@flusys/nestjs-shared 9.1.0 → 9.1.2

package/fesm/utils/index.js

@@ -276,7 +276,6 @@ const FLOW_DEFINITION_PERMISSIONS = {
     UPDATE: 'entity_builder.flow_definition.update',
     DELETE: 'entity_builder.flow_definition.delete',
     TEST: 'entity_builder.flow_definition.test',
-    /** Needed to save a flow that runs as the system (bypassing per-entity permissions). */ SYSTEM: 'entity_builder.flow_definition.system',
     /** Needed to save a flow containing a code node (sandboxed JavaScript). */ CODE: 'entity_builder.flow_definition.code'
 };
 const ENTITY_BUILDER_DYNAMIC_PREFIX = 'entity_builder.entity';
@@ -443,6 +442,53 @@ __webpack_require__.d(__webpack_exports__, {
 });
 
 
+},
+374(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(157);
+/* import */ var _constants_message_keys_js__rspack_import_1 = __webpack_require__(389);
+
+
+class PermissionSystemUnavailableException extends _nestjs_common__rspack_import_0.InternalServerErrorException {
+    constructor(){
+        super({
+            success: false,
+            message: 'Permission system temporarily unavailable',
+            messageKey: _constants_message_keys_js__rspack_import_1/* .ERROR_MESSAGES.PERMISSION_SYSTEM_UNAVAILABLE */.UU.PERMISSION_SYSTEM_UNAVAILABLE
+        });
+    }
+}
+class InsufficientPermissionsException extends _nestjs_common__rspack_import_0.ForbiddenException {
+    constructor(missingPermissions, operator = 'AND'){
+        const messageKey = operator === 'OR' ? _constants_message_keys_js__rspack_import_1/* .ERROR_MESSAGES.INSUFFICIENT_PERMISSIONS_OR */.UU.INSUFFICIENT_PERMISSIONS_OR : _constants_message_keys_js__rspack_import_1/* .ERROR_MESSAGES.INSUFFICIENT_PERMISSIONS */.UU.INSUFFICIENT_PERMISSIONS;
+        super({
+            success: false,
+            message: 'Insufficient permissions',
+            messageKey,
+            messageVariables: {
+                permissions: missingPermissions.join(', ')
+            },
+            missingPermissions,
+            operator
+        });
+    }
+}
+class NoPermissionsFoundException extends _nestjs_common__rspack_import_0.ForbiddenException {
+    constructor(){
+        super({
+            success: false,
+            message: 'No permissions found',
+            messageKey: _constants_message_keys_js__rspack_import_1/* .ERROR_MESSAGES.NO_PERMISSIONS_FOUND */.UU.NO_PERMISSIONS_FOUND
+        });
+    }
+}
+
+__webpack_require__.d(__webpack_exports__, {
+  GS: () => (PermissionSystemUnavailableException),
+  d$: () => (NoPermissionsFoundException),
+  z8: () => (InsufficientPermissionsException)
+});
+
+
 },
 154(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 /**
@@ -559,538 +605,6 @@ __webpack_require__.d(__webpack_exports__, {
 });
 
 
-},
-528(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-
-// EXPORTS
-__webpack_require__.d(__webpack_exports__, {
-  s8: () => (/* reexport */ permission_cache_key_util/* .DEFAULT_COMPANY_PERMISSION_KEY_FORMAT */.s8),
-  q6: () => (/* reexport */ permission_cache_key_util/* .DEFAULT_USER_PERMISSION_KEY_FORMAT */.q6),
-  wf: () => (/* reexport */ applyCompanyFilter),
-  kQ: () => (/* reexport */ buildCompanyWhereCondition),
-  fJ: () => (/* reexport */ buildCookieOptions),
-  oV: () => (/* reexport */ buildFrontendUrl),
-  nt: () => (/* reexport */ permission_cache_key_util/* .buildPermissionCacheKey */.nt),
-  qW: () => (/* reexport */ cache_tenant_util/* .cacheTenantId */.q),
-  ZD: () => (/* reexport */ escapeHtml),
-  qo: () => (/* reexport */ escapeHtmlVariables),
-  hX: () => (/* reexport */ extractFrontendUrl),
-  Sd: () => (/* reexport */ formatInTimezone),
-  sN: () => (/* reexport */ generateSecureToken),
-  z9: () => (/* reexport */ generateSlug),
-  oo: () => (/* reexport */ generateUniqueSlug),
-  oB: () => (/* reexport */ getTodayInTimezone),
-  f: () => (/* reexport */ hasCompanyId),
-  QK: () => (/* reexport */ hashToken),
-  wh: () => (/* reexport */ isBrowserRequest),
-  _d: () => (/* reexport */ isExpired),
-  _c: () => (/* reexport */ event_pattern_util/* .isMultiWildcard */._c),
-  lk: () => (/* reexport */ optional_module_util/* .loadOptionalModule */.l),
-  vf: () => (/* reexport */ localToUtc),
-  qe: () => (/* reexport */ event_pattern_util/* .matchEventPattern */.qe),
-  xY: () => (/* reexport */ permission_match_util/* .matchesPermission */.x),
-  RG: () => (/* reexport */ messageRef),
-  Ju: () => (/* reexport */ parseDurationToMs),
-  IN: () => (/* reexport */ event_pattern_util/* .sanitizeEventPayload */.IN),
-  v4: () => (/* reexport */ utcToLocal),
-  bE: () => (/* reexport */ validateCompanyOwnership),
-  o0: () => (/* reexport */ withSavepoint)
-});
-
-// EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/cache-tenant.util.ts
-var cache_tenant_util = __webpack_require__(154);
-;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/date-time.util.ts
-function getOffsetMinutes(utcDate, timezone) {
-    const extract = (tz)=>{
-        const parts = new Intl.DateTimeFormat('en-US', {
-            timeZone: tz,
-            year: 'numeric',
-            month: '2-digit',
-            day: '2-digit',
-            hour: '2-digit',
-            minute: '2-digit',
-            second: '2-digit',
-            hour12: false
-        }).formatToParts(utcDate);
-        const p = Object.fromEntries(parts.filter((x)=>x.type !== 'literal').map((x)=>[
-                x.type,
-                parseInt(x.value)
-            ]));
-        return Date.UTC(p['year'], p['month'] - 1, p['day'], p['hour'], p['minute'], p['second']);
-    };
-    return (extract(timezone) - extract('UTC')) / 60_000;
-}
-function localToUtc(dateStr, timeStr, timezone) {
-    const [year, month, day] = dateStr.split('-').map(Number);
-    const [hours, minutes] = timeStr.split(':').map(Number);
-    const approx = new Date(Date.UTC(year, month - 1, day, hours, minutes, 0));
-    const offset = getOffsetMinutes(approx, timezone);
-    const utcDate = new Date(approx.getTime() - offset * 60_000);
-    // DST boundary guard: re-check offset after adjustment
-    const finalOffset = getOffsetMinutes(utcDate, timezone);
-    return finalOffset !== offset ? new Date(approx.getTime() - finalOffset * 60_000) : utcDate;
-}
-function utcToLocal(utcDate, timezone) {
-    const d = typeof utcDate === 'string' ? new Date(utcDate) : utcDate;
-    const parts = new Intl.DateTimeFormat('en-CA', {
-        timeZone: timezone,
-        year: 'numeric',
-        month: '2-digit',
-        day: '2-digit',
-        hour: '2-digit',
-        minute: '2-digit',
-        hour12: false
-    }).formatToParts(d);
-    const p = Object.fromEntries(parts.filter((x)=>x.type !== 'literal').map((x)=>[
-            x.type,
-            x.value
-        ]));
-    // en-CA formats midnight hour as '24' — normalize to '00'
-    const hour = p['hour'] === '24' ? '00' : p['hour'];
-    return {
-        date: `${p['year']}-${p['month']}-${p['day']}`,
-        time: `${hour}:${p['minute']}`,
-        display: new Intl.DateTimeFormat('en-US', {
-            timeZone: timezone,
-            dateStyle: 'medium',
-            timeStyle: 'short'
-        }).format(d)
-    };
-}
-function formatInTimezone(utcDate, timezone, options = {
-    dateStyle: 'medium',
-    timeStyle: 'short'
-}) {
-    const d = typeof utcDate === 'string' ? new Date(utcDate) : utcDate;
-    return new Intl.DateTimeFormat('en-US', {
-        ...options,
-        timeZone: timezone
-    }).format(d);
-}
-function getTodayInTimezone(timezone) {
-    return utcToLocal(new Date(), timezone).date;
-}
-
-// EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/event-pattern.util.ts
-var event_pattern_util = __webpack_require__(456);
-;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/html-sanitizer.util.ts
-/**
- * HTML Sanitizer Utilities
- *
- * Provides functions for escaping HTML content to prevent XSS attacks.
- * Use these utilities when interpolating user-provided variables into HTML content.
- */ /**
- * HTML entity mapping for escaping special characters
- */ const HTML_ESCAPE_MAP = {
-    '&': '&',
-    '<': '&lt;',
-    '>': '&gt;',
-    '"': '&quot;',
-    "'": '&#x27;',
-    '/': '&#x2F;',
-    '`': '&#x60;',
-    '=': '&#x3D;'
-};
-/**
- * Regex pattern matching characters that need HTML escaping
- */ const HTML_ESCAPE_REGEX = /[&<>"'`=/]/g;
-/**
- * Escapes HTML special characters to prevent XSS attacks.
- *
- * @param str - The string to escape
- * @returns The escaped string safe for HTML insertion
- *
- * @example
- * ```typescript
- * escapeHtml('<script>alert("xss")</script>')
- * // Returns: '&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt;'
- * ```
- */ function escapeHtml(str) {
-    if (!str || typeof str !== 'string') {
-        return str ?? '';
-    }
-    return str.replace(HTML_ESCAPE_REGEX, (char)=>HTML_ESCAPE_MAP[char]);
-}
-/**
- * Escapes all string values in a variables object for safe HTML interpolation.
- * Non-string values are converted to strings and escaped.
- *
- * @param variables - Object containing template variables
- * @returns New object with all string values HTML-escaped
- *
- * @example
- * ```typescript
- * escapeHtmlVariables({ name: '<script>xss</script>', count: 5 })
- * // Returns: { name: '&lt;script&gt;xss&lt;/script&gt;', count: '5' }
- * ```
- */ function escapeHtmlVariables(variables) {
-    if (!variables || typeof variables !== 'object') {
-        return {};
-    }
-    const escaped = {};
-    for (const [key, value] of Object.entries(variables)){
-        if (value === null || value === undefined) {
-            escaped[key] = '';
-        } else if (typeof value === 'string') {
-            escaped[key] = escapeHtml(value);
-        } else if (typeof value === 'object') {
-            // For objects/arrays, stringify and escape
-            escaped[key] = escapeHtml(JSON.stringify(value));
-        } else {
-            // For numbers, booleans, etc., convert to string (no escaping needed)
-            escaped[key] = String(value);
-        }
-    }
-    return escaped;
-}
-
-;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/message-ref.util.ts
-function messageRef(messageKey, messageVariables) {
-    return messageVariables ? {
-        messageKey,
-        messageVariables
-    } : {
-        messageKey
-    };
-}
-
-// EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/optional-module.util.ts
-var optional_module_util = __webpack_require__(368);
-// EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/permission-cache-key.util.ts
-var permission_cache_key_util = __webpack_require__(199);
-// EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/permission-match.util.ts
-var permission_match_util = __webpack_require__(788);
-// EXTERNAL MODULE: external "@nestjs/common"
-var common_ = __webpack_require__(157);
-// EXTERNAL MODULE: ./projects/nestjs-shared/src/constants/index.ts
-var constants = __webpack_require__(43);
-;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/query-helpers.util.ts
-
-
-/**
- * Apply company filter to a query builder if company feature is enabled.
- * Centralizes the common pattern of filtering by user's company.
- *
- * @param query - TypeORM SelectQueryBuilder
- * @param config - Company filter configuration
- * @param user - Current logged user (may be null)
- * @returns The modified query builder
- *
- * @example
- * ```typescript
- * applyCompanyFilter(query, {
- *   isCompanyFeatureEnabled: this.config.isCompanyFeatureEnabled(),
- *   entityAlias: 'file_manager',
- * }, user);
- * ```
- */ function applyCompanyFilter(query, config, user) {
-    const columnName = config.columnName ?? 'companyId';
-    if (config.isCompanyFeatureEnabled && user?.companyId) {
-        query.andWhere(`${config.entityAlias}.${columnName} = :companyId`, {
-            companyId: user.companyId
-        });
-    }
-    return query;
-}
-/**
- * Build a where condition object with optional company filter.
- *
- * @param baseWhere - Base where condition object
- * @param isCompanyFeatureEnabled - Whether company feature is enabled
- * @param user - Current logged user
- * @returns Where condition with companyId added if applicable
- *
- * @example
- * ```typescript
- * const where = buildCompanyWhereCondition(
- *   { id: dto.id },
- *   this.config.isCompanyFeatureEnabled(),
- *   user
- * );
- * // Returns { id: dto.id, companyId: user.companyId } if company feature enabled
- * ```
- */ function buildCompanyWhereCondition(baseWhere, isCompanyFeatureEnabled, user) {
-    if (isCompanyFeatureEnabled && user?.companyId) {
-        return {
-            ...baseWhere,
-            companyId: user.companyId
-        };
-    }
-    return baseWhere;
-}
-/**
- * Type guard to check if entity has companyId property
- */ function hasCompanyId(entity) {
-    return entity !== null && typeof entity === 'object' && 'companyId' in entity;
-}
-/**
- * Validates that an entity with companyId belongs to the user's company.
- * Throws BadRequestException if the entity belongs to another company.
- *
- * @param entity - Entity to validate
- * @param user - Current logged user
- * @param isCompanyFeatureEnabled - Whether company feature is enabled
- * @param entityName - Name of entity for error message (e.g., 'Email configuration')
- * @throws BadRequestException if entity belongs to another company
- *
- * @example
- * ```typescript
- * validateCompanyOwnership(config, user, this.config.isCompanyFeatureEnabled(), 'Email configuration');
- * ```
- */ function validateCompanyOwnership(entity, user, isCompanyFeatureEnabled, entityName) {
-    if (isCompanyFeatureEnabled && user?.companyId && hasCompanyId(entity)) {
-        if (entity.companyId && entity.companyId !== user.companyId) {
-            throw new common_.BadRequestException({
-                message: `${entityName} belongs to another company`,
-                messageKey: constants/* .AUTH_MESSAGES.ENTITY_BELOG_ANOTHER_COMPANY */.mK.ENTITY_BELOG_ANOTHER_COMPANY,
-                messageVariables: {
-                    entity: entityName
-                }
-            });
-        }
-    }
-}
-/**
- * Runs `fn` inside a savepoint of an already-open transaction. A failure rolls back only what
- * `fn` did, so the caller can swallow the error and keep using the transaction - without it,
- * PostgreSQL aborts the whole transaction after any failed statement.
- */ async function withSavepoint(queryRunner, fn) {
-    await queryRunner.startTransaction();
-    try {
-        const result = await fn();
-        await queryRunner.commitTransaction();
-        return result;
-    } catch (error) {
-        await queryRunner.rollbackTransaction();
-        throw error;
-    }
-}
-
-// EXTERNAL MODULE: external "@flusys/nestjs-core/config"
-var config_ = __webpack_require__(307);
-;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/request.util.ts
-
-
-
-/** Time unit multipliers in milliseconds */ const TIME_UNIT_MS = {
-    s: 1000,
-    m: 60 * 1000,
-    h: 60 * 60 * 1000,
-    d: 24 * 60 * 60 * 1000,
-    w: 7 * 24 * 60 * 60 * 1000
-};
-/** Get normalized client type from request header */ function getClientType(req) {
-    const clientType = req.headers[constants/* .CLIENT_TYPE_HEADER */.xw];
-    return clientType ? clientType.toLowerCase() : null;
-}
-/**
- * Detect if request is from a browser client.
- * Uses x-client-type header first, then falls back to user-agent detection.
- */ function isBrowserRequest(req) {
-    const clientType = getClientType(req);
-    if (clientType) {
-        return clientType === 'browser' || clientType === 'web';
-    }
-    const accept = req.headers['accept'] || '';
-    if (accept.includes('text/html')) return true;
-    const userAgent = req.headers['user-agent'] || '';
-    const browserPatterns = /mozilla|chrome|safari|firefox|edge|opera|msie/i;
-    return browserPatterns.test(userAgent) && !userAgent.includes('Postman');
-}
-/**
- * Build secure cookie options based on request context.
- * Handles HTTPS detection for TLS-terminating proxies.
- */ function buildCookieOptions(req) {
-    const hostname = req.hostname || '';
-    const origin = req.headers.origin || '';
-    const isProduction = config_.envConfig.isProduction();
-    const forwardedProto = req.headers['x-forwarded-proto'];
-    const isHttps = isProduction || forwardedProto === 'https' || origin.startsWith('https://') || req.secure;
-    let domain;
-    const domainParts = hostname.split('.');
-    if (domainParts.length > 2 && !hostname.includes('localhost')) {
-        domain = '.' + domainParts.slice(-2).join('.');
-    }
-    return {
-        secure: isHttps,
-        sameSite: isHttps ? 'strict' : 'lax',
-        ...domain && {
-            domain
-        }
-    };
-}
-/**
- * Parse duration string to milliseconds.
- * @example '7d' → 604800000, '24h' → 86400000, '30m' → 1800000
- */ function parseDurationToMs(duration, defaultMs = TIME_UNIT_MS.w) {
-    const match = duration.match(/^(\d+)(s|m|h|d|w)$/);
-    if (!match) return defaultMs;
-    const value = parseInt(match[1], 10);
-    const unit = match[2];
-    return value * (TIME_UNIT_MS[unit] ?? TIME_UNIT_MS.d);
-}
-/**
- * Determine the frontend base URL for auth-related links.
- * Matches the request's Origin/Referer against configured allowed origins.
- * Never trusts the request's Host header - it is client-controlled and would
- * let an attacker redirect password-reset/verification links to their own domain.
- */ function extractFrontendUrl(req) {
-    const allowedOrigins = config_.envConfig.getOrigins();
-    const origin = (req.get('origin') ?? req.get('referer') ?? '').trim();
-    if (origin && allowedOrigins.length) {
-        const matched = allowedOrigins.find((u)=>origin.startsWith(u));
-        if (matched) {
-            return matched;
-        }
-    }
-    if (allowedOrigins.length) {
-        return allowedOrigins[0];
-    }
-    throw new common_.BadRequestException({
-        message: 'Unable to determine frontend URL from request',
-        messageKey: constants/* .ERROR_MESSAGES.VALIDATION */.UU.VALIDATION
-    });
-}
-function buildFrontendUrl(req, path) {
-    const baseUrl = extractFrontendUrl(req);
-    return `${baseUrl}${path}`;
-}
-
-;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/string.util.ts
-/**
- * String utility functions
- */ /**
- * Generate URL-friendly slug from a string
- * @param text - The text to convert to slug
- * @param maxLength - Maximum length of the slug (default: 100)
- * @returns URL-friendly slug
- *
- * @example
- * generateSlug('My Company Name') // 'my-company-name'
- * generateSlug('Hello World!') // 'hello-world'
- */ function generateSlug(text, maxLength = 100) {
-    return text.toLowerCase().trim().replace(/[^a-z0-9\s-]/g, '') // Remove special characters
-    .replace(/\s+/g, '-') // Replace spaces with hyphens
-    .replace(/-+/g, '-') // Replace multiple hyphens with single
-    .replace(/^-+|-+$/g, '') // Remove leading/trailing hyphens
-    .substring(0, maxLength);
-}
-/**
- * Generate unique slug using single database query (optimized for large datasets)
- * Appends numeric suffix if collision exists (e.g., 'my-company-1', 'my-company-2')
- *
- * Performance: O(1) database query regardless of collision count
- * - Works efficiently with millions of records
- * - Requires index on slug column for best performance
- *
- * @param text - The text to convert to slug
- * @param findMatchingSlugs - Async function that returns all slugs matching base pattern
- *                            Should query: WHERE slug = baseSlug OR slug LIKE 'baseSlug-%'
- * @param maxLength - Maximum length of the base slug (default: 100)
- * @returns Unique URL-friendly slug
- *
- * @example
- * const slug = await generateUniqueSlug('My Company', async (baseSlug) => {
- *   return repo
- *     .createQueryBuilder('c')
- *     .select('c.slug')
- *     .where('c.slug = :base OR c.slug LIKE :pattern', {
- *       base: baseSlug,
- *       pattern: `${baseSlug}-%`,
- *     })
- *     .getMany()
- *     .then(rows => rows.map(r => r.slug));
- * });
- */ async function generateUniqueSlug(text, findMatchingSlugs, maxLength = 100) {
-    const baseSlug = generateSlug(text, maxLength);
-    // Single query to get all matching slugs
-    const existingSlugs = await findMatchingSlugs(baseSlug);
-    // No collisions - base slug is available
-    if (existingSlugs.length === 0) {
-        return baseSlug;
-    }
-    // Build set for O(1) lookup
-    const existingSet = new Set(existingSlugs);
-    // Base slug not taken (only suffixed versions exist)
-    if (!existingSet.has(baseSlug)) {
-        return baseSlug;
-    }
-    // Find next available suffix in memory (fast)
-    let counter = 1;
-    while(counter < 10000){
-        const slugWithSuffix = `${baseSlug}-${counter}`;
-        if (!existingSet.has(slugWithSuffix)) {
-            return slugWithSuffix;
-        }
-        counter++;
-    }
-    // Fallback: append random string (extremely rare edge case)
-    const randomSuffix = Math.random().toString(36).substring(2, 8);
-    return `${baseSlug}-${randomSuffix}`;
-}
-
-// EXTERNAL MODULE: external "crypto"
-var external_crypto_ = __webpack_require__(823);
-;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/token.util.ts
-
-/** 32 random bytes as hex, suitable for a password-reset/OTP/access-style token */ function generateSecureToken() {
-    return external_crypto_.randomBytes(32).toString('hex');
-}
-/** SHA-256 hash of a token, for storing/comparing tokens without keeping the raw value */ function hashToken(value) {
-    return external_crypto_.createHash('sha256').update(value).digest('hex');
-}
-function isExpired(expiresAt) {
-    return expiresAt < new Date();
-}
-
-;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/index.ts
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-},
-368(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/**
- * Loads an optional peer dependency at runtime.
- *
- * The specifier has to stay invisible to the bundler. A plain `import(name)`
- * looks dynamic in source but webpack rewrites it into a context module rooted
- * at this directory - one that can only ever resolve files sitting next to this
- * one - so `amqplib` and `kafkajs` fail to load in the bundled app no matter how
- * correctly they are installed. Both lookups below are assembled at runtime,
- * where no bundler can rewrite them.
- *
- * `require` is used first because it is what the CommonJS builds actually run
- * on; native ESM has no `require`, and there `import()` is the only way in.
- */ async function loadOptionalModule(name) {
-    const runtimeRequire = resolveRuntimeRequire();
-    if (runtimeRequire) return runtimeRequire(name);
-    const runtimeImport = new Function('specifier', 'return import(specifier);');
-    return runtimeImport(name);
-}
-/** Undefined under native ESM and inside a bundle that shadows nothing back */ function resolveRuntimeRequire() {
-    try {
-        return eval('typeof require === "function" ? require : undefined');
-    } catch  {
-        return undefined;
-    }
-}
-
-__webpack_require__.d(__webpack_exports__, {
-  l: () => (loadOptionalModule)
-});
-
-
 },
 199(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 /* import */ var _constants_index_js__rspack_import_0 = __webpack_require__(43);
@@ -1115,6 +629,8 @@ __webpack_require__.d(__webpack_exports__, {
 
 },
 788(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _exceptions_permission_exception_js__rspack_import_0 = __webpack_require__(374);
+
 /** Whether `granted` covers `required`, honoring `*` (everything) and `prefix.*` (everything under prefix) wildcards */ function matchesPermission(granted, required) {
     if (granted.includes(required)) return true;
     for (const permission of granted){
@@ -1123,9 +639,73 @@ __webpack_require__.d(__webpack_exports__, {
     }
     return false;
 }
+/** Evaluates an AND / OR permission tree against `granted`; a group without children fails closed. */ function evaluatePermissionLogic(node, granted) {
+    if (node.type === 'action') {
+        const passed = matchesPermission(granted, node.actionId);
+        return {
+            passed,
+            missingPermissions: passed ? [] : [
+                node.actionId
+            ],
+            operator: 'AND'
+        };
+    }
+    const { operator, children } = node;
+    if (!children?.length) return {
+        passed: false,
+        missingPermissions: [],
+        operator
+    };
+    const results = children.map((child)=>evaluatePermissionLogic(child, granted));
+    const passed = operator === 'OR' ? results.some((r)=>r.passed) : results.every((r)=>r.passed);
+    return {
+        passed,
+        missingPermissions: passed ? [] : results.flatMap((r)=>r.missingPermissions),
+        operator
+    };
+}
+/** Every permission code a tree names, each once, in order. */ function permissionLogicCodes(node) {
+    if (node.type === 'action') return node.actionId ? [
+        node.actionId
+    ] : [];
+    return [
+        ...new Set((node.children ?? []).flatMap(permissionLogicCodes))
+    ];
+}
+/** Groups nested in a permission rule, the outer one included. */ const MAX_PERMISSION_LOGIC_DEPTH = 5;
+/** Permission codes one rule may name. */ const MAX_PERMISSION_LOGIC_CODES = 50;
+const MAX_PERMISSION_CODE_LENGTH = 255;
+/** What is wrong with a stored permission rule: `invalid` (its shape), `empty` (it names no permission), `too_many` codes, or null. */ function permissionLogicProblem(value) {
+    let codes = 0;
+    const walk = (node, depth)=>{
+        if (!node || typeof node !== 'object' || Array.isArray(node)) return false;
+        const n = node;
+        if (n['type'] === 'action') {
+            codes++;
+            return typeof n['actionId'] === 'string' && n['actionId'].trim() !== '' && n['actionId'].length <= MAX_PERMISSION_CODE_LENGTH;
+        }
+        if (n['type'] !== 'group' || n['operator'] !== 'AND' && n['operator'] !== 'OR' || !Array.isArray(n['children'])) return false;
+        if (depth >= MAX_PERMISSION_LOGIC_DEPTH || !n['children'].length) return false;
+        return n['children'].every((child)=>walk(child, depth + 1));
+    };
+    if (!value || typeof value !== 'object') return 'invalid';
+    const node = value;
+    if (node['type'] === 'group' && (node['operator'] === 'AND' || node['operator'] === 'OR') && Array.isArray(node['children']) && !node['children'].length) return 'empty';
+    if (!walk(value, 0)) return 'invalid';
+    return codes > MAX_PERMISSION_LOGIC_CODES ? 'too_many' : null;
+}
+/** A user's codes in `scope`, from the resolver or else the cache; with neither, fails closed with PermissionSystemUnavailableException. */ async function loadPermissionCodes(scope, sources) {
+    if (sources.resolver) return sources.resolver.getPermissionCodes(scope);
+    if (sources.cache?.isCacheConfigured()) return sources.cache.getPermissions(scope);
+    throw new _exceptions_permission_exception_js__rspack_import_0/* .PermissionSystemUnavailableException */.GS();
+}
 
 __webpack_require__.d(__webpack_exports__, {
-  x: () => (matchesPermission)
+  CQ: () => (loadPermissionCodes),
+  HU: () => (permissionLogicProblem),
+  MO: () => (permissionLogicCodes),
+  Ng: () => (evaluatePermissionLogic),
+  xY: () => (matchesPermission)
 });
 
 
@@ -1152,37 +732,64 @@ module.exports = __rspack_external_crypto;
 };
 import { __webpack_require__ } from '../runtime.js';
 var __webpack_exec__ = function(moduleId) { return __webpack_require__(__webpack_require__.s = moduleId); }
-import * as __rspack_chunk_1 from './index.js';
+import * as __rspack_chunk_1 from '../282.js';
 __webpack_require__.C(__rspack_chunk_1);
-var __webpack_exports__ = __webpack_exec__(528);var __webpack_exports__DEFAULT_COMPANY_PERMISSION_KEY_FORMAT = __webpack_exports__.s8;
+import * as __rspack_chunk_2 from './index.js';
+__webpack_require__.C(__rspack_chunk_2);
+var __webpack_exports__ = __webpack_exec__(129);var __webpack_exports__DEFAULT_COMPANY_PERMISSION_KEY_FORMAT = __webpack_exports__.s8;
 var __webpack_exports__DEFAULT_USER_PERMISSION_KEY_FORMAT = __webpack_exports__.q6;
+var __webpack_exports__EXPRESSION_FUNCTIONS = __webpack_exports__.Dd;
+var __webpack_exports__EXPRESSION_LIMITS = __webpack_exports__.wj;
+var __webpack_exports__ExpressionError = __webpack_exports__.tj;
+var __webpack_exports__MAX_PERMISSION_LOGIC_CODES = __webpack_exports__.Df;
+var __webpack_exports__MAX_PERMISSION_LOGIC_DEPTH = __webpack_exports__.kW;
+var __webpack_exports__SAFE_REGEX_LIMITS = __webpack_exports__.ZA;
+var __webpack_exports__applyBranchFilter = __webpack_exports__.f7;
 var __webpack_exports__applyCompanyFilter = __webpack_exports__.wf;
+var __webpack_exports__assertValidConditionGroup = __webpack_exports__.P;
+var __webpack_exports__assertValidExpression = __webpack_exports__.bh;
 var __webpack_exports__buildCompanyWhereCondition = __webpack_exports__.kQ;
 var __webpack_exports__buildCookieOptions = __webpack_exports__.fJ;
 var __webpack_exports__buildFrontendUrl = __webpack_exports__.oV;
 var __webpack_exports__buildPermissionCacheKey = __webpack_exports__.nt;
 var __webpack_exports__cacheTenantId = __webpack_exports__.qW;
+var __webpack_exports__collectBranchAncestorIds = __webpack_exports__.Sf;
+var __webpack_exports__collectBranchDescendantIds = __webpack_exports__.qY;
+var __webpack_exports__compileSafeRegex = __webpack_exports__.Yc;
 var __webpack_exports__escapeHtml = __webpack_exports__.ZD;
 var __webpack_exports__escapeHtmlVariables = __webpack_exports__.qo;
+var __webpack_exports__evaluateConditionGroup = __webpack_exports__.Sb;
+var __webpack_exports__evaluateExpression = __webpack_exports__.O4;
+var __webpack_exports__evaluatePermissionLogic = __webpack_exports__.Ng;
+var __webpack_exports__expressionToNumber = __webpack_exports__.HK;
+var __webpack_exports__expressionToText = __webpack_exports__.zj;
 var __webpack_exports__extractFrontendUrl = __webpack_exports__.hX;
 var __webpack_exports__formatInTimezone = __webpack_exports__.Sd;
 var __webpack_exports__generateSecureToken = __webpack_exports__.sN;
 var __webpack_exports__generateSlug = __webpack_exports__.z9;
 var __webpack_exports__generateUniqueSlug = __webpack_exports__.oo;
+var __webpack_exports__getBranchPath = __webpack_exports__.gN;
 var __webpack_exports__getTodayInTimezone = __webpack_exports__.oB;
 var __webpack_exports__hasCompanyId = __webpack_exports__.f;
 var __webpack_exports__hashToken = __webpack_exports__.QK;
+var __webpack_exports__isBranchWithin = __webpack_exports__.QU;
 var __webpack_exports__isBrowserRequest = __webpack_exports__.wh;
 var __webpack_exports__isExpired = __webpack_exports__._d;
+var __webpack_exports__isExpressionError = __webpack_exports__.tX;
 var __webpack_exports__isMultiWildcard = __webpack_exports__._c;
 var __webpack_exports__loadOptionalModule = __webpack_exports__.lk;
+var __webpack_exports__loadPermissionCodes = __webpack_exports__.CQ;
 var __webpack_exports__localToUtc = __webpack_exports__.vf;
 var __webpack_exports__matchEventPattern = __webpack_exports__.qe;
 var __webpack_exports__matchesPermission = __webpack_exports__.xY;
 var __webpack_exports__messageRef = __webpack_exports__.RG;
+var __webpack_exports__normalizeBranchIds = __webpack_exports__.Ty;
 var __webpack_exports__parseDurationToMs = __webpack_exports__.Ju;
+var __webpack_exports__permissionLogicCodes = __webpack_exports__.MO;
+var __webpack_exports__permissionLogicProblem = __webpack_exports__.HU;
+var __webpack_exports__safeRegexProblem = __webpack_exports__._X;
 var __webpack_exports__sanitizeEventPayload = __webpack_exports__.IN;
 var __webpack_exports__utcToLocal = __webpack_exports__.v4;
 var __webpack_exports__validateCompanyOwnership = __webpack_exports__.bE;
 var __webpack_exports__withSavepoint = __webpack_exports__.o0;
-export { __webpack_exports__DEFAULT_COMPANY_PERMISSION_KEY_FORMAT as DEFAULT_COMPANY_PERMISSION_KEY_FORMAT, __webpack_exports__DEFAULT_USER_PERMISSION_KEY_FORMAT as DEFAULT_USER_PERMISSION_KEY_FORMAT, __webpack_exports__applyCompanyFilter as applyCompanyFilter, __webpack_exports__buildCompanyWhereCondition as buildCompanyWhereCondition, __webpack_exports__buildCookieOptions as buildCookieOptions, __webpack_exports__buildFrontendUrl as buildFrontendUrl, __webpack_exports__buildPermissionCacheKey as buildPermissionCacheKey, __webpack_exports__cacheTenantId as cacheTenantId, __webpack_exports__escapeHtml as escapeHtml, __webpack_exports__escapeHtmlVariables as escapeHtmlVariables, __webpack_exports__extractFrontendUrl as extractFrontendUrl, __webpack_exports__formatInTimezone as formatInTimezone, __webpack_exports__generateSecureToken as generateSecureToken, __webpack_exports__generateSlug as generateSlug, __webpack_exports__generateUniqueSlug as generateUniqueSlug, __webpack_exports__getTodayInTimezone as getTodayInTimezone, __webpack_exports__hasCompanyId as hasCompanyId, __webpack_exports__hashToken as hashToken, __webpack_exports__isBrowserRequest as isBrowserRequest, __webpack_exports__isExpired as isExpired, __webpack_exports__isMultiWildcard as isMultiWildcard, __webpack_exports__loadOptionalModule as loadOptionalModule, __webpack_exports__localToUtc as localToUtc, __webpack_exports__matchEventPattern as matchEventPattern, __webpack_exports__matchesPermission as matchesPermission, __webpack_exports__messageRef as messageRef, __webpack_exports__parseDurationToMs as parseDurationToMs, __webpack_exports__sanitizeEventPayload as sanitizeEventPayload, __webpack_exports__utcToLocal as utcToLocal, __webpack_exports__validateCompanyOwnership as validateCompanyOwnership, __webpack_exports__withSavepoint as withSavepoint };
+export { __webpack_exports__DEFAULT_COMPANY_PERMISSION_KEY_FORMAT as DEFAULT_COMPANY_PERMISSION_KEY_FORMAT, __webpack_exports__DEFAULT_USER_PERMISSION_KEY_FORMAT as DEFAULT_USER_PERMISSION_KEY_FORMAT, __webpack_exports__EXPRESSION_FUNCTIONS as EXPRESSION_FUNCTIONS, __webpack_exports__EXPRESSION_LIMITS as EXPRESSION_LIMITS, __webpack_exports__ExpressionError as ExpressionError, __webpack_exports__MAX_PERMISSION_LOGIC_CODES as MAX_PERMISSION_LOGIC_CODES, __webpack_exports__MAX_PERMISSION_LOGIC_DEPTH as MAX_PERMISSION_LOGIC_DEPTH, __webpack_exports__SAFE_REGEX_LIMITS as SAFE_REGEX_LIMITS, __webpack_exports__applyBranchFilter as applyBranchFilter, __webpack_exports__applyCompanyFilter as applyCompanyFilter, __webpack_exports__assertValidConditionGroup as assertValidConditionGroup, __webpack_exports__assertValidExpression as assertValidExpression, __webpack_exports__buildCompanyWhereCondition as buildCompanyWhereCondition, __webpack_exports__buildCookieOptions as buildCookieOptions, __webpack_exports__buildFrontendUrl as buildFrontendUrl, __webpack_exports__buildPermissionCacheKey as buildPermissionCacheKey, __webpack_exports__cacheTenantId as cacheTenantId, __webpack_exports__collectBranchAncestorIds as collectBranchAncestorIds, __webpack_exports__collectBranchDescendantIds as collectBranchDescendantIds, __webpack_exports__compileSafeRegex as compileSafeRegex, __webpack_exports__escapeHtml as escapeHtml, __webpack_exports__escapeHtmlVariables as escapeHtmlVariables, __webpack_exports__evaluateConditionGroup as evaluateConditionGroup, __webpack_exports__evaluateExpression as evaluateExpression, __webpack_exports__evaluatePermissionLogic as evaluatePermissionLogic, __webpack_exports__expressionToNumber as expressionToNumber, __webpack_exports__expressionToText as expressionToText, __webpack_exports__extractFrontendUrl as extractFrontendUrl, __webpack_exports__formatInTimezone as formatInTimezone, __webpack_exports__generateSecureToken as generateSecureToken, __webpack_exports__generateSlug as generateSlug, __webpack_exports__generateUniqueSlug as generateUniqueSlug, __webpack_exports__getBranchPath as getBranchPath, __webpack_exports__getTodayInTimezone as getTodayInTimezone, __webpack_exports__hasCompanyId as hasCompanyId, __webpack_exports__hashToken as hashToken, __webpack_exports__isBranchWithin as isBranchWithin, __webpack_exports__isBrowserRequest as isBrowserRequest, __webpack_exports__isExpired as isExpired, __webpack_exports__isExpressionError as isExpressionError, __webpack_exports__isMultiWildcard as isMultiWildcard, __webpack_exports__loadOptionalModule as loadOptionalModule, __webpack_exports__loadPermissionCodes as loadPermissionCodes, __webpack_exports__localToUtc as localToUtc, __webpack_exports__matchEventPattern as matchEventPattern, __webpack_exports__matchesPermission as matchesPermission, __webpack_exports__messageRef as messageRef, __webpack_exports__normalizeBranchIds as normalizeBranchIds, __webpack_exports__parseDurationToMs as parseDurationToMs, __webpack_exports__permissionLogicCodes as permissionLogicCodes, __webpack_exports__permissionLogicProblem as permissionLogicProblem, __webpack_exports__safeRegexProblem as safeRegexProblem, __webpack_exports__sanitizeEventPayload as sanitizeEventPayload, __webpack_exports__utcToLocal as utcToLocal, __webpack_exports__validateCompanyOwnership as validateCompanyOwnership, __webpack_exports__withSavepoint as withSavepoint };