@contember/schema-definition 2.1.0-alpha.25 → 2.1.0-alpha.27

package/dist/development/src/acl/definition/internal/AclFactory.cjs

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const schemaUtils = require("@contember/schema-utils");
 const EntityPredicateResolver = require("./EntityPredicateResolver.cjs");
 const stores = require("./stores.cjs");
 const roles = require("../roles.cjs");
@@ -15,7 +16,7 @@ class AclFactory {
     const entityLikeDefinition = filterEntityDefinition.filterEntityDefinition(exportedDefinitions);
     const roles$1 = Object.values(exportedDefinitions).filter((it) => it instanceof roles.Role);
     const variables$1 = Object.values(exportedDefinitions).filter((it) => it instanceof variables.VariableDefinition);
-    const groupedPermissions = AclFactory.groupPermissions(entityLikeDefinition, roles$1);
+    const groupedPermissions = this.groupPermissions(entityLikeDefinition, roles$1);
     return {
       roles: Object.fromEntries(roles$1.map((role) => {
         const rolePermissions = groupedPermissions.get(role);
@@ -97,7 +98,7 @@ class AclFactory {
       return [variable.name, variable.variable];
     }));
   }
-  static groupPermissions(entityLikeDefinition, roles2) {
+  groupPermissions(entityLikeDefinition, roles2) {
     const groupedPermissions = /* @__PURE__ */ new Map();
     for (const [name, entity] of entityLikeDefinition) {
       const initEntityPermissions = (role) => {
@@ -110,12 +111,17 @@ class AclFactory {
         return entityPermissions;
       };
       const metadata = stores.allowDefinitionsStore.get(entity);
-      for (const { role, ...definition } of metadata) {
+      for (const { role, factory } of metadata) {
         if (!roles2.includes(role)) {
           throw `Role ${role.name} used on entity ${name} is not registered. Have you exported it?`;
         }
         const entityPermissions = initEntityPermissions(role);
-        entityPermissions.definitions.push(definition);
+        const entity2 = schemaUtils.getEntity(this.model, name);
+        entityPermissions.definitions.push(factory({
+          model: this.model,
+          entity: schemaUtils.getEntity(this.model, name),
+          except: (...fields) => Object.keys(entity2.fields).filter((it) => !fields.includes(it))
+        }));
       }
     }
     return groupedPermissions;

package/dist/development/src/acl/definition/internal/AclFactory.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AclFactory.cjs","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/AclFactory.ts"],"sourcesContent":["import { Acl, Model, Writable } from '@contember/schema'\nimport { getEntity } from '@contember/schema-utils'\n\nimport { EntityPredicatesResolver } from './EntityPredicateResolver'\nimport { AllowDefinition } from '../permissions'\nimport {\n\tallowDefinitionsStore,\n\tEntityPermissionsDefinition,\n} from './stores'\nimport { Role } from '../roles'\nimport {  VariableDefinition } from '../variables'\nimport { filterEntityDefinition } from '../../../utils'\nimport { applyEntityAclExtensions } from '../aclExtensions'\n\nexport class AclFactory {\n\tconstructor(\n\t\tprivate model: Model.Schema,\n\t) {\n\t}\n\n\tpublic create(\n\t\texportedDefinitions: Record<string, any>,\n\t): Acl.Schema {\n\t\tconst entityLikeDefinition = filterEntityDefinition(exportedDefinitions)\n\t\tconst roles: Role[] = Object.values(exportedDefinitions).filter(it => it instanceof Role)\n\t\tconst variables: VariableDefinition[] = Object.values(exportedDefinitions).filter(it => it instanceof VariableDefinition)\n\n\t\tconst groupedPermissions = AclFactory.groupPermissions(entityLikeDefinition, roles)\n\n\t\treturn {\n\t\t\troles: Object.fromEntries(roles.map((role): [string, Acl.RolePermissions] => {\n\t\t\t\tconst rolePermissions = groupedPermissions.get(role)\n\t\t\t\treturn [\n\t\t\t\t\trole.name,\n\t\t\t\t\t{\n\t\t\t\t\t\t...role.options,\n\t\t\t\t\t\tstages: role.options.stages ?? '*',\n\t\t\t\t\t\tentities: this.createPermissions(rolePermissions, Object.fromEntries(entityLikeDefinition), role),\n\t\t\t\t\t\tvariables: this.createVariables(role, variables),\n\t\t\t\t\t},\n\t\t\t\t]\n\t\t\t})),\n\t\t}\n\t}\n\n\tprivate createPermissions(rolePermissions: PermissionsByEntity | undefined, entityLikeDefinition: Record<string, { new(): any }>, role: Role): Acl.Permissions {\n\t\treturn Object.fromEntries(Object.values(this.model.entities).map((entity): [string, Acl.EntityPermissions] | undefined => {\n\t\t\tconst permissions = rolePermissions ? this.createPermissionsFromAllow(rolePermissions, entity) : { predicates: {}, operations: {} }\n\t\t\tconst isEmpty = !rolePermissions?.has(entity.name)\n\t\t\tconst withExtensions = applyEntityAclExtensions(entityLikeDefinition[entity.name], { entity, permissions, role })\n\t\t\tif (isEmpty && withExtensions === permissions) {\n\t\t\t\treturn undefined\n\t\t\t}\n\t\t\treturn [\n\t\t\t\tentity.name,\n\t\t\t\twithExtensions,\n\t\t\t]\n\t\t}).filter(<T>(it: T | undefined): it is T => it !== undefined))\n\t}\n\n\tprivate createPermissionsFromAllow(rolePermissions: PermissionsByEntity, entity: Model.Entity): Acl.EntityPermissions {\n\t\tconst predicatesResolver = EntityPredicatesResolver.create(rolePermissions, this.model, entity)\n\n\t\tconst entityOperations: Writable<Acl.EntityOperations> = {}\n\t\tconst noRootOptions = this.getNoRootOptions(entity, rolePermissions.get(entity.name))\n\t\tif (noRootOptions?.length) {\n\t\t\tentityOperations.noRoot = noRootOptions\n\t\t}\n\t\tfor (const op of ['create', 'update', 'read'] as const) {\n\t\t\tconst fieldPermissions: Writable<Acl.FieldPermissions> = {}\n\t\t\tfor (const field of Object.keys(entity.fields)) {\n\t\t\t\tconst predicate = predicatesResolver.createFieldPredicate(op, field, field === entity.primary)\n\t\t\t\tif (predicate !== undefined) {\n\t\t\t\t\tfieldPermissions[field] = predicate\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (Object.keys(fieldPermissions).length > 0) {\n\t\t\t\tentityOperations[op] = fieldPermissions\n\t\t\t}\n\t\t}\n\t\tconst delPredicate = predicatesResolver.createFieldPredicate('delete', '', false)\n\t\tif (delPredicate !== undefined) {\n\t\t\tentityOperations.delete = delPredicate\n\t\t}\n\t\treturn {\n\t\t\tpredicates: predicatesResolver.getUsedPredicates(),\n\t\t\toperations: entityOperations,\n\t\t}\n\t}\n\n\n\tgetNoRootOptions(entity: Model.Entity, permissions?: EntityPermissions): Acl.EntityOperations['noRoot'] {\n\t\tconst allowedRoot = new Set<Acl.Operation>()\n\t\tconst disallowedRoot = new Set<Acl.Operation>()\n\t\tfor (const def of permissions?.definitions ?? []) {\n\t\t\tconst noRoot = def.through === true\n\t\t\tfor (const op of ['create', 'read', 'update', 'delete'] as const) {\n\t\t\t\tif (def[op]) {\n\t\t\t\t\tconst currentSet = noRoot ? disallowedRoot : allowedRoot\n\t\t\t\t\tcurrentSet.add(op as Acl.Operation)\n\n\t\t\t\t\tconst otherSet = noRoot ? allowedRoot : disallowedRoot\n\n\t\t\t\t\tif (otherSet.has(op as Acl.Operation)) {\n\t\t\t\t\t\tthrow new Error(`Operation ${op} cannot be both allowed and disallowed on root on entity ${entity.name}`)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t}\n\t\treturn [...disallowedRoot.values()]\n\t}\n\n\tprivate createVariables(role: Role, variables: VariableDefinition[]): Acl.Variables {\n\t\tconst roleVariables = variables.filter(it => it.roles.includes(role))\n\t\treturn Object.fromEntries(roleVariables.map((variable): [string, Acl.Variable] => {\n\t\t\treturn [variable.name, variable.variable]\n\t\t}))\n\t}\n\n\tprivate static groupPermissions(entityLikeDefinition: [string, { new(): any }][], roles: Role[]): PermissionsByRoleAndEntity {\n\t\tconst groupedPermissions: PermissionsByRoleAndEntity = new Map()\n\t\tfor (const [name, entity] of entityLikeDefinition) {\n\t\t\tconst initEntityPermissions = (role: Role): EntityPermissions => {\n\t\t\t\tconst rolePermissions: PermissionsByEntity = groupedPermissions.get(role) ?? new Map()\n\t\t\t\tgroupedPermissions.set(role, rolePermissions)\n\t\t\t\tconst entityPermissions = rolePermissions.get(name) ?? {\n\t\t\t\t\tdefinitions: [],\n\t\t\t\t}\n\t\t\t\trolePermissions.set(name, entityPermissions)\n\t\t\t\treturn entityPermissions\n\t\t\t}\n\t\t\tconst metadata: EntityPermissionsDefinition[] = allowDefinitionsStore.get(entity)\n\t\t\tfor (const { role, ...definition } of metadata) {\n\t\t\t\tif (!roles.includes(role)) {\n\t\t\t\t\tthrow `Role ${role.name} used on entity ${name} is not registered. Have you exported it?`\n\t\t\t\t}\n\t\t\t\tconst entityPermissions = initEntityPermissions(role)\n\t\t\t\tentityPermissions.definitions.push(definition)\n\t\t\t}\n\t\t}\n\n\t\treturn groupedPermissions\n\t}\n}\n\n\nexport type EntityPermissions = { definitions: AllowDefinition<any>[] }\nexport type PermissionsByEntity = Map<string, EntityPermissions>\nexport type PermissionsByRoleAndEntity = Map<Role, PermissionsByEntity>\n"],"names":["filterEntityDefinition","roles","Role","variables","VariableDefinition","applyEntityAclExtensions","EntityPredicatesResolver","allowDefinitionsStore"],"mappings":";;;;;;;;;AAcO,MAAM,WAAW;AAAA,EACvB,YACS,OACP;AADO,SAAA,QAAA;AAAA,EAAA;AAAA,EAIF,OACN,qBACa;AACP,UAAA,uBAAuBA,8CAAuB,mBAAmB;AACjE,UAAAC,UAAgB,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAcC,UAAI;AAClF,UAAAC,cAAkC,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAcC,4BAAkB;AAExH,UAAM,qBAAqB,WAAW,iBAAiB,sBAAsBH,OAAK;AAE3E,WAAA;AAAA,MACN,OAAO,OAAO,YAAYA,QAAM,IAAI,CAAC,SAAwC;AACtE,cAAA,kBAAkB,mBAAmB,IAAI,IAAI;AAC5C,eAAA;AAAA,UACN,KAAK;AAAA,UACL;AAAA,YACC,GAAG,KAAK;AAAA,YACR,QAAQ,KAAK,QAAQ,UAAU;AAAA,YAC/B,UAAU,KAAK,kBAAkB,iBAAiB,OAAO,YAAY,oBAAoB,GAAG,IAAI;AAAA,YAChG,WAAW,KAAK,gBAAgB,MAAME,WAAS;AAAA,UAAA;AAAA,QAEjD;AAAA,MAAA,CACA,CAAC;AAAA,IACH;AAAA,EAAA;AAAA,EAGO,kBAAkB,iBAAkD,sBAAsD,MAA6B;AACvJ,WAAA,OAAO,YAAY,OAAO,OAAO,KAAK,MAAM,QAAQ,EAAE,IAAI,CAAC,WAAwD;AACzH,YAAM,cAAc,kBAAkB,KAAK,2BAA2B,iBAAiB,MAAM,IAAI,EAAE,YAAY,IAAI,YAAY,CAAA,EAAG;AAClI,YAAM,UAAU,CAAC,iBAAiB,IAAI,OAAO,IAAI;AAC3C,YAAA,iBAAiBE,uCAAyB,qBAAqB,OAAO,IAAI,GAAG,EAAE,QAAQ,aAAa,MAAM;AAC5G,UAAA,WAAW,mBAAmB,aAAa;AACvC,eAAA;AAAA,MAAA;AAED,aAAA;AAAA,QACN,OAAO;AAAA,QACP;AAAA,MACD;AAAA,IAAA,CACA,EAAE,OAAO,CAAI,OAA+B,OAAO,MAAS,CAAC;AAAA,EAAA;AAAA,EAGvD,2BAA2B,iBAAsC,QAA6C;AACrH,UAAM,qBAAqBC,wBAAAA,yBAAyB,OAAO,iBAAiB,KAAK,OAAO,MAAM;AAE9F,UAAM,mBAAmD,CAAC;AACpD,UAAA,gBAAgB,KAAK,iBAAiB,QAAQ,gBAAgB,IAAI,OAAO,IAAI,CAAC;AACpF,QAAI,eAAe,QAAQ;AAC1B,uBAAiB,SAAS;AAAA,IAAA;AAE3B,eAAW,MAAM,CAAC,UAAU,UAAU,MAAM,GAAY;AACvD,YAAM,mBAAmD,CAAC;AAC1D,iBAAW,SAAS,OAAO,KAAK,OAAO,MAAM,GAAG;AAC/C,cAAM,YAAY,mBAAmB,qBAAqB,IAAI,OAAO,UAAU,OAAO,OAAO;AAC7F,YAAI,cAAc,QAAW;AAC5B,2BAAiB,KAAK,IAAI;AAAA,QAAA;AAAA,MAC3B;AAED,UAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,GAAG;AAC7C,yBAAiB,EAAE,IAAI;AAAA,MAAA;AAAA,IACxB;AAED,UAAM,eAAe,mBAAmB,qBAAqB,UAAU,IAAI,KAAK;AAChF,QAAI,iBAAiB,QAAW;AAC/B,uBAAiB,SAAS;AAAA,IAAA;AAEpB,WAAA;AAAA,MACN,YAAY,mBAAmB,kBAAkB;AAAA,MACjD,YAAY;AAAA,IACb;AAAA,EAAA;AAAA,EAID,iBAAiB,QAAsB,aAAiE;AACjG,UAAA,kCAAkB,IAAmB;AACrC,UAAA,qCAAqB,IAAmB;AAC9C,eAAW,OAAO,aAAa,eAAe,CAAA,GAAI;AAC3C,YAAA,SAAS,IAAI,YAAY;AAC/B,iBAAW,MAAM,CAAC,UAAU,QAAQ,UAAU,QAAQ,GAAY;AAC7D,YAAA,IAAI,EAAE,GAAG;AACN,gBAAA,aAAa,SAAS,iBAAiB;AAC7C,qBAAW,IAAI,EAAmB;AAE5B,gBAAA,WAAW,SAAS,cAAc;AAEpC,cAAA,SAAS,IAAI,EAAmB,GAAG;AACtC,kBAAM,IAAI,MAAM,aAAa,EAAE,4DAA4D,OAAO,IAAI,EAAE;AAAA,UAAA;AAAA,QACzG;AAAA,MACD;AAAA,IACD;AAGD,WAAO,CAAC,GAAG,eAAe,QAAQ;AAAA,EAAA;AAAA,EAG3B,gBAAgB,MAAYH,YAAgD;AAC7E,UAAA,gBAAgBA,WAAU,OAAO,CAAA,OAAM,GAAG,MAAM,SAAS,IAAI,CAAC;AACpE,WAAO,OAAO,YAAY,cAAc,IAAI,CAAC,aAAqC;AACjF,aAAO,CAAC,SAAS,MAAM,SAAS,QAAQ;AAAA,IAAA,CACxC,CAAC;AAAA,EAAA;AAAA,EAGH,OAAe,iBAAiB,sBAAkDF,QAA2C;AACtH,UAAA,yCAAqD,IAAI;AAC/D,eAAW,CAAC,MAAM,MAAM,KAAK,sBAAsB;AAC5C,YAAA,wBAAwB,CAAC,SAAkC;AAChE,cAAM,kBAAuC,mBAAmB,IAAI,IAAI,yBAAS,IAAI;AAClE,2BAAA,IAAI,MAAM,eAAe;AAC5C,cAAM,oBAAoB,gBAAgB,IAAI,IAAI,KAAK;AAAA,UACtD,aAAa,CAAA;AAAA,QACd;AACgB,wBAAA,IAAI,MAAM,iBAAiB;AACpC,eAAA;AAAA,MACR;AACM,YAAA,WAA0CM,OAAAA,sBAAsB,IAAI,MAAM;AAChF,iBAAW,EAAE,MAAM,GAAG,WAAA,KAAgB,UAAU;AAC/C,YAAI,CAACN,OAAM,SAAS,IAAI,GAAG;AAC1B,gBAAM,QAAQ,KAAK,IAAI,mBAAmB,IAAI;AAAA,QAAA;AAEzC,cAAA,oBAAoB,sBAAsB,IAAI;AAClC,0BAAA,YAAY,KAAK,UAAU;AAAA,MAAA;AAAA,IAC9C;AAGM,WAAA;AAAA,EAAA;AAET;;"}
+{"version":3,"file":"AclFactory.cjs","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/AclFactory.ts"],"sourcesContent":["import { Acl, Model, Writable } from '@contember/schema'\nimport { getEntity } from '@contember/schema-utils'\n\nimport { EntityPredicatesResolver } from './EntityPredicateResolver'\nimport { AllowDefinition } from '../permissions'\nimport {\n\tallowDefinitionsStore,\n\tEntityPermissionsDefinition,\n} from './stores'\nimport { Role } from '../roles'\nimport {  VariableDefinition } from '../variables'\nimport { filterEntityDefinition } from '../../../utils'\nimport { applyEntityAclExtensions } from '../aclExtensions'\n\nexport class AclFactory {\n\tconstructor(\n\t\tprivate model: Model.Schema,\n\t) {\n\t}\n\n\tpublic create(\n\t\texportedDefinitions: Record<string, any>,\n\t): Acl.Schema {\n\t\tconst entityLikeDefinition = filterEntityDefinition(exportedDefinitions)\n\t\tconst roles: Role[] = Object.values(exportedDefinitions).filter(it => it instanceof Role)\n\t\tconst variables: VariableDefinition[] = Object.values(exportedDefinitions).filter(it => it instanceof VariableDefinition)\n\n\t\tconst groupedPermissions = this.groupPermissions(entityLikeDefinition, roles)\n\n\t\treturn {\n\t\t\troles: Object.fromEntries(roles.map((role): [string, Acl.RolePermissions] => {\n\t\t\t\tconst rolePermissions = groupedPermissions.get(role)\n\t\t\t\treturn [\n\t\t\t\t\trole.name,\n\t\t\t\t\t{\n\t\t\t\t\t\t...role.options,\n\t\t\t\t\t\tstages: role.options.stages ?? '*',\n\t\t\t\t\t\tentities: this.createPermissions(rolePermissions, Object.fromEntries(entityLikeDefinition), role),\n\t\t\t\t\t\tvariables: this.createVariables(role, variables),\n\t\t\t\t\t},\n\t\t\t\t]\n\t\t\t})),\n\t\t}\n\t}\n\n\tprivate createPermissions(rolePermissions: PermissionsByEntity | undefined, entityLikeDefinition: Record<string, { new(): any }>, role: Role): Acl.Permissions {\n\t\treturn Object.fromEntries(Object.values(this.model.entities).map((entity): [string, Acl.EntityPermissions] | undefined => {\n\t\t\tconst permissions = rolePermissions ? this.createPermissionsFromAllow(rolePermissions, entity) : { predicates: {}, operations: {} }\n\t\t\tconst isEmpty = !rolePermissions?.has(entity.name)\n\t\t\tconst withExtensions = applyEntityAclExtensions(entityLikeDefinition[entity.name], { entity, permissions, role })\n\t\t\tif (isEmpty && withExtensions === permissions) {\n\t\t\t\treturn undefined\n\t\t\t}\n\t\t\treturn [\n\t\t\t\tentity.name,\n\t\t\t\twithExtensions,\n\t\t\t]\n\t\t}).filter(<T>(it: T | undefined): it is T => it !== undefined))\n\t}\n\n\tprivate createPermissionsFromAllow(rolePermissions: PermissionsByEntity, entity: Model.Entity): Acl.EntityPermissions {\n\t\tconst predicatesResolver = EntityPredicatesResolver.create(rolePermissions, this.model, entity)\n\n\t\tconst entityOperations: Writable<Acl.EntityOperations> = {}\n\t\tconst noRootOptions = this.getNoRootOptions(entity, rolePermissions.get(entity.name))\n\t\tif (noRootOptions?.length) {\n\t\t\tentityOperations.noRoot = noRootOptions\n\t\t}\n\t\tfor (const op of ['create', 'update', 'read'] as const) {\n\t\t\tconst fieldPermissions: Writable<Acl.FieldPermissions> = {}\n\t\t\tfor (const field of Object.keys(entity.fields)) {\n\t\t\t\tconst predicate = predicatesResolver.createFieldPredicate(op, field, field === entity.primary)\n\t\t\t\tif (predicate !== undefined) {\n\t\t\t\t\tfieldPermissions[field] = predicate\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (Object.keys(fieldPermissions).length > 0) {\n\t\t\t\tentityOperations[op] = fieldPermissions\n\t\t\t}\n\t\t}\n\t\tconst delPredicate = predicatesResolver.createFieldPredicate('delete', '', false)\n\t\tif (delPredicate !== undefined) {\n\t\t\tentityOperations.delete = delPredicate\n\t\t}\n\t\treturn {\n\t\t\tpredicates: predicatesResolver.getUsedPredicates(),\n\t\t\toperations: entityOperations,\n\t\t}\n\t}\n\n\n\tgetNoRootOptions(entity: Model.Entity, permissions?: EntityPermissions): Acl.EntityOperations['noRoot'] {\n\t\tconst allowedRoot = new Set<Acl.Operation>()\n\t\tconst disallowedRoot = new Set<Acl.Operation>()\n\t\tfor (const def of permissions?.definitions ?? []) {\n\t\t\tconst noRoot = def.through === true\n\t\t\tfor (const op of ['create', 'read', 'update', 'delete'] as const) {\n\t\t\t\tif (def[op]) {\n\t\t\t\t\tconst currentSet = noRoot ? disallowedRoot : allowedRoot\n\t\t\t\t\tcurrentSet.add(op as Acl.Operation)\n\n\t\t\t\t\tconst otherSet = noRoot ? allowedRoot : disallowedRoot\n\n\t\t\t\t\tif (otherSet.has(op as Acl.Operation)) {\n\t\t\t\t\t\tthrow new Error(`Operation ${op} cannot be both allowed and disallowed on root on entity ${entity.name}`)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t}\n\t\treturn [...disallowedRoot.values()]\n\t}\n\n\tprivate createVariables(role: Role, variables: VariableDefinition[]): Acl.Variables {\n\t\tconst roleVariables = variables.filter(it => it.roles.includes(role))\n\t\treturn Object.fromEntries(roleVariables.map((variable): [string, Acl.Variable] => {\n\t\t\treturn [variable.name, variable.variable]\n\t\t}))\n\t}\n\n\tprivate groupPermissions(entityLikeDefinition: [string, { new(): any }][], roles: Role[]): PermissionsByRoleAndEntity {\n\t\tconst groupedPermissions: PermissionsByRoleAndEntity = new Map()\n\t\tfor (const [name, entity] of entityLikeDefinition) {\n\t\t\tconst initEntityPermissions = (role: Role): EntityPermissions => {\n\t\t\t\tconst rolePermissions: PermissionsByEntity = groupedPermissions.get(role) ?? new Map()\n\t\t\t\tgroupedPermissions.set(role, rolePermissions)\n\t\t\t\tconst entityPermissions = rolePermissions.get(name) ?? {\n\t\t\t\t\tdefinitions: [],\n\t\t\t\t}\n\t\t\t\trolePermissions.set(name, entityPermissions)\n\t\t\t\treturn entityPermissions\n\t\t\t}\n\t\t\tconst metadata: EntityPermissionsDefinition[] = allowDefinitionsStore.get(entity)\n\t\t\tfor (const { role, factory } of metadata) {\n\t\t\t\tif (!roles.includes(role)) {\n\t\t\t\t\tthrow `Role ${role.name} used on entity ${name} is not registered. Have you exported it?`\n\t\t\t\t}\n\t\t\t\tconst entityPermissions = initEntityPermissions(role)\n\t\t\t\tconst entity = getEntity(this.model, name)\n\t\t\t\tentityPermissions.definitions.push(factory({\n\t\t\t\t\tmodel: this.model,\n\t\t\t\t\tentity: getEntity(this.model, name),\n\t\t\t\t\texcept: (...fields) => (Object.keys(entity.fields)).filter(it => !fields.includes(it)),\n\t\t\t\t}))\n\t\t\t}\n\t\t}\n\n\t\treturn groupedPermissions\n\t}\n}\n\n\nexport type EntityPermissions = { definitions: AllowDefinition<any>[] }\nexport type PermissionsByEntity = Map<string, EntityPermissions>\nexport type PermissionsByRoleAndEntity = Map<Role, PermissionsByEntity>\n"],"names":["filterEntityDefinition","roles","Role","variables","VariableDefinition","applyEntityAclExtensions","EntityPredicatesResolver","allowDefinitionsStore","entity","getEntity"],"mappings":";;;;;;;;;;AAcO,MAAM,WAAW;AAAA,EACvB,YACS,OACP;AADO,SAAA,QAAA;AAAA,EAAA;AAAA,EAIF,OACN,qBACa;AACP,UAAA,uBAAuBA,8CAAuB,mBAAmB;AACjE,UAAAC,UAAgB,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAcC,UAAI;AAClF,UAAAC,cAAkC,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAcC,4BAAkB;AAExH,UAAM,qBAAqB,KAAK,iBAAiB,sBAAsBH,OAAK;AAErE,WAAA;AAAA,MACN,OAAO,OAAO,YAAYA,QAAM,IAAI,CAAC,SAAwC;AACtE,cAAA,kBAAkB,mBAAmB,IAAI,IAAI;AAC5C,eAAA;AAAA,UACN,KAAK;AAAA,UACL;AAAA,YACC,GAAG,KAAK;AAAA,YACR,QAAQ,KAAK,QAAQ,UAAU;AAAA,YAC/B,UAAU,KAAK,kBAAkB,iBAAiB,OAAO,YAAY,oBAAoB,GAAG,IAAI;AAAA,YAChG,WAAW,KAAK,gBAAgB,MAAME,WAAS;AAAA,UAAA;AAAA,QAEjD;AAAA,MAAA,CACA,CAAC;AAAA,IACH;AAAA,EAAA;AAAA,EAGO,kBAAkB,iBAAkD,sBAAsD,MAA6B;AACvJ,WAAA,OAAO,YAAY,OAAO,OAAO,KAAK,MAAM,QAAQ,EAAE,IAAI,CAAC,WAAwD;AACzH,YAAM,cAAc,kBAAkB,KAAK,2BAA2B,iBAAiB,MAAM,IAAI,EAAE,YAAY,IAAI,YAAY,CAAA,EAAG;AAClI,YAAM,UAAU,CAAC,iBAAiB,IAAI,OAAO,IAAI;AAC3C,YAAA,iBAAiBE,uCAAyB,qBAAqB,OAAO,IAAI,GAAG,EAAE,QAAQ,aAAa,MAAM;AAC5G,UAAA,WAAW,mBAAmB,aAAa;AACvC,eAAA;AAAA,MAAA;AAED,aAAA;AAAA,QACN,OAAO;AAAA,QACP;AAAA,MACD;AAAA,IAAA,CACA,EAAE,OAAO,CAAI,OAA+B,OAAO,MAAS,CAAC;AAAA,EAAA;AAAA,EAGvD,2BAA2B,iBAAsC,QAA6C;AACrH,UAAM,qBAAqBC,wBAAAA,yBAAyB,OAAO,iBAAiB,KAAK,OAAO,MAAM;AAE9F,UAAM,mBAAmD,CAAC;AACpD,UAAA,gBAAgB,KAAK,iBAAiB,QAAQ,gBAAgB,IAAI,OAAO,IAAI,CAAC;AACpF,QAAI,eAAe,QAAQ;AAC1B,uBAAiB,SAAS;AAAA,IAAA;AAE3B,eAAW,MAAM,CAAC,UAAU,UAAU,MAAM,GAAY;AACvD,YAAM,mBAAmD,CAAC;AAC1D,iBAAW,SAAS,OAAO,KAAK,OAAO,MAAM,GAAG;AAC/C,cAAM,YAAY,mBAAmB,qBAAqB,IAAI,OAAO,UAAU,OAAO,OAAO;AAC7F,YAAI,cAAc,QAAW;AAC5B,2BAAiB,KAAK,IAAI;AAAA,QAAA;AAAA,MAC3B;AAED,UAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,GAAG;AAC7C,yBAAiB,EAAE,IAAI;AAAA,MAAA;AAAA,IACxB;AAED,UAAM,eAAe,mBAAmB,qBAAqB,UAAU,IAAI,KAAK;AAChF,QAAI,iBAAiB,QAAW;AAC/B,uBAAiB,SAAS;AAAA,IAAA;AAEpB,WAAA;AAAA,MACN,YAAY,mBAAmB,kBAAkB;AAAA,MACjD,YAAY;AAAA,IACb;AAAA,EAAA;AAAA,EAID,iBAAiB,QAAsB,aAAiE;AACjG,UAAA,kCAAkB,IAAmB;AACrC,UAAA,qCAAqB,IAAmB;AAC9C,eAAW,OAAO,aAAa,eAAe,CAAA,GAAI;AAC3C,YAAA,SAAS,IAAI,YAAY;AAC/B,iBAAW,MAAM,CAAC,UAAU,QAAQ,UAAU,QAAQ,GAAY;AAC7D,YAAA,IAAI,EAAE,GAAG;AACN,gBAAA,aAAa,SAAS,iBAAiB;AAC7C,qBAAW,IAAI,EAAmB;AAE5B,gBAAA,WAAW,SAAS,cAAc;AAEpC,cAAA,SAAS,IAAI,EAAmB,GAAG;AACtC,kBAAM,IAAI,MAAM,aAAa,EAAE,4DAA4D,OAAO,IAAI,EAAE;AAAA,UAAA;AAAA,QACzG;AAAA,MACD;AAAA,IACD;AAGD,WAAO,CAAC,GAAG,eAAe,QAAQ;AAAA,EAAA;AAAA,EAG3B,gBAAgB,MAAYH,YAAgD;AAC7E,UAAA,gBAAgBA,WAAU,OAAO,CAAA,OAAM,GAAG,MAAM,SAAS,IAAI,CAAC;AACpE,WAAO,OAAO,YAAY,cAAc,IAAI,CAAC,aAAqC;AACjF,aAAO,CAAC,SAAS,MAAM,SAAS,QAAQ;AAAA,IAAA,CACxC,CAAC;AAAA,EAAA;AAAA,EAGK,iBAAiB,sBAAkDF,QAA2C;AAC/G,UAAA,yCAAqD,IAAI;AAC/D,eAAW,CAAC,MAAM,MAAM,KAAK,sBAAsB;AAC5C,YAAA,wBAAwB,CAAC,SAAkC;AAChE,cAAM,kBAAuC,mBAAmB,IAAI,IAAI,yBAAS,IAAI;AAClE,2BAAA,IAAI,MAAM,eAAe;AAC5C,cAAM,oBAAoB,gBAAgB,IAAI,IAAI,KAAK;AAAA,UACtD,aAAa,CAAA;AAAA,QACd;AACgB,wBAAA,IAAI,MAAM,iBAAiB;AACpC,eAAA;AAAA,MACR;AACM,YAAA,WAA0CM,OAAAA,sBAAsB,IAAI,MAAM;AAChF,iBAAW,EAAE,MAAM,QAAQ,KAAK,UAAU;AACzC,YAAI,CAACN,OAAM,SAAS,IAAI,GAAG;AAC1B,gBAAM,QAAQ,KAAK,IAAI,mBAAmB,IAAI;AAAA,QAAA;AAEzC,cAAA,oBAAoB,sBAAsB,IAAI;AACpD,cAAMO,UAASC,YAAA,UAAU,KAAK,OAAO,IAAI;AACvB,0BAAA,YAAY,KAAK,QAAQ;AAAA,UAC1C,OAAO,KAAK;AAAA,UACZ,QAAQA,YAAA,UAAU,KAAK,OAAO,IAAI;AAAA,UAClC,QAAQ,IAAI,WAAY,OAAO,KAAKD,QAAO,MAAM,EAAG,OAAO,CAAM,OAAA,CAAC,OAAO,SAAS,EAAE,CAAC;AAAA,QAAA,CACrF,CAAC;AAAA,MAAA;AAAA,IACH;AAGM,WAAA;AAAA,EAAA;AAET;;"}

package/dist/development/src/acl/definition/internal/AclFactory.js

@@ -1,3 +1,4 @@
+import { getEntity } from "@contember/schema-utils";
 import { EntityPredicatesResolver } from "./EntityPredicateResolver.js";
 import { allowDefinitionsStore } from "./stores.js";
 import { Role } from "../roles.js";
@@ -13,7 +14,7 @@ class AclFactory {
     const entityLikeDefinition = filterEntityDefinition(exportedDefinitions);
     const roles = Object.values(exportedDefinitions).filter((it) => it instanceof Role);
     const variables = Object.values(exportedDefinitions).filter((it) => it instanceof VariableDefinition);
-    const groupedPermissions = AclFactory.groupPermissions(entityLikeDefinition, roles);
+    const groupedPermissions = this.groupPermissions(entityLikeDefinition, roles);
     return {
       roles: Object.fromEntries(roles.map((role) => {
         const rolePermissions = groupedPermissions.get(role);
@@ -95,7 +96,7 @@ class AclFactory {
       return [variable.name, variable.variable];
     }));
   }
-  static groupPermissions(entityLikeDefinition, roles) {
+  groupPermissions(entityLikeDefinition, roles) {
     const groupedPermissions = /* @__PURE__ */ new Map();
     for (const [name, entity] of entityLikeDefinition) {
       const initEntityPermissions = (role) => {
@@ -108,12 +109,17 @@ class AclFactory {
         return entityPermissions;
       };
       const metadata = allowDefinitionsStore.get(entity);
-      for (const { role, ...definition } of metadata) {
+      for (const { role, factory } of metadata) {
         if (!roles.includes(role)) {
           throw `Role ${role.name} used on entity ${name} is not registered. Have you exported it?`;
         }
         const entityPermissions = initEntityPermissions(role);
-        entityPermissions.definitions.push(definition);
+        const entity2 = getEntity(this.model, name);
+        entityPermissions.definitions.push(factory({
+          model: this.model,
+          entity: getEntity(this.model, name),
+          except: (...fields) => Object.keys(entity2.fields).filter((it) => !fields.includes(it))
+        }));
       }
     }
     return groupedPermissions;

package/dist/development/src/acl/definition/internal/AclFactory.js.map

@@ -1 +1 @@
-{"version":3,"file":"AclFactory.js","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/AclFactory.ts"],"sourcesContent":["import { Acl, Model, Writable } from '@contember/schema'\nimport { getEntity } from '@contember/schema-utils'\n\nimport { EntityPredicatesResolver } from './EntityPredicateResolver'\nimport { AllowDefinition } from '../permissions'\nimport {\n\tallowDefinitionsStore,\n\tEntityPermissionsDefinition,\n} from './stores'\nimport { Role } from '../roles'\nimport {  VariableDefinition } from '../variables'\nimport { filterEntityDefinition } from '../../../utils'\nimport { applyEntityAclExtensions } from '../aclExtensions'\n\nexport class AclFactory {\n\tconstructor(\n\t\tprivate model: Model.Schema,\n\t) {\n\t}\n\n\tpublic create(\n\t\texportedDefinitions: Record<string, any>,\n\t): Acl.Schema {\n\t\tconst entityLikeDefinition = filterEntityDefinition(exportedDefinitions)\n\t\tconst roles: Role[] = Object.values(exportedDefinitions).filter(it => it instanceof Role)\n\t\tconst variables: VariableDefinition[] = Object.values(exportedDefinitions).filter(it => it instanceof VariableDefinition)\n\n\t\tconst groupedPermissions = AclFactory.groupPermissions(entityLikeDefinition, roles)\n\n\t\treturn {\n\t\t\troles: Object.fromEntries(roles.map((role): [string, Acl.RolePermissions] => {\n\t\t\t\tconst rolePermissions = groupedPermissions.get(role)\n\t\t\t\treturn [\n\t\t\t\t\trole.name,\n\t\t\t\t\t{\n\t\t\t\t\t\t...role.options,\n\t\t\t\t\t\tstages: role.options.stages ?? '*',\n\t\t\t\t\t\tentities: this.createPermissions(rolePermissions, Object.fromEntries(entityLikeDefinition), role),\n\t\t\t\t\t\tvariables: this.createVariables(role, variables),\n\t\t\t\t\t},\n\t\t\t\t]\n\t\t\t})),\n\t\t}\n\t}\n\n\tprivate createPermissions(rolePermissions: PermissionsByEntity | undefined, entityLikeDefinition: Record<string, { new(): any }>, role: Role): Acl.Permissions {\n\t\treturn Object.fromEntries(Object.values(this.model.entities).map((entity): [string, Acl.EntityPermissions] | undefined => {\n\t\t\tconst permissions = rolePermissions ? this.createPermissionsFromAllow(rolePermissions, entity) : { predicates: {}, operations: {} }\n\t\t\tconst isEmpty = !rolePermissions?.has(entity.name)\n\t\t\tconst withExtensions = applyEntityAclExtensions(entityLikeDefinition[entity.name], { entity, permissions, role })\n\t\t\tif (isEmpty && withExtensions === permissions) {\n\t\t\t\treturn undefined\n\t\t\t}\n\t\t\treturn [\n\t\t\t\tentity.name,\n\t\t\t\twithExtensions,\n\t\t\t]\n\t\t}).filter(<T>(it: T | undefined): it is T => it !== undefined))\n\t}\n\n\tprivate createPermissionsFromAllow(rolePermissions: PermissionsByEntity, entity: Model.Entity): Acl.EntityPermissions {\n\t\tconst predicatesResolver = EntityPredicatesResolver.create(rolePermissions, this.model, entity)\n\n\t\tconst entityOperations: Writable<Acl.EntityOperations> = {}\n\t\tconst noRootOptions = this.getNoRootOptions(entity, rolePermissions.get(entity.name))\n\t\tif (noRootOptions?.length) {\n\t\t\tentityOperations.noRoot = noRootOptions\n\t\t}\n\t\tfor (const op of ['create', 'update', 'read'] as const) {\n\t\t\tconst fieldPermissions: Writable<Acl.FieldPermissions> = {}\n\t\t\tfor (const field of Object.keys(entity.fields)) {\n\t\t\t\tconst predicate = predicatesResolver.createFieldPredicate(op, field, field === entity.primary)\n\t\t\t\tif (predicate !== undefined) {\n\t\t\t\t\tfieldPermissions[field] = predicate\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (Object.keys(fieldPermissions).length > 0) {\n\t\t\t\tentityOperations[op] = fieldPermissions\n\t\t\t}\n\t\t}\n\t\tconst delPredicate = predicatesResolver.createFieldPredicate('delete', '', false)\n\t\tif (delPredicate !== undefined) {\n\t\t\tentityOperations.delete = delPredicate\n\t\t}\n\t\treturn {\n\t\t\tpredicates: predicatesResolver.getUsedPredicates(),\n\t\t\toperations: entityOperations,\n\t\t}\n\t}\n\n\n\tgetNoRootOptions(entity: Model.Entity, permissions?: EntityPermissions): Acl.EntityOperations['noRoot'] {\n\t\tconst allowedRoot = new Set<Acl.Operation>()\n\t\tconst disallowedRoot = new Set<Acl.Operation>()\n\t\tfor (const def of permissions?.definitions ?? []) {\n\t\t\tconst noRoot = def.through === true\n\t\t\tfor (const op of ['create', 'read', 'update', 'delete'] as const) {\n\t\t\t\tif (def[op]) {\n\t\t\t\t\tconst currentSet = noRoot ? disallowedRoot : allowedRoot\n\t\t\t\t\tcurrentSet.add(op as Acl.Operation)\n\n\t\t\t\t\tconst otherSet = noRoot ? allowedRoot : disallowedRoot\n\n\t\t\t\t\tif (otherSet.has(op as Acl.Operation)) {\n\t\t\t\t\t\tthrow new Error(`Operation ${op} cannot be both allowed and disallowed on root on entity ${entity.name}`)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t}\n\t\treturn [...disallowedRoot.values()]\n\t}\n\n\tprivate createVariables(role: Role, variables: VariableDefinition[]): Acl.Variables {\n\t\tconst roleVariables = variables.filter(it => it.roles.includes(role))\n\t\treturn Object.fromEntries(roleVariables.map((variable): [string, Acl.Variable] => {\n\t\t\treturn [variable.name, variable.variable]\n\t\t}))\n\t}\n\n\tprivate static groupPermissions(entityLikeDefinition: [string, { new(): any }][], roles: Role[]): PermissionsByRoleAndEntity {\n\t\tconst groupedPermissions: PermissionsByRoleAndEntity = new Map()\n\t\tfor (const [name, entity] of entityLikeDefinition) {\n\t\t\tconst initEntityPermissions = (role: Role): EntityPermissions => {\n\t\t\t\tconst rolePermissions: PermissionsByEntity = groupedPermissions.get(role) ?? new Map()\n\t\t\t\tgroupedPermissions.set(role, rolePermissions)\n\t\t\t\tconst entityPermissions = rolePermissions.get(name) ?? {\n\t\t\t\t\tdefinitions: [],\n\t\t\t\t}\n\t\t\t\trolePermissions.set(name, entityPermissions)\n\t\t\t\treturn entityPermissions\n\t\t\t}\n\t\t\tconst metadata: EntityPermissionsDefinition[] = allowDefinitionsStore.get(entity)\n\t\t\tfor (const { role, ...definition } of metadata) {\n\t\t\t\tif (!roles.includes(role)) {\n\t\t\t\t\tthrow `Role ${role.name} used on entity ${name} is not registered. Have you exported it?`\n\t\t\t\t}\n\t\t\t\tconst entityPermissions = initEntityPermissions(role)\n\t\t\t\tentityPermissions.definitions.push(definition)\n\t\t\t}\n\t\t}\n\n\t\treturn groupedPermissions\n\t}\n}\n\n\nexport type EntityPermissions = { definitions: AllowDefinition<any>[] }\nexport type PermissionsByEntity = Map<string, EntityPermissions>\nexport type PermissionsByRoleAndEntity = Map<Role, PermissionsByEntity>\n"],"names":[],"mappings":";;;;;;;AAcO,MAAM,WAAW;AAAA,EACvB,YACS,OACP;AADO,SAAA,QAAA;AAAA,EAAA;AAAA,EAIF,OACN,qBACa;AACP,UAAA,uBAAuB,uBAAuB,mBAAmB;AACjE,UAAA,QAAgB,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAc,IAAI;AAClF,UAAA,YAAkC,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAc,kBAAkB;AAExH,UAAM,qBAAqB,WAAW,iBAAiB,sBAAsB,KAAK;AAE3E,WAAA;AAAA,MACN,OAAO,OAAO,YAAY,MAAM,IAAI,CAAC,SAAwC;AACtE,cAAA,kBAAkB,mBAAmB,IAAI,IAAI;AAC5C,eAAA;AAAA,UACN,KAAK;AAAA,UACL;AAAA,YACC,GAAG,KAAK;AAAA,YACR,QAAQ,KAAK,QAAQ,UAAU;AAAA,YAC/B,UAAU,KAAK,kBAAkB,iBAAiB,OAAO,YAAY,oBAAoB,GAAG,IAAI;AAAA,YAChG,WAAW,KAAK,gBAAgB,MAAM,SAAS;AAAA,UAAA;AAAA,QAEjD;AAAA,MAAA,CACA,CAAC;AAAA,IACH;AAAA,EAAA;AAAA,EAGO,kBAAkB,iBAAkD,sBAAsD,MAA6B;AACvJ,WAAA,OAAO,YAAY,OAAO,OAAO,KAAK,MAAM,QAAQ,EAAE,IAAI,CAAC,WAAwD;AACzH,YAAM,cAAc,kBAAkB,KAAK,2BAA2B,iBAAiB,MAAM,IAAI,EAAE,YAAY,IAAI,YAAY,CAAA,EAAG;AAClI,YAAM,UAAU,CAAC,iBAAiB,IAAI,OAAO,IAAI;AAC3C,YAAA,iBAAiB,yBAAyB,qBAAqB,OAAO,IAAI,GAAG,EAAE,QAAQ,aAAa,MAAM;AAC5G,UAAA,WAAW,mBAAmB,aAAa;AACvC,eAAA;AAAA,MAAA;AAED,aAAA;AAAA,QACN,OAAO;AAAA,QACP;AAAA,MACD;AAAA,IAAA,CACA,EAAE,OAAO,CAAI,OAA+B,OAAO,MAAS,CAAC;AAAA,EAAA;AAAA,EAGvD,2BAA2B,iBAAsC,QAA6C;AACrH,UAAM,qBAAqB,yBAAyB,OAAO,iBAAiB,KAAK,OAAO,MAAM;AAE9F,UAAM,mBAAmD,CAAC;AACpD,UAAA,gBAAgB,KAAK,iBAAiB,QAAQ,gBAAgB,IAAI,OAAO,IAAI,CAAC;AACpF,QAAI,eAAe,QAAQ;AAC1B,uBAAiB,SAAS;AAAA,IAAA;AAE3B,eAAW,MAAM,CAAC,UAAU,UAAU,MAAM,GAAY;AACvD,YAAM,mBAAmD,CAAC;AAC1D,iBAAW,SAAS,OAAO,KAAK,OAAO,MAAM,GAAG;AAC/C,cAAM,YAAY,mBAAmB,qBAAqB,IAAI,OAAO,UAAU,OAAO,OAAO;AAC7F,YAAI,cAAc,QAAW;AAC5B,2BAAiB,KAAK,IAAI;AAAA,QAAA;AAAA,MAC3B;AAED,UAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,GAAG;AAC7C,yBAAiB,EAAE,IAAI;AAAA,MAAA;AAAA,IACxB;AAED,UAAM,eAAe,mBAAmB,qBAAqB,UAAU,IAAI,KAAK;AAChF,QAAI,iBAAiB,QAAW;AAC/B,uBAAiB,SAAS;AAAA,IAAA;AAEpB,WAAA;AAAA,MACN,YAAY,mBAAmB,kBAAkB;AAAA,MACjD,YAAY;AAAA,IACb;AAAA,EAAA;AAAA,EAID,iBAAiB,QAAsB,aAAiE;AACjG,UAAA,kCAAkB,IAAmB;AACrC,UAAA,qCAAqB,IAAmB;AAC9C,eAAW,OAAO,aAAa,eAAe,CAAA,GAAI;AAC3C,YAAA,SAAS,IAAI,YAAY;AAC/B,iBAAW,MAAM,CAAC,UAAU,QAAQ,UAAU,QAAQ,GAAY;AAC7D,YAAA,IAAI,EAAE,GAAG;AACN,gBAAA,aAAa,SAAS,iBAAiB;AAC7C,qBAAW,IAAI,EAAmB;AAE5B,gBAAA,WAAW,SAAS,cAAc;AAEpC,cAAA,SAAS,IAAI,EAAmB,GAAG;AACtC,kBAAM,IAAI,MAAM,aAAa,EAAE,4DAA4D,OAAO,IAAI,EAAE;AAAA,UAAA;AAAA,QACzG;AAAA,MACD;AAAA,IACD;AAGD,WAAO,CAAC,GAAG,eAAe,QAAQ;AAAA,EAAA;AAAA,EAG3B,gBAAgB,MAAY,WAAgD;AAC7E,UAAA,gBAAgB,UAAU,OAAO,CAAA,OAAM,GAAG,MAAM,SAAS,IAAI,CAAC;AACpE,WAAO,OAAO,YAAY,cAAc,IAAI,CAAC,aAAqC;AACjF,aAAO,CAAC,SAAS,MAAM,SAAS,QAAQ;AAAA,IAAA,CACxC,CAAC;AAAA,EAAA;AAAA,EAGH,OAAe,iBAAiB,sBAAkD,OAA2C;AACtH,UAAA,yCAAqD,IAAI;AAC/D,eAAW,CAAC,MAAM,MAAM,KAAK,sBAAsB;AAC5C,YAAA,wBAAwB,CAAC,SAAkC;AAChE,cAAM,kBAAuC,mBAAmB,IAAI,IAAI,yBAAS,IAAI;AAClE,2BAAA,IAAI,MAAM,eAAe;AAC5C,cAAM,oBAAoB,gBAAgB,IAAI,IAAI,KAAK;AAAA,UACtD,aAAa,CAAA;AAAA,QACd;AACgB,wBAAA,IAAI,MAAM,iBAAiB;AACpC,eAAA;AAAA,MACR;AACM,YAAA,WAA0C,sBAAsB,IAAI,MAAM;AAChF,iBAAW,EAAE,MAAM,GAAG,WAAA,KAAgB,UAAU;AAC/C,YAAI,CAAC,MAAM,SAAS,IAAI,GAAG;AAC1B,gBAAM,QAAQ,KAAK,IAAI,mBAAmB,IAAI;AAAA,QAAA;AAEzC,cAAA,oBAAoB,sBAAsB,IAAI;AAClC,0BAAA,YAAY,KAAK,UAAU;AAAA,MAAA;AAAA,IAC9C;AAGM,WAAA;AAAA,EAAA;AAET;"}
+{"version":3,"file":"AclFactory.js","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/AclFactory.ts"],"sourcesContent":["import { Acl, Model, Writable } from '@contember/schema'\nimport { getEntity } from '@contember/schema-utils'\n\nimport { EntityPredicatesResolver } from './EntityPredicateResolver'\nimport { AllowDefinition } from '../permissions'\nimport {\n\tallowDefinitionsStore,\n\tEntityPermissionsDefinition,\n} from './stores'\nimport { Role } from '../roles'\nimport {  VariableDefinition } from '../variables'\nimport { filterEntityDefinition } from '../../../utils'\nimport { applyEntityAclExtensions } from '../aclExtensions'\n\nexport class AclFactory {\n\tconstructor(\n\t\tprivate model: Model.Schema,\n\t) {\n\t}\n\n\tpublic create(\n\t\texportedDefinitions: Record<string, any>,\n\t): Acl.Schema {\n\t\tconst entityLikeDefinition = filterEntityDefinition(exportedDefinitions)\n\t\tconst roles: Role[] = Object.values(exportedDefinitions).filter(it => it instanceof Role)\n\t\tconst variables: VariableDefinition[] = Object.values(exportedDefinitions).filter(it => it instanceof VariableDefinition)\n\n\t\tconst groupedPermissions = this.groupPermissions(entityLikeDefinition, roles)\n\n\t\treturn {\n\t\t\troles: Object.fromEntries(roles.map((role): [string, Acl.RolePermissions] => {\n\t\t\t\tconst rolePermissions = groupedPermissions.get(role)\n\t\t\t\treturn [\n\t\t\t\t\trole.name,\n\t\t\t\t\t{\n\t\t\t\t\t\t...role.options,\n\t\t\t\t\t\tstages: role.options.stages ?? '*',\n\t\t\t\t\t\tentities: this.createPermissions(rolePermissions, Object.fromEntries(entityLikeDefinition), role),\n\t\t\t\t\t\tvariables: this.createVariables(role, variables),\n\t\t\t\t\t},\n\t\t\t\t]\n\t\t\t})),\n\t\t}\n\t}\n\n\tprivate createPermissions(rolePermissions: PermissionsByEntity | undefined, entityLikeDefinition: Record<string, { new(): any }>, role: Role): Acl.Permissions {\n\t\treturn Object.fromEntries(Object.values(this.model.entities).map((entity): [string, Acl.EntityPermissions] | undefined => {\n\t\t\tconst permissions = rolePermissions ? this.createPermissionsFromAllow(rolePermissions, entity) : { predicates: {}, operations: {} }\n\t\t\tconst isEmpty = !rolePermissions?.has(entity.name)\n\t\t\tconst withExtensions = applyEntityAclExtensions(entityLikeDefinition[entity.name], { entity, permissions, role })\n\t\t\tif (isEmpty && withExtensions === permissions) {\n\t\t\t\treturn undefined\n\t\t\t}\n\t\t\treturn [\n\t\t\t\tentity.name,\n\t\t\t\twithExtensions,\n\t\t\t]\n\t\t}).filter(<T>(it: T | undefined): it is T => it !== undefined))\n\t}\n\n\tprivate createPermissionsFromAllow(rolePermissions: PermissionsByEntity, entity: Model.Entity): Acl.EntityPermissions {\n\t\tconst predicatesResolver = EntityPredicatesResolver.create(rolePermissions, this.model, entity)\n\n\t\tconst entityOperations: Writable<Acl.EntityOperations> = {}\n\t\tconst noRootOptions = this.getNoRootOptions(entity, rolePermissions.get(entity.name))\n\t\tif (noRootOptions?.length) {\n\t\t\tentityOperations.noRoot = noRootOptions\n\t\t}\n\t\tfor (const op of ['create', 'update', 'read'] as const) {\n\t\t\tconst fieldPermissions: Writable<Acl.FieldPermissions> = {}\n\t\t\tfor (const field of Object.keys(entity.fields)) {\n\t\t\t\tconst predicate = predicatesResolver.createFieldPredicate(op, field, field === entity.primary)\n\t\t\t\tif (predicate !== undefined) {\n\t\t\t\t\tfieldPermissions[field] = predicate\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (Object.keys(fieldPermissions).length > 0) {\n\t\t\t\tentityOperations[op] = fieldPermissions\n\t\t\t}\n\t\t}\n\t\tconst delPredicate = predicatesResolver.createFieldPredicate('delete', '', false)\n\t\tif (delPredicate !== undefined) {\n\t\t\tentityOperations.delete = delPredicate\n\t\t}\n\t\treturn {\n\t\t\tpredicates: predicatesResolver.getUsedPredicates(),\n\t\t\toperations: entityOperations,\n\t\t}\n\t}\n\n\n\tgetNoRootOptions(entity: Model.Entity, permissions?: EntityPermissions): Acl.EntityOperations['noRoot'] {\n\t\tconst allowedRoot = new Set<Acl.Operation>()\n\t\tconst disallowedRoot = new Set<Acl.Operation>()\n\t\tfor (const def of permissions?.definitions ?? []) {\n\t\t\tconst noRoot = def.through === true\n\t\t\tfor (const op of ['create', 'read', 'update', 'delete'] as const) {\n\t\t\t\tif (def[op]) {\n\t\t\t\t\tconst currentSet = noRoot ? disallowedRoot : allowedRoot\n\t\t\t\t\tcurrentSet.add(op as Acl.Operation)\n\n\t\t\t\t\tconst otherSet = noRoot ? allowedRoot : disallowedRoot\n\n\t\t\t\t\tif (otherSet.has(op as Acl.Operation)) {\n\t\t\t\t\t\tthrow new Error(`Operation ${op} cannot be both allowed and disallowed on root on entity ${entity.name}`)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t}\n\t\treturn [...disallowedRoot.values()]\n\t}\n\n\tprivate createVariables(role: Role, variables: VariableDefinition[]): Acl.Variables {\n\t\tconst roleVariables = variables.filter(it => it.roles.includes(role))\n\t\treturn Object.fromEntries(roleVariables.map((variable): [string, Acl.Variable] => {\n\t\t\treturn [variable.name, variable.variable]\n\t\t}))\n\t}\n\n\tprivate groupPermissions(entityLikeDefinition: [string, { new(): any }][], roles: Role[]): PermissionsByRoleAndEntity {\n\t\tconst groupedPermissions: PermissionsByRoleAndEntity = new Map()\n\t\tfor (const [name, entity] of entityLikeDefinition) {\n\t\t\tconst initEntityPermissions = (role: Role): EntityPermissions => {\n\t\t\t\tconst rolePermissions: PermissionsByEntity = groupedPermissions.get(role) ?? new Map()\n\t\t\t\tgroupedPermissions.set(role, rolePermissions)\n\t\t\t\tconst entityPermissions = rolePermissions.get(name) ?? {\n\t\t\t\t\tdefinitions: [],\n\t\t\t\t}\n\t\t\t\trolePermissions.set(name, entityPermissions)\n\t\t\t\treturn entityPermissions\n\t\t\t}\n\t\t\tconst metadata: EntityPermissionsDefinition[] = allowDefinitionsStore.get(entity)\n\t\t\tfor (const { role, factory } of metadata) {\n\t\t\t\tif (!roles.includes(role)) {\n\t\t\t\t\tthrow `Role ${role.name} used on entity ${name} is not registered. Have you exported it?`\n\t\t\t\t}\n\t\t\t\tconst entityPermissions = initEntityPermissions(role)\n\t\t\t\tconst entity = getEntity(this.model, name)\n\t\t\t\tentityPermissions.definitions.push(factory({\n\t\t\t\t\tmodel: this.model,\n\t\t\t\t\tentity: getEntity(this.model, name),\n\t\t\t\t\texcept: (...fields) => (Object.keys(entity.fields)).filter(it => !fields.includes(it)),\n\t\t\t\t}))\n\t\t\t}\n\t\t}\n\n\t\treturn groupedPermissions\n\t}\n}\n\n\nexport type EntityPermissions = { definitions: AllowDefinition<any>[] }\nexport type PermissionsByEntity = Map<string, EntityPermissions>\nexport type PermissionsByRoleAndEntity = Map<Role, PermissionsByEntity>\n"],"names":["entity"],"mappings":";;;;;;;;AAcO,MAAM,WAAW;AAAA,EACvB,YACS,OACP;AADO,SAAA,QAAA;AAAA,EAAA;AAAA,EAIF,OACN,qBACa;AACP,UAAA,uBAAuB,uBAAuB,mBAAmB;AACjE,UAAA,QAAgB,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAc,IAAI;AAClF,UAAA,YAAkC,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAc,kBAAkB;AAExH,UAAM,qBAAqB,KAAK,iBAAiB,sBAAsB,KAAK;AAErE,WAAA;AAAA,MACN,OAAO,OAAO,YAAY,MAAM,IAAI,CAAC,SAAwC;AACtE,cAAA,kBAAkB,mBAAmB,IAAI,IAAI;AAC5C,eAAA;AAAA,UACN,KAAK;AAAA,UACL;AAAA,YACC,GAAG,KAAK;AAAA,YACR,QAAQ,KAAK,QAAQ,UAAU;AAAA,YAC/B,UAAU,KAAK,kBAAkB,iBAAiB,OAAO,YAAY,oBAAoB,GAAG,IAAI;AAAA,YAChG,WAAW,KAAK,gBAAgB,MAAM,SAAS;AAAA,UAAA;AAAA,QAEjD;AAAA,MAAA,CACA,CAAC;AAAA,IACH;AAAA,EAAA;AAAA,EAGO,kBAAkB,iBAAkD,sBAAsD,MAA6B;AACvJ,WAAA,OAAO,YAAY,OAAO,OAAO,KAAK,MAAM,QAAQ,EAAE,IAAI,CAAC,WAAwD;AACzH,YAAM,cAAc,kBAAkB,KAAK,2BAA2B,iBAAiB,MAAM,IAAI,EAAE,YAAY,IAAI,YAAY,CAAA,EAAG;AAClI,YAAM,UAAU,CAAC,iBAAiB,IAAI,OAAO,IAAI;AAC3C,YAAA,iBAAiB,yBAAyB,qBAAqB,OAAO,IAAI,GAAG,EAAE,QAAQ,aAAa,MAAM;AAC5G,UAAA,WAAW,mBAAmB,aAAa;AACvC,eAAA;AAAA,MAAA;AAED,aAAA;AAAA,QACN,OAAO;AAAA,QACP;AAAA,MACD;AAAA,IAAA,CACA,EAAE,OAAO,CAAI,OAA+B,OAAO,MAAS,CAAC;AAAA,EAAA;AAAA,EAGvD,2BAA2B,iBAAsC,QAA6C;AACrH,UAAM,qBAAqB,yBAAyB,OAAO,iBAAiB,KAAK,OAAO,MAAM;AAE9F,UAAM,mBAAmD,CAAC;AACpD,UAAA,gBAAgB,KAAK,iBAAiB,QAAQ,gBAAgB,IAAI,OAAO,IAAI,CAAC;AACpF,QAAI,eAAe,QAAQ;AAC1B,uBAAiB,SAAS;AAAA,IAAA;AAE3B,eAAW,MAAM,CAAC,UAAU,UAAU,MAAM,GAAY;AACvD,YAAM,mBAAmD,CAAC;AAC1D,iBAAW,SAAS,OAAO,KAAK,OAAO,MAAM,GAAG;AAC/C,cAAM,YAAY,mBAAmB,qBAAqB,IAAI,OAAO,UAAU,OAAO,OAAO;AAC7F,YAAI,cAAc,QAAW;AAC5B,2BAAiB,KAAK,IAAI;AAAA,QAAA;AAAA,MAC3B;AAED,UAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,GAAG;AAC7C,yBAAiB,EAAE,IAAI;AAAA,MAAA;AAAA,IACxB;AAED,UAAM,eAAe,mBAAmB,qBAAqB,UAAU,IAAI,KAAK;AAChF,QAAI,iBAAiB,QAAW;AAC/B,uBAAiB,SAAS;AAAA,IAAA;AAEpB,WAAA;AAAA,MACN,YAAY,mBAAmB,kBAAkB;AAAA,MACjD,YAAY;AAAA,IACb;AAAA,EAAA;AAAA,EAID,iBAAiB,QAAsB,aAAiE;AACjG,UAAA,kCAAkB,IAAmB;AACrC,UAAA,qCAAqB,IAAmB;AAC9C,eAAW,OAAO,aAAa,eAAe,CAAA,GAAI;AAC3C,YAAA,SAAS,IAAI,YAAY;AAC/B,iBAAW,MAAM,CAAC,UAAU,QAAQ,UAAU,QAAQ,GAAY;AAC7D,YAAA,IAAI,EAAE,GAAG;AACN,gBAAA,aAAa,SAAS,iBAAiB;AAC7C,qBAAW,IAAI,EAAmB;AAE5B,gBAAA,WAAW,SAAS,cAAc;AAEpC,cAAA,SAAS,IAAI,EAAmB,GAAG;AACtC,kBAAM,IAAI,MAAM,aAAa,EAAE,4DAA4D,OAAO,IAAI,EAAE;AAAA,UAAA;AAAA,QACzG;AAAA,MACD;AAAA,IACD;AAGD,WAAO,CAAC,GAAG,eAAe,QAAQ;AAAA,EAAA;AAAA,EAG3B,gBAAgB,MAAY,WAAgD;AAC7E,UAAA,gBAAgB,UAAU,OAAO,CAAA,OAAM,GAAG,MAAM,SAAS,IAAI,CAAC;AACpE,WAAO,OAAO,YAAY,cAAc,IAAI,CAAC,aAAqC;AACjF,aAAO,CAAC,SAAS,MAAM,SAAS,QAAQ;AAAA,IAAA,CACxC,CAAC;AAAA,EAAA;AAAA,EAGK,iBAAiB,sBAAkD,OAA2C;AAC/G,UAAA,yCAAqD,IAAI;AAC/D,eAAW,CAAC,MAAM,MAAM,KAAK,sBAAsB;AAC5C,YAAA,wBAAwB,CAAC,SAAkC;AAChE,cAAM,kBAAuC,mBAAmB,IAAI,IAAI,yBAAS,IAAI;AAClE,2BAAA,IAAI,MAAM,eAAe;AAC5C,cAAM,oBAAoB,gBAAgB,IAAI,IAAI,KAAK;AAAA,UACtD,aAAa,CAAA;AAAA,QACd;AACgB,wBAAA,IAAI,MAAM,iBAAiB;AACpC,eAAA;AAAA,MACR;AACM,YAAA,WAA0C,sBAAsB,IAAI,MAAM;AAChF,iBAAW,EAAE,MAAM,QAAQ,KAAK,UAAU;AACzC,YAAI,CAAC,MAAM,SAAS,IAAI,GAAG;AAC1B,gBAAM,QAAQ,KAAK,IAAI,mBAAmB,IAAI;AAAA,QAAA;AAEzC,cAAA,oBAAoB,sBAAsB,IAAI;AACpD,cAAMA,UAAS,UAAU,KAAK,OAAO,IAAI;AACvB,0BAAA,YAAY,KAAK,QAAQ;AAAA,UAC1C,OAAO,KAAK;AAAA,UACZ,QAAQ,UAAU,KAAK,OAAO,IAAI;AAAA,UAClC,QAAQ,IAAI,WAAY,OAAO,KAAKA,QAAO,MAAM,EAAG,OAAO,CAAM,OAAA,CAAC,OAAO,SAAS,EAAE,CAAC;AAAA,QAAA,CACrF,CAAC;AAAA,MAAA;AAAA,IACH;AAGM,WAAA;AAAA,EAAA;AAET;"}

package/dist/development/src/acl/definition/internal/stores.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"stores.cjs","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/stores.ts"],"sourcesContent":["import { createMetadataStore } from '../../../utils/MetadataStore'\nimport { Role } from '../roles'\nimport { AllowDefinition } from '../permissions'\n\nexport type EntityPermissionsDefinition =\n\t& AllowDefinition<any>\n\t& {\n\t\trole: Role<string>\n\t}\nexport const allowDefinitionsStore = createMetadataStore<EntityPermissionsDefinition[]>([])\n"],"names":["createMetadataStore"],"mappings":";;;AASa,MAAA,wBAAwBA,cAAmD,oBAAA,CAAE,CAAA;;"}
+{"version":3,"file":"stores.cjs","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/stores.ts"],"sourcesContent":["import { createMetadataStore } from '../../../utils/MetadataStore'\nimport { AllowDefinitionFactory } from '../permissions'\nimport { Role } from '../roles'\n\nexport type EntityPermissionsDefinition =\n\t& {\n\t\tfactory: AllowDefinitionFactory<any>\n\t\trole: Role<string>\n\t}\nexport const allowDefinitionsStore = createMetadataStore<EntityPermissionsDefinition[]>([])\n"],"names":["createMetadataStore"],"mappings":";;;AASa,MAAA,wBAAwBA,cAAmD,oBAAA,CAAE,CAAA;;"}

package/dist/development/src/acl/definition/internal/stores.js.map

@@ -1 +1 @@
-{"version":3,"file":"stores.js","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/stores.ts"],"sourcesContent":["import { createMetadataStore } from '../../../utils/MetadataStore'\nimport { Role } from '../roles'\nimport { AllowDefinition } from '../permissions'\n\nexport type EntityPermissionsDefinition =\n\t& AllowDefinition<any>\n\t& {\n\t\trole: Role<string>\n\t}\nexport const allowDefinitionsStore = createMetadataStore<EntityPermissionsDefinition[]>([])\n"],"names":[],"mappings":";AASa,MAAA,wBAAwB,oBAAmD,CAAE,CAAA;"}
+{"version":3,"file":"stores.js","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/stores.ts"],"sourcesContent":["import { createMetadataStore } from '../../../utils/MetadataStore'\nimport { AllowDefinitionFactory } from '../permissions'\nimport { Role } from '../roles'\n\nexport type EntityPermissionsDefinition =\n\t& {\n\t\tfactory: AllowDefinitionFactory<any>\n\t\trole: Role<string>\n\t}\nexport const allowDefinitionsStore = createMetadataStore<EntityPermissionsDefinition[]>([])\n"],"names":[],"mappings":";AASa,MAAA,wBAAwB,oBAAmD,CAAE,CAAA;"}

package/dist/development/src/acl/definition/permissions.cjs

@@ -4,7 +4,10 @@ const stores = require("./internal/stores.cjs");
 const allow = (role, args) => {
   return (entity) => {
     (Array.isArray(role) ? role : [role]).forEach((role2) => {
-      stores.allowDefinitionsStore.update(entity, (val) => [...val, { ...args, role: role2 }]);
+      stores.allowDefinitionsStore.update(entity, (val) => [...val, {
+        factory: typeof args === "function" ? args : () => args,
+        role: role2
+      }]);
     });
   };
 };

package/dist/development/src/acl/definition/permissions.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.cjs","sources":["../../../../../../packages/schema-definition/src/acl/definition/permissions.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\nimport { Role } from './roles'\nimport { VariableDefinition } from './variables'\nimport { PredicateEvaluationReference } from './references'\nimport { allowDefinitionsStore } from './internal/stores'\nimport { DecoratorFunction, EntityConstructor } from '../../utils'\n\nexport type PredicateExtra = PredicateEvaluationReference | VariableDefinition\nexport type WhenDefinition = Acl.PredicateDefinition<PredicateExtra>\n\nexport interface AllowDefinition<E> {\n\twhen?: WhenDefinition\n\tthrough?: true\n\tname?: string\n\tcreate?: true | ('id' | keyof E)[]\n\tupdate?: true | ('id' | keyof E)[]\n\tread?: true | ('id' | keyof E)[]\n\tdelete?: true\n}\n\nexport const allow = <E, R extends Role<string>>(role: R | R[], args: AllowDefinition<E>): DecoratorFunction<E> => {\n\treturn (entity: EntityConstructor<E>) => {\n\t\t(Array.isArray(role) ? role : [role]).forEach(role => {\n\t\t\tallowDefinitionsStore.update(entity, val => [...val, { ...args, role }])\n\t\t})\n\t}\n}\n\n\n\n"],"names":["role","allowDefinitionsStore"],"mappings":";;;AAoBa,MAAA,QAAQ,CAA4B,MAAe,SAAmD;AAClH,SAAO,CAAC,WAAiC;AACvC,KAAA,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAAA,UAAQ;AACrDC,aAAAA,sBAAsB,OAAO,QAAQ,CAAO,QAAA,CAAC,GAAG,KAAK,EAAE,GAAG,MAAM,MAAAD,MAAM,CAAA,CAAC;AAAA,IAAA,CACvE;AAAA,EACF;AACD;;"}
+{"version":3,"file":"permissions.cjs","sources":["../../../../../../packages/schema-definition/src/acl/definition/permissions.ts"],"sourcesContent":["import { Acl, Model } from '@contember/schema'\nimport { Role } from './roles'\nimport { VariableDefinition } from './variables'\nimport { PredicateEvaluationReference } from './references'\nimport { allowDefinitionsStore } from './internal/stores'\nimport { DecoratorFunction, EntityConstructor } from '../../utils'\n\nexport type PredicateExtra = PredicateEvaluationReference | VariableDefinition\nexport type WhenDefinition = Acl.PredicateDefinition<PredicateExtra>\n\nexport interface AllowDefinition<E> {\n\twhen?: WhenDefinition\n\tthrough?: true\n\tname?: string\n\tcreate?: true | ('id' | keyof E)[]\n\tupdate?: true | ('id' | keyof E)[]\n\tread?: true | ('id' | keyof E)[]\n\tdelete?: true\n}\n\nexport type AllowDefinitionFactory<E> = (args: {\n\tmodel: Model.Schema\n\tentity: Model.Entity<(keyof E) & string>\n\texcept: (...fields: (keyof E)[]) => (keyof E)[]\n}) => AllowDefinition<E>\n\nexport const allow = <E, R extends Role<string>>(role: R | R[], args: AllowDefinition<E> | AllowDefinitionFactory<E>): DecoratorFunction<E> => {\n\treturn (entity: EntityConstructor<E>) => {\n\t\t(Array.isArray(role) ? role : [role]).forEach(role => {\n\t\t\tallowDefinitionsStore.update(entity, val => [...val, {\n\t\t\t\tfactory: typeof args === 'function' ? args : () => args,\n\t\t\t\trole,\n\t\t\t}])\n\t\t})\n\t}\n}\n\n\n\n"],"names":["role","allowDefinitionsStore"],"mappings":";;;AA0Ba,MAAA,QAAQ,CAA4B,MAAe,SAA+E;AAC9I,SAAO,CAAC,WAAiC;AACvC,KAAA,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAAA,UAAQ;AACrDC,aAAA,sBAAsB,OAAO,QAAQ,CAAO,QAAA,CAAC,GAAG,KAAK;AAAA,QACpD,SAAS,OAAO,SAAS,aAAa,OAAO,MAAM;AAAA,QACnD,MAAAD;AAAAA,MAAA,CACA,CAAC;AAAA,IAAA,CACF;AAAA,EACF;AACD;;"}

package/dist/development/src/acl/definition/permissions.js

@@ -2,7 +2,10 @@ import { allowDefinitionsStore } from "./internal/stores.js";
 const allow = (role, args) => {
   return (entity) => {
     (Array.isArray(role) ? role : [role]).forEach((role2) => {
-      allowDefinitionsStore.update(entity, (val) => [...val, { ...args, role: role2 }]);
+      allowDefinitionsStore.update(entity, (val) => [...val, {
+        factory: typeof args === "function" ? args : () => args,
+        role: role2
+      }]);
     });
   };
 };

package/dist/development/src/acl/definition/permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.js","sources":["../../../../../../packages/schema-definition/src/acl/definition/permissions.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\nimport { Role } from './roles'\nimport { VariableDefinition } from './variables'\nimport { PredicateEvaluationReference } from './references'\nimport { allowDefinitionsStore } from './internal/stores'\nimport { DecoratorFunction, EntityConstructor } from '../../utils'\n\nexport type PredicateExtra = PredicateEvaluationReference | VariableDefinition\nexport type WhenDefinition = Acl.PredicateDefinition<PredicateExtra>\n\nexport interface AllowDefinition<E> {\n\twhen?: WhenDefinition\n\tthrough?: true\n\tname?: string\n\tcreate?: true | ('id' | keyof E)[]\n\tupdate?: true | ('id' | keyof E)[]\n\tread?: true | ('id' | keyof E)[]\n\tdelete?: true\n}\n\nexport const allow = <E, R extends Role<string>>(role: R | R[], args: AllowDefinition<E>): DecoratorFunction<E> => {\n\treturn (entity: EntityConstructor<E>) => {\n\t\t(Array.isArray(role) ? role : [role]).forEach(role => {\n\t\t\tallowDefinitionsStore.update(entity, val => [...val, { ...args, role }])\n\t\t})\n\t}\n}\n\n\n\n"],"names":["role"],"mappings":";AAoBa,MAAA,QAAQ,CAA4B,MAAe,SAAmD;AAClH,SAAO,CAAC,WAAiC;AACvC,KAAA,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAAA,UAAQ;AACrD,4BAAsB,OAAO,QAAQ,CAAO,QAAA,CAAC,GAAG,KAAK,EAAE,GAAG,MAAM,MAAAA,MAAM,CAAA,CAAC;AAAA,IAAA,CACvE;AAAA,EACF;AACD;"}
+{"version":3,"file":"permissions.js","sources":["../../../../../../packages/schema-definition/src/acl/definition/permissions.ts"],"sourcesContent":["import { Acl, Model } from '@contember/schema'\nimport { Role } from './roles'\nimport { VariableDefinition } from './variables'\nimport { PredicateEvaluationReference } from './references'\nimport { allowDefinitionsStore } from './internal/stores'\nimport { DecoratorFunction, EntityConstructor } from '../../utils'\n\nexport type PredicateExtra = PredicateEvaluationReference | VariableDefinition\nexport type WhenDefinition = Acl.PredicateDefinition<PredicateExtra>\n\nexport interface AllowDefinition<E> {\n\twhen?: WhenDefinition\n\tthrough?: true\n\tname?: string\n\tcreate?: true | ('id' | keyof E)[]\n\tupdate?: true | ('id' | keyof E)[]\n\tread?: true | ('id' | keyof E)[]\n\tdelete?: true\n}\n\nexport type AllowDefinitionFactory<E> = (args: {\n\tmodel: Model.Schema\n\tentity: Model.Entity<(keyof E) & string>\n\texcept: (...fields: (keyof E)[]) => (keyof E)[]\n}) => AllowDefinition<E>\n\nexport const allow = <E, R extends Role<string>>(role: R | R[], args: AllowDefinition<E> | AllowDefinitionFactory<E>): DecoratorFunction<E> => {\n\treturn (entity: EntityConstructor<E>) => {\n\t\t(Array.isArray(role) ? role : [role]).forEach(role => {\n\t\t\tallowDefinitionsStore.update(entity, val => [...val, {\n\t\t\t\tfactory: typeof args === 'function' ? args : () => args,\n\t\t\t\trole,\n\t\t\t}])\n\t\t})\n\t}\n}\n\n\n\n"],"names":["role"],"mappings":";AA0Ba,MAAA,QAAQ,CAA4B,MAAe,SAA+E;AAC9I,SAAO,CAAC,WAAiC;AACvC,KAAA,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAAA,UAAQ;AACrD,4BAAsB,OAAO,QAAQ,CAAO,QAAA,CAAC,GAAG,KAAK;AAAA,QACpD,SAAS,OAAO,SAAS,aAAa,OAAO,MAAM;AAAA,QACnD,MAAAA;AAAAA,MAAA,CACA,CAAC;AAAA,IAAA,CACF;AAAA,EACF;AACD;"}

package/dist/development/src/model/definition/IndexDefinition.cjs

@@ -3,12 +3,12 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const extensions = require("./extensions.cjs");
 function Index(options, ...args) {
   return extensions.extendEntity(({ entity }) => {
-    const fields = typeof options !== "object" ? [options, ...args] : options.fields;
+    const indexDef = typeof options !== "object" ? { fields: [options, ...args] } : options;
     return {
       ...entity,
       indexes: [
         ...entity.indexes,
-        { fields }
+        indexDef
       ]
     };
   });

package/dist/development/src/model/definition/IndexDefinition.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"IndexDefinition.cjs","sources":["../../../../../../packages/schema-definition/src/model/definition/IndexDefinition.ts"],"sourcesContent":["import { extendEntity } from './extensions'\nimport { DecoratorFunction } from '../../utils'\n\nexport type IndexOptions<T> = { fields: (keyof T)[] }\nexport function Index<T>(options: IndexOptions<T>): DecoratorFunction<T>\nexport function Index<T>(...fields: (keyof T)[]): DecoratorFunction<T>\nexport function Index<T>(options: IndexOptions<T> | keyof T, ...args: (keyof T)[]): DecoratorFunction<T> {\n\treturn extendEntity(({ entity }) => {\n\t\tconst fields = (typeof options !== 'object' ? [options, ...args] : options.fields) as string[]\n\t\treturn {\n\t\t\t...entity,\n\t\t\tindexes: [\n\t\t\t\t...entity.indexes,\n\t\t\t\t{ fields },\n\t\t\t],\n\t\t}\n\t})\n}\n"],"names":["extendEntity"],"mappings":";;;AAMgB,SAAA,MAAS,YAAuC,MAAyC;AACxG,SAAOA,WAAa,aAAA,CAAC,EAAE,aAAa;AAC7B,UAAA,SAAU,OAAO,YAAY,WAAW,CAAC,SAAS,GAAG,IAAI,IAAI,QAAQ;AACpE,WAAA;AAAA,MACN,GAAG;AAAA,MACH,SAAS;AAAA,QACR,GAAG,OAAO;AAAA,QACV,EAAE,OAAO;AAAA,MAAA;AAAA,IAEX;AAAA,EAAA,CACA;AACF;;"}
+{"version":3,"file":"IndexDefinition.cjs","sources":["../../../../../../packages/schema-definition/src/model/definition/IndexDefinition.ts"],"sourcesContent":["import { extendEntity } from './extensions'\nimport { DecoratorFunction } from '../../utils'\nimport { Model } from '@contember/schema'\n\nexport type IndexOptions<T> = {\n\tfields: (keyof T)[]\n\tmethod?: Model.IndexMethod\n}\nexport function Index<T>(options: IndexOptions<T>): DecoratorFunction<T>\nexport function Index<T>(...fields: (keyof T)[]): DecoratorFunction<T>\nexport function Index<T>(options: IndexOptions<T> | keyof T, ...args: (keyof T)[]): DecoratorFunction<T> {\n\treturn extendEntity(({ entity }) => {\n\t\tconst indexDef = (typeof options !== 'object' ? { fields: [options, ...args] } : options) as { fields: string[]; method?: Model.IndexMethod }\n\t\treturn {\n\t\t\t...entity,\n\t\t\tindexes: [\n\t\t\t\t...entity.indexes,\n\t\t\t\tindexDef,\n\t\t\t],\n\t\t}\n\t})\n}\n"],"names":["extendEntity"],"mappings":";;;AAUgB,SAAA,MAAS,YAAuC,MAAyC;AACxG,SAAOA,WAAa,aAAA,CAAC,EAAE,aAAa;AAC7B,UAAA,WAAY,OAAO,YAAY,WAAW,EAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,EAAA,IAAM;AAC1E,WAAA;AAAA,MACN,GAAG;AAAA,MACH,SAAS;AAAA,QACR,GAAG,OAAO;AAAA,QACV;AAAA,MAAA;AAAA,IAEF;AAAA,EAAA,CACA;AACF;;"}

package/dist/development/src/model/definition/IndexDefinition.js

@@ -1,12 +1,12 @@
 import { extendEntity } from "./extensions.js";
 function Index(options, ...args) {
   return extendEntity(({ entity }) => {
-    const fields = typeof options !== "object" ? [options, ...args] : options.fields;
+    const indexDef = typeof options !== "object" ? { fields: [options, ...args] } : options;
     return {
       ...entity,
       indexes: [
         ...entity.indexes,
-        { fields }
+        indexDef
       ]
     };
   });

package/dist/development/src/model/definition/IndexDefinition.js.map

@@ -1 +1 @@
-{"version":3,"file":"IndexDefinition.js","sources":["../../../../../../packages/schema-definition/src/model/definition/IndexDefinition.ts"],"sourcesContent":["import { extendEntity } from './extensions'\nimport { DecoratorFunction } from '../../utils'\n\nexport type IndexOptions<T> = { fields: (keyof T)[] }\nexport function Index<T>(options: IndexOptions<T>): DecoratorFunction<T>\nexport function Index<T>(...fields: (keyof T)[]): DecoratorFunction<T>\nexport function Index<T>(options: IndexOptions<T> | keyof T, ...args: (keyof T)[]): DecoratorFunction<T> {\n\treturn extendEntity(({ entity }) => {\n\t\tconst fields = (typeof options !== 'object' ? [options, ...args] : options.fields) as string[]\n\t\treturn {\n\t\t\t...entity,\n\t\t\tindexes: [\n\t\t\t\t...entity.indexes,\n\t\t\t\t{ fields },\n\t\t\t],\n\t\t}\n\t})\n}\n"],"names":[],"mappings":";AAMgB,SAAA,MAAS,YAAuC,MAAyC;AACxG,SAAO,aAAa,CAAC,EAAE,aAAa;AAC7B,UAAA,SAAU,OAAO,YAAY,WAAW,CAAC,SAAS,GAAG,IAAI,IAAI,QAAQ;AACpE,WAAA;AAAA,MACN,GAAG;AAAA,MACH,SAAS;AAAA,QACR,GAAG,OAAO;AAAA,QACV,EAAE,OAAO;AAAA,MAAA;AAAA,IAEX;AAAA,EAAA,CACA;AACF;"}
+{"version":3,"file":"IndexDefinition.js","sources":["../../../../../../packages/schema-definition/src/model/definition/IndexDefinition.ts"],"sourcesContent":["import { extendEntity } from './extensions'\nimport { DecoratorFunction } from '../../utils'\nimport { Model } from '@contember/schema'\n\nexport type IndexOptions<T> = {\n\tfields: (keyof T)[]\n\tmethod?: Model.IndexMethod\n}\nexport function Index<T>(options: IndexOptions<T>): DecoratorFunction<T>\nexport function Index<T>(...fields: (keyof T)[]): DecoratorFunction<T>\nexport function Index<T>(options: IndexOptions<T> | keyof T, ...args: (keyof T)[]): DecoratorFunction<T> {\n\treturn extendEntity(({ entity }) => {\n\t\tconst indexDef = (typeof options !== 'object' ? { fields: [options, ...args] } : options) as { fields: string[]; method?: Model.IndexMethod }\n\t\treturn {\n\t\t\t...entity,\n\t\t\tindexes: [\n\t\t\t\t...entity.indexes,\n\t\t\t\tindexDef,\n\t\t\t],\n\t\t}\n\t})\n}\n"],"names":[],"mappings":";AAUgB,SAAA,MAAS,YAAuC,MAAyC;AACxG,SAAO,aAAa,CAAC,EAAE,aAAa;AAC7B,UAAA,WAAY,OAAO,YAAY,WAAW,EAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,EAAA,IAAM;AAC1E,WAAA;AAAA,MACN,GAAG;AAAA,MACH,SAAS;AAAA,QACR,GAAG,OAAO;AAAA,QACV;AAAA,MAAA;AAAA,IAEF;AAAA,EAAA,CACA;AACF;"}

package/dist/development/src/model/definition/UniqueDefinition.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"UniqueDefinition.cjs","sources":["../../../../../../packages/schema-definition/src/model/definition/UniqueDefinition.ts"],"sourcesContent":["import { extendEntity } from './extensions'\nimport { DecoratorFunction } from '../../utils'\nimport { Model } from '@contember/schema'\n\nexport type UniqueOptions<T> = {\n\tfields: (keyof T & string)[]\n\n} & (\n\t| {\n\t\tindex?: false\n\t\ttiming?: Model.ConstraintTiming\n\t}\n\t| {\n\t\tindex: true\n\t\tnulls?: Model.NullsDistinctBehaviour\n\t}\n)\nexport function Unique<T>(options: UniqueOptions<T>): DecoratorFunction<T>\nexport function Unique<T>(...fields: (keyof T & string)[]): DecoratorFunction<T>\nexport function Unique<T>(options: UniqueOptions<T> | keyof T & string, ...args: (keyof T & string)[]): DecoratorFunction<T> {\n\treturn extendEntity(({ entity }) => {\n\t\tconst unique = typeof options !== 'object'\n\t\t\t? { fields: [options, ...args] }\n\t\t\t: options\n\t\treturn {\n\t\t\t...entity,\n\t\t\tunique: [\n\t\t\t\t...entity.unique,\n\t\t\t\tunique,\n\t\t\t],\n\t\t}\n\t})\n}\n"],"names":["extendEntity"],"mappings":";;;AAmBgB,SAAA,OAAU,YAAiD,MAAkD;AAC5H,SAAOA,WAAa,aAAA,CAAC,EAAE,aAAa;AAC7B,UAAA,SAAS,OAAO,YAAY,WAC/B,EAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,EAAA,IAC3B;AACI,WAAA;AAAA,MACN,GAAG;AAAA,MACH,QAAQ;AAAA,QACP,GAAG,OAAO;AAAA,QACV;AAAA,MAAA;AAAA,IAEF;AAAA,EAAA,CACA;AACF;;"}
+{"version":3,"file":"UniqueDefinition.cjs","sources":["../../../../../../packages/schema-definition/src/model/definition/UniqueDefinition.ts"],"sourcesContent":["import { extendEntity } from './extensions'\nimport { DecoratorFunction } from '../../utils'\nimport { Model } from '@contember/schema'\n\nexport type UniqueOptions<T> = {\n\tfields: (keyof T & string)[]\n\n} & (\n\t| {\n\t\tindex?: false\n\t\ttiming?: Model.ConstraintTiming\n\t}\n\t| {\n\t\tindex: true\n\t\tnulls?: Model.NullsDistinctBehaviour\n\t\tmethod?: Model.IndexMethod\n\t}\n)\nexport function Unique<T>(options: UniqueOptions<T>): DecoratorFunction<T>\nexport function Unique<T>(...fields: (keyof T & string)[]): DecoratorFunction<T>\nexport function Unique<T>(options: UniqueOptions<T> | keyof T & string, ...args: (keyof T & string)[]): DecoratorFunction<T> {\n\treturn extendEntity(({ entity }) => {\n\t\tconst unique = typeof options !== 'object'\n\t\t\t? { fields: [options, ...args] }\n\t\t\t: options\n\t\treturn {\n\t\t\t...entity,\n\t\t\tunique: [\n\t\t\t\t...entity.unique,\n\t\t\t\tunique,\n\t\t\t],\n\t\t}\n\t})\n}\n"],"names":["extendEntity"],"mappings":";;;AAoBgB,SAAA,OAAU,YAAiD,MAAkD;AAC5H,SAAOA,WAAa,aAAA,CAAC,EAAE,aAAa;AAC7B,UAAA,SAAS,OAAO,YAAY,WAC/B,EAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,EAAA,IAC3B;AACI,WAAA;AAAA,MACN,GAAG;AAAA,MACH,QAAQ;AAAA,QACP,GAAG,OAAO;AAAA,QACV;AAAA,MAAA;AAAA,IAEF;AAAA,EAAA,CACA;AACF;;"}

package/dist/development/src/model/definition/UniqueDefinition.js.map

@@ -1 +1 @@
-{"version":3,"file":"UniqueDefinition.js","sources":["../../../../../../packages/schema-definition/src/model/definition/UniqueDefinition.ts"],"sourcesContent":["import { extendEntity } from './extensions'\nimport { DecoratorFunction } from '../../utils'\nimport { Model } from '@contember/schema'\n\nexport type UniqueOptions<T> = {\n\tfields: (keyof T & string)[]\n\n} & (\n\t| {\n\t\tindex?: false\n\t\ttiming?: Model.ConstraintTiming\n\t}\n\t| {\n\t\tindex: true\n\t\tnulls?: Model.NullsDistinctBehaviour\n\t}\n)\nexport function Unique<T>(options: UniqueOptions<T>): DecoratorFunction<T>\nexport function Unique<T>(...fields: (keyof T & string)[]): DecoratorFunction<T>\nexport function Unique<T>(options: UniqueOptions<T> | keyof T & string, ...args: (keyof T & string)[]): DecoratorFunction<T> {\n\treturn extendEntity(({ entity }) => {\n\t\tconst unique = typeof options !== 'object'\n\t\t\t? { fields: [options, ...args] }\n\t\t\t: options\n\t\treturn {\n\t\t\t...entity,\n\t\t\tunique: [\n\t\t\t\t...entity.unique,\n\t\t\t\tunique,\n\t\t\t],\n\t\t}\n\t})\n}\n"],"names":[],"mappings":";AAmBgB,SAAA,OAAU,YAAiD,MAAkD;AAC5H,SAAO,aAAa,CAAC,EAAE,aAAa;AAC7B,UAAA,SAAS,OAAO,YAAY,WAC/B,EAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,EAAA,IAC3B;AACI,WAAA;AAAA,MACN,GAAG;AAAA,MACH,QAAQ;AAAA,QACP,GAAG,OAAO;AAAA,QACV;AAAA,MAAA;AAAA,IAEF;AAAA,EAAA,CACA;AACF;"}
+{"version":3,"file":"UniqueDefinition.js","sources":["../../../../../../packages/schema-definition/src/model/definition/UniqueDefinition.ts"],"sourcesContent":["import { extendEntity } from './extensions'\nimport { DecoratorFunction } from '../../utils'\nimport { Model } from '@contember/schema'\n\nexport type UniqueOptions<T> = {\n\tfields: (keyof T & string)[]\n\n} & (\n\t| {\n\t\tindex?: false\n\t\ttiming?: Model.ConstraintTiming\n\t}\n\t| {\n\t\tindex: true\n\t\tnulls?: Model.NullsDistinctBehaviour\n\t\tmethod?: Model.IndexMethod\n\t}\n)\nexport function Unique<T>(options: UniqueOptions<T>): DecoratorFunction<T>\nexport function Unique<T>(...fields: (keyof T & string)[]): DecoratorFunction<T>\nexport function Unique<T>(options: UniqueOptions<T> | keyof T & string, ...args: (keyof T & string)[]): DecoratorFunction<T> {\n\treturn extendEntity(({ entity }) => {\n\t\tconst unique = typeof options !== 'object'\n\t\t\t? { fields: [options, ...args] }\n\t\t\t: options\n\t\treturn {\n\t\t\t...entity,\n\t\t\tunique: [\n\t\t\t\t...entity.unique,\n\t\t\t\tunique,\n\t\t\t],\n\t\t}\n\t})\n}\n"],"names":[],"mappings":";AAoBgB,SAAA,OAAU,YAAiD,MAAkD;AAC5H,SAAO,aAAa,CAAC,EAAE,aAAa;AAC7B,UAAA,SAAS,OAAO,YAAY,WAC/B,EAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,EAAA,IAC3B;AACI,WAAA;AAAA,MACN,GAAG;AAAA,MACH,QAAQ;AAAA,QACP,GAAG,OAAO;AAAA,QACV;AAAA,MAAA;AAAA,IAEF;AAAA,EAAA,CACA;AACF;"}

package/dist/production/src/acl/definition/internal/AclFactory.cjs

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const schemaUtils = require("@contember/schema-utils");
 const EntityPredicateResolver = require("./EntityPredicateResolver.cjs");
 const stores = require("./stores.cjs");
 const roles = require("../roles.cjs");
@@ -15,7 +16,7 @@ class AclFactory {
     const entityLikeDefinition = filterEntityDefinition.filterEntityDefinition(exportedDefinitions);
     const roles$1 = Object.values(exportedDefinitions).filter((it) => it instanceof roles.Role);
     const variables$1 = Object.values(exportedDefinitions).filter((it) => it instanceof variables.VariableDefinition);
-    const groupedPermissions = AclFactory.groupPermissions(entityLikeDefinition, roles$1);
+    const groupedPermissions = this.groupPermissions(entityLikeDefinition, roles$1);
     return {
       roles: Object.fromEntries(roles$1.map((role) => {
         const rolePermissions = groupedPermissions.get(role);
@@ -97,7 +98,7 @@ class AclFactory {
       return [variable.name, variable.variable];
     }));
   }
-  static groupPermissions(entityLikeDefinition, roles2) {
+  groupPermissions(entityLikeDefinition, roles2) {
     const groupedPermissions = /* @__PURE__ */ new Map();
     for (const [name, entity] of entityLikeDefinition) {
       const initEntityPermissions = (role) => {
@@ -110,12 +111,17 @@ class AclFactory {
         return entityPermissions;
       };
       const metadata = stores.allowDefinitionsStore.get(entity);
-      for (const { role, ...definition } of metadata) {
+      for (const { role, factory } of metadata) {
         if (!roles2.includes(role)) {
           throw `Role ${role.name} used on entity ${name} is not registered. Have you exported it?`;
         }
         const entityPermissions = initEntityPermissions(role);
-        entityPermissions.definitions.push(definition);
+        const entity2 = schemaUtils.getEntity(this.model, name);
+        entityPermissions.definitions.push(factory({
+          model: this.model,
+          entity: schemaUtils.getEntity(this.model, name),
+          except: (...fields) => Object.keys(entity2.fields).filter((it) => !fields.includes(it))
+        }));
       }
     }
     return groupedPermissions;

package/dist/production/src/acl/definition/internal/AclFactory.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AclFactory.cjs","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/AclFactory.ts"],"sourcesContent":["import { Acl, Model, Writable } from '@contember/schema'\nimport { getEntity } from '@contember/schema-utils'\n\nimport { EntityPredicatesResolver } from './EntityPredicateResolver'\nimport { AllowDefinition } from '../permissions'\nimport {\n\tallowDefinitionsStore,\n\tEntityPermissionsDefinition,\n} from './stores'\nimport { Role } from '../roles'\nimport {  VariableDefinition } from '../variables'\nimport { filterEntityDefinition } from '../../../utils'\nimport { applyEntityAclExtensions } from '../aclExtensions'\n\nexport class AclFactory {\n\tconstructor(\n\t\tprivate model: Model.Schema,\n\t) {\n\t}\n\n\tpublic create(\n\t\texportedDefinitions: Record<string, any>,\n\t): Acl.Schema {\n\t\tconst entityLikeDefinition = filterEntityDefinition(exportedDefinitions)\n\t\tconst roles: Role[] = Object.values(exportedDefinitions).filter(it => it instanceof Role)\n\t\tconst variables: VariableDefinition[] = Object.values(exportedDefinitions).filter(it => it instanceof VariableDefinition)\n\n\t\tconst groupedPermissions = AclFactory.groupPermissions(entityLikeDefinition, roles)\n\n\t\treturn {\n\t\t\troles: Object.fromEntries(roles.map((role): [string, Acl.RolePermissions] => {\n\t\t\t\tconst rolePermissions = groupedPermissions.get(role)\n\t\t\t\treturn [\n\t\t\t\t\trole.name,\n\t\t\t\t\t{\n\t\t\t\t\t\t...role.options,\n\t\t\t\t\t\tstages: role.options.stages ?? '*',\n\t\t\t\t\t\tentities: this.createPermissions(rolePermissions, Object.fromEntries(entityLikeDefinition), role),\n\t\t\t\t\t\tvariables: this.createVariables(role, variables),\n\t\t\t\t\t},\n\t\t\t\t]\n\t\t\t})),\n\t\t}\n\t}\n\n\tprivate createPermissions(rolePermissions: PermissionsByEntity | undefined, entityLikeDefinition: Record<string, { new(): any }>, role: Role): Acl.Permissions {\n\t\treturn Object.fromEntries(Object.values(this.model.entities).map((entity): [string, Acl.EntityPermissions] | undefined => {\n\t\t\tconst permissions = rolePermissions ? this.createPermissionsFromAllow(rolePermissions, entity) : { predicates: {}, operations: {} }\n\t\t\tconst isEmpty = !rolePermissions?.has(entity.name)\n\t\t\tconst withExtensions = applyEntityAclExtensions(entityLikeDefinition[entity.name], { entity, permissions, role })\n\t\t\tif (isEmpty && withExtensions === permissions) {\n\t\t\t\treturn undefined\n\t\t\t}\n\t\t\treturn [\n\t\t\t\tentity.name,\n\t\t\t\twithExtensions,\n\t\t\t]\n\t\t}).filter(<T>(it: T | undefined): it is T => it !== undefined))\n\t}\n\n\tprivate createPermissionsFromAllow(rolePermissions: PermissionsByEntity, entity: Model.Entity): Acl.EntityPermissions {\n\t\tconst predicatesResolver = EntityPredicatesResolver.create(rolePermissions, this.model, entity)\n\n\t\tconst entityOperations: Writable<Acl.EntityOperations> = {}\n\t\tconst noRootOptions = this.getNoRootOptions(entity, rolePermissions.get(entity.name))\n\t\tif (noRootOptions?.length) {\n\t\t\tentityOperations.noRoot = noRootOptions\n\t\t}\n\t\tfor (const op of ['create', 'update', 'read'] as const) {\n\t\t\tconst fieldPermissions: Writable<Acl.FieldPermissions> = {}\n\t\t\tfor (const field of Object.keys(entity.fields)) {\n\t\t\t\tconst predicate = predicatesResolver.createFieldPredicate(op, field, field === entity.primary)\n\t\t\t\tif (predicate !== undefined) {\n\t\t\t\t\tfieldPermissions[field] = predicate\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (Object.keys(fieldPermissions).length > 0) {\n\t\t\t\tentityOperations[op] = fieldPermissions\n\t\t\t}\n\t\t}\n\t\tconst delPredicate = predicatesResolver.createFieldPredicate('delete', '', false)\n\t\tif (delPredicate !== undefined) {\n\t\t\tentityOperations.delete = delPredicate\n\t\t}\n\t\treturn {\n\t\t\tpredicates: predicatesResolver.getUsedPredicates(),\n\t\t\toperations: entityOperations,\n\t\t}\n\t}\n\n\n\tgetNoRootOptions(entity: Model.Entity, permissions?: EntityPermissions): Acl.EntityOperations['noRoot'] {\n\t\tconst allowedRoot = new Set<Acl.Operation>()\n\t\tconst disallowedRoot = new Set<Acl.Operation>()\n\t\tfor (const def of permissions?.definitions ?? []) {\n\t\t\tconst noRoot = def.through === true\n\t\t\tfor (const op of ['create', 'read', 'update', 'delete'] as const) {\n\t\t\t\tif (def[op]) {\n\t\t\t\t\tconst currentSet = noRoot ? disallowedRoot : allowedRoot\n\t\t\t\t\tcurrentSet.add(op as Acl.Operation)\n\n\t\t\t\t\tconst otherSet = noRoot ? allowedRoot : disallowedRoot\n\n\t\t\t\t\tif (otherSet.has(op as Acl.Operation)) {\n\t\t\t\t\t\tthrow new Error(`Operation ${op} cannot be both allowed and disallowed on root on entity ${entity.name}`)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t}\n\t\treturn [...disallowedRoot.values()]\n\t}\n\n\tprivate createVariables(role: Role, variables: VariableDefinition[]): Acl.Variables {\n\t\tconst roleVariables = variables.filter(it => it.roles.includes(role))\n\t\treturn Object.fromEntries(roleVariables.map((variable): [string, Acl.Variable] => {\n\t\t\treturn [variable.name, variable.variable]\n\t\t}))\n\t}\n\n\tprivate static groupPermissions(entityLikeDefinition: [string, { new(): any }][], roles: Role[]): PermissionsByRoleAndEntity {\n\t\tconst groupedPermissions: PermissionsByRoleAndEntity = new Map()\n\t\tfor (const [name, entity] of entityLikeDefinition) {\n\t\t\tconst initEntityPermissions = (role: Role): EntityPermissions => {\n\t\t\t\tconst rolePermissions: PermissionsByEntity = groupedPermissions.get(role) ?? new Map()\n\t\t\t\tgroupedPermissions.set(role, rolePermissions)\n\t\t\t\tconst entityPermissions = rolePermissions.get(name) ?? {\n\t\t\t\t\tdefinitions: [],\n\t\t\t\t}\n\t\t\t\trolePermissions.set(name, entityPermissions)\n\t\t\t\treturn entityPermissions\n\t\t\t}\n\t\t\tconst metadata: EntityPermissionsDefinition[] = allowDefinitionsStore.get(entity)\n\t\t\tfor (const { role, ...definition } of metadata) {\n\t\t\t\tif (!roles.includes(role)) {\n\t\t\t\t\tthrow `Role ${role.name} used on entity ${name} is not registered. Have you exported it?`\n\t\t\t\t}\n\t\t\t\tconst entityPermissions = initEntityPermissions(role)\n\t\t\t\tentityPermissions.definitions.push(definition)\n\t\t\t}\n\t\t}\n\n\t\treturn groupedPermissions\n\t}\n}\n\n\nexport type EntityPermissions = { definitions: AllowDefinition<any>[] }\nexport type PermissionsByEntity = Map<string, EntityPermissions>\nexport type PermissionsByRoleAndEntity = Map<Role, PermissionsByEntity>\n"],"names":["filterEntityDefinition","roles","Role","variables","VariableDefinition","applyEntityAclExtensions","EntityPredicatesResolver","allowDefinitionsStore"],"mappings":";;;;;;;;;AAcO,MAAM,WAAW;AAAA,EACvB,YACS,OACP;AADO,SAAA,QAAA;AAAA,EAAA;AAAA,EAIF,OACN,qBACa;AACP,UAAA,uBAAuBA,8CAAuB,mBAAmB;AACjE,UAAAC,UAAgB,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAcC,UAAI;AAClF,UAAAC,cAAkC,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAcC,4BAAkB;AAExH,UAAM,qBAAqB,WAAW,iBAAiB,sBAAsBH,OAAK;AAE3E,WAAA;AAAA,MACN,OAAO,OAAO,YAAYA,QAAM,IAAI,CAAC,SAAwC;AACtE,cAAA,kBAAkB,mBAAmB,IAAI,IAAI;AAC5C,eAAA;AAAA,UACN,KAAK;AAAA,UACL;AAAA,YACC,GAAG,KAAK;AAAA,YACR,QAAQ,KAAK,QAAQ,UAAU;AAAA,YAC/B,UAAU,KAAK,kBAAkB,iBAAiB,OAAO,YAAY,oBAAoB,GAAG,IAAI;AAAA,YAChG,WAAW,KAAK,gBAAgB,MAAME,WAAS;AAAA,UAAA;AAAA,QAEjD;AAAA,MAAA,CACA,CAAC;AAAA,IACH;AAAA,EAAA;AAAA,EAGO,kBAAkB,iBAAkD,sBAAsD,MAA6B;AACvJ,WAAA,OAAO,YAAY,OAAO,OAAO,KAAK,MAAM,QAAQ,EAAE,IAAI,CAAC,WAAwD;AACzH,YAAM,cAAc,kBAAkB,KAAK,2BAA2B,iBAAiB,MAAM,IAAI,EAAE,YAAY,IAAI,YAAY,CAAA,EAAG;AAClI,YAAM,UAAU,CAAC,iBAAiB,IAAI,OAAO,IAAI;AAC3C,YAAA,iBAAiBE,uCAAyB,qBAAqB,OAAO,IAAI,GAAG,EAAE,QAAQ,aAAa,MAAM;AAC5G,UAAA,WAAW,mBAAmB,aAAa;AACvC,eAAA;AAAA,MAAA;AAED,aAAA;AAAA,QACN,OAAO;AAAA,QACP;AAAA,MACD;AAAA,IAAA,CACA,EAAE,OAAO,CAAI,OAA+B,OAAO,MAAS,CAAC;AAAA,EAAA;AAAA,EAGvD,2BAA2B,iBAAsC,QAA6C;AACrH,UAAM,qBAAqBC,wBAAAA,yBAAyB,OAAO,iBAAiB,KAAK,OAAO,MAAM;AAE9F,UAAM,mBAAmD,CAAC;AACpD,UAAA,gBAAgB,KAAK,iBAAiB,QAAQ,gBAAgB,IAAI,OAAO,IAAI,CAAC;AACpF,QAAI,eAAe,QAAQ;AAC1B,uBAAiB,SAAS;AAAA,IAAA;AAE3B,eAAW,MAAM,CAAC,UAAU,UAAU,MAAM,GAAY;AACvD,YAAM,mBAAmD,CAAC;AAC1D,iBAAW,SAAS,OAAO,KAAK,OAAO,MAAM,GAAG;AAC/C,cAAM,YAAY,mBAAmB,qBAAqB,IAAI,OAAO,UAAU,OAAO,OAAO;AAC7F,YAAI,cAAc,QAAW;AAC5B,2BAAiB,KAAK,IAAI;AAAA,QAAA;AAAA,MAC3B;AAED,UAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,GAAG;AAC7C,yBAAiB,EAAE,IAAI;AAAA,MAAA;AAAA,IACxB;AAED,UAAM,eAAe,mBAAmB,qBAAqB,UAAU,IAAI,KAAK;AAChF,QAAI,iBAAiB,QAAW;AAC/B,uBAAiB,SAAS;AAAA,IAAA;AAEpB,WAAA;AAAA,MACN,YAAY,mBAAmB,kBAAkB;AAAA,MACjD,YAAY;AAAA,IACb;AAAA,EAAA;AAAA,EAID,iBAAiB,QAAsB,aAAiE;AACjG,UAAA,kCAAkB,IAAmB;AACrC,UAAA,qCAAqB,IAAmB;AAC9C,eAAW,OAAO,aAAa,eAAe,CAAA,GAAI;AAC3C,YAAA,SAAS,IAAI,YAAY;AAC/B,iBAAW,MAAM,CAAC,UAAU,QAAQ,UAAU,QAAQ,GAAY;AAC7D,YAAA,IAAI,EAAE,GAAG;AACN,gBAAA,aAAa,SAAS,iBAAiB;AAC7C,qBAAW,IAAI,EAAmB;AAE5B,gBAAA,WAAW,SAAS,cAAc;AAEpC,cAAA,SAAS,IAAI,EAAmB,GAAG;AACtC,kBAAM,IAAI,MAAM,aAAa,EAAE,4DAA4D,OAAO,IAAI,EAAE;AAAA,UAAA;AAAA,QACzG;AAAA,MACD;AAAA,IACD;AAGD,WAAO,CAAC,GAAG,eAAe,QAAQ;AAAA,EAAA;AAAA,EAG3B,gBAAgB,MAAYH,YAAgD;AAC7E,UAAA,gBAAgBA,WAAU,OAAO,CAAA,OAAM,GAAG,MAAM,SAAS,IAAI,CAAC;AACpE,WAAO,OAAO,YAAY,cAAc,IAAI,CAAC,aAAqC;AACjF,aAAO,CAAC,SAAS,MAAM,SAAS,QAAQ;AAAA,IAAA,CACxC,CAAC;AAAA,EAAA;AAAA,EAGH,OAAe,iBAAiB,sBAAkDF,QAA2C;AACtH,UAAA,yCAAqD,IAAI;AAC/D,eAAW,CAAC,MAAM,MAAM,KAAK,sBAAsB;AAC5C,YAAA,wBAAwB,CAAC,SAAkC;AAChE,cAAM,kBAAuC,mBAAmB,IAAI,IAAI,yBAAS,IAAI;AAClE,2BAAA,IAAI,MAAM,eAAe;AAC5C,cAAM,oBAAoB,gBAAgB,IAAI,IAAI,KAAK;AAAA,UACtD,aAAa,CAAA;AAAA,QACd;AACgB,wBAAA,IAAI,MAAM,iBAAiB;AACpC,eAAA;AAAA,MACR;AACM,YAAA,WAA0CM,OAAAA,sBAAsB,IAAI,MAAM;AAChF,iBAAW,EAAE,MAAM,GAAG,WAAA,KAAgB,UAAU;AAC/C,YAAI,CAACN,OAAM,SAAS,IAAI,GAAG;AAC1B,gBAAM,QAAQ,KAAK,IAAI,mBAAmB,IAAI;AAAA,QAAA;AAEzC,cAAA,oBAAoB,sBAAsB,IAAI;AAClC,0BAAA,YAAY,KAAK,UAAU;AAAA,MAAA;AAAA,IAC9C;AAGM,WAAA;AAAA,EAAA;AAET;;"}
+{"version":3,"file":"AclFactory.cjs","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/AclFactory.ts"],"sourcesContent":["import { Acl, Model, Writable } from '@contember/schema'\nimport { getEntity } from '@contember/schema-utils'\n\nimport { EntityPredicatesResolver } from './EntityPredicateResolver'\nimport { AllowDefinition } from '../permissions'\nimport {\n\tallowDefinitionsStore,\n\tEntityPermissionsDefinition,\n} from './stores'\nimport { Role } from '../roles'\nimport {  VariableDefinition } from '../variables'\nimport { filterEntityDefinition } from '../../../utils'\nimport { applyEntityAclExtensions } from '../aclExtensions'\n\nexport class AclFactory {\n\tconstructor(\n\t\tprivate model: Model.Schema,\n\t) {\n\t}\n\n\tpublic create(\n\t\texportedDefinitions: Record<string, any>,\n\t): Acl.Schema {\n\t\tconst entityLikeDefinition = filterEntityDefinition(exportedDefinitions)\n\t\tconst roles: Role[] = Object.values(exportedDefinitions).filter(it => it instanceof Role)\n\t\tconst variables: VariableDefinition[] = Object.values(exportedDefinitions).filter(it => it instanceof VariableDefinition)\n\n\t\tconst groupedPermissions = this.groupPermissions(entityLikeDefinition, roles)\n\n\t\treturn {\n\t\t\troles: Object.fromEntries(roles.map((role): [string, Acl.RolePermissions] => {\n\t\t\t\tconst rolePermissions = groupedPermissions.get(role)\n\t\t\t\treturn [\n\t\t\t\t\trole.name,\n\t\t\t\t\t{\n\t\t\t\t\t\t...role.options,\n\t\t\t\t\t\tstages: role.options.stages ?? '*',\n\t\t\t\t\t\tentities: this.createPermissions(rolePermissions, Object.fromEntries(entityLikeDefinition), role),\n\t\t\t\t\t\tvariables: this.createVariables(role, variables),\n\t\t\t\t\t},\n\t\t\t\t]\n\t\t\t})),\n\t\t}\n\t}\n\n\tprivate createPermissions(rolePermissions: PermissionsByEntity | undefined, entityLikeDefinition: Record<string, { new(): any }>, role: Role): Acl.Permissions {\n\t\treturn Object.fromEntries(Object.values(this.model.entities).map((entity): [string, Acl.EntityPermissions] | undefined => {\n\t\t\tconst permissions = rolePermissions ? this.createPermissionsFromAllow(rolePermissions, entity) : { predicates: {}, operations: {} }\n\t\t\tconst isEmpty = !rolePermissions?.has(entity.name)\n\t\t\tconst withExtensions = applyEntityAclExtensions(entityLikeDefinition[entity.name], { entity, permissions, role })\n\t\t\tif (isEmpty && withExtensions === permissions) {\n\t\t\t\treturn undefined\n\t\t\t}\n\t\t\treturn [\n\t\t\t\tentity.name,\n\t\t\t\twithExtensions,\n\t\t\t]\n\t\t}).filter(<T>(it: T | undefined): it is T => it !== undefined))\n\t}\n\n\tprivate createPermissionsFromAllow(rolePermissions: PermissionsByEntity, entity: Model.Entity): Acl.EntityPermissions {\n\t\tconst predicatesResolver = EntityPredicatesResolver.create(rolePermissions, this.model, entity)\n\n\t\tconst entityOperations: Writable<Acl.EntityOperations> = {}\n\t\tconst noRootOptions = this.getNoRootOptions(entity, rolePermissions.get(entity.name))\n\t\tif (noRootOptions?.length) {\n\t\t\tentityOperations.noRoot = noRootOptions\n\t\t}\n\t\tfor (const op of ['create', 'update', 'read'] as const) {\n\t\t\tconst fieldPermissions: Writable<Acl.FieldPermissions> = {}\n\t\t\tfor (const field of Object.keys(entity.fields)) {\n\t\t\t\tconst predicate = predicatesResolver.createFieldPredicate(op, field, field === entity.primary)\n\t\t\t\tif (predicate !== undefined) {\n\t\t\t\t\tfieldPermissions[field] = predicate\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (Object.keys(fieldPermissions).length > 0) {\n\t\t\t\tentityOperations[op] = fieldPermissions\n\t\t\t}\n\t\t}\n\t\tconst delPredicate = predicatesResolver.createFieldPredicate('delete', '', false)\n\t\tif (delPredicate !== undefined) {\n\t\t\tentityOperations.delete = delPredicate\n\t\t}\n\t\treturn {\n\t\t\tpredicates: predicatesResolver.getUsedPredicates(),\n\t\t\toperations: entityOperations,\n\t\t}\n\t}\n\n\n\tgetNoRootOptions(entity: Model.Entity, permissions?: EntityPermissions): Acl.EntityOperations['noRoot'] {\n\t\tconst allowedRoot = new Set<Acl.Operation>()\n\t\tconst disallowedRoot = new Set<Acl.Operation>()\n\t\tfor (const def of permissions?.definitions ?? []) {\n\t\t\tconst noRoot = def.through === true\n\t\t\tfor (const op of ['create', 'read', 'update', 'delete'] as const) {\n\t\t\t\tif (def[op]) {\n\t\t\t\t\tconst currentSet = noRoot ? disallowedRoot : allowedRoot\n\t\t\t\t\tcurrentSet.add(op as Acl.Operation)\n\n\t\t\t\t\tconst otherSet = noRoot ? allowedRoot : disallowedRoot\n\n\t\t\t\t\tif (otherSet.has(op as Acl.Operation)) {\n\t\t\t\t\t\tthrow new Error(`Operation ${op} cannot be both allowed and disallowed on root on entity ${entity.name}`)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t}\n\t\treturn [...disallowedRoot.values()]\n\t}\n\n\tprivate createVariables(role: Role, variables: VariableDefinition[]): Acl.Variables {\n\t\tconst roleVariables = variables.filter(it => it.roles.includes(role))\n\t\treturn Object.fromEntries(roleVariables.map((variable): [string, Acl.Variable] => {\n\t\t\treturn [variable.name, variable.variable]\n\t\t}))\n\t}\n\n\tprivate groupPermissions(entityLikeDefinition: [string, { new(): any }][], roles: Role[]): PermissionsByRoleAndEntity {\n\t\tconst groupedPermissions: PermissionsByRoleAndEntity = new Map()\n\t\tfor (const [name, entity] of entityLikeDefinition) {\n\t\t\tconst initEntityPermissions = (role: Role): EntityPermissions => {\n\t\t\t\tconst rolePermissions: PermissionsByEntity = groupedPermissions.get(role) ?? new Map()\n\t\t\t\tgroupedPermissions.set(role, rolePermissions)\n\t\t\t\tconst entityPermissions = rolePermissions.get(name) ?? {\n\t\t\t\t\tdefinitions: [],\n\t\t\t\t}\n\t\t\t\trolePermissions.set(name, entityPermissions)\n\t\t\t\treturn entityPermissions\n\t\t\t}\n\t\t\tconst metadata: EntityPermissionsDefinition[] = allowDefinitionsStore.get(entity)\n\t\t\tfor (const { role, factory } of metadata) {\n\t\t\t\tif (!roles.includes(role)) {\n\t\t\t\t\tthrow `Role ${role.name} used on entity ${name} is not registered. Have you exported it?`\n\t\t\t\t}\n\t\t\t\tconst entityPermissions = initEntityPermissions(role)\n\t\t\t\tconst entity = getEntity(this.model, name)\n\t\t\t\tentityPermissions.definitions.push(factory({\n\t\t\t\t\tmodel: this.model,\n\t\t\t\t\tentity: getEntity(this.model, name),\n\t\t\t\t\texcept: (...fields) => (Object.keys(entity.fields)).filter(it => !fields.includes(it)),\n\t\t\t\t}))\n\t\t\t}\n\t\t}\n\n\t\treturn groupedPermissions\n\t}\n}\n\n\nexport type EntityPermissions = { definitions: AllowDefinition<any>[] }\nexport type PermissionsByEntity = Map<string, EntityPermissions>\nexport type PermissionsByRoleAndEntity = Map<Role, PermissionsByEntity>\n"],"names":["filterEntityDefinition","roles","Role","variables","VariableDefinition","applyEntityAclExtensions","EntityPredicatesResolver","allowDefinitionsStore","entity","getEntity"],"mappings":";;;;;;;;;;AAcO,MAAM,WAAW;AAAA,EACvB,YACS,OACP;AADO,SAAA,QAAA;AAAA,EAAA;AAAA,EAIF,OACN,qBACa;AACP,UAAA,uBAAuBA,8CAAuB,mBAAmB;AACjE,UAAAC,UAAgB,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAcC,UAAI;AAClF,UAAAC,cAAkC,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAcC,4BAAkB;AAExH,UAAM,qBAAqB,KAAK,iBAAiB,sBAAsBH,OAAK;AAErE,WAAA;AAAA,MACN,OAAO,OAAO,YAAYA,QAAM,IAAI,CAAC,SAAwC;AACtE,cAAA,kBAAkB,mBAAmB,IAAI,IAAI;AAC5C,eAAA;AAAA,UACN,KAAK;AAAA,UACL;AAAA,YACC,GAAG,KAAK;AAAA,YACR,QAAQ,KAAK,QAAQ,UAAU;AAAA,YAC/B,UAAU,KAAK,kBAAkB,iBAAiB,OAAO,YAAY,oBAAoB,GAAG,IAAI;AAAA,YAChG,WAAW,KAAK,gBAAgB,MAAME,WAAS;AAAA,UAAA;AAAA,QAEjD;AAAA,MAAA,CACA,CAAC;AAAA,IACH;AAAA,EAAA;AAAA,EAGO,kBAAkB,iBAAkD,sBAAsD,MAA6B;AACvJ,WAAA,OAAO,YAAY,OAAO,OAAO,KAAK,MAAM,QAAQ,EAAE,IAAI,CAAC,WAAwD;AACzH,YAAM,cAAc,kBAAkB,KAAK,2BAA2B,iBAAiB,MAAM,IAAI,EAAE,YAAY,IAAI,YAAY,CAAA,EAAG;AAClI,YAAM,UAAU,CAAC,iBAAiB,IAAI,OAAO,IAAI;AAC3C,YAAA,iBAAiBE,uCAAyB,qBAAqB,OAAO,IAAI,GAAG,EAAE,QAAQ,aAAa,MAAM;AAC5G,UAAA,WAAW,mBAAmB,aAAa;AACvC,eAAA;AAAA,MAAA;AAED,aAAA;AAAA,QACN,OAAO;AAAA,QACP;AAAA,MACD;AAAA,IAAA,CACA,EAAE,OAAO,CAAI,OAA+B,OAAO,MAAS,CAAC;AAAA,EAAA;AAAA,EAGvD,2BAA2B,iBAAsC,QAA6C;AACrH,UAAM,qBAAqBC,wBAAAA,yBAAyB,OAAO,iBAAiB,KAAK,OAAO,MAAM;AAE9F,UAAM,mBAAmD,CAAC;AACpD,UAAA,gBAAgB,KAAK,iBAAiB,QAAQ,gBAAgB,IAAI,OAAO,IAAI,CAAC;AACpF,QAAI,eAAe,QAAQ;AAC1B,uBAAiB,SAAS;AAAA,IAAA;AAE3B,eAAW,MAAM,CAAC,UAAU,UAAU,MAAM,GAAY;AACvD,YAAM,mBAAmD,CAAC;AAC1D,iBAAW,SAAS,OAAO,KAAK,OAAO,MAAM,GAAG;AAC/C,cAAM,YAAY,mBAAmB,qBAAqB,IAAI,OAAO,UAAU,OAAO,OAAO;AAC7F,YAAI,cAAc,QAAW;AAC5B,2BAAiB,KAAK,IAAI;AAAA,QAAA;AAAA,MAC3B;AAED,UAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,GAAG;AAC7C,yBAAiB,EAAE,IAAI;AAAA,MAAA;AAAA,IACxB;AAED,UAAM,eAAe,mBAAmB,qBAAqB,UAAU,IAAI,KAAK;AAChF,QAAI,iBAAiB,QAAW;AAC/B,uBAAiB,SAAS;AAAA,IAAA;AAEpB,WAAA;AAAA,MACN,YAAY,mBAAmB,kBAAkB;AAAA,MACjD,YAAY;AAAA,IACb;AAAA,EAAA;AAAA,EAID,iBAAiB,QAAsB,aAAiE;AACjG,UAAA,kCAAkB,IAAmB;AACrC,UAAA,qCAAqB,IAAmB;AAC9C,eAAW,OAAO,aAAa,eAAe,CAAA,GAAI;AAC3C,YAAA,SAAS,IAAI,YAAY;AAC/B,iBAAW,MAAM,CAAC,UAAU,QAAQ,UAAU,QAAQ,GAAY;AAC7D,YAAA,IAAI,EAAE,GAAG;AACN,gBAAA,aAAa,SAAS,iBAAiB;AAC7C,qBAAW,IAAI,EAAmB;AAE5B,gBAAA,WAAW,SAAS,cAAc;AAEpC,cAAA,SAAS,IAAI,EAAmB,GAAG;AACtC,kBAAM,IAAI,MAAM,aAAa,EAAE,4DAA4D,OAAO,IAAI,EAAE;AAAA,UAAA;AAAA,QACzG;AAAA,MACD;AAAA,IACD;AAGD,WAAO,CAAC,GAAG,eAAe,QAAQ;AAAA,EAAA;AAAA,EAG3B,gBAAgB,MAAYH,YAAgD;AAC7E,UAAA,gBAAgBA,WAAU,OAAO,CAAA,OAAM,GAAG,MAAM,SAAS,IAAI,CAAC;AACpE,WAAO,OAAO,YAAY,cAAc,IAAI,CAAC,aAAqC;AACjF,aAAO,CAAC,SAAS,MAAM,SAAS,QAAQ;AAAA,IAAA,CACxC,CAAC;AAAA,EAAA;AAAA,EAGK,iBAAiB,sBAAkDF,QAA2C;AAC/G,UAAA,yCAAqD,IAAI;AAC/D,eAAW,CAAC,MAAM,MAAM,KAAK,sBAAsB;AAC5C,YAAA,wBAAwB,CAAC,SAAkC;AAChE,cAAM,kBAAuC,mBAAmB,IAAI,IAAI,yBAAS,IAAI;AAClE,2BAAA,IAAI,MAAM,eAAe;AAC5C,cAAM,oBAAoB,gBAAgB,IAAI,IAAI,KAAK;AAAA,UACtD,aAAa,CAAA;AAAA,QACd;AACgB,wBAAA,IAAI,MAAM,iBAAiB;AACpC,eAAA;AAAA,MACR;AACM,YAAA,WAA0CM,OAAAA,sBAAsB,IAAI,MAAM;AAChF,iBAAW,EAAE,MAAM,QAAQ,KAAK,UAAU;AACzC,YAAI,CAACN,OAAM,SAAS,IAAI,GAAG;AAC1B,gBAAM,QAAQ,KAAK,IAAI,mBAAmB,IAAI;AAAA,QAAA;AAEzC,cAAA,oBAAoB,sBAAsB,IAAI;AACpD,cAAMO,UAASC,YAAA,UAAU,KAAK,OAAO,IAAI;AACvB,0BAAA,YAAY,KAAK,QAAQ;AAAA,UAC1C,OAAO,KAAK;AAAA,UACZ,QAAQA,YAAA,UAAU,KAAK,OAAO,IAAI;AAAA,UAClC,QAAQ,IAAI,WAAY,OAAO,KAAKD,QAAO,MAAM,EAAG,OAAO,CAAM,OAAA,CAAC,OAAO,SAAS,EAAE,CAAC;AAAA,QAAA,CACrF,CAAC;AAAA,MAAA;AAAA,IACH;AAGM,WAAA;AAAA,EAAA;AAET;;"}

package/dist/production/src/acl/definition/internal/AclFactory.js

@@ -1,3 +1,4 @@
+import { getEntity } from "@contember/schema-utils";
 import { EntityPredicatesResolver } from "./EntityPredicateResolver.js";
 import { allowDefinitionsStore } from "./stores.js";
 import { Role } from "../roles.js";
@@ -13,7 +14,7 @@ class AclFactory {
     const entityLikeDefinition = filterEntityDefinition(exportedDefinitions);
     const roles = Object.values(exportedDefinitions).filter((it) => it instanceof Role);
     const variables = Object.values(exportedDefinitions).filter((it) => it instanceof VariableDefinition);
-    const groupedPermissions = AclFactory.groupPermissions(entityLikeDefinition, roles);
+    const groupedPermissions = this.groupPermissions(entityLikeDefinition, roles);
     return {
       roles: Object.fromEntries(roles.map((role) => {
         const rolePermissions = groupedPermissions.get(role);
@@ -95,7 +96,7 @@ class AclFactory {
       return [variable.name, variable.variable];
     }));
   }
-  static groupPermissions(entityLikeDefinition, roles) {
+  groupPermissions(entityLikeDefinition, roles) {
     const groupedPermissions = /* @__PURE__ */ new Map();
     for (const [name, entity] of entityLikeDefinition) {
       const initEntityPermissions = (role) => {
@@ -108,12 +109,17 @@ class AclFactory {
         return entityPermissions;
       };
       const metadata = allowDefinitionsStore.get(entity);
-      for (const { role, ...definition } of metadata) {
+      for (const { role, factory } of metadata) {
         if (!roles.includes(role)) {
           throw `Role ${role.name} used on entity ${name} is not registered. Have you exported it?`;
         }
         const entityPermissions = initEntityPermissions(role);
-        entityPermissions.definitions.push(definition);
+        const entity2 = getEntity(this.model, name);
+        entityPermissions.definitions.push(factory({
+          model: this.model,
+          entity: getEntity(this.model, name),
+          except: (...fields) => Object.keys(entity2.fields).filter((it) => !fields.includes(it))
+        }));
       }
     }
     return groupedPermissions;

package/dist/production/src/acl/definition/internal/AclFactory.js.map

@@ -1 +1 @@
-{"version":3,"file":"AclFactory.js","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/AclFactory.ts"],"sourcesContent":["import { Acl, Model, Writable } from '@contember/schema'\nimport { getEntity } from '@contember/schema-utils'\n\nimport { EntityPredicatesResolver } from './EntityPredicateResolver'\nimport { AllowDefinition } from '../permissions'\nimport {\n\tallowDefinitionsStore,\n\tEntityPermissionsDefinition,\n} from './stores'\nimport { Role } from '../roles'\nimport {  VariableDefinition } from '../variables'\nimport { filterEntityDefinition } from '../../../utils'\nimport { applyEntityAclExtensions } from '../aclExtensions'\n\nexport class AclFactory {\n\tconstructor(\n\t\tprivate model: Model.Schema,\n\t) {\n\t}\n\n\tpublic create(\n\t\texportedDefinitions: Record<string, any>,\n\t): Acl.Schema {\n\t\tconst entityLikeDefinition = filterEntityDefinition(exportedDefinitions)\n\t\tconst roles: Role[] = Object.values(exportedDefinitions).filter(it => it instanceof Role)\n\t\tconst variables: VariableDefinition[] = Object.values(exportedDefinitions).filter(it => it instanceof VariableDefinition)\n\n\t\tconst groupedPermissions = AclFactory.groupPermissions(entityLikeDefinition, roles)\n\n\t\treturn {\n\t\t\troles: Object.fromEntries(roles.map((role): [string, Acl.RolePermissions] => {\n\t\t\t\tconst rolePermissions = groupedPermissions.get(role)\n\t\t\t\treturn [\n\t\t\t\t\trole.name,\n\t\t\t\t\t{\n\t\t\t\t\t\t...role.options,\n\t\t\t\t\t\tstages: role.options.stages ?? '*',\n\t\t\t\t\t\tentities: this.createPermissions(rolePermissions, Object.fromEntries(entityLikeDefinition), role),\n\t\t\t\t\t\tvariables: this.createVariables(role, variables),\n\t\t\t\t\t},\n\t\t\t\t]\n\t\t\t})),\n\t\t}\n\t}\n\n\tprivate createPermissions(rolePermissions: PermissionsByEntity | undefined, entityLikeDefinition: Record<string, { new(): any }>, role: Role): Acl.Permissions {\n\t\treturn Object.fromEntries(Object.values(this.model.entities).map((entity): [string, Acl.EntityPermissions] | undefined => {\n\t\t\tconst permissions = rolePermissions ? this.createPermissionsFromAllow(rolePermissions, entity) : { predicates: {}, operations: {} }\n\t\t\tconst isEmpty = !rolePermissions?.has(entity.name)\n\t\t\tconst withExtensions = applyEntityAclExtensions(entityLikeDefinition[entity.name], { entity, permissions, role })\n\t\t\tif (isEmpty && withExtensions === permissions) {\n\t\t\t\treturn undefined\n\t\t\t}\n\t\t\treturn [\n\t\t\t\tentity.name,\n\t\t\t\twithExtensions,\n\t\t\t]\n\t\t}).filter(<T>(it: T | undefined): it is T => it !== undefined))\n\t}\n\n\tprivate createPermissionsFromAllow(rolePermissions: PermissionsByEntity, entity: Model.Entity): Acl.EntityPermissions {\n\t\tconst predicatesResolver = EntityPredicatesResolver.create(rolePermissions, this.model, entity)\n\n\t\tconst entityOperations: Writable<Acl.EntityOperations> = {}\n\t\tconst noRootOptions = this.getNoRootOptions(entity, rolePermissions.get(entity.name))\n\t\tif (noRootOptions?.length) {\n\t\t\tentityOperations.noRoot = noRootOptions\n\t\t}\n\t\tfor (const op of ['create', 'update', 'read'] as const) {\n\t\t\tconst fieldPermissions: Writable<Acl.FieldPermissions> = {}\n\t\t\tfor (const field of Object.keys(entity.fields)) {\n\t\t\t\tconst predicate = predicatesResolver.createFieldPredicate(op, field, field === entity.primary)\n\t\t\t\tif (predicate !== undefined) {\n\t\t\t\t\tfieldPermissions[field] = predicate\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (Object.keys(fieldPermissions).length > 0) {\n\t\t\t\tentityOperations[op] = fieldPermissions\n\t\t\t}\n\t\t}\n\t\tconst delPredicate = predicatesResolver.createFieldPredicate('delete', '', false)\n\t\tif (delPredicate !== undefined) {\n\t\t\tentityOperations.delete = delPredicate\n\t\t}\n\t\treturn {\n\t\t\tpredicates: predicatesResolver.getUsedPredicates(),\n\t\t\toperations: entityOperations,\n\t\t}\n\t}\n\n\n\tgetNoRootOptions(entity: Model.Entity, permissions?: EntityPermissions): Acl.EntityOperations['noRoot'] {\n\t\tconst allowedRoot = new Set<Acl.Operation>()\n\t\tconst disallowedRoot = new Set<Acl.Operation>()\n\t\tfor (const def of permissions?.definitions ?? []) {\n\t\t\tconst noRoot = def.through === true\n\t\t\tfor (const op of ['create', 'read', 'update', 'delete'] as const) {\n\t\t\t\tif (def[op]) {\n\t\t\t\t\tconst currentSet = noRoot ? disallowedRoot : allowedRoot\n\t\t\t\t\tcurrentSet.add(op as Acl.Operation)\n\n\t\t\t\t\tconst otherSet = noRoot ? allowedRoot : disallowedRoot\n\n\t\t\t\t\tif (otherSet.has(op as Acl.Operation)) {\n\t\t\t\t\t\tthrow new Error(`Operation ${op} cannot be both allowed and disallowed on root on entity ${entity.name}`)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t}\n\t\treturn [...disallowedRoot.values()]\n\t}\n\n\tprivate createVariables(role: Role, variables: VariableDefinition[]): Acl.Variables {\n\t\tconst roleVariables = variables.filter(it => it.roles.includes(role))\n\t\treturn Object.fromEntries(roleVariables.map((variable): [string, Acl.Variable] => {\n\t\t\treturn [variable.name, variable.variable]\n\t\t}))\n\t}\n\n\tprivate static groupPermissions(entityLikeDefinition: [string, { new(): any }][], roles: Role[]): PermissionsByRoleAndEntity {\n\t\tconst groupedPermissions: PermissionsByRoleAndEntity = new Map()\n\t\tfor (const [name, entity] of entityLikeDefinition) {\n\t\t\tconst initEntityPermissions = (role: Role): EntityPermissions => {\n\t\t\t\tconst rolePermissions: PermissionsByEntity = groupedPermissions.get(role) ?? new Map()\n\t\t\t\tgroupedPermissions.set(role, rolePermissions)\n\t\t\t\tconst entityPermissions = rolePermissions.get(name) ?? {\n\t\t\t\t\tdefinitions: [],\n\t\t\t\t}\n\t\t\t\trolePermissions.set(name, entityPermissions)\n\t\t\t\treturn entityPermissions\n\t\t\t}\n\t\t\tconst metadata: EntityPermissionsDefinition[] = allowDefinitionsStore.get(entity)\n\t\t\tfor (const { role, ...definition } of metadata) {\n\t\t\t\tif (!roles.includes(role)) {\n\t\t\t\t\tthrow `Role ${role.name} used on entity ${name} is not registered. Have you exported it?`\n\t\t\t\t}\n\t\t\t\tconst entityPermissions = initEntityPermissions(role)\n\t\t\t\tentityPermissions.definitions.push(definition)\n\t\t\t}\n\t\t}\n\n\t\treturn groupedPermissions\n\t}\n}\n\n\nexport type EntityPermissions = { definitions: AllowDefinition<any>[] }\nexport type PermissionsByEntity = Map<string, EntityPermissions>\nexport type PermissionsByRoleAndEntity = Map<Role, PermissionsByEntity>\n"],"names":[],"mappings":";;;;;;;AAcO,MAAM,WAAW;AAAA,EACvB,YACS,OACP;AADO,SAAA,QAAA;AAAA,EAAA;AAAA,EAIF,OACN,qBACa;AACP,UAAA,uBAAuB,uBAAuB,mBAAmB;AACjE,UAAA,QAAgB,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAc,IAAI;AAClF,UAAA,YAAkC,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAc,kBAAkB;AAExH,UAAM,qBAAqB,WAAW,iBAAiB,sBAAsB,KAAK;AAE3E,WAAA;AAAA,MACN,OAAO,OAAO,YAAY,MAAM,IAAI,CAAC,SAAwC;AACtE,cAAA,kBAAkB,mBAAmB,IAAI,IAAI;AAC5C,eAAA;AAAA,UACN,KAAK;AAAA,UACL;AAAA,YACC,GAAG,KAAK;AAAA,YACR,QAAQ,KAAK,QAAQ,UAAU;AAAA,YAC/B,UAAU,KAAK,kBAAkB,iBAAiB,OAAO,YAAY,oBAAoB,GAAG,IAAI;AAAA,YAChG,WAAW,KAAK,gBAAgB,MAAM,SAAS;AAAA,UAAA;AAAA,QAEjD;AAAA,MAAA,CACA,CAAC;AAAA,IACH;AAAA,EAAA;AAAA,EAGO,kBAAkB,iBAAkD,sBAAsD,MAA6B;AACvJ,WAAA,OAAO,YAAY,OAAO,OAAO,KAAK,MAAM,QAAQ,EAAE,IAAI,CAAC,WAAwD;AACzH,YAAM,cAAc,kBAAkB,KAAK,2BAA2B,iBAAiB,MAAM,IAAI,EAAE,YAAY,IAAI,YAAY,CAAA,EAAG;AAClI,YAAM,UAAU,CAAC,iBAAiB,IAAI,OAAO,IAAI;AAC3C,YAAA,iBAAiB,yBAAyB,qBAAqB,OAAO,IAAI,GAAG,EAAE,QAAQ,aAAa,MAAM;AAC5G,UAAA,WAAW,mBAAmB,aAAa;AACvC,eAAA;AAAA,MAAA;AAED,aAAA;AAAA,QACN,OAAO;AAAA,QACP;AAAA,MACD;AAAA,IAAA,CACA,EAAE,OAAO,CAAI,OAA+B,OAAO,MAAS,CAAC;AAAA,EAAA;AAAA,EAGvD,2BAA2B,iBAAsC,QAA6C;AACrH,UAAM,qBAAqB,yBAAyB,OAAO,iBAAiB,KAAK,OAAO,MAAM;AAE9F,UAAM,mBAAmD,CAAC;AACpD,UAAA,gBAAgB,KAAK,iBAAiB,QAAQ,gBAAgB,IAAI,OAAO,IAAI,CAAC;AACpF,QAAI,eAAe,QAAQ;AAC1B,uBAAiB,SAAS;AAAA,IAAA;AAE3B,eAAW,MAAM,CAAC,UAAU,UAAU,MAAM,GAAY;AACvD,YAAM,mBAAmD,CAAC;AAC1D,iBAAW,SAAS,OAAO,KAAK,OAAO,MAAM,GAAG;AAC/C,cAAM,YAAY,mBAAmB,qBAAqB,IAAI,OAAO,UAAU,OAAO,OAAO;AAC7F,YAAI,cAAc,QAAW;AAC5B,2BAAiB,KAAK,IAAI;AAAA,QAAA;AAAA,MAC3B;AAED,UAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,GAAG;AAC7C,yBAAiB,EAAE,IAAI;AAAA,MAAA;AAAA,IACxB;AAED,UAAM,eAAe,mBAAmB,qBAAqB,UAAU,IAAI,KAAK;AAChF,QAAI,iBAAiB,QAAW;AAC/B,uBAAiB,SAAS;AAAA,IAAA;AAEpB,WAAA;AAAA,MACN,YAAY,mBAAmB,kBAAkB;AAAA,MACjD,YAAY;AAAA,IACb;AAAA,EAAA;AAAA,EAID,iBAAiB,QAAsB,aAAiE;AACjG,UAAA,kCAAkB,IAAmB;AACrC,UAAA,qCAAqB,IAAmB;AAC9C,eAAW,OAAO,aAAa,eAAe,CAAA,GAAI;AAC3C,YAAA,SAAS,IAAI,YAAY;AAC/B,iBAAW,MAAM,CAAC,UAAU,QAAQ,UAAU,QAAQ,GAAY;AAC7D,YAAA,IAAI,EAAE,GAAG;AACN,gBAAA,aAAa,SAAS,iBAAiB;AAC7C,qBAAW,IAAI,EAAmB;AAE5B,gBAAA,WAAW,SAAS,cAAc;AAEpC,cAAA,SAAS,IAAI,EAAmB,GAAG;AACtC,kBAAM,IAAI,MAAM,aAAa,EAAE,4DAA4D,OAAO,IAAI,EAAE;AAAA,UAAA;AAAA,QACzG;AAAA,MACD;AAAA,IACD;AAGD,WAAO,CAAC,GAAG,eAAe,QAAQ;AAAA,EAAA;AAAA,EAG3B,gBAAgB,MAAY,WAAgD;AAC7E,UAAA,gBAAgB,UAAU,OAAO,CAAA,OAAM,GAAG,MAAM,SAAS,IAAI,CAAC;AACpE,WAAO,OAAO,YAAY,cAAc,IAAI,CAAC,aAAqC;AACjF,aAAO,CAAC,SAAS,MAAM,SAAS,QAAQ;AAAA,IAAA,CACxC,CAAC;AAAA,EAAA;AAAA,EAGH,OAAe,iBAAiB,sBAAkD,OAA2C;AACtH,UAAA,yCAAqD,IAAI;AAC/D,eAAW,CAAC,MAAM,MAAM,KAAK,sBAAsB;AAC5C,YAAA,wBAAwB,CAAC,SAAkC;AAChE,cAAM,kBAAuC,mBAAmB,IAAI,IAAI,yBAAS,IAAI;AAClE,2BAAA,IAAI,MAAM,eAAe;AAC5C,cAAM,oBAAoB,gBAAgB,IAAI,IAAI,KAAK;AAAA,UACtD,aAAa,CAAA;AAAA,QACd;AACgB,wBAAA,IAAI,MAAM,iBAAiB;AACpC,eAAA;AAAA,MACR;AACM,YAAA,WAA0C,sBAAsB,IAAI,MAAM;AAChF,iBAAW,EAAE,MAAM,GAAG,WAAA,KAAgB,UAAU;AAC/C,YAAI,CAAC,MAAM,SAAS,IAAI,GAAG;AAC1B,gBAAM,QAAQ,KAAK,IAAI,mBAAmB,IAAI;AAAA,QAAA;AAEzC,cAAA,oBAAoB,sBAAsB,IAAI;AAClC,0BAAA,YAAY,KAAK,UAAU;AAAA,MAAA;AAAA,IAC9C;AAGM,WAAA;AAAA,EAAA;AAET;"}
+{"version":3,"file":"AclFactory.js","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/AclFactory.ts"],"sourcesContent":["import { Acl, Model, Writable } from '@contember/schema'\nimport { getEntity } from '@contember/schema-utils'\n\nimport { EntityPredicatesResolver } from './EntityPredicateResolver'\nimport { AllowDefinition } from '../permissions'\nimport {\n\tallowDefinitionsStore,\n\tEntityPermissionsDefinition,\n} from './stores'\nimport { Role } from '../roles'\nimport {  VariableDefinition } from '../variables'\nimport { filterEntityDefinition } from '../../../utils'\nimport { applyEntityAclExtensions } from '../aclExtensions'\n\nexport class AclFactory {\n\tconstructor(\n\t\tprivate model: Model.Schema,\n\t) {\n\t}\n\n\tpublic create(\n\t\texportedDefinitions: Record<string, any>,\n\t): Acl.Schema {\n\t\tconst entityLikeDefinition = filterEntityDefinition(exportedDefinitions)\n\t\tconst roles: Role[] = Object.values(exportedDefinitions).filter(it => it instanceof Role)\n\t\tconst variables: VariableDefinition[] = Object.values(exportedDefinitions).filter(it => it instanceof VariableDefinition)\n\n\t\tconst groupedPermissions = this.groupPermissions(entityLikeDefinition, roles)\n\n\t\treturn {\n\t\t\troles: Object.fromEntries(roles.map((role): [string, Acl.RolePermissions] => {\n\t\t\t\tconst rolePermissions = groupedPermissions.get(role)\n\t\t\t\treturn [\n\t\t\t\t\trole.name,\n\t\t\t\t\t{\n\t\t\t\t\t\t...role.options,\n\t\t\t\t\t\tstages: role.options.stages ?? '*',\n\t\t\t\t\t\tentities: this.createPermissions(rolePermissions, Object.fromEntries(entityLikeDefinition), role),\n\t\t\t\t\t\tvariables: this.createVariables(role, variables),\n\t\t\t\t\t},\n\t\t\t\t]\n\t\t\t})),\n\t\t}\n\t}\n\n\tprivate createPermissions(rolePermissions: PermissionsByEntity | undefined, entityLikeDefinition: Record<string, { new(): any }>, role: Role): Acl.Permissions {\n\t\treturn Object.fromEntries(Object.values(this.model.entities).map((entity): [string, Acl.EntityPermissions] | undefined => {\n\t\t\tconst permissions = rolePermissions ? this.createPermissionsFromAllow(rolePermissions, entity) : { predicates: {}, operations: {} }\n\t\t\tconst isEmpty = !rolePermissions?.has(entity.name)\n\t\t\tconst withExtensions = applyEntityAclExtensions(entityLikeDefinition[entity.name], { entity, permissions, role })\n\t\t\tif (isEmpty && withExtensions === permissions) {\n\t\t\t\treturn undefined\n\t\t\t}\n\t\t\treturn [\n\t\t\t\tentity.name,\n\t\t\t\twithExtensions,\n\t\t\t]\n\t\t}).filter(<T>(it: T | undefined): it is T => it !== undefined))\n\t}\n\n\tprivate createPermissionsFromAllow(rolePermissions: PermissionsByEntity, entity: Model.Entity): Acl.EntityPermissions {\n\t\tconst predicatesResolver = EntityPredicatesResolver.create(rolePermissions, this.model, entity)\n\n\t\tconst entityOperations: Writable<Acl.EntityOperations> = {}\n\t\tconst noRootOptions = this.getNoRootOptions(entity, rolePermissions.get(entity.name))\n\t\tif (noRootOptions?.length) {\n\t\t\tentityOperations.noRoot = noRootOptions\n\t\t}\n\t\tfor (const op of ['create', 'update', 'read'] as const) {\n\t\t\tconst fieldPermissions: Writable<Acl.FieldPermissions> = {}\n\t\t\tfor (const field of Object.keys(entity.fields)) {\n\t\t\t\tconst predicate = predicatesResolver.createFieldPredicate(op, field, field === entity.primary)\n\t\t\t\tif (predicate !== undefined) {\n\t\t\t\t\tfieldPermissions[field] = predicate\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (Object.keys(fieldPermissions).length > 0) {\n\t\t\t\tentityOperations[op] = fieldPermissions\n\t\t\t}\n\t\t}\n\t\tconst delPredicate = predicatesResolver.createFieldPredicate('delete', '', false)\n\t\tif (delPredicate !== undefined) {\n\t\t\tentityOperations.delete = delPredicate\n\t\t}\n\t\treturn {\n\t\t\tpredicates: predicatesResolver.getUsedPredicates(),\n\t\t\toperations: entityOperations,\n\t\t}\n\t}\n\n\n\tgetNoRootOptions(entity: Model.Entity, permissions?: EntityPermissions): Acl.EntityOperations['noRoot'] {\n\t\tconst allowedRoot = new Set<Acl.Operation>()\n\t\tconst disallowedRoot = new Set<Acl.Operation>()\n\t\tfor (const def of permissions?.definitions ?? []) {\n\t\t\tconst noRoot = def.through === true\n\t\t\tfor (const op of ['create', 'read', 'update', 'delete'] as const) {\n\t\t\t\tif (def[op]) {\n\t\t\t\t\tconst currentSet = noRoot ? disallowedRoot : allowedRoot\n\t\t\t\t\tcurrentSet.add(op as Acl.Operation)\n\n\t\t\t\t\tconst otherSet = noRoot ? allowedRoot : disallowedRoot\n\n\t\t\t\t\tif (otherSet.has(op as Acl.Operation)) {\n\t\t\t\t\t\tthrow new Error(`Operation ${op} cannot be both allowed and disallowed on root on entity ${entity.name}`)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t}\n\t\treturn [...disallowedRoot.values()]\n\t}\n\n\tprivate createVariables(role: Role, variables: VariableDefinition[]): Acl.Variables {\n\t\tconst roleVariables = variables.filter(it => it.roles.includes(role))\n\t\treturn Object.fromEntries(roleVariables.map((variable): [string, Acl.Variable] => {\n\t\t\treturn [variable.name, variable.variable]\n\t\t}))\n\t}\n\n\tprivate groupPermissions(entityLikeDefinition: [string, { new(): any }][], roles: Role[]): PermissionsByRoleAndEntity {\n\t\tconst groupedPermissions: PermissionsByRoleAndEntity = new Map()\n\t\tfor (const [name, entity] of entityLikeDefinition) {\n\t\t\tconst initEntityPermissions = (role: Role): EntityPermissions => {\n\t\t\t\tconst rolePermissions: PermissionsByEntity = groupedPermissions.get(role) ?? new Map()\n\t\t\t\tgroupedPermissions.set(role, rolePermissions)\n\t\t\t\tconst entityPermissions = rolePermissions.get(name) ?? {\n\t\t\t\t\tdefinitions: [],\n\t\t\t\t}\n\t\t\t\trolePermissions.set(name, entityPermissions)\n\t\t\t\treturn entityPermissions\n\t\t\t}\n\t\t\tconst metadata: EntityPermissionsDefinition[] = allowDefinitionsStore.get(entity)\n\t\t\tfor (const { role, factory } of metadata) {\n\t\t\t\tif (!roles.includes(role)) {\n\t\t\t\t\tthrow `Role ${role.name} used on entity ${name} is not registered. Have you exported it?`\n\t\t\t\t}\n\t\t\t\tconst entityPermissions = initEntityPermissions(role)\n\t\t\t\tconst entity = getEntity(this.model, name)\n\t\t\t\tentityPermissions.definitions.push(factory({\n\t\t\t\t\tmodel: this.model,\n\t\t\t\t\tentity: getEntity(this.model, name),\n\t\t\t\t\texcept: (...fields) => (Object.keys(entity.fields)).filter(it => !fields.includes(it)),\n\t\t\t\t}))\n\t\t\t}\n\t\t}\n\n\t\treturn groupedPermissions\n\t}\n}\n\n\nexport type EntityPermissions = { definitions: AllowDefinition<any>[] }\nexport type PermissionsByEntity = Map<string, EntityPermissions>\nexport type PermissionsByRoleAndEntity = Map<Role, PermissionsByEntity>\n"],"names":["entity"],"mappings":";;;;;;;;AAcO,MAAM,WAAW;AAAA,EACvB,YACS,OACP;AADO,SAAA,QAAA;AAAA,EAAA;AAAA,EAIF,OACN,qBACa;AACP,UAAA,uBAAuB,uBAAuB,mBAAmB;AACjE,UAAA,QAAgB,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAc,IAAI;AAClF,UAAA,YAAkC,OAAO,OAAO,mBAAmB,EAAE,OAAO,CAAA,OAAM,cAAc,kBAAkB;AAExH,UAAM,qBAAqB,KAAK,iBAAiB,sBAAsB,KAAK;AAErE,WAAA;AAAA,MACN,OAAO,OAAO,YAAY,MAAM,IAAI,CAAC,SAAwC;AACtE,cAAA,kBAAkB,mBAAmB,IAAI,IAAI;AAC5C,eAAA;AAAA,UACN,KAAK;AAAA,UACL;AAAA,YACC,GAAG,KAAK;AAAA,YACR,QAAQ,KAAK,QAAQ,UAAU;AAAA,YAC/B,UAAU,KAAK,kBAAkB,iBAAiB,OAAO,YAAY,oBAAoB,GAAG,IAAI;AAAA,YAChG,WAAW,KAAK,gBAAgB,MAAM,SAAS;AAAA,UAAA;AAAA,QAEjD;AAAA,MAAA,CACA,CAAC;AAAA,IACH;AAAA,EAAA;AAAA,EAGO,kBAAkB,iBAAkD,sBAAsD,MAA6B;AACvJ,WAAA,OAAO,YAAY,OAAO,OAAO,KAAK,MAAM,QAAQ,EAAE,IAAI,CAAC,WAAwD;AACzH,YAAM,cAAc,kBAAkB,KAAK,2BAA2B,iBAAiB,MAAM,IAAI,EAAE,YAAY,IAAI,YAAY,CAAA,EAAG;AAClI,YAAM,UAAU,CAAC,iBAAiB,IAAI,OAAO,IAAI;AAC3C,YAAA,iBAAiB,yBAAyB,qBAAqB,OAAO,IAAI,GAAG,EAAE,QAAQ,aAAa,MAAM;AAC5G,UAAA,WAAW,mBAAmB,aAAa;AACvC,eAAA;AAAA,MAAA;AAED,aAAA;AAAA,QACN,OAAO;AAAA,QACP;AAAA,MACD;AAAA,IAAA,CACA,EAAE,OAAO,CAAI,OAA+B,OAAO,MAAS,CAAC;AAAA,EAAA;AAAA,EAGvD,2BAA2B,iBAAsC,QAA6C;AACrH,UAAM,qBAAqB,yBAAyB,OAAO,iBAAiB,KAAK,OAAO,MAAM;AAE9F,UAAM,mBAAmD,CAAC;AACpD,UAAA,gBAAgB,KAAK,iBAAiB,QAAQ,gBAAgB,IAAI,OAAO,IAAI,CAAC;AACpF,QAAI,eAAe,QAAQ;AAC1B,uBAAiB,SAAS;AAAA,IAAA;AAE3B,eAAW,MAAM,CAAC,UAAU,UAAU,MAAM,GAAY;AACvD,YAAM,mBAAmD,CAAC;AAC1D,iBAAW,SAAS,OAAO,KAAK,OAAO,MAAM,GAAG;AAC/C,cAAM,YAAY,mBAAmB,qBAAqB,IAAI,OAAO,UAAU,OAAO,OAAO;AAC7F,YAAI,cAAc,QAAW;AAC5B,2BAAiB,KAAK,IAAI;AAAA,QAAA;AAAA,MAC3B;AAED,UAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,GAAG;AAC7C,yBAAiB,EAAE,IAAI;AAAA,MAAA;AAAA,IACxB;AAED,UAAM,eAAe,mBAAmB,qBAAqB,UAAU,IAAI,KAAK;AAChF,QAAI,iBAAiB,QAAW;AAC/B,uBAAiB,SAAS;AAAA,IAAA;AAEpB,WAAA;AAAA,MACN,YAAY,mBAAmB,kBAAkB;AAAA,MACjD,YAAY;AAAA,IACb;AAAA,EAAA;AAAA,EAID,iBAAiB,QAAsB,aAAiE;AACjG,UAAA,kCAAkB,IAAmB;AACrC,UAAA,qCAAqB,IAAmB;AAC9C,eAAW,OAAO,aAAa,eAAe,CAAA,GAAI;AAC3C,YAAA,SAAS,IAAI,YAAY;AAC/B,iBAAW,MAAM,CAAC,UAAU,QAAQ,UAAU,QAAQ,GAAY;AAC7D,YAAA,IAAI,EAAE,GAAG;AACN,gBAAA,aAAa,SAAS,iBAAiB;AAC7C,qBAAW,IAAI,EAAmB;AAE5B,gBAAA,WAAW,SAAS,cAAc;AAEpC,cAAA,SAAS,IAAI,EAAmB,GAAG;AACtC,kBAAM,IAAI,MAAM,aAAa,EAAE,4DAA4D,OAAO,IAAI,EAAE;AAAA,UAAA;AAAA,QACzG;AAAA,MACD;AAAA,IACD;AAGD,WAAO,CAAC,GAAG,eAAe,QAAQ;AAAA,EAAA;AAAA,EAG3B,gBAAgB,MAAY,WAAgD;AAC7E,UAAA,gBAAgB,UAAU,OAAO,CAAA,OAAM,GAAG,MAAM,SAAS,IAAI,CAAC;AACpE,WAAO,OAAO,YAAY,cAAc,IAAI,CAAC,aAAqC;AACjF,aAAO,CAAC,SAAS,MAAM,SAAS,QAAQ;AAAA,IAAA,CACxC,CAAC;AAAA,EAAA;AAAA,EAGK,iBAAiB,sBAAkD,OAA2C;AAC/G,UAAA,yCAAqD,IAAI;AAC/D,eAAW,CAAC,MAAM,MAAM,KAAK,sBAAsB;AAC5C,YAAA,wBAAwB,CAAC,SAAkC;AAChE,cAAM,kBAAuC,mBAAmB,IAAI,IAAI,yBAAS,IAAI;AAClE,2BAAA,IAAI,MAAM,eAAe;AAC5C,cAAM,oBAAoB,gBAAgB,IAAI,IAAI,KAAK;AAAA,UACtD,aAAa,CAAA;AAAA,QACd;AACgB,wBAAA,IAAI,MAAM,iBAAiB;AACpC,eAAA;AAAA,MACR;AACM,YAAA,WAA0C,sBAAsB,IAAI,MAAM;AAChF,iBAAW,EAAE,MAAM,QAAQ,KAAK,UAAU;AACzC,YAAI,CAAC,MAAM,SAAS,IAAI,GAAG;AAC1B,gBAAM,QAAQ,KAAK,IAAI,mBAAmB,IAAI;AAAA,QAAA;AAEzC,cAAA,oBAAoB,sBAAsB,IAAI;AACpD,cAAMA,UAAS,UAAU,KAAK,OAAO,IAAI;AACvB,0BAAA,YAAY,KAAK,QAAQ;AAAA,UAC1C,OAAO,KAAK;AAAA,UACZ,QAAQ,UAAU,KAAK,OAAO,IAAI;AAAA,UAClC,QAAQ,IAAI,WAAY,OAAO,KAAKA,QAAO,MAAM,EAAG,OAAO,CAAM,OAAA,CAAC,OAAO,SAAS,EAAE,CAAC;AAAA,QAAA,CACrF,CAAC;AAAA,MAAA;AAAA,IACH;AAGM,WAAA;AAAA,EAAA;AAET;"}

package/dist/production/src/acl/definition/internal/stores.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"stores.cjs","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/stores.ts"],"sourcesContent":["import { createMetadataStore } from '../../../utils/MetadataStore'\nimport { Role } from '../roles'\nimport { AllowDefinition } from '../permissions'\n\nexport type EntityPermissionsDefinition =\n\t& AllowDefinition<any>\n\t& {\n\t\trole: Role<string>\n\t}\nexport const allowDefinitionsStore = createMetadataStore<EntityPermissionsDefinition[]>([])\n"],"names":["createMetadataStore"],"mappings":";;;AASa,MAAA,wBAAwBA,cAAmD,oBAAA,CAAE,CAAA;;"}
+{"version":3,"file":"stores.cjs","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/stores.ts"],"sourcesContent":["import { createMetadataStore } from '../../../utils/MetadataStore'\nimport { AllowDefinitionFactory } from '../permissions'\nimport { Role } from '../roles'\n\nexport type EntityPermissionsDefinition =\n\t& {\n\t\tfactory: AllowDefinitionFactory<any>\n\t\trole: Role<string>\n\t}\nexport const allowDefinitionsStore = createMetadataStore<EntityPermissionsDefinition[]>([])\n"],"names":["createMetadataStore"],"mappings":";;;AASa,MAAA,wBAAwBA,cAAmD,oBAAA,CAAE,CAAA;;"}

package/dist/production/src/acl/definition/internal/stores.js.map

@@ -1 +1 @@
-{"version":3,"file":"stores.js","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/stores.ts"],"sourcesContent":["import { createMetadataStore } from '../../../utils/MetadataStore'\nimport { Role } from '../roles'\nimport { AllowDefinition } from '../permissions'\n\nexport type EntityPermissionsDefinition =\n\t& AllowDefinition<any>\n\t& {\n\t\trole: Role<string>\n\t}\nexport const allowDefinitionsStore = createMetadataStore<EntityPermissionsDefinition[]>([])\n"],"names":[],"mappings":";AASa,MAAA,wBAAwB,oBAAmD,CAAE,CAAA;"}
+{"version":3,"file":"stores.js","sources":["../../../../../../../packages/schema-definition/src/acl/definition/internal/stores.ts"],"sourcesContent":["import { createMetadataStore } from '../../../utils/MetadataStore'\nimport { AllowDefinitionFactory } from '../permissions'\nimport { Role } from '../roles'\n\nexport type EntityPermissionsDefinition =\n\t& {\n\t\tfactory: AllowDefinitionFactory<any>\n\t\trole: Role<string>\n\t}\nexport const allowDefinitionsStore = createMetadataStore<EntityPermissionsDefinition[]>([])\n"],"names":[],"mappings":";AASa,MAAA,wBAAwB,oBAAmD,CAAE,CAAA;"}

package/dist/production/src/acl/definition/permissions.cjs

@@ -4,7 +4,10 @@ const stores = require("./internal/stores.cjs");
 const allow = (role, args) => {
   return (entity) => {
     (Array.isArray(role) ? role : [role]).forEach((role2) => {
-      stores.allowDefinitionsStore.update(entity, (val) => [...val, { ...args, role: role2 }]);
+      stores.allowDefinitionsStore.update(entity, (val) => [...val, {
+        factory: typeof args === "function" ? args : () => args,
+        role: role2
+      }]);
     });
   };
 };

package/dist/production/src/acl/definition/permissions.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.cjs","sources":["../../../../../../packages/schema-definition/src/acl/definition/permissions.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\nimport { Role } from './roles'\nimport { VariableDefinition } from './variables'\nimport { PredicateEvaluationReference } from './references'\nimport { allowDefinitionsStore } from './internal/stores'\nimport { DecoratorFunction, EntityConstructor } from '../../utils'\n\nexport type PredicateExtra = PredicateEvaluationReference | VariableDefinition\nexport type WhenDefinition = Acl.PredicateDefinition<PredicateExtra>\n\nexport interface AllowDefinition<E> {\n\twhen?: WhenDefinition\n\tthrough?: true\n\tname?: string\n\tcreate?: true | ('id' | keyof E)[]\n\tupdate?: true | ('id' | keyof E)[]\n\tread?: true | ('id' | keyof E)[]\n\tdelete?: true\n}\n\nexport const allow = <E, R extends Role<string>>(role: R | R[], args: AllowDefinition<E>): DecoratorFunction<E> => {\n\treturn (entity: EntityConstructor<E>) => {\n\t\t(Array.isArray(role) ? role : [role]).forEach(role => {\n\t\t\tallowDefinitionsStore.update(entity, val => [...val, { ...args, role }])\n\t\t})\n\t}\n}\n\n\n\n"],"names":["role","allowDefinitionsStore"],"mappings":";;;AAoBa,MAAA,QAAQ,CAA4B,MAAe,SAAmD;AAClH,SAAO,CAAC,WAAiC;AACvC,KAAA,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAAA,UAAQ;AACrDC,aAAAA,sBAAsB,OAAO,QAAQ,CAAO,QAAA,CAAC,GAAG,KAAK,EAAE,GAAG,MAAM,MAAAD,MAAM,CAAA,CAAC;AAAA,IAAA,CACvE;AAAA,EACF;AACD;;"}
+{"version":3,"file":"permissions.cjs","sources":["../../../../../../packages/schema-definition/src/acl/definition/permissions.ts"],"sourcesContent":["import { Acl, Model } from '@contember/schema'\nimport { Role } from './roles'\nimport { VariableDefinition } from './variables'\nimport { PredicateEvaluationReference } from './references'\nimport { allowDefinitionsStore } from './internal/stores'\nimport { DecoratorFunction, EntityConstructor } from '../../utils'\n\nexport type PredicateExtra = PredicateEvaluationReference | VariableDefinition\nexport type WhenDefinition = Acl.PredicateDefinition<PredicateExtra>\n\nexport interface AllowDefinition<E> {\n\twhen?: WhenDefinition\n\tthrough?: true\n\tname?: string\n\tcreate?: true | ('id' | keyof E)[]\n\tupdate?: true | ('id' | keyof E)[]\n\tread?: true | ('id' | keyof E)[]\n\tdelete?: true\n}\n\nexport type AllowDefinitionFactory<E> = (args: {\n\tmodel: Model.Schema\n\tentity: Model.Entity<(keyof E) & string>\n\texcept: (...fields: (keyof E)[]) => (keyof E)[]\n}) => AllowDefinition<E>\n\nexport const allow = <E, R extends Role<string>>(role: R | R[], args: AllowDefinition<E> | AllowDefinitionFactory<E>): DecoratorFunction<E> => {\n\treturn (entity: EntityConstructor<E>) => {\n\t\t(Array.isArray(role) ? role : [role]).forEach(role => {\n\t\t\tallowDefinitionsStore.update(entity, val => [...val, {\n\t\t\t\tfactory: typeof args === 'function' ? args : () => args,\n\t\t\t\trole,\n\t\t\t}])\n\t\t})\n\t}\n}\n\n\n\n"],"names":["role","allowDefinitionsStore"],"mappings":";;;AA0Ba,MAAA,QAAQ,CAA4B,MAAe,SAA+E;AAC9I,SAAO,CAAC,WAAiC;AACvC,KAAA,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAAA,UAAQ;AACrDC,aAAA,sBAAsB,OAAO,QAAQ,CAAO,QAAA,CAAC,GAAG,KAAK;AAAA,QACpD,SAAS,OAAO,SAAS,aAAa,OAAO,MAAM;AAAA,QACnD,MAAAD;AAAAA,MAAA,CACA,CAAC;AAAA,IAAA,CACF;AAAA,EACF;AACD;;"}

package/dist/production/src/acl/definition/permissions.js

@@ -2,7 +2,10 @@ import { allowDefinitionsStore } from "./internal/stores.js";
 const allow = (role, args) => {
   return (entity) => {
     (Array.isArray(role) ? role : [role]).forEach((role2) => {
-      allowDefinitionsStore.update(entity, (val) => [...val, { ...args, role: role2 }]);
+      allowDefinitionsStore.update(entity, (val) => [...val, {
+        factory: typeof args === "function" ? args : () => args,
+        role: role2
+      }]);
     });
   };
 };

package/dist/production/src/acl/definition/permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.js","sources":["../../../../../../packages/schema-definition/src/acl/definition/permissions.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\nimport { Role } from './roles'\nimport { VariableDefinition } from './variables'\nimport { PredicateEvaluationReference } from './references'\nimport { allowDefinitionsStore } from './internal/stores'\nimport { DecoratorFunction, EntityConstructor } from '../../utils'\n\nexport type PredicateExtra = PredicateEvaluationReference | VariableDefinition\nexport type WhenDefinition = Acl.PredicateDefinition<PredicateExtra>\n\nexport interface AllowDefinition<E> {\n\twhen?: WhenDefinition\n\tthrough?: true\n\tname?: string\n\tcreate?: true | ('id' | keyof E)[]\n\tupdate?: true | ('id' | keyof E)[]\n\tread?: true | ('id' | keyof E)[]\n\tdelete?: true\n}\n\nexport const allow = <E, R extends Role<string>>(role: R | R[], args: AllowDefinition<E>): DecoratorFunction<E> => {\n\treturn (entity: EntityConstructor<E>) => {\n\t\t(Array.isArray(role) ? role : [role]).forEach(role => {\n\t\t\tallowDefinitionsStore.update(entity, val => [...val, { ...args, role }])\n\t\t})\n\t}\n}\n\n\n\n"],"names":["role"],"mappings":";AAoBa,MAAA,QAAQ,CAA4B,MAAe,SAAmD;AAClH,SAAO,CAAC,WAAiC;AACvC,KAAA,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAAA,UAAQ;AACrD,4BAAsB,OAAO,QAAQ,CAAO,QAAA,CAAC,GAAG,KAAK,EAAE,GAAG,MAAM,MAAAA,MAAM,CAAA,CAAC;AAAA,IAAA,CACvE;AAAA,EACF;AACD;"}
+{"version":3,"file":"permissions.js","sources":["../../../../../../packages/schema-definition/src/acl/definition/permissions.ts"],"sourcesContent":["import { Acl, Model } from '@contember/schema'\nimport { Role } from './roles'\nimport { VariableDefinition } from './variables'\nimport { PredicateEvaluationReference } from './references'\nimport { allowDefinitionsStore } from './internal/stores'\nimport { DecoratorFunction, EntityConstructor } from '../../utils'\n\nexport type PredicateExtra = PredicateEvaluationReference | VariableDefinition\nexport type WhenDefinition = Acl.PredicateDefinition<PredicateExtra>\n\nexport interface AllowDefinition<E> {\n\twhen?: WhenDefinition\n\tthrough?: true\n\tname?: string\n\tcreate?: true | ('id' | keyof E)[]\n\tupdate?: true | ('id' | keyof E)[]\n\tread?: true | ('id' | keyof E)[]\n\tdelete?: true\n}\n\nexport type AllowDefinitionFactory<E> = (args: {\n\tmodel: Model.Schema\n\tentity: Model.Entity<(keyof E) & string>\n\texcept: (...fields: (keyof E)[]) => (keyof E)[]\n}) => AllowDefinition<E>\n\nexport const allow = <E, R extends Role<string>>(role: R | R[], args: AllowDefinition<E> | AllowDefinitionFactory<E>): DecoratorFunction<E> => {\n\treturn (entity: EntityConstructor<E>) => {\n\t\t(Array.isArray(role) ? role : [role]).forEach(role => {\n\t\t\tallowDefinitionsStore.update(entity, val => [...val, {\n\t\t\t\tfactory: typeof args === 'function' ? args : () => args,\n\t\t\t\trole,\n\t\t\t}])\n\t\t})\n\t}\n}\n\n\n\n"],"names":["role"],"mappings":";AA0Ba,MAAA,QAAQ,CAA4B,MAAe,SAA+E;AAC9I,SAAO,CAAC,WAAiC;AACvC,KAAA,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAAA,UAAQ;AACrD,4BAAsB,OAAO,QAAQ,CAAO,QAAA,CAAC,GAAG,KAAK;AAAA,QACpD,SAAS,OAAO,SAAS,aAAa,OAAO,MAAM;AAAA,QACnD,MAAAA;AAAAA,MAAA,CACA,CAAC;AAAA,IAAA,CACF;AAAA,EACF;AACD;"}