@headless-lms/core 0.3.0 → 0.5.0

package/dist/organizations/default-roles.js

@@ -0,0 +1,89 @@
+import { levelSchema } from "../types/schemas/organizations.js";
+import { ALL_PERMISSIONS, fitsLevels, isPermission, withImplied } from "./permissions.js";
+//#region src/organizations/default-roles.ts
+const OWNER_ROLE_KEY = "owner";
+const MEMBER_ROLE_KEY = "member";
+const ADMIN_PERMISSIONS = [...ALL_PERMISSIONS];
+const DEFAULT_ROLES = [
+	{
+		key: OWNER_ROLE_KEY,
+		name: "Owner",
+		description: "Owns the organization and holds every permission.",
+		levels: ["org"],
+		team: true,
+		permissions: [...ALL_PERMISSIONS]
+	},
+	{
+		key: "admin",
+		name: "Admin",
+		description: "Runs the organization: content, people, access, automations and settings.",
+		levels: ["org"],
+		team: true,
+		permissions: ADMIN_PERMISSIONS
+	},
+	{
+		key: "instructor",
+		name: "Instructor",
+		description: "Teaches courses: edits and publishes them, moderates lesson comments and sees learners.",
+		levels: ["org", "course"],
+		team: true,
+		permissions: [
+			"courses:read",
+			"courses:write",
+			"courses:moderate",
+			"progress:read",
+			"api_keys:read",
+			"api_keys:write",
+			"api_keys:delete"
+		]
+	},
+	{
+		key: "moderator",
+		name: "Moderator",
+		description: "Moderates communities: posts, comments, chats, reports and space members.",
+		levels: ["org", "community"],
+		team: true,
+		permissions: ["communities:moderate"]
+	},
+	{
+		key: MEMBER_ROLE_KEY,
+		name: "Member",
+		description: "Everyone who was not given another role.",
+		levels: ["org"],
+		team: false,
+		permissions: []
+	}
+];
+var RoleSetError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "RoleSetError";
+	}
+};
+function validateRoleSet(roles) {
+	const keys = /* @__PURE__ */ new Set();
+	for (const role of roles) {
+		if (keys.has(role.key)) throw new RoleSetError(`role key ${role.key} is repeated`);
+		keys.add(role.key);
+		if (role.levels.length === 0) throw new RoleSetError(`role ${role.key} has no level`);
+		for (const level of role.levels) if (!levelSchema.safeParse(level).success) throw new RoleSetError(`role ${role.key} names an unknown level ${String(level)}`);
+		for (const permission of role.permissions) {
+			if (!isPermission(permission)) throw new RoleSetError(`role ${role.key} names an unknown permission ${String(permission)}`);
+			if (!fitsLevels(permission, role.levels)) throw new RoleSetError(`role ${role.key} holds ${permission}, which doesn't fit its levels ${role.levels.join(", ")}`);
+		}
+	}
+	const owner = roles.find((role) => role.key === OWNER_ROLE_KEY);
+	const member = roles.find((role) => role.key === MEMBER_ROLE_KEY);
+	if (!owner) throw new RoleSetError(`the role set lacks ${OWNER_ROLE_KEY}`);
+	if (!member) throw new RoleSetError(`the role set lacks ${MEMBER_ROLE_KEY}`);
+	if (owner.levels.length !== 1 || owner.levels[0] !== "org") throw new RoleSetError(`${OWNER_ROLE_KEY} must list the org only`);
+	if (owner.permissions.length !== ALL_PERMISSIONS.length) throw new RoleSetError(`${OWNER_ROLE_KEY} must hold every permission`);
+	if (member.levels.length !== 1 || member.levels[0] !== "org" || member.permissions.length > 0) throw new RoleSetError(`${MEMBER_ROLE_KEY} must list the org only and hold nothing`);
+}
+function defaultHolders(permission) {
+	return DEFAULT_ROLES.filter((role) => withImplied(role.permissions).has(permission)).map((role) => role.name);
+}
+//#endregion
+export { DEFAULT_ROLES, MEMBER_ROLE_KEY, OWNER_ROLE_KEY, RoleSetError, defaultHolders, validateRoleSet };
+
+//# sourceMappingURL=default-roles.js.map

package/dist/organizations/default-roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-roles.js","names":[],"sources":["../../src/organizations/default-roles.ts"],"sourcesContent":["import { levelSchema } from '../types/schemas/organizations.js';\nimport type { Level, Permission } from '../types/index.js';\nimport { ALL_PERMISSIONS, fitsLevels, isPermission, withImplied } from './permissions.js';\n\nexport interface RoleDefinition {\n  key: string;\n  name: string;\n  description: string;\n  levels: Level[];\n  team: boolean;\n  permissions: Permission[];\n}\n\nexport const OWNER_ROLE_KEY = 'owner';\nexport const MEMBER_ROLE_KEY = 'member';\n\nconst ADMIN_PERMISSIONS: Permission[] = [...ALL_PERMISSIONS];\n\nexport const DEFAULT_ROLES: readonly RoleDefinition[] = [\n  {\n    key: OWNER_ROLE_KEY,\n    name: 'Owner',\n    description: 'Owns the organization and holds every permission.',\n    levels: ['org'],\n    team: true,\n    permissions: [...ALL_PERMISSIONS],\n  },\n  {\n    key: 'admin',\n    name: 'Admin',\n    description: 'Runs the organization: content, people, access, automations and settings.',\n    levels: ['org'],\n    team: true,\n    permissions: ADMIN_PERMISSIONS,\n  },\n  {\n    key: 'instructor',\n    name: 'Instructor',\n    description:\n      'Teaches courses: edits and publishes them, moderates lesson comments and sees learners.',\n    levels: ['org', 'course'],\n    team: true,\n    permissions: [\n      'courses:read',\n      'courses:write',\n      'courses:moderate',\n      'progress:read',\n      'api_keys:read',\n      'api_keys:write',\n      'api_keys:delete',\n    ],\n  },\n  {\n    key: 'moderator',\n    name: 'Moderator',\n    description: 'Moderates communities: posts, comments, chats, reports and space members.',\n    levels: ['org', 'community'],\n    team: true,\n    permissions: ['communities:moderate'],\n  },\n  {\n    key: MEMBER_ROLE_KEY,\n    name: 'Member',\n    description: 'Everyone who was not given another role.',\n    levels: ['org'],\n    team: false,\n    permissions: [],\n  },\n];\n\nexport class RoleSetError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'RoleSetError';\n  }\n}\n\nexport function validateRoleSet(roles: readonly RoleDefinition[]): void {\n  const keys = new Set<string>();\n  for (const role of roles) {\n    if (keys.has(role.key)) {\n      throw new RoleSetError(`role key ${role.key} is repeated`);\n    }\n    keys.add(role.key);\n    if (role.levels.length === 0) {\n      throw new RoleSetError(`role ${role.key} has no level`);\n    }\n    for (const level of role.levels) {\n      if (!levelSchema.safeParse(level).success) {\n        throw new RoleSetError(`role ${role.key} names an unknown level ${String(level)}`);\n      }\n    }\n    for (const permission of role.permissions) {\n      if (!isPermission(permission)) {\n        throw new RoleSetError(\n          `role ${role.key} names an unknown permission ${String(permission)}`,\n        );\n      }\n      if (!fitsLevels(permission, role.levels)) {\n        throw new RoleSetError(\n          `role ${role.key} holds ${permission}, which doesn't fit its levels ${role.levels.join(', ')}`,\n        );\n      }\n    }\n  }\n  const owner = roles.find((role) => role.key === OWNER_ROLE_KEY);\n  const member = roles.find((role) => role.key === MEMBER_ROLE_KEY);\n  if (!owner) {\n    throw new RoleSetError(`the role set lacks ${OWNER_ROLE_KEY}`);\n  }\n  if (!member) {\n    throw new RoleSetError(`the role set lacks ${MEMBER_ROLE_KEY}`);\n  }\n  if (owner.levels.length !== 1 || owner.levels[0] !== 'org') {\n    throw new RoleSetError(`${OWNER_ROLE_KEY} must list the org only`);\n  }\n  if (owner.permissions.length !== ALL_PERMISSIONS.length) {\n    throw new RoleSetError(`${OWNER_ROLE_KEY} must hold every permission`);\n  }\n  if (member.levels.length !== 1 || member.levels[0] !== 'org' || member.permissions.length > 0) {\n    throw new RoleSetError(`${MEMBER_ROLE_KEY} must list the org only and hold nothing`);\n  }\n}\n\nexport function defaultHolders(permission: Permission): string[] {\n  return DEFAULT_ROLES.filter((role) => withImplied(role.permissions).has(permission)).map(\n    (role) => role.name,\n  );\n}\n"],"mappings":";;;AAaA,MAAa,iBAAiB;AAC9B,MAAa,kBAAkB;AAE/B,MAAM,oBAAkC,CAAC,GAAG,eAAe;AAE3D,MAAa,gBAA2C;CACtD;EACE,KAAK;EACL,MAAM;EACN,aAAa;EACb,QAAQ,CAAC,KAAK;EACd,MAAM;EACN,aAAa,CAAC,GAAG,eAAe;CAClC;CACA;EACE,KAAK;EACL,MAAM;EACN,aAAa;EACb,QAAQ,CAAC,KAAK;EACd,MAAM;EACN,aAAa;CACf;CACA;EACE,KAAK;EACL,MAAM;EACN,aACE;EACF,QAAQ,CAAC,OAAO,QAAQ;EACxB,MAAM;EACN,aAAa;GACX;GACA;GACA;GACA;GACA;GACA;GACA;EACF;CACF;CACA;EACE,KAAK;EACL,MAAM;EACN,aAAa;EACb,QAAQ,CAAC,OAAO,WAAW;EAC3B,MAAM;EACN,aAAa,CAAC,sBAAsB;CACtC;CACA;EACE,KAAK;EACL,MAAM;EACN,aAAa;EACb,QAAQ,CAAC,KAAK;EACd,MAAM;EACN,aAAa,CAAC;CAChB;AACF;AAEA,IAAa,eAAb,cAAkC,MAAM;CACtC,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF;AAEA,SAAgB,gBAAgB,OAAwC;CACtE,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,QAAQ,OAAO;EACxB,IAAI,KAAK,IAAI,KAAK,GAAG,GACnB,MAAM,IAAI,aAAa,YAAY,KAAK,IAAI,aAAa;EAE3D,KAAK,IAAI,KAAK,GAAG;EACjB,IAAI,KAAK,OAAO,WAAW,GACzB,MAAM,IAAI,aAAa,QAAQ,KAAK,IAAI,cAAc;EAExD,KAAK,MAAM,SAAS,KAAK,QACvB,IAAI,CAAC,YAAY,UAAU,KAAK,CAAC,CAAC,SAChC,MAAM,IAAI,aAAa,QAAQ,KAAK,IAAI,0BAA0B,OAAO,KAAK,GAAG;EAGrF,KAAK,MAAM,cAAc,KAAK,aAAa;GACzC,IAAI,CAAC,aAAa,UAAU,GAC1B,MAAM,IAAI,aACR,QAAQ,KAAK,IAAI,+BAA+B,OAAO,UAAU,GACnE;GAEF,IAAI,CAAC,WAAW,YAAY,KAAK,MAAM,GACrC,MAAM,IAAI,aACR,QAAQ,KAAK,IAAI,SAAS,WAAW,iCAAiC,KAAK,OAAO,KAAK,IAAI,GAC7F;EAEJ;CACF;CACA,MAAM,QAAQ,MAAM,MAAM,SAAS,KAAK,QAAQ,cAAc;CAC9D,MAAM,SAAS,MAAM,MAAM,SAAS,KAAK,QAAQ,eAAe;CAChE,IAAI,CAAC,OACH,MAAM,IAAI,aAAa,sBAAsB,gBAAgB;CAE/D,IAAI,CAAC,QACH,MAAM,IAAI,aAAa,sBAAsB,iBAAiB;CAEhE,IAAI,MAAM,OAAO,WAAW,KAAK,MAAM,OAAO,OAAO,OACnD,MAAM,IAAI,aAAa,GAAG,eAAe,wBAAwB;CAEnE,IAAI,MAAM,YAAY,WAAW,gBAAgB,QAC/C,MAAM,IAAI,aAAa,GAAG,eAAe,4BAA4B;CAEvE,IAAI,OAAO,OAAO,WAAW,KAAK,OAAO,OAAO,OAAO,SAAS,OAAO,YAAY,SAAS,GAC1F,MAAM,IAAI,aAAa,GAAG,gBAAgB,yCAAyC;AAEvF;AAEA,SAAgB,eAAe,YAAkC;CAC/D,OAAO,cAAc,QAAQ,SAAS,YAAY,KAAK,WAAW,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,KAClF,SAAS,KAAK,IACjB;AACF"}

package/dist/organizations/effective-permissions.d.ts

@@ -0,0 +1,45 @@
+import { ContentType } from "../types/schemas/content.js";
+import { Permission } from "../types/schemas/organizations.js";
+import { ContentId } from "../types/organizations.js";
+import "../types/index.js";
+import { EffectivePermissions, RoleRef } from "../shared/actor.js";
+import { OrgRole } from "./org-roles.js";
+//#region src/organizations/effective-permissions.d.ts
+interface AssignmentRow {
+  roleKey: string;
+  contentId: ContentId | null;
+  contentType: ContentType | null;
+}
+interface ResolveInput {
+  assignments: readonly AssignmentRow[];
+  roles: ReadonlyMap<string, OrgRole>;
+  tokenScopes?: readonly Permission[];
+}
+interface ContentEntry {
+  permissions: Set<Permission>;
+  role: RoleRef;
+}
+declare class ResolvedPermissions implements EffectivePermissions {
+  private readonly org;
+  private readonly orgRole;
+  private readonly content;
+  private readonly owner;
+  constructor(org: Set<Permission>, orgRole: RoleRef, content: Map<ContentId, ContentEntry>, owner: boolean);
+  has(permission: Permission, on?: ContentId): boolean;
+  require(permission: Permission, on?: ContentId): void;
+  anywhere(permission: Permission): boolean;
+  where(permission: Permission): {
+    org: boolean;
+    content: ContentId[];
+  };
+  roleOn(on?: ContentId): RoleRef;
+  isOwner(): boolean;
+  orgPermissions(): Permission[];
+  contentPermissions(): Record<ContentId, Permission[]>;
+  teamOn(on?: ContentId): boolean;
+}
+declare function resolvePermissions({ assignments, roles, tokenScopes }: ResolveInput): ResolvedPermissions;
+declare function systemPermissions(): ResolvedPermissions;
+//#endregion
+export { AssignmentRow, ResolveInput, ResolvedPermissions, resolvePermissions, systemPermissions };
+//# sourceMappingURL=effective-permissions.d.ts.map

package/dist/organizations/effective-permissions.js

@@ -0,0 +1,113 @@
+import { ForbiddenError } from "../shared/errors.js";
+import { ALL_PERMISSIONS, permissionAbout, withImplied } from "./permissions.js";
+import { MEMBER_ROLE_KEY } from "./default-roles.js";
+//#region src/organizations/effective-permissions.ts
+const MEMBER_REF = {
+	key: MEMBER_ROLE_KEY,
+	name: "Member",
+	team: false
+};
+function refOf(role) {
+	return {
+		key: role.key,
+		name: role.name,
+		team: role.team
+	};
+}
+function intersect(set, scopes) {
+	if (!scopes) return set;
+	return new Set([...set].filter((permission) => scopes.has(permission)));
+}
+var ResolvedPermissions = class {
+	org;
+	orgRole;
+	content;
+	owner;
+	constructor(org, orgRole, content, owner) {
+		this.org = org;
+		this.orgRole = orgRole;
+		this.content = content;
+		this.owner = owner;
+	}
+	has(permission, on) {
+		if (this.org.has(permission)) return true;
+		return on !== void 0 && (this.content.get(on)?.permissions.has(permission) ?? false);
+	}
+	require(permission, on) {
+		if (!this.has(permission, on)) throw Object.assign(new ForbiddenError(`You need ${permission}`), {
+			permission,
+			...on !== void 0 && { contentId: on }
+		});
+	}
+	anywhere(permission) {
+		if (this.org.has(permission)) return true;
+		for (const entry of this.content.values()) if (entry.permissions.has(permission)) return true;
+		return false;
+	}
+	where(permission) {
+		if (this.org.has(permission)) return {
+			org: true,
+			content: []
+		};
+		const content = [];
+		for (const [id, entry] of this.content) if (entry.permissions.has(permission)) content.push(id);
+		return {
+			org: false,
+			content
+		};
+	}
+	roleOn(on) {
+		if (on !== void 0) {
+			const entry = this.content.get(on);
+			if (entry) return entry.role;
+		}
+		return this.orgRole;
+	}
+	isOwner() {
+		return this.owner;
+	}
+	orgPermissions() {
+		return ALL_PERMISSIONS.filter((permission) => this.org.has(permission));
+	}
+	contentPermissions() {
+		const out = {};
+		for (const [id, entry] of this.content) out[id] = ALL_PERMISSIONS.filter((permission) => entry.permissions.has(permission));
+		return out;
+	}
+	teamOn(on) {
+		if (on !== void 0 && this.content.get(on)?.role.team) return true;
+		return this.orgRole.team;
+	}
+};
+function resolvePermissions({ assignments, roles, tokenScopes }) {
+	const scopes = tokenScopes ? withImplied(tokenScopes) : null;
+	const orgRow = assignments.find((row) => row.contentId === null);
+	const listed = orgRow ? roles.get(orgRow.roleKey) : void 0;
+	const orgRole = listed?.levels.includes("org") ? listed : void 0;
+	const orgSet = orgRole ? withImplied(orgRole.permissions) : /* @__PURE__ */ new Set();
+	const content = /* @__PURE__ */ new Map();
+	for (const row of assignments) {
+		if (row.contentId === null || row.contentType === null) continue;
+		const role = roles.get(row.roleKey);
+		if (!role || !role.levels.includes(row.contentType)) continue;
+		const type = row.contentType;
+		const expanded = [...withImplied(role.permissions.filter((permission) => permissionAbout(permission) === type))].filter((permission) => permissionAbout(permission) === type);
+		content.set(row.contentId, {
+			permissions: intersect(new Set(expanded), scopes),
+			role: refOf(role)
+		});
+	}
+	const owner = orgRow?.roleKey === "owner" && orgRole !== void 0;
+	return new ResolvedPermissions(intersect(orgSet, scopes), orgRole ? refOf(orgRole) : roles.get("member") ? refOf(roles.get(MEMBER_ROLE_KEY)) : MEMBER_REF, content, owner && scopes === null);
+}
+function systemPermissions() {
+	return new ResolvedPermissions(new Set(ALL_PERMISSIONS), {
+		key: "system",
+		name: "System",
+		team: false
+	}, /* @__PURE__ */ new Map(), false);
+}
+//#endregion
+export { ResolvedPermissions, resolvePermissions, systemPermissions };
+
+//# sourceMappingURL=effective-permissions.js.map

package/dist/organizations/effective-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"effective-permissions.js","names":[],"sources":["../../src/organizations/effective-permissions.ts"],"sourcesContent":["import type { ContentId, ContentType, Permission } from '../types/index.js';\nimport type { EffectivePermissions, RoleRef } from '../shared/actor.js';\nimport { ForbiddenError } from '../shared/errors.js';\nimport { ALL_PERMISSIONS, permissionAbout, withImplied } from './permissions.js';\nimport { MEMBER_ROLE_KEY, OWNER_ROLE_KEY } from './default-roles.js';\nimport type { OrgRole } from './org-roles.js';\n\nexport interface AssignmentRow {\n  roleKey: string;\n  contentId: ContentId | null;\n  contentType: ContentType | null;\n}\n\nexport interface ResolveInput {\n  assignments: readonly AssignmentRow[];\n  roles: ReadonlyMap<string, OrgRole>;\n  tokenScopes?: readonly Permission[];\n}\n\ninterface ContentEntry {\n  permissions: Set<Permission>;\n  role: RoleRef;\n}\n\nconst MEMBER_REF: RoleRef = { key: MEMBER_ROLE_KEY, name: 'Member', team: false };\n\nfunction refOf(role: OrgRole): RoleRef {\n  return { key: role.key, name: role.name, team: role.team };\n}\n\nfunction intersect(set: Set<Permission>, scopes: Set<Permission> | null): Set<Permission> {\n  if (!scopes) {\n    return set;\n  }\n  return new Set([...set].filter((permission) => scopes.has(permission)));\n}\n\nexport class ResolvedPermissions implements EffectivePermissions {\n  constructor(\n    private readonly org: Set<Permission>,\n    private readonly orgRole: RoleRef,\n    private readonly content: Map<ContentId, ContentEntry>,\n    private readonly owner: boolean,\n  ) {}\n\n  has(permission: Permission, on?: ContentId): boolean {\n    if (this.org.has(permission)) {\n      return true;\n    }\n    return on !== undefined && (this.content.get(on)?.permissions.has(permission) ?? false);\n  }\n\n  require(permission: Permission, on?: ContentId): void {\n    if (!this.has(permission, on)) {\n      throw Object.assign(new ForbiddenError(`You need ${permission}`), {\n        permission,\n        ...(on !== undefined && { contentId: on }),\n      });\n    }\n  }\n\n  anywhere(permission: Permission): boolean {\n    if (this.org.has(permission)) {\n      return true;\n    }\n    for (const entry of this.content.values()) {\n      if (entry.permissions.has(permission)) {\n        return true;\n      }\n    }\n    return false;\n  }\n\n  where(permission: Permission): { org: boolean; content: ContentId[] } {\n    if (this.org.has(permission)) {\n      return { org: true, content: [] };\n    }\n    const content: ContentId[] = [];\n    for (const [id, entry] of this.content) {\n      if (entry.permissions.has(permission)) {\n        content.push(id);\n      }\n    }\n    return { org: false, content };\n  }\n\n  roleOn(on?: ContentId): RoleRef {\n    if (on !== undefined) {\n      const entry = this.content.get(on);\n      if (entry) {\n        return entry.role;\n      }\n    }\n    return this.orgRole;\n  }\n\n  isOwner(): boolean {\n    return this.owner;\n  }\n\n  orgPermissions(): Permission[] {\n    return ALL_PERMISSIONS.filter((permission) => this.org.has(permission));\n  }\n\n  contentPermissions(): Record<ContentId, Permission[]> {\n    const out: Record<ContentId, Permission[]> = {};\n    for (const [id, entry] of this.content) {\n      out[id] = ALL_PERMISSIONS.filter((permission) => entry.permissions.has(permission));\n    }\n    return out;\n  }\n\n  teamOn(on?: ContentId): boolean {\n    if (on !== undefined && this.content.get(on)?.role.team) {\n      return true;\n    }\n    return this.orgRole.team;\n  }\n}\n\nexport function resolvePermissions({\n  assignments,\n  roles,\n  tokenScopes,\n}: ResolveInput): ResolvedPermissions {\n  const scopes = tokenScopes ? withImplied(tokenScopes) : null;\n  const orgRow = assignments.find((row) => row.contentId === null);\n  const listed = orgRow ? roles.get(orgRow.roleKey) : undefined;\n  const orgRole = listed?.levels.includes('org') ? listed : undefined;\n  const orgSet = orgRole ? withImplied(orgRole.permissions) : new Set<Permission>();\n  const content = new Map<ContentId, ContentEntry>();\n  for (const row of assignments) {\n    if (row.contentId === null || row.contentType === null) {\n      continue;\n    }\n    const role = roles.get(row.roleKey);\n    if (!role || !role.levels.includes(row.contentType)) {\n      continue;\n    }\n    const type = row.contentType;\n    const own = role.permissions.filter((permission) => permissionAbout(permission) === type);\n    const expanded = [...withImplied(own)].filter(\n      (permission) => permissionAbout(permission) === type,\n    );\n    content.set(row.contentId, {\n      permissions: intersect(new Set(expanded), scopes),\n      role: refOf(role),\n    });\n  }\n  const owner = orgRow?.roleKey === OWNER_ROLE_KEY && orgRole !== undefined;\n  return new ResolvedPermissions(\n    intersect(orgSet, scopes),\n    orgRole\n      ? refOf(orgRole)\n      : roles.get(MEMBER_ROLE_KEY)\n        ? refOf(roles.get(MEMBER_ROLE_KEY)!)\n        : MEMBER_REF,\n    content,\n    owner && scopes === null,\n  );\n}\n\nexport function systemPermissions(): ResolvedPermissions {\n  return new ResolvedPermissions(\n    new Set(ALL_PERMISSIONS),\n    { key: 'system', name: 'System', team: false },\n    new Map(),\n    false,\n  );\n}\n"],"mappings":";;;;AAwBA,MAAM,aAAsB;CAAE,KAAK;CAAiB,MAAM;CAAU,MAAM;AAAM;AAEhF,SAAS,MAAM,MAAwB;CACrC,OAAO;EAAE,KAAK,KAAK;EAAK,MAAM,KAAK;EAAM,MAAM,KAAK;CAAK;AAC3D;AAEA,SAAS,UAAU,KAAsB,QAAiD;CACxF,IAAI,CAAC,QACH,OAAO;CAET,OAAO,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,QAAQ,eAAe,OAAO,IAAI,UAAU,CAAC,CAAC;AACxE;AAEA,IAAa,sBAAb,MAAiE;CAE5C;CACA;CACA;CACA;CAJnB,YACE,KACA,SACA,SACA,OACA;EAJiB,KAAA,MAAA;EACA,KAAA,UAAA;EACA,KAAA,UAAA;EACA,KAAA,QAAA;CAChB;CAEH,IAAI,YAAwB,IAAyB;EACnD,IAAI,KAAK,IAAI,IAAI,UAAU,GACzB,OAAO;EAET,OAAO,OAAO,KAAA,MAAc,KAAK,QAAQ,IAAI,EAAE,CAAC,EAAE,YAAY,IAAI,UAAU,KAAK;CACnF;CAEA,QAAQ,YAAwB,IAAsB;EACpD,IAAI,CAAC,KAAK,IAAI,YAAY,EAAE,GAC1B,MAAM,OAAO,OAAO,IAAI,eAAe,YAAY,YAAY,GAAG;GAChE;GACA,GAAI,OAAO,KAAA,KAAa,EAAE,WAAW,GAAG;EAC1C,CAAC;CAEL;CAEA,SAAS,YAAiC;EACxC,IAAI,KAAK,IAAI,IAAI,UAAU,GACzB,OAAO;EAET,KAAK,MAAM,SAAS,KAAK,QAAQ,OAAO,GACtC,IAAI,MAAM,YAAY,IAAI,UAAU,GAClC,OAAO;EAGX,OAAO;CACT;CAEA,MAAM,YAAgE;EACpE,IAAI,KAAK,IAAI,IAAI,UAAU,GACzB,OAAO;GAAE,KAAK;GAAM,SAAS,CAAC;EAAE;EAElC,MAAM,UAAuB,CAAC;EAC9B,KAAK,MAAM,CAAC,IAAI,UAAU,KAAK,SAC7B,IAAI,MAAM,YAAY,IAAI,UAAU,GAClC,QAAQ,KAAK,EAAE;EAGnB,OAAO;GAAE,KAAK;GAAO;EAAQ;CAC/B;CAEA,OAAO,IAAyB;EAC9B,IAAI,OAAO,KAAA,GAAW;GACpB,MAAM,QAAQ,KAAK,QAAQ,IAAI,EAAE;GACjC,IAAI,OACF,OAAO,MAAM;EAEjB;EACA,OAAO,KAAK;CACd;CAEA,UAAmB;EACjB,OAAO,KAAK;CACd;CAEA,iBAA+B;EAC7B,OAAO,gBAAgB,QAAQ,eAAe,KAAK,IAAI,IAAI,UAAU,CAAC;CACxE;CAEA,qBAAsD;EACpD,MAAM,MAAuC,CAAC;EAC9C,KAAK,MAAM,CAAC,IAAI,UAAU,KAAK,SAC7B,IAAI,MAAM,gBAAgB,QAAQ,eAAe,MAAM,YAAY,IAAI,UAAU,CAAC;EAEpF,OAAO;CACT;CAEA,OAAO,IAAyB;EAC9B,IAAI,OAAO,KAAA,KAAa,KAAK,QAAQ,IAAI,EAAE,CAAC,EAAE,KAAK,MACjD,OAAO;EAET,OAAO,KAAK,QAAQ;CACtB;AACF;AAEA,SAAgB,mBAAmB,EACjC,aACA,OACA,eACoC;CACpC,MAAM,SAAS,cAAc,YAAY,WAAW,IAAI;CACxD,MAAM,SAAS,YAAY,MAAM,QAAQ,IAAI,cAAc,IAAI;CAC/D,MAAM,SAAS,SAAS,MAAM,IAAI,OAAO,OAAO,IAAI,KAAA;CACpD,MAAM,UAAU,QAAQ,OAAO,SAAS,KAAK,IAAI,SAAS,KAAA;CAC1D,MAAM,SAAS,UAAU,YAAY,QAAQ,WAAW,oBAAI,IAAI,IAAgB;CAChF,MAAM,0BAAU,IAAI,IAA6B;CACjD,KAAK,MAAM,OAAO,aAAa;EAC7B,IAAI,IAAI,cAAc,QAAQ,IAAI,gBAAgB,MAChD;EAEF,MAAM,OAAO,MAAM,IAAI,IAAI,OAAO;EAClC,IAAI,CAAC,QAAQ,CAAC,KAAK,OAAO,SAAS,IAAI,WAAW,GAChD;EAEF,MAAM,OAAO,IAAI;EAEjB,MAAM,WAAW,CAAC,GAAG,YADT,KAAK,YAAY,QAAQ,eAAe,gBAAgB,UAAU,MAAM,IACjD,CAAC,CAAC,CAAC,CAAC,QACpC,eAAe,gBAAgB,UAAU,MAAM,IAClD;EACA,QAAQ,IAAI,IAAI,WAAW;GACzB,aAAa,UAAU,IAAI,IAAI,QAAQ,GAAG,MAAM;GAChD,MAAM,MAAM,IAAI;EAClB,CAAC;CACH;CACA,MAAM,QAAQ,QAAQ,YAAA,WAA8B,YAAY,KAAA;CAChE,OAAO,IAAI,oBACT,UAAU,QAAQ,MAAM,GACxB,UACI,MAAM,OAAO,IACb,MAAM,IAAA,QAAmB,IACvB,MAAM,MAAM,IAAI,eAAe,CAAE,IACjC,YACN,SACA,SAAS,WAAW,IACtB;AACF;AAEA,SAAgB,oBAAyC;CACvD,OAAO,IAAI,oBACT,IAAI,IAAI,eAAe,GACvB;EAAE,KAAK;EAAU,MAAM;EAAU,MAAM;CAAM,mBAC7C,IAAI,IAAI,GACR,KACF;AACF"}