@contember/schema-utils 1.1.2 → 1.2.0-alpha.11

package/src/acl/PredicateDefinitionProcessor.ts

@@ -48,10 +48,10 @@ class PredicateDefinitionProcessor {
 			const fieldWhere = acceptFieldVisitor<
 				WhereValue | Input.Where | Input.Condition | [string, WhereValue | Input.Where | Input.Condition] | undefined
 			>(this.schema, entity, key, {
-				visitColumn: (entity, column) => {
+				visitColumn: ({ entity, column }) => {
 					return handler.handleColumn({ entity, column, value: value as Input.Condition | PredicateExtension, path })
 				},
-				visitRelation: (entity, relation, targetEntity) => {
+				visitRelation: ({ entity, relation, targetEntity }) => {
 					const processedValue = handler.handleRelation({
 						relation,
 						entity,
@@ -61,6 +61,7 @@ class PredicateDefinitionProcessor {
 					})
 					if (
 						typeof processedValue === 'object' &&
+						processedValue !== null &&
 						'constructor' in processedValue &&
 						processedValue.constructor.name === 'Object'
 					) {

package/src/model/NamingHelper.ts

@@ -2,20 +2,31 @@ import crypto from 'crypto'
 
 export class NamingHelper {
 	public static createForeignKeyName(fromTable: string, fromColumn: string, toTable: string, toColumn: string): string {
-		const uniqueSuffix = crypto
-			.createHash('sha256')
-			.update(JSON.stringify([fromTable, fromColumn, toTable, toColumn]), 'ascii')
-			.digest('hex')
+		return 'fk_'
+			+ fromTable + '_'
+			+ fromColumn + '_'
+			+ this.createUniqueSuffix([fromTable, fromColumn, toTable, toColumn])
+	}
 
-		return 'fk_' + fromTable + '_' + fromColumn + '_' + uniqueSuffix.slice(0, 6)
+	public static createIndexName = (entityName: string, fields: readonly string[]): string => {
+		return 'idx_'
+			+ entityName + '_'
+			+ fields.join('_') + '_'
+			+ this.createUniqueSuffix([entityName, ...fields])
 	}
 
 	public static createUniqueConstraintName = (entityName: string, fields: readonly string[]): string => {
+		return 'unique_'
+			+ entityName + '_'
+			+ fields.join('_') + '_'
+			+ this.createUniqueSuffix([entityName, ...fields])
+	}
+
+	private static createUniqueSuffix = (values: string[]): string => {
 		const uniqueSuffix = crypto
 			.createHash('sha256')
-			.update(JSON.stringify([entityName, ...fields]), 'ascii')
+			.update(JSON.stringify(values), 'ascii')
 			.digest('hex')
-
-		return 'unique_' + entityName + '_' + fields.join('_') + '_' + uniqueSuffix.slice(0, 6)
+		return uniqueSuffix.slice(0, 6)
 	}
 }

package/src/model/modelUtils.ts

@@ -28,10 +28,18 @@ export const getEntity = (schema: Model.Schema, entityName: string): Model.Entit
 	return entity
 }
 
+export const getField = (entity: Model.Entity, fieldName: string): Model.AnyField => {
+	const field = entity.fields[fieldName]
+	if (!field) {
+		throw createFieldNotFoundError(entity.name, fieldName)
+	}
+	return field
+}
+
 export const getColumnName = (schema: Model.Schema, entity: Model.Entity, fieldName: string) => {
 	return acceptFieldVisitor(schema, entity, fieldName, {
-		visitColumn: (entity, column) => column.columnName,
-		visitRelation: (entity, relation) => {
+		visitColumn: ({ column }) => column.columnName,
+		visitRelation: ({ entity, relation }) => {
 			if (isIt<Model.JoiningColumnRelation>(relation, 'joiningColumn')) {
 				return relation.joiningColumn.columnName
 			}
@@ -57,8 +65,8 @@ export const tryGetColumnName = (schema: Model.Schema, entity: Model.Entity, fie
 export const getColumnType = (schema: Model.Schema, entity: Model.Entity, fieldName: string): string => {
 	return acceptFieldVisitor(schema, entity, fieldName, {
 		// TODO solve enum handling properly maybe we should distinguish between domain and column type
-		visitColumn: (entity, column) => (column.type === Model.ColumnType.Enum ? 'text' : column.columnType),
-		visitRelation: (entity, relation, targetEntity) => {
+		visitColumn: ({ column }) => (column.type === Model.ColumnType.Enum ? 'text' : column.columnType),
+		visitRelation: ({ entity, relation, targetEntity }) => {
 			if (isIt<Model.JoiningColumnRelation>(relation, 'joiningColumn')) {
 				return getColumnType(schema, targetEntity, targetEntity.primary)
 			}
@@ -77,7 +85,7 @@ export const getTargetEntity = (
 ): Model.Entity | null => {
 	return acceptFieldVisitor(schema, entity, relationName, {
 		visitColumn: () => null,
-		visitRelation: (entity, relation, targetEntity) => targetEntity,
+		visitRelation: ({ targetEntity }) => targetEntity,
 	})
 }
 
@@ -87,9 +95,7 @@ export const acceptEveryFieldVisitor = <T>(
 	visitor: Model.FieldVisitor<T>,
 ): { [fieldName: string]: T } => {
 	const entityObj: Model.Entity = typeof entity === 'string' ? getEntity(schema, entity) : entity
-	if (!entityObj) {
-		throw createEntityNotFoundError(typeof entity === 'string' ? entity : 'unknown')
-	}
+
 	const result: { [fieldName: string]: T } = {}
 	for (const field in entityObj.fields) {
 		result[field] = acceptFieldVisitor(schema, entityObj, field, visitor)
@@ -104,34 +110,28 @@ export const acceptFieldVisitor = <T>(
 	visitor: Model.FieldVisitor<T>,
 ): T => {
 	const entityObj: Model.Entity = typeof entity === 'string' ? getEntity(schema, entity) : entity
-	if (!entityObj) {
-		throw createEntityNotFoundError(typeof entity === 'string' ? entity : 'unknown')
-	}
+
 	const fieldObj: Model.AnyField = typeof field === 'string' ? entityObj.fields[field] : field
 	if (!fieldObj) {
 		throw createFieldNotFoundError(entityObj.name, typeof field === 'string' ? field : 'unknown')
 	}
+
 	if (isIt<Model.AnyColumn>(fieldObj, 'columnType')) {
-		return visitor.visitColumn(entityObj, fieldObj)
-	}
-	if (!isIt<Model.AnyRelation>(fieldObj, 'target')) {
-		throw new Error(`Invalid field type`)
+		return visitor.visitColumn({
+			entity: entityObj,
+			column: fieldObj,
+		})
 	}
-	const targetEntity = getEntity(schema, fieldObj.target)
 
 	if (isIt<Model.ColumnVisitor<T> & Model.RelationVisitor<T>>(visitor, 'visitRelation')) {
-		let targetRelation = null
-		if (isOwningRelation(fieldObj)) {
-			targetRelation = fieldObj.inversedBy ? targetEntity.fields[fieldObj.inversedBy] || null : null
-		} else if (isInverseRelation(fieldObj)) {
-			targetRelation = targetEntity.fields[fieldObj.ownedBy]
-		} else {
-			throw new Error('Invalid relaton type')
-		}
-		if (targetRelation && !isIt<Model.Relation>(targetRelation, 'target')) {
-			throw new Error('Invalid target')
-		}
-		return visitor.visitRelation(entityObj, fieldObj, targetEntity, targetRelation)
+		return acceptRelationTypeVisitor(schema, entityObj, fieldObj, {
+			visitManyHasManyInverse: visitor.visitRelation.bind(visitor),
+			visitManyHasManyOwning: visitor.visitRelation.bind(visitor),
+			visitOneHasMany: visitor.visitRelation.bind(visitor),
+			visitOneHasOneInverse: visitor.visitRelation.bind(visitor),
+			visitOneHasOneOwning: visitor.visitRelation.bind(visitor),
+			visitManyHasOne: visitor.visitRelation.bind(visitor),
+		})
 	}
 
 	if (isIt<Model.ColumnVisitor<T> & Model.RelationByGenericTypeVisitor<T>>(visitor, 'visitHasMany')) {
@@ -148,7 +148,8 @@ export const acceptFieldVisitor = <T>(
 	if (isIt<Model.ColumnVisitor<T> & Model.RelationByTypeVisitor<T>>(visitor, 'visitManyHasManyInverse')) {
 		return acceptRelationTypeVisitor(schema, entityObj, fieldObj, visitor)
 	}
-	throw new Error('Invalid field type')
+
+	throw new Error()
 }
 
 export const acceptRelationTypeVisitor = <T>(
@@ -157,49 +158,50 @@ export const acceptRelationTypeVisitor = <T>(
 	relation: string | Model.AnyRelation,
 	visitor: Model.RelationByTypeVisitor<T>,
 ): T => {
-	const entityObj: Model.Entity = typeof entity === 'string' ? getEntity(schema, entity) : entity
-	if (!entityObj) {
-		throw createEntityNotFoundError(typeof entity === 'string' ? entity : 'unknown')
-	}
+	const entityObj = typeof entity === 'string' ? getEntity(schema, entity) : entity
+
 	const relationObj: Model.AnyField = typeof relation === 'string' ? entityObj.fields[relation] : relation
 	if (!relationObj) {
 		throw createFieldNotFoundError(entityObj.name, typeof relation === 'string' ? relation : 'unknown')
 	}
+
 	if (!isRelation(relationObj)) {
 		throw new ModelError(
 			ModelErrorCode.NOT_RELATION,
 			`Field ${relationObj.name} of entity ${entityObj.name} is not a relation`,
 		)
 	}
+
 	const targetEntity = getEntity(schema, relationObj.target)
 
 	if (isInverseRelation(relationObj)) {
 		const targetRelation = targetEntity.fields[relationObj.ownedBy]
-		if (!isRelation(targetRelation)) {
-			throw new Error('Invalid target relation')
-		}
 		switch (relationObj.type) {
 			case Model.RelationType.ManyHasMany:
-				return visitor.visitManyHasManyInverse(
-					entityObj,
-					relationObj,
-					targetEntity,
-					targetRelation as Model.ManyHasManyOwningRelation,
+				return visitor.visitManyHasManyInverse({
+					type: 'manyHasManyInverse',
+					entity: entityObj,
+					relation: relationObj,
+					targetEntity: targetEntity,
+					targetRelation: targetRelation as Model.ManyHasManyOwningRelation,
+				},
 				)
 			case Model.RelationType.OneHasOne:
-				return visitor.visitOneHasOneInverse(
-					entityObj,
-					relationObj,
-					targetEntity,
-					targetRelation as Model.OneHasOneOwningRelation,
-				)
+				return visitor.visitOneHasOneInverse({
+					type: 'oneHasOneInverse',
+					entity: entityObj,
+					relation: relationObj,
+					targetEntity: targetEntity,
+					targetRelation: targetRelation as Model.OneHasOneOwningRelation,
+				})
 			case Model.RelationType.OneHasMany:
-				return visitor.visitOneHasMany(
-					entityObj, //
-					relationObj,
-					targetEntity,
-					targetRelation as Model.ManyHasOneRelation,
-				)
+				return visitor.visitOneHasMany({
+					type: 'oneHasMany',
+					entity: entityObj,
+					relation: relationObj,
+					targetEntity: targetEntity,
+					targetRelation: targetRelation as Model.ManyHasOneRelation,
+				})
 			default:
 				return assertNever(relationObj)
 		}
@@ -208,26 +210,29 @@ export const acceptRelationTypeVisitor = <T>(
 
 		switch (relationObj.type) {
 			case Model.RelationType.ManyHasMany:
-				return visitor.visitManyHasManyOwning(
-					entityObj,
-					relationObj,
-					targetEntity,
-					targetRelation as Model.ManyHasManyInverseRelation,
-				)
+				return visitor.visitManyHasManyOwning({
+					type: 'manyHasManyOwning',
+					entity: entityObj,
+					relation: relationObj,
+					targetEntity: targetEntity,
+					targetRelation: targetRelation as Model.ManyHasManyInverseRelation,
+				})
 			case Model.RelationType.OneHasOne:
-				return visitor.visitOneHasOneOwning(
-					entityObj,
-					relationObj,
-					targetEntity,
-					targetRelation as Model.OneHasOneInverseRelation,
-				)
+				return visitor.visitOneHasOneOwning({
+					type: 'oneHasOneOwning',
+					entity: entityObj,
+					relation: relationObj,
+					targetEntity: targetEntity,
+					targetRelation: targetRelation as Model.OneHasOneInverseRelation,
+				})
 			case Model.RelationType.ManyHasOne:
-				return visitor.visitManyHasOne(
-					entityObj, //
-					relationObj,
-					targetEntity,
-					targetRelation as Model.OneHasManyRelation,
-				)
+				return visitor.visitManyHasOne({
+					type: 'manyHasOne',
+					entity: entityObj, //
+					relation: relationObj,
+					targetEntity: targetEntity,
+					targetRelation: targetRelation as Model.OneHasManyRelation,
+				})
 			default:
 				return assertNever(relationObj)
 		}

package/src/schemaNormalizer.ts

@@ -18,6 +18,14 @@ export const normalizeSchema = <S extends Schema>(schema: S): S => {
 							read: true,
 						},
 					},
+					content: {
+						export: true,
+						import: true,
+					},
+					system: {
+						export: true,
+						import: true,
+					},
 					...((schema.acl.roles?.[ProjectRole.ADMIN] as Acl.RolePermissions | undefined) || {}),
 				},
 				[ProjectRole.CONTENT_ADMIN]: {
@@ -30,11 +38,14 @@ export const normalizeSchema = <S extends Schema>(schema: S): S => {
 							read: true,
 						},
 					},
+					content: {
+						export: true,
+						import: true,
+					},
 					system: {
-						diff: Acl.SystemPermissionsLevel.any,
-						history: Acl.SystemPermissionsLevel.any,
-						release: Acl.SystemPermissionsLevel.any,
-						rebase: Acl.SystemPermissionsLevel.any,
+						history: true,
+						export: true,
+						import: true,
 					},
 					...((schema.acl.roles?.[ProjectRole.CONTENT_ADMIN] as Acl.RolePermissions | undefined) || {}),
 				},

package/src/type-schema/acl.ts

@@ -1,18 +1,26 @@
 import { Acl, Model } from '@contember/schema'
 import * as Typesafe from '@contember/typesafe'
 
+const membershipMatchRuleSchema = Typesafe.record(
+	Typesafe.string,
+	Typesafe.union(
+		Typesafe.literal(true),
+		Typesafe.partial({
+			variables: Typesafe.union(
+				Typesafe.literal(true),
+				Typesafe.record(
+					Typesafe.string,
+					Typesafe.union(Typesafe.literal(true), Typesafe.string),
+				),
+			),
+		}),
+	),
+)
+
 const tenantPermissionsSchema = Typesafe.partial({
 	invite: Typesafe.boolean,
 	unmanagedInvite: Typesafe.boolean,
-	manage: Typesafe.record(Typesafe.string, Typesafe.partial({
-		variables: Typesafe.union(
-			Typesafe.literal(true),
-			Typesafe.record(
-				Typesafe.string,
-				Typesafe.union(Typesafe.literal(true), Typesafe.string),
-			),
-		),
-	})),
+	manage: membershipMatchRuleSchema,
 })
 const tenantSchemaCheck: Typesafe.Equals<Acl.TenantPermissions, ReturnType<typeof tenantPermissionsSchema>> = true
 
@@ -20,9 +28,18 @@ const systemPermissionsSchema = Typesafe.partial({
 	history: Typesafe.union(Typesafe.boolean, Typesafe.enumeration('any', 'none')),
 	migrate: Typesafe.boolean,
 	assumeIdentity: Typesafe.boolean,
+	export: Typesafe.boolean,
+	import: Typesafe.boolean,
 })
 const systemSchemaCheck: Typesafe.Equals<Acl.SystemPermissions, ReturnType<typeof systemPermissionsSchema>> = true
 
+const contentPermissionsSchema = Typesafe.partial({
+	assumeMembership: membershipMatchRuleSchema,
+	export: Typesafe.boolean,
+	import: Typesafe.boolean,
+})
+const contentSchemaCheck: Typesafe.Equals<Acl.ContentPermissions, ReturnType<typeof contentPermissionsSchema>> = true
+
 const variablesSchema = Typesafe.record(
 	Typesafe.string,
 	Typesafe.union(
@@ -34,6 +51,9 @@ const variablesSchema = Typesafe.record(
 			type: Typesafe.literal(Acl.VariableType.predefined),
 			value: Typesafe.enumeration('identityID', 'personID'),
 		}),
+		Typesafe.object({
+			type: Typesafe.literal(Acl.VariableType.condition),
+		}),
 	),
 )
 
@@ -81,6 +101,7 @@ const baseRolePermissionsSchema = Typesafe.intersection(
 		),
 		tenant: tenantPermissionsSchema,
 		system: systemPermissionsSchema,
+		content: contentPermissionsSchema,
 	}),
 )
 const baseRolePermissionsCheck: Typesafe.Equals<Acl.BaseRolePermissions, ReturnType<typeof baseRolePermissionsSchema>> = true

package/src/type-schema/condition.ts

@@ -0,0 +1,81 @@
+import * as Typesafe from '@contember/typesafe'
+import { Json, Type } from '@contember/typesafe'
+import { Input, Model, Value } from '@contember/schema'
+
+export const conditionSchema = <T extends Value.FieldValue>(type?: Model.ColumnType): Type<Input.Condition<T>> => {
+	const metadata = type ? resolveColumnMetadata(type) : { type: Typesafe.scalar }
+	return conditionSchemaInner(metadata)
+}
+
+interface ResolvedColumnMetadata<T extends Json> {
+	type: Typesafe.Type<T>
+	isJson?: boolean
+	isString?: boolean
+}
+
+const conditionSchemaInner = <T extends Json>(metadata: ResolvedColumnMetadata<T>): Type<Input.Condition<T>> => {
+	return (input: unknown, path: PropertyKey[] = []): Input.Condition<T> => {
+		const self = conditionSchemaInner(metadata)
+		const inner = metadata.type
+		const objectSchema = Typesafe.noExtraProps(Typesafe.partial({
+			and: Typesafe.array(self),
+			or: Typesafe.array(self),
+			not: self,
+			null: Typesafe.boolean,
+			isNull: Typesafe.boolean,
+			never: Typesafe.true_,
+			always: Typesafe.true_,
+			...(metadata.isJson !== true ? {
+				eq: inner,
+				notEq: inner,
+				in: Typesafe.array(inner),
+				notIn: Typesafe.array(inner),
+				lt: inner,
+				lte: inner,
+				gt: inner,
+				gte: inner,
+			} : {}),
+			...(metadata.isString !== false ? {
+				contains: Typesafe.string,
+				startsWith: Typesafe.string,
+				endsWith: Typesafe.string,
+				containsCI: Typesafe.string,
+				startsWithCI: Typesafe.string,
+				endsWithCI: Typesafe.string,
+			} : {}),
+		}))
+		return objectSchema(input, path) as Input.Condition<T>
+	}
+}
+
+const resolveColumnMetadata = (type: Model.ColumnType): ResolvedColumnMetadata<any> => {
+	const resolvedType = Typesafe.nullable(resolveColumnTypeSchema(type))
+	return {
+		type: resolvedType,
+		isJson: type === Model.ColumnType.Json,
+		isString: type === Model.ColumnType.String,
+
+	}
+}
+
+
+const resolveColumnTypeSchema = (type: Model.ColumnType) => {
+	switch (type) {
+		case Model.ColumnType.Bool:
+			return Typesafe.boolean
+
+		// todo: validate format of string-like inputs uuid, date, enum
+		case Model.ColumnType.Date:
+		case Model.ColumnType.DateTime:
+		case Model.ColumnType.Uuid:
+		case Model.ColumnType.Enum:
+		case Model.ColumnType.String:
+			return Typesafe.string
+		case Model.ColumnType.Double:
+			return Typesafe.number
+		case Model.ColumnType.Int:
+			return Typesafe.integer
+		case Model.ColumnType.Json:
+			return Typesafe.anyJson
+	}
+}

package/src/type-schema/index.ts

@@ -1,3 +1,4 @@
 export * from './acl'
+export * from './condition'
 export * from './model'
 export * from './validation'

package/src/type-schema/model.ts

@@ -147,6 +147,12 @@ const viewSchemaInner = Typesafe.intersection(
 const viewSchemaCheck: Typesafe.Equals<Model.View, ReturnType<typeof viewSchemaInner>> = true
 const viewSchema: Typesafe.Type<Model.View> = viewSchemaInner
 
+
+const indexesSchema = Typesafe.coalesce<Model.Indexes, Model.Indexes>(Typesafe.record(Typesafe.string, Typesafe.object({
+	fields: Typesafe.array(Typesafe.string),
+	name: Typesafe.string,
+})), { })
+
 const entitySchema = Typesafe.intersection(
 	Typesafe.object({
 		name: Typesafe.string,
@@ -158,6 +164,7 @@ const entitySchema = Typesafe.intersection(
 			fields: Typesafe.array(Typesafe.string),
 			name: Typesafe.string,
 		})),
+		indexes: indexesSchema,
 		eventLog: eventLogSchema,
 	}),
 	Typesafe.partial({

package/src/validation/AclValidator.ts

@@ -2,6 +2,8 @@ import { Acl, Model } from '@contember/schema'
 import { PredicateDefinitionProcessor } from '../acl'
 import { getEntity } from '../model'
 import { ErrorBuilder, ValidationError } from './errors'
+import { conditionSchema } from '../type-schema/condition'
+import { anyJson } from '@contember/typesafe'
 
 
 export class AclValidator {
@@ -128,8 +130,16 @@ export class AclValidator {
 		const processor = new PredicateDefinitionProcessor(this.model)
 		processor.process(entity, predicate, {
 			handleColumn: ctx => {
-				if (typeof ctx.value === 'string' && !variables[ctx.value]) {
-					errorBuilder.for(...ctx.path).add(`Undefined variable ${ctx.value}`)
+				if (typeof ctx.value === 'string') {
+					if (!variables[ctx.value]) {
+						errorBuilder.for(...ctx.path).add(`Undefined variable ${ctx.value}`)
+					}
+				} else {
+					try {
+						conditionSchema(ctx.column.type)(ctx.value)
+					} catch (e: any) {
+						errorBuilder.for(...ctx.path).add(`Invalid condition (${e.message}): ${JSON.stringify(ctx.value)}`)
+					}
 				}
 				return ctx.value
 			},

package/src/validation/MembershipResolver.ts

@@ -0,0 +1,133 @@
+import { Acl, Input } from '@contember/schema'
+import { getRoleVariables } from '../acl'
+import { conditionSchema } from '../type-schema'
+
+
+export class MembershipResolver {
+	public static UnknownIdentity = { identityId: '00000000-0000-0000-0000-000000000000' }
+
+	resolve(
+		acl: Acl.Schema,
+		memberships: readonly Acl.Membership[],
+		identity: {
+			identityId: string
+			personId?: string
+		},
+	): MembershipReadResult {
+		const errors: MembershipValidationError[] = []
+		const parsed: ParsedMembership[] = []
+		const roles = acl.roles
+		for (const membership of memberships) {
+			if (!roles[membership.role]) {
+				errors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.ROLE_NOT_FOUND))
+				continue
+			}
+			const roleVariables = getRoleVariables(membership.role, acl)
+			for (const variable of membership.variables) {
+				if (!roleVariables[variable.name] || roleVariables[variable.name].type === Acl.VariableType.predefined) {
+					errors.push(
+						new MembershipValidationError(
+							membership.role,
+							MembershipValidationErrorType.VARIABLE_NOT_FOUND,
+							variable.name,
+						),
+					)
+				}
+			}
+			const [membershipErrors, parsedVariables] = this.readMembershipVariables(roleVariables, membership, identity)
+			errors.push(...membershipErrors)
+			parsed.push({
+				role: membership.role,
+				variables: parsedVariables,
+			})
+		}
+		return new MembershipReadResult(errors, parsed)
+	}
+
+	private readMembershipVariables(roleVariables: Acl.Variables, membership: Acl.Membership, identity: {
+		identityId: string
+		personId?: string
+	}): [MembershipValidationError[], ParsedMembershipVariable[]] {
+		const errors: MembershipValidationError[] = []
+		const parsedVariables: ParsedMembershipVariable[] = []
+		for (const [name, variable] of Object.entries(roleVariables)) {
+			const inputVariable = membership.variables.find(it => it.name === name)
+			if (variable.type === Acl.VariableType.predefined) {
+				switch (variable.value) {
+					case 'identityID':
+						parsedVariables.push({ name, condition: { in: [identity.identityId] } })
+						break
+					case 'personID':
+						parsedVariables.push({
+							name,
+							condition: { in: identity.personId ? [identity.personId] : [] },
+						})
+						break
+					default:
+						parsedVariables.push({ name, condition: { never: true } })
+						errors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_INVALID, name))
+						break
+				}
+				continue
+			}
+
+			if (!inputVariable) {
+				errors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_EMPTY, name))
+				parsedVariables.push({ name, condition: { never: true } })
+				continue
+			}
+
+			if (variable.type === Acl.VariableType.entity) {
+				parsedVariables.push({ name, condition: { in: inputVariable.values } }) // todo: cast to int where primary is int
+
+			} else if (variable.type === Acl.VariableType.condition) {
+				try {
+					const conditions = inputVariable.values.map(it => conditionSchema()(JSON.parse(it)))
+					parsedVariables.push({
+						name,
+						condition: conditions.length === 1 ? conditions[0] : { or: conditions },
+					})
+				} catch {
+					errors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_INVALID, name))
+					parsedVariables.push({ name, condition: { never: true } })
+				}
+			}
+		}
+		return [errors, parsedVariables]
+	}
+}
+
+export class MembershipReadResult {
+	constructor(
+		public readonly errors: MembershipValidationError[],
+		public readonly memberships: ParsedMembership[],
+	) {
+	}
+}
+
+export class MembershipValidationError {
+	constructor(
+		public readonly role: string,
+		public readonly error: MembershipValidationErrorType,
+		public readonly variable?: string,
+	) {
+	}
+}
+
+export enum MembershipValidationErrorType {
+	ROLE_NOT_FOUND = 'roleNotFound',
+	VARIABLE_NOT_FOUND = 'variableNotFound',
+	VARIABLE_EMPTY = 'variableEmpty',
+	VARIABLE_INVALID = 'variableInvalid',
+}
+
+
+export interface ParsedMembershipVariable {
+	readonly name: string
+	readonly condition: Input.Condition
+}
+
+export interface ParsedMembership {
+	readonly role: string
+	readonly variables: readonly ParsedMembershipVariable[]
+}