\nexport type EntityPermissions = { definitions: AllowDefinition<any>[]; allowCustomPrimary: boolean }\nexport type PermissionsByEntity = Map<string, EntityPermissions>\nexport type PermissionsByRoleAndEntity = Map<Role, PermissionsByEntity>\n"],"names":[],"mappings":";;;;;;;AAeO,MAAM,WAAW;AAAA,EACvB,YACS,OACP;AADO,SAAA,QAAA;AAAA,EAAA;AAAA,EAIF,OACN,qBACa;AACP,UAAA,uBAAuB,uBAAuB,mBAAmB;AACjE,UAAA,QAAgB,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAc,IAAI;AAClF,UAAA,YAAkC,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAc,kBAAkB;AAExH,UAAM,qBAAqB,WAAW,iBAAiB,sBAAsB,KAAK;AAE3E,WAAA;AAAA,MACN,OAAO,OAAO,YAAY,MAAM,IAAI,CAAC,SAAwC;AACtE,cAAA,kBAAkB,mBAAmB,IAAI,IAAI;AAC5C,eAAA;AAAA,UACN,KAAK;AAAA,UACL;AAAA,YACC,GAAG,KAAK;AAAA,YACR,QAAQ,KAAK,QAAQ,UAAU;AAAA,YAC/B,UAAU,KAAK,kBAAkB,eAAe;AAAA,YAChD,WAAW,KAAK,gBAAgB,MAAM,SAAS;AAAA,UAAA;AAAA,QAEjD;AAAA,MAAA,CACA,CAAC;AAAA,IACH;AAAA,EAAA;AAAA,EAGO,kBAAkB,iBAAmE;AAC5F,QAAI,CAAC,iBAAiB;AACrB,aAAO,CAAC;AAAA,IAAA;AAEF,WAAA,OAAO,YAAY,MAAM,KAAK,gBAAgB,MAAM,EAAE,IAAI,CAAC,eAAgD;AACjH,YAAM,SAAS,UAAU,KAAK,OAAO,UAAU;AAE/C,YAAM,qBAAqB,yBAAyB,OAAO,iBAAiB,KAAK,OAAO,MAAM;AAE9F,YAAM,mBAAmD,CAAC;~~AAC1D~~,iBAAW,MAAM,CAAC,UAAU,UAAU,MAAM,GAAY;AACvD,cAAM,mBAAmD,CAAC;AAC1D,mBAAW,SAAS,OAAO,KAAK,OAAO,MAAM,GAAG;AAC/C,gBAAM,YAAY,mBAAmB,qBAAqB,IAAI,OAAO,UAAU,OAAO,OAAO;AAC7F,cAAI,cAAc,QAAW;AAC5B,6BAAiB,KAAK,IAAI;AAAA,UAAA;AAAA,QAC3B;AAED,YAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,GAAG;AAC7C,2BAAiB,EAAE,IAAI;AAAA,QAAA;AAAA,MACxB;AAED,YAAM,eAAe,mBAAmB,qBAAqB,UAAU,IAAI,KAAK;AAChF,UAAI,iBAAiB,QAAW;AAC/B,yBAAiB,SAAS;AAAA,MAAA;AAE3B,UAAI,gBAAgB,IAAI,UAAU,GAAG,oBAAoB;AACxD,yBAAiB,gBAAgB;AAAA,MAAA;AAElC,aAAO,CAAC,YAAY;AAAA,QACnB,YAAY,mBAAmB,kBAAkB;AAAA,QACjD,YAAY;AAAA,MAAA,~~CACZ~~;AAAA,IAAA,CACD,CAAC;AAAA,EAAA;AAAA,~~EAGK~~,gBAAgB,MAAY,WAAgD;AAC7E,UAAA,gBAAgB,UAAU,OAAO,CAAA,OAAM,GAAG,MAAM,SAAS,IAAI,CAAC;AACpE,WAAO,OAAO,YAAY,cAAc,IAAI,CAAC,aAAqC;AACjF,aAAO,CAAC,SAAS,MAAM,SAAS,QAAQ;AAAA,IAAA,CACxC,CAAC;AAAA,EAAA;AAAA,EAGH,OAAe,iBAAiB,sBAAkD,OAA2C;AACtH,UAAA,yCAAqD,IAAI;AAC/D,eAAW,CAAC,MAAM,MAAM,KAAK,sBAAsB;AAC5C,YAAA,wBAAwB,CAAC,SAAkC;AAChE,cAAM,kBAAuC,mBAAmB,IAAI,IAAI,yBAAS,IAAI;AAClE,2BAAA,IAAI,MAAM,eAAe;AAC5C,cAAM,oBAAoB,gBAAgB,IAAI,IAAI,KAAK;AAAA,UACtD,oBAAoB;AAAA,UACpB,aAAa,CAAA;AAAA,QACd;AACgB,wBAAA,IAAI,MAAM,iBAAiB;AACpC,eAAA;AAAA,MACR;AACM,YAAA,WAA0C,sBAAsB,IAAI,MAAM;AAChF,iBAAW,EAAE,MAAM,GAAG,WAAA,KAAgB,UAAU;AAC/C,YAAI,CAAC,MAAM,SAAS,IAAI,GAAG;AAC1B,gBAAM,QAAQ,KAAK,IAAI,mBAAmB,IAAI;AAAA,QAAA;AAEzC,cAAA,oBAAoB,sBAAsB,IAAI;AAClC,0BAAA,YAAY,KAAK,UAAU;AAAA,MAAA;AAGxC,YAAA,yBAAyB,gCAAgC,IAAI,MAAM,IAAI,QAAQ,wBAAwB,IAAI,MAAM;AACvH,iBAAW,QAAQ,wBAAwB;AACpB,8BAAA,IAAI,EAAE,qBAAqB;AAAA,MAAA;AAAA,IAClD;AAGM,WAAA;AAAA,EAAA;AAET;"}
1	+ {"version":3,"file":"AclFactory.js","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/AclFactory.ts"],"sourcesContent":["import { Acl, Model, Writable } from '@contember/schema'\nimport { getEntity } from '@contember/schema-utils'\n\nimport { EntityPredicatesResolver } from './EntityPredicateResolver'\nimport { AllowDefinition } from '../permissions'\nimport {\n\tallowCustomPrimaryAllRolesStore,\n\tallowCustomPrimaryStore,\n\tallowDefinitionsStore,\n\tEntityPermissionsDefinition,\n} from './stores'\nimport { Role } from '../roles'\nimport { VariableDefinition } from '../variables'\nimport { filterEntityDefinition } from '../../../utils'\n\nexport class AclFactory {\n\tconstructor(\n\t\tprivate model: Model.Schema,\n\t) {\n\t}\n\n\tpublic create(\n\t\texportedDefinitions: Record<string, any>,\n\t): Acl.Schema {\n\t\tconst entityLikeDefinition = filterEntityDefinition(exportedDefinitions)\n\t\tconst roles: Role[] = Object.values(exportedDefinitions).filter(it => it instanceof Role)\n\t\tconst variables: VariableDefinition[] = Object.values(exportedDefinitions).filter(it => it instanceof VariableDefinition)\n\n\t\tconst groupedPermissions = AclFactory.groupPermissions(entityLikeDefinition, roles)\n\n\t\treturn {\n\t\t\troles: Object.fromEntries(roles.map((role): [string, Acl.RolePermissions] => {\n\t\t\t\tconst rolePermissions = groupedPermissions.get(role)\n\t\t\t\treturn [\n\t\t\t\t\trole.name,\n\t\t\t\t\t{\n\t\t\t\t\t\t...role.options,\n\t\t\t\t\t\tstages: role.options.stages ?? '*',\n\t\t\t\t\t\tentities: this.createPermissions(rolePermissions),\n\t\t\t\t\t\tvariables: this.createVariables(role, variables),\n\t\t\t\t\t},\n\t\t\t\t]\n\t\t\t})),\n\t\t}\n\t}\n\n\tprivate createPermissions(rolePermissions: PermissionsByEntity \| undefined): Acl.Permissions {\n\t\tif (!rolePermissions) {\n\t\t\treturn {}\n\t\t}\n\t\treturn Object.fromEntries(Array.from(rolePermissions.keys()).map((entityName): [string, Acl.EntityPermissions] => {\n\t\t\tconst entity = getEntity(this.model, entityName)\n\n\t\t\tconst predicatesResolver = EntityPredicatesResolver.create(rolePermissions, this.model, entity)\n\n\t\t\tconst entityOperations: Writable<Acl.EntityOperations> = {\n\t\t\t}\n\t\t\tconst noRootOptions = this.getNoRootOptions(entity, rolePermissions.get(entityName))\n\t\t\tif (noRootOptions?.length) {\n\t\t\t\tentityOperations.noRoot = noRootOptions\n\t\t\t}\n\t\t\tfor (const op of ['create', 'update', 'read'] as const) {\n\t\t\t\tconst fieldPermissions: Writable<Acl.FieldPermissions> = {}\n\t\t\t\tfor (const field of Object.keys(entity.fields)) {\n\t\t\t\t\tconst predicate = predicatesResolver.createFieldPredicate(op, field, field === entity.primary)\n\t\t\t\t\tif (predicate !== undefined) {\n\t\t\t\t\t\tfieldPermissions[field] = predicate\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tif (Object.keys(fieldPermissions).length > 0) {\n\t\t\t\t\tentityOperations[op] = fieldPermissions\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst delPredicate = predicatesResolver.createFieldPredicate('delete', '', false)\n\t\t\tif (delPredicate !== undefined) {\n\t\t\t\tentityOperations.delete = delPredicate\n\t\t\t}\n\t\t\tif (rolePermissions.get(entityName)?.allowCustomPrimary) {\n\t\t\t\tentityOperations.customPrimary = true\n\t\t\t}\n\t\t\treturn [entityName, {\n\t\t\t\tpredicates: predicatesResolver.getUsedPredicates(),\n\t\t\t\toperations: entityOperations,\n\n\t\t\t}]\n\t\t}))\n\t}\n\n\n\tgetNoRootOptions(entity: Model.Entity, permissions?: EntityPermissions): Acl.EntityOperations['noRoot'] {\n\t\tconst allowedRoot = new Set<Acl.Operation>()\n\t\tconst disallowedRoot = new Set<Acl.Operation>()\n\t\tfor (const def of permissions?.definitions ?? []) {\n\t\t\tconst noRoot = def.through === true\n\t\t\tfor (const op of ['create', 'read', 'update', 'delete'] as const) {\n\t\t\t\tif (def[op]) {\n\t\t\t\t\tconst currentSet = noRoot ? disallowedRoot : allowedRoot\n\t\t\t\t\tcurrentSet.add(op as Acl.Operation)\n\n\t\t\t\t\tconst otherSet = noRoot ? allowedRoot : disallowedRoot\n\n\t\t\t\t\tif (otherSet.has(op as Acl.Operation)) {\n\t\t\t\t\t\tthrow new Error(`Operation ${op} cannot be both allowed and disallowed on root on entity ${entity.name}`)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t}\n\t\treturn [...disallowedRoot.values()]\n\t}\n\n\tprivate createVariables(role: Role, variables: VariableDefinition[]): Acl.Variables {\n\t\tconst roleVariables = variables.filter(it => it.roles.includes(role))\n\t\treturn Object.fromEntries(roleVariables.map((variable): [string, Acl.Variable] => {\n\t\t\treturn [variable.name, variable.variable]\n\t\t}))\n\t}\n\n\tprivate static groupPermissions(entityLikeDefinition: [string, { new(): any }][], roles: Role[]): PermissionsByRoleAndEntity {\n\t\tconst groupedPermissions: PermissionsByRoleAndEntity = new Map()\n\t\tfor (const [name, entity] of entityLikeDefinition) {\n\t\t\tconst initEntityPermissions = (role: Role): EntityPermissions => {\n\t\t\t\tconst rolePermissions: PermissionsByEntity = groupedPermissions.get(role) ?? new Map()\n\t\t\t\tgroupedPermissions.set(role, rolePermissions)\n\t\t\t\tconst entityPermissions = rolePermissions.get(name) ?? {\n\t\t\t\t\tallowCustomPrimary: false,\n\t\t\t\t\tdefinitions: [],\n\t\t\t\t}\n\t\t\t\trolePermissions.set(name, entityPermissions)\n\t\t\t\treturn entityPermissions\n\t\t\t}\n\t\t\tconst metadata: EntityPermissionsDefinition[] = allowDefinitionsStore.get(entity)\n\t\t\tfor (const { role, ...definition } of metadata) {\n\t\t\t\tif (!roles.includes(role)) {\n\t\t\t\t\tthrow `Role ${role.name} used on entity ${name} is not registered. Have you exported it?`\n\t\t\t\t}\n\t\t\t\tconst entityPermissions = initEntityPermissions(role)\n\t\t\t\tentityPermissions.definitions.push(definition)\n\t\t\t}\n\n\t\t\tconst rolesWithCustomPrimary = allowCustomPrimaryAllRolesStore.get(entity) ? roles : allowCustomPrimaryStore.get(entity)\n\t\t\tfor (const role of rolesWithCustomPrimary) {\n\t\t\t\tinitEntityPermissions(role).allowCustomPrimary = true\n\t\t\t}\n\t\t}\n\n\t\treturn groupedPermissions\n\t}\n}\n\n\nexport type EntityPermissions = { definitions: AllowDefinition<any>[]; allowCustomPrimary: boolean }\nexport type PermissionsByEntity = Map<string, EntityPermissions>\nexport type PermissionsByRoleAndEntity = Map<Role, PermissionsByEntity>\n"],"names":[],"mappings":";;;;;;;AAeO,MAAM,WAAW;AAAA,EACvB,YACS,OACP;AADO,SAAA,QAAA;AAAA,EAAA;AAAA,EAIF,OACN,qBACa;AACP,UAAA,uBAAuB,uBAAuB,mBAAmB;AACjE,UAAA,QAAgB,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAc,IAAI;AAClF,UAAA,YAAkC,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAc,kBAAkB;AAExH,UAAM,qBAAqB,WAAW,iBAAiB,sBAAsB,KAAK;AAE3E,WAAA;AAAA,MACN,OAAO,OAAO,YAAY,MAAM,IAAI,CAAC,SAAwC;AACtE,cAAA,kBAAkB,mBAAmB,IAAI,IAAI;AAC5C,eAAA;AAAA,UACN,KAAK;AAAA,UACL;AAAA,YACC,GAAG,KAAK;AAAA,YACR,QAAQ,KAAK,QAAQ,UAAU;AAAA,YAC/B,UAAU,KAAK,kBAAkB,eAAe;AAAA,YAChD,WAAW,KAAK,gBAAgB,MAAM,SAAS;AAAA,UAAA;AAAA,QAEjD;AAAA,MAAA,CACA,CAAC;AAAA,IACH;AAAA,EAAA;AAAA,EAGO,kBAAkB,iBAAmE;AAC5F,QAAI,CAAC,iBAAiB;AACrB,aAAO,CAAC;AAAA,IAAA;AAEF,WAAA,OAAO,YAAY,MAAM,KAAK,gBAAgB,MAAM,EAAE,IAAI,CAAC,eAAgD;AACjH,YAAM,SAAS,UAAU,KAAK,OAAO,UAAU;AAE/C,YAAM,qBAAqB,yBAAyB,OAAO,iBAAiB,KAAK,OAAO,MAAM;AAE9F,YAAM,mBAAmD,CACzD;AACA,YAAM,gBAAgB,KAAK,iBAAiB,QAAQ,gBAAgB,IAAI,UAAU,CAAC;AACnF,UAAI,eAAe,QAAQ;AAC1B,yBAAiB,SAAS;AAAA,MAAA;AAE3B,iBAAW,MAAM,CAAC,UAAU,UAAU,MAAM,GAAY;AACvD,cAAM,mBAAmD,CAAC;AAC1D,mBAAW,SAAS,OAAO,KAAK,OAAO,MAAM,GAAG;AAC/C,gBAAM,YAAY,mBAAmB,qBAAqB,IAAI,OAAO,UAAU,OAAO,OAAO;AAC7F,cAAI,cAAc,QAAW;AAC5B,6BAAiB,KAAK,IAAI;AAAA,UAAA;AAAA,QAC3B;AAED,YAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,GAAG;AAC7C,2BAAiB,EAAE,IAAI;AAAA,QAAA;AAAA,MACxB;AAED,YAAM,eAAe,mBAAmB,qBAAqB,UAAU,IAAI,KAAK;AAChF,UAAI,iBAAiB,QAAW;AAC/B,yBAAiB,SAAS;AAAA,MAAA;AAE3B,UAAI,gBAAgB,IAAI,UAAU,GAAG,oBAAoB;AACxD,yBAAiB,gBAAgB;AAAA,MAAA;AAElC,aAAO,CAAC,YAAY;AAAA,QACnB,YAAY,mBAAmB,kBAAkB;AAAA,QACjD,YAAY;AAAA,MAAA,CAEZ;AAAA,IAAA,CACD,CAAC;AAAA,EAAA;AAAA,EAIH,iBAAiB,QAAsB,aAAiE;AACjG,UAAA,kCAAkB,IAAmB;AACrC,UAAA,qCAAqB,IAAmB;AAC9C,eAAW,OAAO,aAAa,eAAe,CAAA,GAAI;AAC3C,YAAA,SAAS,IAAI,YAAY;AAC/B,iBAAW,MAAM,CAAC,UAAU,QAAQ,UAAU,QAAQ,GAAY;AAC7D,YAAA,IAAI,EAAE,GAAG;AACN,gBAAA,aAAa,SAAS,iBAAiB;AAC7C,qBAAW,IAAI,EAAmB;AAE5B,gBAAA,WAAW,SAAS,cAAc;AAEpC,cAAA,SAAS,IAAI,EAAmB,GAAG;AACtC,kBAAM,IAAI,MAAM,aAAa,EAAE,4DAA4D,OAAO,IAAI,EAAE;AAAA,UAAA;AAAA,QACzG;AAAA,MACD;AAAA,IACD;AAGD,WAAO,CAAC,GAAG,eAAe,QAAQ;AAAA,EAAA;AAAA,EAG3B,gBAAgB,MAAY,WAAgD;AAC7E,UAAA,gBAAgB,UAAU,OAAO,CAAA,OAAM,GAAG,MAAM,SAAS,IAAI,CAAC;AACpE,WAAO,OAAO,YAAY,cAAc,IAAI,CAAC,aAAqC;AACjF,aAAO,CAAC,SAAS,MAAM,SAAS,QAAQ;AAAA,IAAA,CACxC,CAAC;AAAA,EAAA;AAAA,EAGH,OAAe,iBAAiB,sBAAkD,OAA2C;AACtH,UAAA,yCAAqD,IAAI;AAC/D,eAAW,CAAC,MAAM,MAAM,KAAK,sBAAsB;AAC5C,YAAA,wBAAwB,CAAC,SAAkC;AAChE,cAAM,kBAAuC,mBAAmB,IAAI,IAAI,yBAAS,IAAI;AAClE,2BAAA,IAAI,MAAM,eAAe;AAC5C,cAAM,oBAAoB,gBAAgB,IAAI,IAAI,KAAK;AAAA,UACtD,oBAAoB;AAAA,UACpB,aAAa,CAAA;AAAA,QACd;AACgB,wBAAA,IAAI,MAAM,iBAAiB;AACpC,eAAA;AAAA,MACR;AACM,YAAA,WAA0C,sBAAsB,IAAI,MAAM;AAChF,iBAAW,EAAE,MAAM,GAAG,WAAA,KAAgB,UAAU;AAC/C,YAAI,CAAC,MAAM,SAAS,IAAI,GAAG;AAC1B,gBAAM,QAAQ,KAAK,IAAI,mBAAmB,IAAI;AAAA,QAAA;AAEzC,cAAA,oBAAoB,sBAAsB,IAAI;AAClC,0BAAA,YAAY,KAAK,UAAU;AAAA,MAAA;AAGxC,YAAA,yBAAyB,gCAAgC,IAAI,MAAM,IAAI,QAAQ,wBAAwB,IAAI,MAAM;AACvH,iBAAW,QAAQ,wBAAwB;AACpB,8BAAA,IAAI,EAAE,qBAAqB;AAAA,MAAA;AAAA,IAClD;AAGM,WAAA;AAAA,EAAA;AAET;"}

package/dist/development/src/acl/definition/permissions.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"permissions.cjs","sources":["../../../../../../packages/schema-definition/src/acl/definition/permissions.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\nimport { Role } from './roles'\nimport { VariableDefinition } from './variables'\nimport { PredicateEvaluationReference } from './references'\nimport { allowDefinitionsStore } from './internal/stores'\nimport { DecoratorFunction, EntityConstructor } from '../../utils'\n\nexport type PredicateExtra = PredicateEvaluationReference \| VariableDefinition\nexport type WhenDefinition = Acl.PredicateDefinition<PredicateExtra>\n\nexport interface AllowDefinition<E> {\n\twhen?: WhenDefinition\n\tname?: string\n\tcreate?: true \| ('id' \| keyof E)[]\n\tupdate?: true \| ('id' \| keyof E)[]\n\tread?: true \| ('id' \| keyof E)[]\n\tdelete?: true\n}\n\nexport const allow = <E, R extends Role<string>>(role: R \| R[], args: AllowDefinition<E>): DecoratorFunction<E> => {\n\treturn (entity: EntityConstructor<E>) => {\n\t\t(Array.isArray(role) ? role : [role]).forEach(role => {\n\t\t\tallowDefinitionsStore.update(entity, val => [...val, { ...args, role }])\n\t\t})\n\t}\n}\n\n\n\n"],"names":["role","allowDefinitionsStore"],"mappings":";;;~~AAmBa~~,MAAA,QAAQ,CAA4B,MAAe,SAAmD;AAClH,SAAO,CAAC,WAAiC;AACvC,KAAA,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAAA,UAAQ;AACrDC,aAAAA,sBAAsB,OAAO,QAAQ,CAAO,QAAA,CAAC,GAAG,KAAK,EAAE,GAAG,MAAM,MAAAD,MAAM,CAAA,CAAC;AAAA,IAAA,CACvE;AAAA,EACF;AACD;;"}
1	+ {"version":3,"file":"permissions.cjs","sources":["../../../../../../packages/schema-definition/src/acl/definition/permissions.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\nimport { Role } from './roles'\nimport { VariableDefinition } from './variables'\nimport { PredicateEvaluationReference } from './references'\nimport { allowDefinitionsStore } from './internal/stores'\nimport { DecoratorFunction, EntityConstructor } from '../../utils'\n\nexport type PredicateExtra = PredicateEvaluationReference \| VariableDefinition\nexport type WhenDefinition = Acl.PredicateDefinition<PredicateExtra>\n\nexport interface AllowDefinition<E> {\n\twhen?: WhenDefinition\n\tthrough?: true\n\tname?: string\n\tcreate?: true \| ('id' \| keyof E)[]\n\tupdate?: true \| ('id' \| keyof E)[]\n\tread?: true \| ('id' \| keyof E)[]\n\tdelete?: true\n}\n\nexport const allow = <E, R extends Role<string>>(role: R \| R[], args: AllowDefinition<E>): DecoratorFunction<E> => {\n\treturn (entity: EntityConstructor<E>) => {\n\t\t(Array.isArray(role) ? role : [role]).forEach(role => {\n\t\t\tallowDefinitionsStore.update(entity, val => [...val, { ...args, role }])\n\t\t})\n\t}\n}\n\n\n\n"],"names":["role","allowDefinitionsStore"],"mappings":";;;AAoBa,MAAA,QAAQ,CAA4B,MAAe,SAAmD;AAClH,SAAO,CAAC,WAAiC;AACvC,KAAA,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAAA,UAAQ;AACrDC,aAAAA,sBAAsB,OAAO,QAAQ,CAAO,QAAA,CAAC,GAAG,KAAK,EAAE,GAAG,MAAM,MAAAD,MAAM,CAAA,CAAC;AAAA,IAAA,CACvE;AAAA,EACF;AACD;;"}

package/dist/development/src/acl/definition/permissions.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"permissions.js","sources":["../../../../../../packages/schema-definition/src/acl/definition/permissions.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\nimport { Role } from './roles'\nimport { VariableDefinition } from './variables'\nimport { PredicateEvaluationReference } from './references'\nimport { allowDefinitionsStore } from './internal/stores'\nimport { DecoratorFunction, EntityConstructor } from '../../utils'\n\nexport type PredicateExtra = PredicateEvaluationReference \| VariableDefinition\nexport type WhenDefinition = Acl.PredicateDefinition<PredicateExtra>\n\nexport interface AllowDefinition<E> {\n\twhen?: WhenDefinition\n\tname?: string\n\tcreate?: true \| ('id' \| keyof E)[]\n\tupdate?: true \| ('id' \| keyof E)[]\n\tread?: true \| ('id' \| keyof E)[]\n\tdelete?: true\n}\n\nexport const allow = <E, R extends Role<string>>(role: R \| R[], args: AllowDefinition<E>): DecoratorFunction<E> => {\n\treturn (entity: EntityConstructor<E>) => {\n\t\t(Array.isArray(role) ? role : [role]).forEach(role => {\n\t\t\tallowDefinitionsStore.update(entity, val => [...val, { ...args, role }])\n\t\t})\n\t}\n}\n\n\n\n"],"names":["role"],"mappings":";~~AAmBa~~,MAAA,QAAQ,CAA4B,MAAe,SAAmD;AAClH,SAAO,CAAC,WAAiC;AACvC,KAAA,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAAA,UAAQ;AACrD,4BAAsB,OAAO,QAAQ,CAAO,QAAA,CAAC,GAAG,KAAK,EAAE,GAAG,MAAM,MAAAA,MAAM,CAAA,CAAC;AAAA,IAAA,CACvE;AAAA,EACF;AACD;"}
1	+ {"version":3,"file":"permissions.js","sources":["../../../../../../packages/schema-definition/src/acl/definition/permissions.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\nimport { Role } from './roles'\nimport { VariableDefinition } from './variables'\nimport { PredicateEvaluationReference } from './references'\nimport { allowDefinitionsStore } from './internal/stores'\nimport { DecoratorFunction, EntityConstructor } from '../../utils'\n\nexport type PredicateExtra = PredicateEvaluationReference \| VariableDefinition\nexport type WhenDefinition = Acl.PredicateDefinition<PredicateExtra>\n\nexport interface AllowDefinition<E> {\n\twhen?: WhenDefinition\n\tthrough?: true\n\tname?: string\n\tcreate?: true \| ('id' \| keyof E)[]\n\tupdate?: true \| ('id' \| keyof E)[]\n\tread?: true \| ('id' \| keyof E)[]\n\tdelete?: true\n}\n\nexport const allow = <E, R extends Role<string>>(role: R \| R[], args: AllowDefinition<E>): DecoratorFunction<E> => {\n\treturn (entity: EntityConstructor<E>) => {\n\t\t(Array.isArray(role) ? role : [role]).forEach(role => {\n\t\t\tallowDefinitionsStore.update(entity, val => [...val, { ...args, role }])\n\t\t})\n\t}\n}\n\n\n\n"],"names":["role"],"mappings":";AAoBa,MAAA,QAAQ,CAA4B,MAAe,SAAmD;AAClH,SAAO,CAAC,WAAiC;AACvC,KAAA,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAAA,UAAQ;AACrD,4BAAsB,OAAO,QAAQ,CAAO,QAAA,CAAC,GAAG,KAAK,EAAE,GAAG,MAAM,MAAAA,MAAM,CAAA,CAAC;AAAA,IAAA,CACvE;AAAA,EACF;AACD;"}

package/dist/production/src/acl/builder/PermissionOverrider.cjs CHANGED Viewed

@@ -22,7 +22,13 @@ class PermissionOverrider {
         },
         ...original.operations.customPrimary === void 0 && overrides.operations.customPrimary === void 0 ? {} : {
           customPrimary: overrides.operations.customPrimary ?? original.operations.customPrimary
-        }
+        },
+        ...original.operations.noRoot || overrides.operations.noRoot ? {
+          noRoot: [
+            ...original.operations.noRoot || [],
+            ...overrides.operations.noRoot || []
+          ]
+        } : {}
       }
     };
   }

package/dist/production/src/acl/builder/PermissionOverrider.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"PermissionOverrider.cjs","sources":["../../../../../../packages/schema-definition/src/acl/builder/PermissionOverrider.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\nimport { tuple } from '../../utils'\n\nexport default class PermissionOverrider {\n\tpublic override(original: Acl.Permissions, overrides: Acl.Permissions): Acl.Permissions {\n\t\treturn Object.entries({ ...overrides, ...original })\n\t\t\t.map(([key, value]) => {\n\t\t\t\tif (overrides[key]) {\n\t\t\t\t\treturn tuple(key, this.overrideEntityPermissions(value, overrides[key]))\n\t\t\t\t}\n\t\t\t\treturn tuple(key, value)\n\t\t\t})\n\t\t\t.reduce((acc, [key, value]) => ({ ...acc, [key]: value }), {})\n\t}\n\n\tprivate overrideEntityPermissions(\n\t\toriginal: Acl.EntityPermissions,\n\t\toverrides: Acl.EntityPermissions,\n\t): Acl.EntityPermissions {\n\t\treturn {\n\t\t\tpredicates: { ...original.predicates, ...overrides.predicates },\n\t\t\toperations: {\n\t\t\t\tcreate: { ...(original.operations.create \|\| {}), ...(overrides.operations.create \|\| {}) },\n\t\t\t\tread: { ...(original.operations.read \|\| {}), ...(overrides.operations.read \|\| {}) },\n\t\t\t\tupdate: { ...(original.operations.update \|\| {}), ...(overrides.operations.update \|\| {}) },\n\t\t\t\t...(original.operations.delete === undefined && overrides.operations.delete === undefined\n\t\t\t\t\t? {}\n\t\t\t\t\t: {\n\t\t\t\t\t\tdelete: overrides.operations.delete ?? original.operations.delete,\n\t\t\t\t\t }),\n\t\t\t\t...(original.operations.customPrimary === undefined && overrides.operations.customPrimary === undefined\n\t\t\t\t\t? {}\n\t\t\t\t\t: {\n\t\t\t\t\t\tcustomPrimary: overrides.operations.customPrimary ?? original.operations.customPrimary,\n\t\t\t\t\t }),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["tuple"],"mappings":";;;AAGA,MAAqB,oBAAoB;AAAA,EACjC,SAAS,UAA2B,WAA6C;AACvF,WAAO,OAAO,QAAQ,EAAE,GAAG,WAAW,GAAG,UAAU,EACjD,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;AAClB,UAAA,UAAU,GAAG,GAAG;AACZ,eAAAA,MAAA,MAAM,KAAK,KAAK,0BAA0B,OAAO,UAAU,GAAG,CAAC,CAAC;AAAA,MAAA;AAEjE,aAAAA,MAAA,MAAM,KAAK,KAAK;AAAA,IACvB,CAAA,EACA,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,GAAG,MAAM,IAAI,CAAA,CAAE;AAAA,EAAA;AAAA,EAGvD,0BACP,UACA,WACwB;AACjB,WAAA;AAAA,MACN,YAAY,EAAE,GAAG,SAAS,YAAY,GAAG,UAAU,WAAW;AAAA,MAC9D,YAAY;AAAA,QACX,QAAQ,EAAE,GAAI,SAAS,WAAW,UAAU,IAAK,GAAI,UAAU,WAAW,UAAU,GAAI;AAAA,QACxF,MAAM,EAAE,GAAI,SAAS,WAAW,QAAQ,IAAK,GAAI,UAAU,WAAW,QAAQ,GAAI;AAAA,QAClF,QAAQ,EAAE,GAAI,SAAS,WAAW,UAAU,IAAK,GAAI,UAAU,WAAW,UAAU,GAAI;AAAA,QACxF,GAAI,SAAS,WAAW,WAAW,UAAa,UAAU,WAAW,WAAW,SAC7E,KACA;AAAA,UACD,QAAQ,UAAU,WAAW,UAAU,SAAS,WAAW;AAAA,QAC1D;AAAA,QACH,GAAI,SAAS,WAAW,kBAAkB,UAAa,UAAU,WAAW,kBAAkB,SAC3F,KACA;AAAA,UACD,eAAe,UAAU,WAAW,iBAAiB,SAAS,WAAW;AAAA,~~QAAA~~;AAAA,~~MACxE~~;AAAA,~~IAEL~~;AAAA,EAAA;AAEF;;"}
1	+ {"version":3,"file":"PermissionOverrider.cjs","sources":["../../../../../../packages/schema-definition/src/acl/builder/PermissionOverrider.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\nimport { tuple } from '../../utils'\n\nexport default class PermissionOverrider {\n\tpublic override(original: Acl.Permissions, overrides: Acl.Permissions): Acl.Permissions {\n\t\treturn Object.entries({ ...overrides, ...original })\n\t\t\t.map(([key, value]) => {\n\t\t\t\tif (overrides[key]) {\n\t\t\t\t\treturn tuple(key, this.overrideEntityPermissions(value, overrides[key]))\n\t\t\t\t}\n\t\t\t\treturn tuple(key, value)\n\t\t\t})\n\t\t\t.reduce((acc, [key, value]) => ({ ...acc, [key]: value }), {})\n\t}\n\n\tprivate overrideEntityPermissions(\n\t\toriginal: Acl.EntityPermissions,\n\t\toverrides: Acl.EntityPermissions,\n\t): Acl.EntityPermissions {\n\t\treturn {\n\t\t\tpredicates: { ...original.predicates, ...overrides.predicates },\n\t\t\toperations: {\n\t\t\t\tcreate: { ...(original.operations.create \|\| {}), ...(overrides.operations.create \|\| {}) },\n\t\t\t\tread: { ...(original.operations.read \|\| {}), ...(overrides.operations.read \|\| {}) },\n\t\t\t\tupdate: { ...(original.operations.update \|\| {}), ...(overrides.operations.update \|\| {}) },\n\t\t\t\t...(original.operations.delete === undefined && overrides.operations.delete === undefined\n\t\t\t\t\t? {}\n\t\t\t\t\t: {\n\t\t\t\t\t\tdelete: overrides.operations.delete ?? original.operations.delete,\n\t\t\t\t\t }),\n\t\t\t\t...(original.operations.customPrimary === undefined && overrides.operations.customPrimary === undefined\n\t\t\t\t\t? {}\n\t\t\t\t\t: {\n\t\t\t\t\t\tcustomPrimary: overrides.operations.customPrimary ?? original.operations.customPrimary,\n\t\t\t\t\t }),\n\t\t\t\t...(original.operations.noRoot \|\| overrides.operations.noRoot ? {\n\t\t\t\t\tnoRoot: [\n\t\t\t\t\t\t...(original.operations.noRoot \|\| []),\n\t\t\t\t\t\t...(overrides.operations.noRoot \|\| []),\n\t\t\t\t\t],\n\t\t\t\t} : {}),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["tuple"],"mappings":";;;AAGA,MAAqB,oBAAoB;AAAA,EACjC,SAAS,UAA2B,WAA6C;AACvF,WAAO,OAAO,QAAQ,EAAE,GAAG,WAAW,GAAG,UAAU,EACjD,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;AAClB,UAAA,UAAU,GAAG,GAAG;AACZ,eAAAA,MAAA,MAAM,KAAK,KAAK,0BAA0B,OAAO,UAAU,GAAG,CAAC,CAAC;AAAA,MAAA;AAEjE,aAAAA,MAAA,MAAM,KAAK,KAAK;AAAA,IACvB,CAAA,EACA,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,GAAG,MAAM,IAAI,CAAA,CAAE;AAAA,EAAA;AAAA,EAGvD,0BACP,UACA,WACwB;AACjB,WAAA;AAAA,MACN,YAAY,EAAE,GAAG,SAAS,YAAY,GAAG,UAAU,WAAW;AAAA,MAC9D,YAAY;AAAA,QACX,QAAQ,EAAE,GAAI,SAAS,WAAW,UAAU,IAAK,GAAI,UAAU,WAAW,UAAU,GAAI;AAAA,QACxF,MAAM,EAAE,GAAI,SAAS,WAAW,QAAQ,IAAK,GAAI,UAAU,WAAW,QAAQ,GAAI;AAAA,QAClF,QAAQ,EAAE,GAAI,SAAS,WAAW,UAAU,IAAK,GAAI,UAAU,WAAW,UAAU,GAAI;AAAA,QACxF,GAAI,SAAS,WAAW,WAAW,UAAa,UAAU,WAAW,WAAW,SAC7E,KACA;AAAA,UACD,QAAQ,UAAU,WAAW,UAAU,SAAS,WAAW;AAAA,QAC1D;AAAA,QACH,GAAI,SAAS,WAAW,kBAAkB,UAAa,UAAU,WAAW,kBAAkB,SAC3F,KACA;AAAA,UACD,eAAe,UAAU,WAAW,iBAAiB,SAAS,WAAW;AAAA,QACxE;AAAA,QACH,GAAI,SAAS,WAAW,UAAU,UAAU,WAAW,SAAS;AAAA,UAC/D,QAAQ;AAAA,YACP,GAAI,SAAS,WAAW,UAAU,CAAC;AAAA,YACnC,GAAI,UAAU,WAAW,UAAU,CAAA;AAAA,UAAC;AAAA,QACrC,IACG,CAAA;AAAA,MAAC;AAAA,IAEP;AAAA,EAAA;AAEF;;"}

package/dist/production/src/acl/builder/PermissionOverrider.js CHANGED Viewed

@@ -21,7 +21,13 @@ class PermissionOverrider {
         },
         ...original.operations.customPrimary === void 0 && overrides.operations.customPrimary === void 0 ? {} : {
           customPrimary: overrides.operations.customPrimary ?? original.operations.customPrimary
-        }
+        },
+        ...original.operations.noRoot || overrides.operations.noRoot ? {
+          noRoot: [
+            ...original.operations.noRoot || [],
+            ...overrides.operations.noRoot || []
+          ]
+        } : {}
       }
     };
   }

package/dist/production/src/acl/builder/PermissionOverrider.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"PermissionOverrider.js","sources":["../../../../../../packages/schema-definition/src/acl/builder/PermissionOverrider.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\nimport { tuple } from '../../utils'\n\nexport default class PermissionOverrider {\n\tpublic override(original: Acl.Permissions, overrides: Acl.Permissions): Acl.Permissions {\n\t\treturn Object.entries({ ...overrides, ...original })\n\t\t\t.map(([key, value]) => {\n\t\t\t\tif (overrides[key]) {\n\t\t\t\t\treturn tuple(key, this.overrideEntityPermissions(value, overrides[key]))\n\t\t\t\t}\n\t\t\t\treturn tuple(key, value)\n\t\t\t})\n\t\t\t.reduce((acc, [key, value]) => ({ ...acc, [key]: value }), {})\n\t}\n\n\tprivate overrideEntityPermissions(\n\t\toriginal: Acl.EntityPermissions,\n\t\toverrides: Acl.EntityPermissions,\n\t): Acl.EntityPermissions {\n\t\treturn {\n\t\t\tpredicates: { ...original.predicates, ...overrides.predicates },\n\t\t\toperations: {\n\t\t\t\tcreate: { ...(original.operations.create \|\| {}), ...(overrides.operations.create \|\| {}) },\n\t\t\t\tread: { ...(original.operations.read \|\| {}), ...(overrides.operations.read \|\| {}) },\n\t\t\t\tupdate: { ...(original.operations.update \|\| {}), ...(overrides.operations.update \|\| {}) },\n\t\t\t\t...(original.operations.delete === undefined && overrides.operations.delete === undefined\n\t\t\t\t\t? {}\n\t\t\t\t\t: {\n\t\t\t\t\t\tdelete: overrides.operations.delete ?? original.operations.delete,\n\t\t\t\t\t }),\n\t\t\t\t...(original.operations.customPrimary === undefined && overrides.operations.customPrimary === undefined\n\t\t\t\t\t? {}\n\t\t\t\t\t: {\n\t\t\t\t\t\tcustomPrimary: overrides.operations.customPrimary ?? original.operations.customPrimary,\n\t\t\t\t\t }),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;AAGA,MAAqB,oBAAoB;AAAA,EACjC,SAAS,UAA2B,WAA6C;AACvF,WAAO,OAAO,QAAQ,EAAE,GAAG,WAAW,GAAG,UAAU,EACjD,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;AAClB,UAAA,UAAU,GAAG,GAAG;AACZ,eAAA,MAAM,KAAK,KAAK,0BAA0B,OAAO,UAAU,GAAG,CAAC,CAAC;AAAA,MAAA;AAEjE,aAAA,MAAM,KAAK,KAAK;AAAA,IACvB,CAAA,EACA,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,GAAG,MAAM,IAAI,CAAA,CAAE;AAAA,EAAA;AAAA,EAGvD,0BACP,UACA,WACwB;AACjB,WAAA;AAAA,MACN,YAAY,EAAE,GAAG,SAAS,YAAY,GAAG,UAAU,WAAW;AAAA,MAC9D,YAAY;AAAA,QACX,QAAQ,EAAE,GAAI,SAAS,WAAW,UAAU,IAAK,GAAI,UAAU,WAAW,UAAU,GAAI;AAAA,QACxF,MAAM,EAAE,GAAI,SAAS,WAAW,QAAQ,IAAK,GAAI,UAAU,WAAW,QAAQ,GAAI;AAAA,QAClF,QAAQ,EAAE,GAAI,SAAS,WAAW,UAAU,IAAK,GAAI,UAAU,WAAW,UAAU,GAAI;AAAA,QACxF,GAAI,SAAS,WAAW,WAAW,UAAa,UAAU,WAAW,WAAW,SAC7E,KACA;AAAA,UACD,QAAQ,UAAU,WAAW,UAAU,SAAS,WAAW;AAAA,QAC1D;AAAA,QACH,GAAI,SAAS,WAAW,kBAAkB,UAAa,UAAU,WAAW,kBAAkB,SAC3F,KACA;AAAA,UACD,eAAe,UAAU,WAAW,iBAAiB,SAAS,WAAW;AAAA,~~QAAA~~;AAAA,~~MACxE~~;AAAA,~~IAEL~~;AAAA,EAAA;AAEF;"}
1	+ {"version":3,"file":"PermissionOverrider.js","sources":["../../../../../../packages/schema-definition/src/acl/builder/PermissionOverrider.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\nimport { tuple } from '../../utils'\n\nexport default class PermissionOverrider {\n\tpublic override(original: Acl.Permissions, overrides: Acl.Permissions): Acl.Permissions {\n\t\treturn Object.entries({ ...overrides, ...original })\n\t\t\t.map(([key, value]) => {\n\t\t\t\tif (overrides[key]) {\n\t\t\t\t\treturn tuple(key, this.overrideEntityPermissions(value, overrides[key]))\n\t\t\t\t}\n\t\t\t\treturn tuple(key, value)\n\t\t\t})\n\t\t\t.reduce((acc, [key, value]) => ({ ...acc, [key]: value }), {})\n\t}\n\n\tprivate overrideEntityPermissions(\n\t\toriginal: Acl.EntityPermissions,\n\t\toverrides: Acl.EntityPermissions,\n\t): Acl.EntityPermissions {\n\t\treturn {\n\t\t\tpredicates: { ...original.predicates, ...overrides.predicates },\n\t\t\toperations: {\n\t\t\t\tcreate: { ...(original.operations.create \|\| {}), ...(overrides.operations.create \|\| {}) },\n\t\t\t\tread: { ...(original.operations.read \|\| {}), ...(overrides.operations.read \|\| {}) },\n\t\t\t\tupdate: { ...(original.operations.update \|\| {}), ...(overrides.operations.update \|\| {}) },\n\t\t\t\t...(original.operations.delete === undefined && overrides.operations.delete === undefined\n\t\t\t\t\t? {}\n\t\t\t\t\t: {\n\t\t\t\t\t\tdelete: overrides.operations.delete ?? original.operations.delete,\n\t\t\t\t\t }),\n\t\t\t\t...(original.operations.customPrimary === undefined && overrides.operations.customPrimary === undefined\n\t\t\t\t\t? {}\n\t\t\t\t\t: {\n\t\t\t\t\t\tcustomPrimary: overrides.operations.customPrimary ?? original.operations.customPrimary,\n\t\t\t\t\t }),\n\t\t\t\t...(original.operations.noRoot \|\| overrides.operations.noRoot ? {\n\t\t\t\t\tnoRoot: [\n\t\t\t\t\t\t...(original.operations.noRoot \|\| []),\n\t\t\t\t\t\t...(overrides.operations.noRoot \|\| []),\n\t\t\t\t\t],\n\t\t\t\t} : {}),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;AAGA,MAAqB,oBAAoB;AAAA,EACjC,SAAS,UAA2B,WAA6C;AACvF,WAAO,OAAO,QAAQ,EAAE,GAAG,WAAW,GAAG,UAAU,EACjD,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;AAClB,UAAA,UAAU,GAAG,GAAG;AACZ,eAAA,MAAM,KAAK,KAAK,0BAA0B,OAAO,UAAU,GAAG,CAAC,CAAC;AAAA,MAAA;AAEjE,aAAA,MAAM,KAAK,KAAK;AAAA,IACvB,CAAA,EACA,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,GAAG,MAAM,IAAI,CAAA,CAAE;AAAA,EAAA;AAAA,EAGvD,0BACP,UACA,WACwB;AACjB,WAAA;AAAA,MACN,YAAY,EAAE,GAAG,SAAS,YAAY,GAAG,UAAU,WAAW;AAAA,MAC9D,YAAY;AAAA,QACX,QAAQ,EAAE,GAAI,SAAS,WAAW,UAAU,IAAK,GAAI,UAAU,WAAW,UAAU,GAAI;AAAA,QACxF,MAAM,EAAE,GAAI,SAAS,WAAW,QAAQ,IAAK,GAAI,UAAU,WAAW,QAAQ,GAAI;AAAA,QAClF,QAAQ,EAAE,GAAI,SAAS,WAAW,UAAU,IAAK,GAAI,UAAU,WAAW,UAAU,GAAI;AAAA,QACxF,GAAI,SAAS,WAAW,WAAW,UAAa,UAAU,WAAW,WAAW,SAC7E,KACA;AAAA,UACD,QAAQ,UAAU,WAAW,UAAU,SAAS,WAAW;AAAA,QAC1D;AAAA,QACH,GAAI,SAAS,WAAW,kBAAkB,UAAa,UAAU,WAAW,kBAAkB,SAC3F,KACA;AAAA,UACD,eAAe,UAAU,WAAW,iBAAiB,SAAS,WAAW;AAAA,QACxE;AAAA,QACH,GAAI,SAAS,WAAW,UAAU,UAAU,WAAW,SAAS;AAAA,UAC/D,QAAQ;AAAA,YACP,GAAI,SAAS,WAAW,UAAU,CAAC;AAAA,YACnC,GAAI,UAAU,WAAW,UAAU,CAAA;AAAA,UAAC;AAAA,QACrC,IACG,CAAA;AAAA,MAAC;AAAA,IAEP;AAAA,EAAA;AAEF;"}

package/dist/production/src/acl/definition/internal/AclFactory.cjs CHANGED Viewed

@@ -39,6 +39,10 @@ class AclFactory {
       const entity = schemaUtils.getEntity(this.model, entityName);
       const predicatesResolver = EntityPredicateResolver.EntityPredicatesResolver.create(rolePermissions, this.model, entity);
       const entityOperations = {};
+      const noRootOptions = this.getNoRootOptions(entity, rolePermissions.get(entityName));
+      if (noRootOptions?.length) {
+        entityOperations.noRoot = noRootOptions;
+      }
       for (const op of ["create", "update", "read"]) {
         const fieldPermissions = {};
         for (const field of Object.keys(entity.fields)) {
@@ -64,6 +68,24 @@ class AclFactory {
       }];
     }));
   }
+  getNoRootOptions(entity, permissions) {
+    const allowedRoot = /* @__PURE__ */ new Set();
+    const disallowedRoot = /* @__PURE__ */ new Set();
+    for (const def of permissions?.definitions ?? []) {
+      const noRoot = def.through === true;
+      for (const op of ["create", "read", "update", "delete"]) {
+        if (def[op]) {
+          const currentSet = noRoot ? disallowedRoot : allowedRoot;
+          currentSet.add(op);
+          const otherSet = noRoot ? allowedRoot : disallowedRoot;
+          if (otherSet.has(op)) {
+            throw new Error(`Operation ${op} cannot be both allowed and disallowed on root on entity ${entity.name}`);
+          }
+        }
+      }
+    }
+    return [...disallowedRoot.values()];
+  }
   createVariables(role, variables2) {
     const roleVariables = variables2.filter((it) => it.roles.includes(role));
     return Object.fromEntries(roleVariables.map((variable) => {

package/dist/production/src/acl/definition/internal/AclFactory.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"AclFactory.cjs","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/AclFactory.ts"],"sourcesContent":["import { Acl, Model, Writable } from '@contember/schema'\nimport { getEntity } from '@contember/schema-utils'\n\nimport { EntityPredicatesResolver } from './EntityPredicateResolver'\nimport { AllowDefinition } from '../permissions'\nimport {\n\tallowCustomPrimaryAllRolesStore,\n\tallowCustomPrimaryStore,\n\tallowDefinitionsStore,\n\tEntityPermissionsDefinition,\n} from './stores'\nimport { Role } from '../roles'\nimport { VariableDefinition } from '../variables'\nimport { filterEntityDefinition } from '../../../utils'\n\nexport class AclFactory {\n\tconstructor(\n\t\tprivate model: Model.Schema,\n\t) {\n\t}\n\n\tpublic create(\n\t\texportedDefinitions: Record<string, any>,\n\t): Acl.Schema {\n\t\tconst entityLikeDefinition = filterEntityDefinition(exportedDefinitions)\n\t\tconst roles: Role[] = Object.values(exportedDefinitions).filter(it => it instanceof Role)\n\t\tconst variables: VariableDefinition[] = Object.values(exportedDefinitions).filter(it => it instanceof VariableDefinition)\n\n\t\tconst groupedPermissions = AclFactory.groupPermissions(entityLikeDefinition, roles)\n\n\t\treturn {\n\t\t\troles: Object.fromEntries(roles.map((role): [string, Acl.RolePermissions] => {\n\t\t\t\tconst rolePermissions = groupedPermissions.get(role)\n\t\t\t\treturn [\n\t\t\t\t\trole.name,\n\t\t\t\t\t{\n\t\t\t\t\t\t...role.options,\n\t\t\t\t\t\tstages: role.options.stages ?? '*',\n\t\t\t\t\t\tentities: this.createPermissions(rolePermissions),\n\t\t\t\t\t\tvariables: this.createVariables(role, variables),\n\t\t\t\t\t},\n\t\t\t\t]\n\t\t\t})),\n\t\t}\n\t}\n\n\tprivate createPermissions(rolePermissions: PermissionsByEntity \| undefined): Acl.Permissions {\n\t\tif (!rolePermissions) {\n\t\t\treturn {}\n\t\t}\n\t\treturn Object.fromEntries(Array.from(rolePermissions.keys()).map((entityName): [string, Acl.EntityPermissions] => {\n\t\t\tconst entity = getEntity(this.model, entityName)\n\n\t\t\tconst predicatesResolver = EntityPredicatesResolver.create(rolePermissions, this.model, entity)\n\n\t\t\tconst entityOperations: Writable<Acl.EntityOperations> = {}\n\t\t\tfor (const op of ['create', 'update', 'read'] as const) {\n\t\t\t\tconst fieldPermissions: Writable<Acl.FieldPermissions> = {}\n\t\t\t\tfor (const field of Object.keys(entity.fields)) {\n\t\t\t\t\tconst predicate = predicatesResolver.createFieldPredicate(op, field, field === entity.primary)\n\t\t\t\t\tif (predicate !== undefined) {\n\t\t\t\t\t\tfieldPermissions[field] = predicate\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tif (Object.keys(fieldPermissions).length > 0) {\n\t\t\t\t\tentityOperations[op] = fieldPermissions\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst delPredicate = predicatesResolver.createFieldPredicate('delete', '', false)\n\t\t\tif (delPredicate !== undefined) {\n\t\t\t\tentityOperations.delete = delPredicate\n\t\t\t}\n\t\t\tif (rolePermissions.get(entityName)?.allowCustomPrimary) {\n\t\t\t\tentityOperations.customPrimary = true\n\t\t\t}\n\t\t\treturn [entityName, {\n\t\t\t\tpredicates: predicatesResolver.getUsedPredicates(),\n\t\t\t\toperations: entityOperations,\n\t\t\t}]\n\t\t}))\n\t}\n\n\tprivate createVariables(role: Role, variables: VariableDefinition[]): Acl.Variables {\n\t\tconst roleVariables = variables.filter(it => it.roles.includes(role))\n\t\treturn Object.fromEntries(roleVariables.map((variable): [string, Acl.Variable] => {\n\t\t\treturn [variable.name, variable.variable]\n\t\t}))\n\t}\n\n\tprivate static groupPermissions(entityLikeDefinition: [string, { new(): any }][], roles: Role[]): PermissionsByRoleAndEntity {\n\t\tconst groupedPermissions: PermissionsByRoleAndEntity = new Map()\n\t\tfor (const [name, entity] of entityLikeDefinition) {\n\t\t\tconst initEntityPermissions = (role: Role): EntityPermissions => {\n\t\t\t\tconst rolePermissions: PermissionsByEntity = groupedPermissions.get(role) ?? new Map()\n\t\t\t\tgroupedPermissions.set(role, rolePermissions)\n\t\t\t\tconst entityPermissions = rolePermissions.get(name) ?? {\n\t\t\t\t\tallowCustomPrimary: false,\n\t\t\t\t\tdefinitions: [],\n\t\t\t\t}\n\t\t\t\trolePermissions.set(name, entityPermissions)\n\t\t\t\treturn entityPermissions\n\t\t\t}\n\t\t\tconst metadata: EntityPermissionsDefinition[] = allowDefinitionsStore.get(entity)\n\t\t\tfor (const { role, ...definition } of metadata) {\n\t\t\t\tif (!roles.includes(role)) {\n\t\t\t\t\tthrow `Role ${role.name} used on entity ${name} is not registered. Have you exported it?`\n\t\t\t\t}\n\t\t\t\tconst entityPermissions = initEntityPermissions(role)\n\t\t\t\tentityPermissions.definitions.push(definition)\n\t\t\t}\n\n\t\t\tconst rolesWithCustomPrimary = allowCustomPrimaryAllRolesStore.get(entity) ? roles : allowCustomPrimaryStore.get(entity)\n\t\t\tfor (const role of rolesWithCustomPrimary) {\n\t\t\t\tinitEntityPermissions(role).allowCustomPrimary = true\n\t\t\t}\n\t\t}\n\n\t\treturn groupedPermissions\n\t}\n}\n\n\nexport type EntityPermissions = { definitions: AllowDefinition<any>[]; allowCustomPrimary: boolean }\nexport type PermissionsByEntity = Map<string, EntityPermissions>\nexport type PermissionsByRoleAndEntity = Map<Role, PermissionsByEntity>\n"],"names":["filterEntityDefinition","roles","Role","variables","VariableDefinition","getEntity","EntityPredicatesResolver","allowDefinitionsStore","allowCustomPrimaryAllRolesStore","allowCustomPrimaryStore"],"mappings":";;;;;;;;;AAeO,MAAM,WAAW;AAAA,EACvB,YACS,OACP;AADO,SAAA,QAAA;AAAA,EAAA;AAAA,EAIF,OACN,qBACa;AACP,UAAA,uBAAuBA,8CAAuB,mBAAmB;AACjE,UAAAC,UAAgB,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAcC,UAAI;AAClF,UAAAC,cAAkC,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAcC,4BAAkB;AAExH,UAAM,qBAAqB,WAAW,iBAAiB,sBAAsBH,OAAK;AAE3E,WAAA;AAAA,MACN,OAAO,OAAO,YAAYA,QAAM,IAAI,CAAC,SAAwC;AACtE,cAAA,kBAAkB,mBAAmB,IAAI,IAAI;AAC5C,eAAA;AAAA,UACN,KAAK;AAAA,UACL;AAAA,YACC,GAAG,KAAK;AAAA,YACR,QAAQ,KAAK,QAAQ,UAAU;AAAA,YAC/B,UAAU,KAAK,kBAAkB,eAAe;AAAA,YAChD,WAAW,KAAK,gBAAgB,MAAME,WAAS;AAAA,UAAA;AAAA,QAEjD;AAAA,MAAA,CACA,CAAC;AAAA,IACH;AAAA,EAAA;AAAA,EAGO,kBAAkB,iBAAmE;AAC5F,QAAI,CAAC,iBAAiB;AACrB,aAAO,CAAC;AAAA,IAAA;AAEF,WAAA,OAAO,YAAY,MAAM,KAAK,gBAAgB,MAAM,EAAE,IAAI,CAAC,eAAgD;AACjH,YAAM,SAASE,YAAA,UAAU,KAAK,OAAO,UAAU;AAE/C,YAAM,qBAAqBC,wBAAAA,yBAAyB,OAAO,iBAAiB,KAAK,OAAO,MAAM;AAE9F,YAAM,mBAAmD,CAAC;~~AAC1D~~,iBAAW,MAAM,CAAC,UAAU,UAAU,MAAM,GAAY;AACvD,cAAM,mBAAmD,CAAC;AAC1D,mBAAW,SAAS,OAAO,KAAK,OAAO,MAAM,GAAG;AAC/C,gBAAM,YAAY,mBAAmB,qBAAqB,IAAI,OAAO,UAAU,OAAO,OAAO;AAC7F,cAAI,cAAc,QAAW;AAC5B,6BAAiB,KAAK,IAAI;AAAA,UAAA;AAAA,QAC3B;AAED,YAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,GAAG;AAC7C,2BAAiB,EAAE,IAAI;AAAA,QAAA;AAAA,MACxB;AAED,YAAM,eAAe,mBAAmB,qBAAqB,UAAU,IAAI,KAAK;AAChF,UAAI,iBAAiB,QAAW;AAC/B,yBAAiB,SAAS;AAAA,MAAA;AAE3B,UAAI,gBAAgB,IAAI,UAAU,GAAG,oBAAoB;AACxD,yBAAiB,gBAAgB;AAAA,MAAA;AAElC,aAAO,CAAC,YAAY;AAAA,QACnB,YAAY,mBAAmB,kBAAkB;AAAA,QACjD,YAAY;AAAA,MAAA,~~CACZ~~;AAAA,IAAA,CACD,CAAC;AAAA,EAAA;AAAA,~~EAGK~~,gBAAgB,MAAYH,YAAgD;AAC7E,UAAA,gBAAgBA,WAAU,OAAO,CAAA,OAAM,GAAG,MAAM,SAAS,IAAI,CAAC;AACpE,WAAO,OAAO,YAAY,cAAc,IAAI,CAAC,aAAqC;AACjF,aAAO,CAAC,SAAS,MAAM,SAAS,QAAQ;AAAA,IAAA,CACxC,CAAC;AAAA,EAAA;AAAA,EAGH,OAAe,iBAAiB,sBAAkDF,QAA2C;AACtH,UAAA,yCAAqD,IAAI;AAC/D,eAAW,CAAC,MAAM,MAAM,KAAK,sBAAsB;AAC5C,YAAA,wBAAwB,CAAC,SAAkC;AAChE,cAAM,kBAAuC,mBAAmB,IAAI,IAAI,yBAAS,IAAI;AAClE,2BAAA,IAAI,MAAM,eAAe;AAC5C,cAAM,oBAAoB,gBAAgB,IAAI,IAAI,KAAK;AAAA,UACtD,oBAAoB;AAAA,UACpB,aAAa,CAAA;AAAA,QACd;AACgB,wBAAA,IAAI,MAAM,iBAAiB;AACpC,eAAA;AAAA,MACR;AACM,YAAA,WAA0CM,OAAAA,sBAAsB,IAAI,MAAM;AAChF,iBAAW,EAAE,MAAM,GAAG,WAAA,KAAgB,UAAU;AAC/C,YAAI,CAACN,OAAM,SAAS,IAAI,GAAG;AAC1B,gBAAM,QAAQ,KAAK,IAAI,mBAAmB,IAAI;AAAA,QAAA;AAEzC,cAAA,oBAAoB,sBAAsB,IAAI;AAClC,0BAAA,YAAY,KAAK,UAAU;AAAA,MAAA;AAGxC,YAAA,yBAAyBO,uCAAgC,IAAI,MAAM,IAAIP,SAAQQ,OAAAA,wBAAwB,IAAI,MAAM;AACvH,iBAAW,QAAQ,wBAAwB;AACpB,8BAAA,IAAI,EAAE,qBAAqB;AAAA,MAAA;AAAA,IAClD;AAGM,WAAA;AAAA,EAAA;AAET;;"}
1	+ {"version":3,"file":"AclFactory.cjs","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/AclFactory.ts"],"sourcesContent":["import { Acl, Model, Writable } from '@contember/schema'\nimport { getEntity } from '@contember/schema-utils'\n\nimport { EntityPredicatesResolver } from './EntityPredicateResolver'\nimport { AllowDefinition } from '../permissions'\nimport {\n\tallowCustomPrimaryAllRolesStore,\n\tallowCustomPrimaryStore,\n\tallowDefinitionsStore,\n\tEntityPermissionsDefinition,\n} from './stores'\nimport { Role } from '../roles'\nimport { VariableDefinition } from '../variables'\nimport { filterEntityDefinition } from '../../../utils'\n\nexport class AclFactory {\n\tconstructor(\n\t\tprivate model: Model.Schema,\n\t) {\n\t}\n\n\tpublic create(\n\t\texportedDefinitions: Record<string, any>,\n\t): Acl.Schema {\n\t\tconst entityLikeDefinition = filterEntityDefinition(exportedDefinitions)\n\t\tconst roles: Role[] = Object.values(exportedDefinitions).filter(it => it instanceof Role)\n\t\tconst variables: VariableDefinition[] = Object.values(exportedDefinitions).filter(it => it instanceof VariableDefinition)\n\n\t\tconst groupedPermissions = AclFactory.groupPermissions(entityLikeDefinition, roles)\n\n\t\treturn {\n\t\t\troles: Object.fromEntries(roles.map((role): [string, Acl.RolePermissions] => {\n\t\t\t\tconst rolePermissions = groupedPermissions.get(role)\n\t\t\t\treturn [\n\t\t\t\t\trole.name,\n\t\t\t\t\t{\n\t\t\t\t\t\t...role.options,\n\t\t\t\t\t\tstages: role.options.stages ?? '*',\n\t\t\t\t\t\tentities: this.createPermissions(rolePermissions),\n\t\t\t\t\t\tvariables: this.createVariables(role, variables),\n\t\t\t\t\t},\n\t\t\t\t]\n\t\t\t})),\n\t\t}\n\t}\n\n\tprivate createPermissions(rolePermissions: PermissionsByEntity \| undefined): Acl.Permissions {\n\t\tif (!rolePermissions) {\n\t\t\treturn {}\n\t\t}\n\t\treturn Object.fromEntries(Array.from(rolePermissions.keys()).map((entityName): [string, Acl.EntityPermissions] => {\n\t\t\tconst entity = getEntity(this.model, entityName)\n\n\t\t\tconst predicatesResolver = EntityPredicatesResolver.create(rolePermissions, this.model, entity)\n\n\t\t\tconst entityOperations: Writable<Acl.EntityOperations> = {\n\t\t\t}\n\t\t\tconst noRootOptions = this.getNoRootOptions(entity, rolePermissions.get(entityName))\n\t\t\tif (noRootOptions?.length) {\n\t\t\t\tentityOperations.noRoot = noRootOptions\n\t\t\t}\n\t\t\tfor (const op of ['create', 'update', 'read'] as const) {\n\t\t\t\tconst fieldPermissions: Writable<Acl.FieldPermissions> = {}\n\t\t\t\tfor (const field of Object.keys(entity.fields)) {\n\t\t\t\t\tconst predicate = predicatesResolver.createFieldPredicate(op, field, field === entity.primary)\n\t\t\t\t\tif (predicate !== undefined) {\n\t\t\t\t\t\tfieldPermissions[field] = predicate\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tif (Object.keys(fieldPermissions).length > 0) {\n\t\t\t\t\tentityOperations[op] = fieldPermissions\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst delPredicate = predicatesResolver.createFieldPredicate('delete', '', false)\n\t\t\tif (delPredicate !== undefined) {\n\t\t\t\tentityOperations.delete = delPredicate\n\t\t\t}\n\t\t\tif (rolePermissions.get(entityName)?.allowCustomPrimary) {\n\t\t\t\tentityOperations.customPrimary = true\n\t\t\t}\n\t\t\treturn [entityName, {\n\t\t\t\tpredicates: predicatesResolver.getUsedPredicates(),\n\t\t\t\toperations: entityOperations,\n\n\t\t\t}]\n\t\t}))\n\t}\n\n\n\tgetNoRootOptions(entity: Model.Entity, permissions?: EntityPermissions): Acl.EntityOperations['noRoot'] {\n\t\tconst allowedRoot = new Set<Acl.Operation>()\n\t\tconst disallowedRoot = new Set<Acl.Operation>()\n\t\tfor (const def of permissions?.definitions ?? []) {\n\t\t\tconst noRoot = def.through === true\n\t\t\tfor (const op of ['create', 'read', 'update', 'delete'] as const) {\n\t\t\t\tif (def[op]) {\n\t\t\t\t\tconst currentSet = noRoot ? disallowedRoot : allowedRoot\n\t\t\t\t\tcurrentSet.add(op as Acl.Operation)\n\n\t\t\t\t\tconst otherSet = noRoot ? allowedRoot : disallowedRoot\n\n\t\t\t\t\tif (otherSet.has(op as Acl.Operation)) {\n\t\t\t\t\t\tthrow new Error(`Operation ${op} cannot be both allowed and disallowed on root on entity ${entity.name}`)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t}\n\t\treturn [...disallowedRoot.values()]\n\t}\n\n\tprivate createVariables(role: Role, variables: VariableDefinition[]): Acl.Variables {\n\t\tconst roleVariables = variables.filter(it => it.roles.includes(role))\n\t\treturn Object.fromEntries(roleVariables.map((variable): [string, Acl.Variable] => {\n\t\t\treturn [variable.name, variable.variable]\n\t\t}))\n\t}\n\n\tprivate static groupPermissions(entityLikeDefinition: [string, { new(): any }][], roles: Role[]): PermissionsByRoleAndEntity {\n\t\tconst groupedPermissions: PermissionsByRoleAndEntity = new Map()\n\t\tfor (const [name, entity] of entityLikeDefinition) {\n\t\t\tconst initEntityPermissions = (role: Role): EntityPermissions => {\n\t\t\t\tconst rolePermissions: PermissionsByEntity = groupedPermissions.get(role) ?? new Map()\n\t\t\t\tgroupedPermissions.set(role, rolePermissions)\n\t\t\t\tconst entityPermissions = rolePermissions.get(name) ?? {\n\t\t\t\t\tallowCustomPrimary: false,\n\t\t\t\t\tdefinitions: [],\n\t\t\t\t}\n\t\t\t\trolePermissions.set(name, entityPermissions)\n\t\t\t\treturn entityPermissions\n\t\t\t}\n\t\t\tconst metadata: EntityPermissionsDefinition[] = allowDefinitionsStore.get(entity)\n\t\t\tfor (const { role, ...definition } of metadata) {\n\t\t\t\tif (!roles.includes(role)) {\n\t\t\t\t\tthrow `Role ${role.name} used on entity ${name} is not registered. Have you exported it?`\n\t\t\t\t}\n\t\t\t\tconst entityPermissions = initEntityPermissions(role)\n\t\t\t\tentityPermissions.definitions.push(definition)\n\t\t\t}\n\n\t\t\tconst rolesWithCustomPrimary = allowCustomPrimaryAllRolesStore.get(entity) ? roles : allowCustomPrimaryStore.get(entity)\n\t\t\tfor (const role of rolesWithCustomPrimary) {\n\t\t\t\tinitEntityPermissions(role).allowCustomPrimary = true\n\t\t\t}\n\t\t}\n\n\t\treturn groupedPermissions\n\t}\n}\n\n\nexport type EntityPermissions = { definitions: AllowDefinition<any>[]; allowCustomPrimary: boolean }\nexport type PermissionsByEntity = Map<string, EntityPermissions>\nexport type PermissionsByRoleAndEntity = Map<Role, PermissionsByEntity>\n"],"names":["filterEntityDefinition","roles","Role","variables","VariableDefinition","getEntity","EntityPredicatesResolver","allowDefinitionsStore","allowCustomPrimaryAllRolesStore","allowCustomPrimaryStore"],"mappings":";;;;;;;;;AAeO,MAAM,WAAW;AAAA,EACvB,YACS,OACP;AADO,SAAA,QAAA;AAAA,EAAA;AAAA,EAIF,OACN,qBACa;AACP,UAAA,uBAAuBA,8CAAuB,mBAAmB;AACjE,UAAAC,UAAgB,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAcC,UAAI;AAClF,UAAAC,cAAkC,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAcC,4BAAkB;AAExH,UAAM,qBAAqB,WAAW,iBAAiB,sBAAsBH,OAAK;AAE3E,WAAA;AAAA,MACN,OAAO,OAAO,YAAYA,QAAM,IAAI,CAAC,SAAwC;AACtE,cAAA,kBAAkB,mBAAmB,IAAI,IAAI;AAC5C,eAAA;AAAA,UACN,KAAK;AAAA,UACL;AAAA,YACC,GAAG,KAAK;AAAA,YACR,QAAQ,KAAK,QAAQ,UAAU;AAAA,YAC/B,UAAU,KAAK,kBAAkB,eAAe;AAAA,YAChD,WAAW,KAAK,gBAAgB,MAAME,WAAS;AAAA,UAAA;AAAA,QAEjD;AAAA,MAAA,CACA,CAAC;AAAA,IACH;AAAA,EAAA;AAAA,EAGO,kBAAkB,iBAAmE;AAC5F,QAAI,CAAC,iBAAiB;AACrB,aAAO,CAAC;AAAA,IAAA;AAEF,WAAA,OAAO,YAAY,MAAM,KAAK,gBAAgB,MAAM,EAAE,IAAI,CAAC,eAAgD;AACjH,YAAM,SAASE,YAAA,UAAU,KAAK,OAAO,UAAU;AAE/C,YAAM,qBAAqBC,wBAAAA,yBAAyB,OAAO,iBAAiB,KAAK,OAAO,MAAM;AAE9F,YAAM,mBAAmD,CACzD;AACA,YAAM,gBAAgB,KAAK,iBAAiB,QAAQ,gBAAgB,IAAI,UAAU,CAAC;AACnF,UAAI,eAAe,QAAQ;AAC1B,yBAAiB,SAAS;AAAA,MAAA;AAE3B,iBAAW,MAAM,CAAC,UAAU,UAAU,MAAM,GAAY;AACvD,cAAM,mBAAmD,CAAC;AAC1D,mBAAW,SAAS,OAAO,KAAK,OAAO,MAAM,GAAG;AAC/C,gBAAM,YAAY,mBAAmB,qBAAqB,IAAI,OAAO,UAAU,OAAO,OAAO;AAC7F,cAAI,cAAc,QAAW;AAC5B,6BAAiB,KAAK,IAAI;AAAA,UAAA;AAAA,QAC3B;AAED,YAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,GAAG;AAC7C,2BAAiB,EAAE,IAAI;AAAA,QAAA;AAAA,MACxB;AAED,YAAM,eAAe,mBAAmB,qBAAqB,UAAU,IAAI,KAAK;AAChF,UAAI,iBAAiB,QAAW;AAC/B,yBAAiB,SAAS;AAAA,MAAA;AAE3B,UAAI,gBAAgB,IAAI,UAAU,GAAG,oBAAoB;AACxD,yBAAiB,gBAAgB;AAAA,MAAA;AAElC,aAAO,CAAC,YAAY;AAAA,QACnB,YAAY,mBAAmB,kBAAkB;AAAA,QACjD,YAAY;AAAA,MAAA,CAEZ;AAAA,IAAA,CACD,CAAC;AAAA,EAAA;AAAA,EAIH,iBAAiB,QAAsB,aAAiE;AACjG,UAAA,kCAAkB,IAAmB;AACrC,UAAA,qCAAqB,IAAmB;AAC9C,eAAW,OAAO,aAAa,eAAe,CAAA,GAAI;AAC3C,YAAA,SAAS,IAAI,YAAY;AAC/B,iBAAW,MAAM,CAAC,UAAU,QAAQ,UAAU,QAAQ,GAAY;AAC7D,YAAA,IAAI,EAAE,GAAG;AACN,gBAAA,aAAa,SAAS,iBAAiB;AAC7C,qBAAW,IAAI,EAAmB;AAE5B,gBAAA,WAAW,SAAS,cAAc;AAEpC,cAAA,SAAS,IAAI,EAAmB,GAAG;AACtC,kBAAM,IAAI,MAAM,aAAa,EAAE,4DAA4D,OAAO,IAAI,EAAE;AAAA,UAAA;AAAA,QACzG;AAAA,MACD;AAAA,IACD;AAGD,WAAO,CAAC,GAAG,eAAe,QAAQ;AAAA,EAAA;AAAA,EAG3B,gBAAgB,MAAYH,YAAgD;AAC7E,UAAA,gBAAgBA,WAAU,OAAO,CAAA,OAAM,GAAG,MAAM,SAAS,IAAI,CAAC;AACpE,WAAO,OAAO,YAAY,cAAc,IAAI,CAAC,aAAqC;AACjF,aAAO,CAAC,SAAS,MAAM,SAAS,QAAQ;AAAA,IAAA,CACxC,CAAC;AAAA,EAAA;AAAA,EAGH,OAAe,iBAAiB,sBAAkDF,QAA2C;AACtH,UAAA,yCAAqD,IAAI;AAC/D,eAAW,CAAC,MAAM,MAAM,KAAK,sBAAsB;AAC5C,YAAA,wBAAwB,CAAC,SAAkC;AAChE,cAAM,kBAAuC,mBAAmB,IAAI,IAAI,yBAAS,IAAI;AAClE,2BAAA,IAAI,MAAM,eAAe;AAC5C,cAAM,oBAAoB,gBAAgB,IAAI,IAAI,KAAK;AAAA,UACtD,oBAAoB;AAAA,UACpB,aAAa,CAAA;AAAA,QACd;AACgB,wBAAA,IAAI,MAAM,iBAAiB;AACpC,eAAA;AAAA,MACR;AACM,YAAA,WAA0CM,OAAAA,sBAAsB,IAAI,MAAM;AAChF,iBAAW,EAAE,MAAM,GAAG,WAAA,KAAgB,UAAU;AAC/C,YAAI,CAACN,OAAM,SAAS,IAAI,GAAG;AAC1B,gBAAM,QAAQ,KAAK,IAAI,mBAAmB,IAAI;AAAA,QAAA;AAEzC,cAAA,oBAAoB,sBAAsB,IAAI;AAClC,0BAAA,YAAY,KAAK,UAAU;AAAA,MAAA;AAGxC,YAAA,yBAAyBO,uCAAgC,IAAI,MAAM,IAAIP,SAAQQ,OAAAA,wBAAwB,IAAI,MAAM;AACvH,iBAAW,QAAQ,wBAAwB;AACpB,8BAAA,IAAI,EAAE,qBAAqB;AAAA,MAAA;AAAA,IAClD;AAGM,WAAA;AAAA,EAAA;AAET;;"}

package/dist/production/src/acl/definition/internal/AclFactory.js CHANGED Viewed

@@ -37,6 +37,10 @@ class AclFactory {
       const entity = getEntity(this.model, entityName);
       const predicatesResolver = EntityPredicatesResolver.create(rolePermissions, this.model, entity);
       const entityOperations = {};
+      const noRootOptions = this.getNoRootOptions(entity, rolePermissions.get(entityName));
+      if (noRootOptions?.length) {
+        entityOperations.noRoot = noRootOptions;
+      }
       for (const op of ["create", "update", "read"]) {
         const fieldPermissions = {};
         for (const field of Object.keys(entity.fields)) {
@@ -62,6 +66,24 @@ class AclFactory {
       }];
     }));
   }
+  getNoRootOptions(entity, permissions) {
+    const allowedRoot = /* @__PURE__ */ new Set();
+    const disallowedRoot = /* @__PURE__ */ new Set();
+    for (const def of permissions?.definitions ?? []) {
+      const noRoot = def.through === true;
+      for (const op of ["create", "read", "update", "delete"]) {
+        if (def[op]) {
+          const currentSet = noRoot ? disallowedRoot : allowedRoot;
+          currentSet.add(op);
+          const otherSet = noRoot ? allowedRoot : disallowedRoot;
+          if (otherSet.has(op)) {
+            throw new Error(`Operation ${op} cannot be both allowed and disallowed on root on entity ${entity.name}`);
+          }
+        }
+      }
+    }
+    return [...disallowedRoot.values()];
+  }
   createVariables(role, variables) {
     const roleVariables = variables.filter((it) => it.roles.includes(role));
     return Object.fromEntries(roleVariables.map((variable) => {

package/dist/production/src/acl/definition/internal/AclFactory.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"AclFactory.js","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/AclFactory.ts"],"sourcesContent":["import { Acl, Model, Writable } from '@contember/schema'\nimport { getEntity } from '@contember/schema-utils'\n\nimport { EntityPredicatesResolver } from './EntityPredicateResolver'\nimport { AllowDefinition } from '../permissions'\nimport {\n\tallowCustomPrimaryAllRolesStore,\n\tallowCustomPrimaryStore,\n\tallowDefinitionsStore,\n\tEntityPermissionsDefinition,\n} from './stores'\nimport { Role } from '../roles'\nimport { VariableDefinition } from '../variables'\nimport { filterEntityDefinition } from '../../../utils'\n\nexport class AclFactory {\n\tconstructor(\n\t\tprivate model: Model.Schema,\n\t) {\n\t}\n\n\tpublic create(\n\t\texportedDefinitions: Record<string, any>,\n\t): Acl.Schema {\n\t\tconst entityLikeDefinition = filterEntityDefinition(exportedDefinitions)\n\t\tconst roles: Role[] = Object.values(exportedDefinitions).filter(it => it instanceof Role)\n\t\tconst variables: VariableDefinition[] = Object.values(exportedDefinitions).filter(it => it instanceof VariableDefinition)\n\n\t\tconst groupedPermissions = AclFactory.groupPermissions(entityLikeDefinition, roles)\n\n\t\treturn {\n\t\t\troles: Object.fromEntries(roles.map((role): [string, Acl.RolePermissions] => {\n\t\t\t\tconst rolePermissions = groupedPermissions.get(role)\n\t\t\t\treturn [\n\t\t\t\t\trole.name,\n\t\t\t\t\t{\n\t\t\t\t\t\t...role.options,\n\t\t\t\t\t\tstages: role.options.stages ?? '*',\n\t\t\t\t\t\tentities: this.createPermissions(rolePermissions),\n\t\t\t\t\t\tvariables: this.createVariables(role, variables),\n\t\t\t\t\t},\n\t\t\t\t]\n\t\t\t})),\n\t\t}\n\t}\n\n\tprivate createPermissions(rolePermissions: PermissionsByEntity \| undefined): Acl.Permissions {\n\t\tif (!rolePermissions) {\n\t\t\treturn {}\n\t\t}\n\t\treturn Object.fromEntries(Array.from(rolePermissions.keys()).map((entityName): [string, Acl.EntityPermissions] => {\n\t\t\tconst entity = getEntity(this.model, entityName)\n\n\t\t\tconst predicatesResolver = EntityPredicatesResolver.create(rolePermissions, this.model, entity)\n\n\t\t\tconst entityOperations: Writable<Acl.EntityOperations> = {}\n\t\t\tfor (const op of ['create', 'update', 'read'] as const) {\n\t\t\t\tconst fieldPermissions: Writable<Acl.FieldPermissions> = {}\n\t\t\t\tfor (const field of Object.keys(entity.fields)) {\n\t\t\t\t\tconst predicate = predicatesResolver.createFieldPredicate(op, field, field === entity.primary)\n\t\t\t\t\tif (predicate !== undefined) {\n\t\t\t\t\t\tfieldPermissions[field] = predicate\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tif (Object.keys(fieldPermissions).length > 0) {\n\t\t\t\t\tentityOperations[op] = fieldPermissions\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst delPredicate = predicatesResolver.createFieldPredicate('delete', '', false)\n\t\t\tif (delPredicate !== undefined) {\n\t\t\t\tentityOperations.delete = delPredicate\n\t\t\t}\n\t\t\tif (rolePermissions.get(entityName)?.allowCustomPrimary) {\n\t\t\t\tentityOperations.customPrimary = true\n\t\t\t}\n\t\t\treturn [entityName, {\n\t\t\t\tpredicates: predicatesResolver.getUsedPredicates(),\n\t\t\t\toperations: entityOperations,\n\t\t\t}]\n\t\t}))\n\t}\n\n\tprivate createVariables(role: Role, variables: VariableDefinition[]): Acl.Variables {\n\t\tconst roleVariables = variables.filter(it => it.roles.includes(role))\n\t\treturn Object.fromEntries(roleVariables.map((variable): [string, Acl.Variable] => {\n\t\t\treturn [variable.name, variable.variable]\n\t\t}))\n\t}\n\n\tprivate static groupPermissions(entityLikeDefinition: [string, { new(): any }][], roles: Role[]): PermissionsByRoleAndEntity {\n\t\tconst groupedPermissions: PermissionsByRoleAndEntity = new Map()\n\t\tfor (const [name, entity] of entityLikeDefinition) {\n\t\t\tconst initEntityPermissions = (role: Role): EntityPermissions => {\n\t\t\t\tconst rolePermissions: PermissionsByEntity = groupedPermissions.get(role) ?? new Map()\n\t\t\t\tgroupedPermissions.set(role, rolePermissions)\n\t\t\t\tconst entityPermissions = rolePermissions.get(name) ?? {\n\t\t\t\t\tallowCustomPrimary: false,\n\t\t\t\t\tdefinitions: [],\n\t\t\t\t}\n\t\t\t\trolePermissions.set(name, entityPermissions)\n\t\t\t\treturn entityPermissions\n\t\t\t}\n\t\t\tconst metadata: EntityPermissionsDefinition[] = allowDefinitionsStore.get(entity)\n\t\t\tfor (const { role, ...definition } of metadata) {\n\t\t\t\tif (!roles.includes(role)) {\n\t\t\t\t\tthrow `Role ${role.name} used on entity ${name} is not registered. Have you exported it?`\n\t\t\t\t}\n\t\t\t\tconst entityPermissions = initEntityPermissions(role)\n\t\t\t\tentityPermissions.definitions.push(definition)\n\t\t\t}\n\n\t\t\tconst rolesWithCustomPrimary = allowCustomPrimaryAllRolesStore.get(entity) ? roles : allowCustomPrimaryStore.get(entity)\n\t\t\tfor (const role of rolesWithCustomPrimary) {\n\t\t\t\tinitEntityPermissions(role).allowCustomPrimary = true\n\t\t\t}\n\t\t}\n\n\t\treturn groupedPermissions\n\t}\n}\n\n\nexport type EntityPermissions = { definitions: AllowDefinition<any>[]; allowCustomPrimary: boolean }\nexport type PermissionsByEntity = Map<string, EntityPermissions>\nexport type PermissionsByRoleAndEntity = Map<Role, PermissionsByEntity>\n"],"names":[],"mappings":";;;;;;;AAeO,MAAM,WAAW;AAAA,EACvB,YACS,OACP;AADO,SAAA,QAAA;AAAA,EAAA;AAAA,EAIF,OACN,qBACa;AACP,UAAA,uBAAuB,uBAAuB,mBAAmB;AACjE,UAAA,QAAgB,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAc,IAAI;AAClF,UAAA,YAAkC,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAc,kBAAkB;AAExH,UAAM,qBAAqB,WAAW,iBAAiB,sBAAsB,KAAK;AAE3E,WAAA;AAAA,MACN,OAAO,OAAO,YAAY,MAAM,IAAI,CAAC,SAAwC;AACtE,cAAA,kBAAkB,mBAAmB,IAAI,IAAI;AAC5C,eAAA;AAAA,UACN,KAAK;AAAA,UACL;AAAA,YACC,GAAG,KAAK;AAAA,YACR,QAAQ,KAAK,QAAQ,UAAU;AAAA,YAC/B,UAAU,KAAK,kBAAkB,eAAe;AAAA,YAChD,WAAW,KAAK,gBAAgB,MAAM,SAAS;AAAA,UAAA;AAAA,QAEjD;AAAA,MAAA,CACA,CAAC;AAAA,IACH;AAAA,EAAA;AAAA,EAGO,kBAAkB,iBAAmE;AAC5F,QAAI,CAAC,iBAAiB;AACrB,aAAO,CAAC;AAAA,IAAA;AAEF,WAAA,OAAO,YAAY,MAAM,KAAK,gBAAgB,MAAM,EAAE,IAAI,CAAC,eAAgD;AACjH,YAAM,SAAS,UAAU,KAAK,OAAO,UAAU;AAE/C,YAAM,qBAAqB,yBAAyB,OAAO,iBAAiB,KAAK,OAAO,MAAM;AAE9F,YAAM,mBAAmD,CAAC;~~AAC1D~~,iBAAW,MAAM,CAAC,UAAU,UAAU,MAAM,GAAY;AACvD,cAAM,mBAAmD,CAAC;AAC1D,mBAAW,SAAS,OAAO,KAAK,OAAO,MAAM,GAAG;AAC/C,gBAAM,YAAY,mBAAmB,qBAAqB,IAAI,OAAO,UAAU,OAAO,OAAO;AAC7F,cAAI,cAAc,QAAW;AAC5B,6BAAiB,KAAK,IAAI;AAAA,UAAA;AAAA,QAC3B;AAED,YAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,GAAG;AAC7C,2BAAiB,EAAE,IAAI;AAAA,QAAA;AAAA,MACxB;AAED,YAAM,eAAe,mBAAmB,qBAAqB,UAAU,IAAI,KAAK;AAChF,UAAI,iBAAiB,QAAW;AAC/B,yBAAiB,SAAS;AAAA,MAAA;AAE3B,UAAI,gBAAgB,IAAI,UAAU,GAAG,oBAAoB;AACxD,yBAAiB,gBAAgB;AAAA,MAAA;AAElC,aAAO,CAAC,YAAY;AAAA,QACnB,YAAY,mBAAmB,kBAAkB;AAAA,QACjD,YAAY;AAAA,MAAA,~~CACZ~~;AAAA,IAAA,CACD,CAAC;AAAA,EAAA;AAAA,~~EAGK~~,gBAAgB,MAAY,WAAgD;AAC7E,UAAA,gBAAgB,UAAU,OAAO,CAAA,OAAM,GAAG,MAAM,SAAS,IAAI,CAAC;AACpE,WAAO,OAAO,YAAY,cAAc,IAAI,CAAC,aAAqC;AACjF,aAAO,CAAC,SAAS,MAAM,SAAS,QAAQ;AAAA,IAAA,CACxC,CAAC;AAAA,EAAA;AAAA,EAGH,OAAe,iBAAiB,sBAAkD,OAA2C;AACtH,UAAA,yCAAqD,IAAI;AAC/D,eAAW,CAAC,MAAM,MAAM,KAAK,sBAAsB;AAC5C,YAAA,wBAAwB,CAAC,SAAkC;AAChE,cAAM,kBAAuC,mBAAmB,IAAI,IAAI,yBAAS,IAAI;AAClE,2BAAA,IAAI,MAAM,eAAe;AAC5C,cAAM,oBAAoB,gBAAgB,IAAI,IAAI,KAAK;AAAA,UACtD,oBAAoB;AAAA,UACpB,aAAa,CAAA;AAAA,QACd;AACgB,wBAAA,IAAI,MAAM,iBAAiB;AACpC,eAAA;AAAA,MACR;AACM,YAAA,WAA0C,sBAAsB,IAAI,MAAM;AAChF,iBAAW,EAAE,MAAM,GAAG,WAAA,KAAgB,UAAU;AAC/C,YAAI,CAAC,MAAM,SAAS,IAAI,GAAG;AAC1B,gBAAM,QAAQ,KAAK,IAAI,mBAAmB,IAAI;AAAA,QAAA;AAEzC,cAAA,oBAAoB,sBAAsB,IAAI;AAClC,0BAAA,YAAY,KAAK,UAAU;AAAA,MAAA;AAGxC,YAAA,yBAAyB,gCAAgC,IAAI,MAAM,IAAI,QAAQ,wBAAwB,IAAI,MAAM;AACvH,iBAAW,QAAQ,wBAAwB;AACpB,8BAAA,IAAI,EAAE,qBAAqB;AAAA,MAAA;AAAA,IAClD;AAGM,WAAA;AAAA,EAAA;AAET;"}
1	+ {"version":3,"file":"AclFactory.js","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/AclFactory.ts"],"sourcesContent":["import { Acl, Model, Writable } from '@contember/schema'\nimport { getEntity } from '@contember/schema-utils'\n\nimport { EntityPredicatesResolver } from './EntityPredicateResolver'\nimport { AllowDefinition } from '../permissions'\nimport {\n\tallowCustomPrimaryAllRolesStore,\n\tallowCustomPrimaryStore,\n\tallowDefinitionsStore,\n\tEntityPermissionsDefinition,\n} from './stores'\nimport { Role } from '../roles'\nimport { VariableDefinition } from '../variables'\nimport { filterEntityDefinition } from '../../../utils'\n\nexport class AclFactory {\n\tconstructor(\n\t\tprivate model: Model.Schema,\n\t) {\n\t}\n\n\tpublic create(\n\t\texportedDefinitions: Record<string, any>,\n\t): Acl.Schema {\n\t\tconst entityLikeDefinition = filterEntityDefinition(exportedDefinitions)\n\t\tconst roles: Role[] = Object.values(exportedDefinitions).filter(it => it instanceof Role)\n\t\tconst variables: VariableDefinition[] = Object.values(exportedDefinitions).filter(it => it instanceof VariableDefinition)\n\n\t\tconst groupedPermissions = AclFactory.groupPermissions(entityLikeDefinition, roles)\n\n\t\treturn {\n\t\t\troles: Object.fromEntries(roles.map((role): [string, Acl.RolePermissions] => {\n\t\t\t\tconst rolePermissions = groupedPermissions.get(role)\n\t\t\t\treturn [\n\t\t\t\t\trole.name,\n\t\t\t\t\t{\n\t\t\t\t\t\t...role.options,\n\t\t\t\t\t\tstages: role.options.stages ?? '*',\n\t\t\t\t\t\tentities: this.createPermissions(rolePermissions),\n\t\t\t\t\t\tvariables: this.createVariables(role, variables),\n\t\t\t\t\t},\n\t\t\t\t]\n\t\t\t})),\n\t\t}\n\t}\n\n\tprivate createPermissions(rolePermissions: PermissionsByEntity \| undefined): Acl.Permissions {\n\t\tif (!rolePermissions) {\n\t\t\treturn {}\n\t\t}\n\t\treturn Object.fromEntries(Array.from(rolePermissions.keys()).map((entityName): [string, Acl.EntityPermissions] => {\n\t\t\tconst entity = getEntity(this.model, entityName)\n\n\t\t\tconst predicatesResolver = EntityPredicatesResolver.create(rolePermissions, this.model, entity)\n\n\t\t\tconst entityOperations: Writable<Acl.EntityOperations> = {\n\t\t\t}\n\t\t\tconst noRootOptions = this.getNoRootOptions(entity, rolePermissions.get(entityName))\n\t\t\tif (noRootOptions?.length) {\n\t\t\t\tentityOperations.noRoot = noRootOptions\n\t\t\t}\n\t\t\tfor (const op of ['create', 'update', 'read'] as const) {\n\t\t\t\tconst fieldPermissions: Writable<Acl.FieldPermissions> = {}\n\t\t\t\tfor (const field of Object.keys(entity.fields)) {\n\t\t\t\t\tconst predicate = predicatesResolver.createFieldPredicate(op, field, field === entity.primary)\n\t\t\t\t\tif (predicate !== undefined) {\n\t\t\t\t\t\tfieldPermissions[field] = predicate\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tif (Object.keys(fieldPermissions).length > 0) {\n\t\t\t\t\tentityOperations[op] = fieldPermissions\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst delPredicate = predicatesResolver.createFieldPredicate('delete', '', false)\n\t\t\tif (delPredicate !== undefined) {\n\t\t\t\tentityOperations.delete = delPredicate\n\t\t\t}\n\t\t\tif (rolePermissions.get(entityName)?.allowCustomPrimary) {\n\t\t\t\tentityOperations.customPrimary = true\n\t\t\t}\n\t\t\treturn [entityName, {\n\t\t\t\tpredicates: predicatesResolver.getUsedPredicates(),\n\t\t\t\toperations: entityOperations,\n\n\t\t\t}]\n\t\t}))\n\t}\n\n\n\tgetNoRootOptions(entity: Model.Entity, permissions?: EntityPermissions): Acl.EntityOperations['noRoot'] {\n\t\tconst allowedRoot = new Set<Acl.Operation>()\n\t\tconst disallowedRoot = new Set<Acl.Operation>()\n\t\tfor (const def of permissions?.definitions ?? []) {\n\t\t\tconst noRoot = def.through === true\n\t\t\tfor (const op of ['create', 'read', 'update', 'delete'] as const) {\n\t\t\t\tif (def[op]) {\n\t\t\t\t\tconst currentSet = noRoot ? disallowedRoot : allowedRoot\n\t\t\t\t\tcurrentSet.add(op as Acl.Operation)\n\n\t\t\t\t\tconst otherSet = noRoot ? allowedRoot : disallowedRoot\n\n\t\t\t\t\tif (otherSet.has(op as Acl.Operation)) {\n\t\t\t\t\t\tthrow new Error(`Operation ${op} cannot be both allowed and disallowed on root on entity ${entity.name}`)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t}\n\t\treturn [...disallowedRoot.values()]\n\t}\n\n\tprivate createVariables(role: Role, variables: VariableDefinition[]): Acl.Variables {\n\t\tconst roleVariables = variables.filter(it => it.roles.includes(role))\n\t\treturn Object.fromEntries(roleVariables.map((variable): [string, Acl.Variable] => {\n\t\t\treturn [variable.name, variable.variable]\n\t\t}))\n\t}\n\n\tprivate static groupPermissions(entityLikeDefinition: [string, { new(): any }][], roles: Role[]): PermissionsByRoleAndEntity {\n\t\tconst groupedPermissions: PermissionsByRoleAndEntity = new Map()\n\t\tfor (const [name, entity] of entityLikeDefinition) {\n\t\t\tconst initEntityPermissions = (role: Role): EntityPermissions => {\n\t\t\t\tconst rolePermissions: PermissionsByEntity = groupedPermissions.get(role) ?? new Map()\n\t\t\t\tgroupedPermissions.set(role, rolePermissions)\n\t\t\t\tconst entityPermissions = rolePermissions.get(name) ?? {\n\t\t\t\t\tallowCustomPrimary: false,\n\t\t\t\t\tdefinitions: [],\n\t\t\t\t}\n\t\t\t\trolePermissions.set(name, entityPermissions)\n\t\t\t\treturn entityPermissions\n\t\t\t}\n\t\t\tconst metadata: EntityPermissionsDefinition[] = allowDefinitionsStore.get(entity)\n\t\t\tfor (const { role, ...definition } of metadata) {\n\t\t\t\tif (!roles.includes(role)) {\n\t\t\t\t\tthrow `Role ${role.name} used on entity ${name} is not registered. Have you exported it?`\n\t\t\t\t}\n\t\t\t\tconst entityPermissions = initEntityPermissions(role)\n\t\t\t\tentityPermissions.definitions.push(definition)\n\t\t\t}\n\n\t\t\tconst rolesWithCustomPrimary = allowCustomPrimaryAllRolesStore.get(entity) ? roles : allowCustomPrimaryStore.get(entity)\n\t\t\tfor (const role of rolesWithCustomPrimary) {\n\t\t\t\tinitEntityPermissions(role).allowCustomPrimary = true\n\t\t\t}\n\t\t}\n\n\t\treturn groupedPermissions\n\t}\n}\n\n\nexport type EntityPermissions = { definitions: AllowDefinition<any>[]; allowCustomPrimary: boolean }\nexport type PermissionsByEntity = Map<string, EntityPermissions>\nexport type PermissionsByRoleAndEntity = Map<Role, PermissionsByEntity>\n"],"names":[],"mappings":";;;;;;;AAeO,MAAM,WAAW;AAAA,EACvB,YACS,OACP;AADO,SAAA,QAAA;AAAA,EAAA;AAAA,EAIF,OACN,qBACa;AACP,UAAA,uBAAuB,uBAAuB,mBAAmB;AACjE,UAAA,QAAgB,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAc,IAAI;AAClF,UAAA,YAAkC,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAc,kBAAkB;AAExH,UAAM,qBAAqB,WAAW,iBAAiB,sBAAsB,KAAK;AAE3E,WAAA;AAAA,MACN,OAAO,OAAO,YAAY,MAAM,IAAI,CAAC,SAAwC;AACtE,cAAA,kBAAkB,mBAAmB,IAAI,IAAI;AAC5C,eAAA;AAAA,UACN,KAAK;AAAA,UACL;AAAA,YACC,GAAG,KAAK;AAAA,YACR,QAAQ,KAAK,QAAQ,UAAU;AAAA,YAC/B,UAAU,KAAK,kBAAkB,eAAe;AAAA,YAChD,WAAW,KAAK,gBAAgB,MAAM,SAAS;AAAA,UAAA;AAAA,QAEjD;AAAA,MAAA,CACA,CAAC;AAAA,IACH;AAAA,EAAA;AAAA,EAGO,kBAAkB,iBAAmE;AAC5F,QAAI,CAAC,iBAAiB;AACrB,aAAO,CAAC;AAAA,IAAA;AAEF,WAAA,OAAO,YAAY,MAAM,KAAK,gBAAgB,MAAM,EAAE,IAAI,CAAC,eAAgD;AACjH,YAAM,SAAS,UAAU,KAAK,OAAO,UAAU;AAE/C,YAAM,qBAAqB,yBAAyB,OAAO,iBAAiB,KAAK,OAAO,MAAM;AAE9F,YAAM,mBAAmD,CACzD;AACA,YAAM,gBAAgB,KAAK,iBAAiB,QAAQ,gBAAgB,IAAI,UAAU,CAAC;AACnF,UAAI,eAAe,QAAQ;AAC1B,yBAAiB,SAAS;AAAA,MAAA;AAE3B,iBAAW,MAAM,CAAC,UAAU,UAAU,MAAM,GAAY;AACvD,cAAM,mBAAmD,CAAC;AAC1D,mBAAW,SAAS,OAAO,KAAK,OAAO,MAAM,GAAG;AAC/C,gBAAM,YAAY,mBAAmB,qBAAqB,IAAI,OAAO,UAAU,OAAO,OAAO;AAC7F,cAAI,cAAc,QAAW;AAC5B,6BAAiB,KAAK,IAAI;AAAA,UAAA;AAAA,QAC3B;AAED,YAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,GAAG;AAC7C,2BAAiB,EAAE,IAAI;AAAA,QAAA;AAAA,MACxB;AAED,YAAM,eAAe,mBAAmB,qBAAqB,UAAU,IAAI,KAAK;AAChF,UAAI,iBAAiB,QAAW;AAC/B,yBAAiB,SAAS;AAAA,MAAA;AAE3B,UAAI,gBAAgB,IAAI,UAAU,GAAG,oBAAoB;AACxD,yBAAiB,gBAAgB;AAAA,MAAA;AAElC,aAAO,CAAC,YAAY;AAAA,QACnB,YAAY,mBAAmB,kBAAkB;AAAA,QACjD,YAAY;AAAA,MAAA,CAEZ;AAAA,IAAA,CACD,CAAC;AAAA,EAAA;AAAA,EAIH,iBAAiB,QAAsB,aAAiE;AACjG,UAAA,kCAAkB,IAAmB;AACrC,UAAA,qCAAqB,IAAmB;AAC9C,eAAW,OAAO,aAAa,eAAe,CAAA,GAAI;AAC3C,YAAA,SAAS,IAAI,YAAY;AAC/B,iBAAW,MAAM,CAAC,UAAU,QAAQ,UAAU,QAAQ,GAAY;AAC7D,YAAA,IAAI,EAAE,GAAG;AACN,gBAAA,aAAa,SAAS,iBAAiB;AAC7C,qBAAW,IAAI,EAAmB;AAE5B,gBAAA,WAAW,SAAS,cAAc;AAEpC,cAAA,SAAS,IAAI,EAAmB,GAAG;AACtC,kBAAM,IAAI,MAAM,aAAa,EAAE,4DAA4D,OAAO,IAAI,EAAE;AAAA,UAAA;AAAA,QACzG;AAAA,MACD;AAAA,IACD;AAGD,WAAO,CAAC,GAAG,eAAe,QAAQ;AAAA,EAAA;AAAA,EAG3B,gBAAgB,MAAY,WAAgD;AAC7E,UAAA,gBAAgB,UAAU,OAAO,CAAA,OAAM,GAAG,MAAM,SAAS,IAAI,CAAC;AACpE,WAAO,OAAO,YAAY,cAAc,IAAI,CAAC,aAAqC;AACjF,aAAO,CAAC,SAAS,MAAM,SAAS,QAAQ;AAAA,IAAA,CACxC,CAAC;AAAA,EAAA;AAAA,EAGH,OAAe,iBAAiB,sBAAkD,OAA2C;AACtH,UAAA,yCAAqD,IAAI;AAC/D,eAAW,CAAC,MAAM,MAAM,KAAK,sBAAsB;AAC5C,YAAA,wBAAwB,CAAC,SAAkC;AAChE,cAAM,kBAAuC,mBAAmB,IAAI,IAAI,yBAAS,IAAI;AAClE,2BAAA,IAAI,MAAM,eAAe;AAC5C,cAAM,oBAAoB,gBAAgB,IAAI,IAAI,KAAK;AAAA,UACtD,oBAAoB;AAAA,UACpB,aAAa,CAAA;AAAA,QACd;AACgB,wBAAA,IAAI,MAAM,iBAAiB;AACpC,eAAA;AAAA,MACR;AACM,YAAA,WAA0C,sBAAsB,IAAI,MAAM;AAChF,iBAAW,EAAE,MAAM,GAAG,WAAA,KAAgB,UAAU;AAC/C,YAAI,CAAC,MAAM,SAAS,IAAI,GAAG;AAC1B,gBAAM,QAAQ,KAAK,IAAI,mBAAmB,IAAI;AAAA,QAAA;AAEzC,cAAA,oBAAoB,sBAAsB,IAAI;AAClC,0BAAA,YAAY,KAAK,UAAU;AAAA,MAAA;AAGxC,YAAA,yBAAyB,gCAAgC,IAAI,MAAM,IAAI,QAAQ,wBAAwB,IAAI,MAAM;AACvH,iBAAW,QAAQ,wBAAwB;AACpB,8BAAA,IAAI,EAAE,qBAAqB;AAAA,MAAA;AAAA,IAClD;AAGM,WAAA;AAAA,EAAA;AAET;"}

package/dist/production/src/acl/definition/permissions.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"permissions.cjs","sources":["../../../../../../packages/schema-definition/src/acl/definition/permissions.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\nimport { Role } from './roles'\nimport { VariableDefinition } from './variables'\nimport { PredicateEvaluationReference } from './references'\nimport { allowDefinitionsStore } from './internal/stores'\nimport { DecoratorFunction, EntityConstructor } from '../../utils'\n\nexport type PredicateExtra = PredicateEvaluationReference \| VariableDefinition\nexport type WhenDefinition = Acl.PredicateDefinition<PredicateExtra>\n\nexport interface AllowDefinition<E> {\n\twhen?: WhenDefinition\n\tname?: string\n\tcreate?: true \| ('id' \| keyof E)[]\n\tupdate?: true \| ('id' \| keyof E)[]\n\tread?: true \| ('id' \| keyof E)[]\n\tdelete?: true\n}\n\nexport const allow = <E, R extends Role<string>>(role: R \| R[], args: AllowDefinition<E>): DecoratorFunction<E> => {\n\treturn (entity: EntityConstructor<E>) => {\n\t\t(Array.isArray(role) ? role : [role]).forEach(role => {\n\t\t\tallowDefinitionsStore.update(entity, val => [...val, { ...args, role }])\n\t\t})\n\t}\n}\n\n\n\n"],"names":["role","allowDefinitionsStore"],"mappings":";;;~~AAmBa~~,MAAA,QAAQ,CAA4B,MAAe,SAAmD;AAClH,SAAO,CAAC,WAAiC;AACvC,KAAA,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAAA,UAAQ;AACrDC,aAAAA,sBAAsB,OAAO,QAAQ,CAAO,QAAA,CAAC,GAAG,KAAK,EAAE,GAAG,MAAM,MAAAD,MAAM,CAAA,CAAC;AAAA,IAAA,CACvE;AAAA,EACF;AACD;;"}
1	+ {"version":3,"file":"permissions.cjs","sources":["../../../../../../packages/schema-definition/src/acl/definition/permissions.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\nimport { Role } from './roles'\nimport { VariableDefinition } from './variables'\nimport { PredicateEvaluationReference } from './references'\nimport { allowDefinitionsStore } from './internal/stores'\nimport { DecoratorFunction, EntityConstructor } from '../../utils'\n\nexport type PredicateExtra = PredicateEvaluationReference \| VariableDefinition\nexport type WhenDefinition = Acl.PredicateDefinition<PredicateExtra>\n\nexport interface AllowDefinition<E> {\n\twhen?: WhenDefinition\n\tthrough?: true\n\tname?: string\n\tcreate?: true \| ('id' \| keyof E)[]\n\tupdate?: true \| ('id' \| keyof E)[]\n\tread?: true \| ('id' \| keyof E)[]\n\tdelete?: true\n}\n\nexport const allow = <E, R extends Role<string>>(role: R \| R[], args: AllowDefinition<E>): DecoratorFunction<E> => {\n\treturn (entity: EntityConstructor<E>) => {\n\t\t(Array.isArray(role) ? role : [role]).forEach(role => {\n\t\t\tallowDefinitionsStore.update(entity, val => [...val, { ...args, role }])\n\t\t})\n\t}\n}\n\n\n\n"],"names":["role","allowDefinitionsStore"],"mappings":";;;AAoBa,MAAA,QAAQ,CAA4B,MAAe,SAAmD;AAClH,SAAO,CAAC,WAAiC;AACvC,KAAA,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAAA,UAAQ;AACrDC,aAAAA,sBAAsB,OAAO,QAAQ,CAAO,QAAA,CAAC,GAAG,KAAK,EAAE,GAAG,MAAM,MAAAD,MAAM,CAAA,CAAC;AAAA,IAAA,CACvE;AAAA,EACF;AACD;;"}

package/dist/production/src/acl/definition/permissions.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"permissions.js","sources":["../../../../../../packages/schema-definition/src/acl/definition/permissions.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\nimport { Role } from './roles'\nimport { VariableDefinition } from './variables'\nimport { PredicateEvaluationReference } from './references'\nimport { allowDefinitionsStore } from './internal/stores'\nimport { DecoratorFunction, EntityConstructor } from '../../utils'\n\nexport type PredicateExtra = PredicateEvaluationReference \| VariableDefinition\nexport type WhenDefinition = Acl.PredicateDefinition<PredicateExtra>\n\nexport interface AllowDefinition<E> {\n\twhen?: WhenDefinition\n\tname?: string\n\tcreate?: true \| ('id' \| keyof E)[]\n\tupdate?: true \| ('id' \| keyof E)[]\n\tread?: true \| ('id' \| keyof E)[]\n\tdelete?: true\n}\n\nexport const allow = <E, R extends Role<string>>(role: R \| R[], args: AllowDefinition<E>): DecoratorFunction<E> => {\n\treturn (entity: EntityConstructor<E>) => {\n\t\t(Array.isArray(role) ? role : [role]).forEach(role => {\n\t\t\tallowDefinitionsStore.update(entity, val => [...val, { ...args, role }])\n\t\t})\n\t}\n}\n\n\n\n"],"names":["role"],"mappings":";~~AAmBa~~,MAAA,QAAQ,CAA4B,MAAe,SAAmD;AAClH,SAAO,CAAC,WAAiC;AACvC,KAAA,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAAA,UAAQ;AACrD,4BAAsB,OAAO,QAAQ,CAAO,QAAA,CAAC,GAAG,KAAK,EAAE,GAAG,MAAM,MAAAA,MAAM,CAAA,CAAC;AAAA,IAAA,CACvE;AAAA,EACF;AACD;"}
1	+ {"version":3,"file":"permissions.js","sources":["../../../../../../packages/schema-definition/src/acl/definition/permissions.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\nimport { Role } from './roles'\nimport { VariableDefinition } from './variables'\nimport { PredicateEvaluationReference } from './references'\nimport { allowDefinitionsStore } from './internal/stores'\nimport { DecoratorFunction, EntityConstructor } from '../../utils'\n\nexport type PredicateExtra = PredicateEvaluationReference \| VariableDefinition\nexport type WhenDefinition = Acl.PredicateDefinition<PredicateExtra>\n\nexport interface AllowDefinition<E> {\n\twhen?: WhenDefinition\n\tthrough?: true\n\tname?: string\n\tcreate?: true \| ('id' \| keyof E)[]\n\tupdate?: true \| ('id' \| keyof E)[]\n\tread?: true \| ('id' \| keyof E)[]\n\tdelete?: true\n}\n\nexport const allow = <E, R extends Role<string>>(role: R \| R[], args: AllowDefinition<E>): DecoratorFunction<E> => {\n\treturn (entity: EntityConstructor<E>) => {\n\t\t(Array.isArray(role) ? role : [role]).forEach(role => {\n\t\t\tallowDefinitionsStore.update(entity, val => [...val, { ...args, role }])\n\t\t})\n\t}\n}\n\n\n\n"],"names":["role"],"mappings":";AAoBa,MAAA,QAAQ,CAA4B,MAAe,SAAmD;AAClH,SAAO,CAAC,WAAiC;AACvC,KAAA,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAAA,UAAQ;AACrD,4BAAsB,OAAO,QAAQ,CAAO,QAAA,CAAC,GAAG,KAAK,EAAE,GAAG,MAAM,MAAAA,MAAM,CAAA,CAAC;AAAA,IAAA,CACvE;AAAA,EACF;AACD;"}