@headless-lms/core 0.4.0 → 0.6.0

package/dist/organizations/effective-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"effective-permissions.js","names":[],"sources":["../../src/organizations/effective-permissions.ts"],"sourcesContent":["import type { ContentId, ContentType, Permission } from '../types/index.js';\nimport type { EffectivePermissions, RoleRef } from '../shared/actor.js';\nimport { ForbiddenError } from '../shared/errors.js';\nimport { ALL_PERMISSIONS, permissionAbout, withImplied } from './permissions.js';\nimport { MEMBER_ROLE_KEY, OWNER_ROLE_KEY } from './default-roles.js';\nimport type { OrgRole } from './org-roles.js';\n\nexport interface AssignmentRow {\n  roleKey: string;\n  contentId: ContentId | null;\n  contentType: ContentType | null;\n}\n\nexport interface ResolveInput {\n  assignments: readonly AssignmentRow[];\n  roles: ReadonlyMap<string, OrgRole>;\n  tokenScopes?: readonly Permission[];\n}\n\ninterface ContentEntry {\n  permissions: Set<Permission>;\n  role: RoleRef;\n}\n\nconst MEMBER_REF: RoleRef = { key: MEMBER_ROLE_KEY, name: 'Member', team: false };\n\nfunction refOf(role: OrgRole): RoleRef {\n  return { key: role.key, name: role.name, team: role.team };\n}\n\nfunction intersect(set: Set<Permission>, scopes: Set<Permission> | null): Set<Permission> {\n  if (!scopes) {\n    return set;\n  }\n  return new Set([...set].filter((permission) => scopes.has(permission)));\n}\n\nexport class ResolvedPermissions implements EffectivePermissions {\n  constructor(\n    private readonly org: Set<Permission>,\n    private readonly orgRole: RoleRef,\n    private readonly content: Map<ContentId, ContentEntry>,\n    private readonly owner: boolean,\n    private readonly token: boolean,\n  ) {}\n\n  has(permission: Permission, on?: ContentId): boolean {\n    if (this.org.has(permission)) {\n      return true;\n    }\n    return on !== undefined && (this.content.get(on)?.permissions.has(permission) ?? false);\n  }\n\n  require(permission: Permission, on?: ContentId): void {\n    if (!this.has(permission, on)) {\n      throw Object.assign(new ForbiddenError(`You need ${permission}`), {\n        permission,\n        ...(on !== undefined && { contentId: on }),\n      });\n    }\n  }\n\n  anywhere(permission: Permission): boolean {\n    if (this.org.has(permission)) {\n      return true;\n    }\n    for (const entry of this.content.values()) {\n      if (entry.permissions.has(permission)) {\n        return true;\n      }\n    }\n    return false;\n  }\n\n  where(permission: Permission): { org: boolean; content: ContentId[] } {\n    if (this.org.has(permission)) {\n      return { org: true, content: [] };\n    }\n    const content: ContentId[] = [];\n    for (const [id, entry] of this.content) {\n      if (entry.permissions.has(permission)) {\n        content.push(id);\n      }\n    }\n    return { org: false, content };\n  }\n\n  roleOn(on?: ContentId): RoleRef {\n    if (on !== undefined) {\n      const entry = this.content.get(on);\n      if (entry) {\n        return entry.role;\n      }\n    }\n    return this.orgRole;\n  }\n\n  isOwner(): boolean {\n    return this.owner;\n  }\n\n  isToken(): boolean {\n    return this.token;\n  }\n\n  orgPermissions(): Permission[] {\n    return ALL_PERMISSIONS.filter((permission) => this.org.has(permission));\n  }\n\n  contentPermissions(): Record<ContentId, Permission[]> {\n    const out: Record<ContentId, Permission[]> = {};\n    for (const [id, entry] of this.content) {\n      out[id] = ALL_PERMISSIONS.filter((permission) => entry.permissions.has(permission));\n    }\n    return out;\n  }\n\n  teamOn(on?: ContentId): boolean {\n    if (on !== undefined && this.content.get(on)?.role.team) {\n      return true;\n    }\n    return this.orgRole.team;\n  }\n}\n\nexport function resolvePermissions({\n  assignments,\n  roles,\n  tokenScopes,\n}: ResolveInput): ResolvedPermissions {\n  const scopes = tokenScopes ? withImplied(tokenScopes) : null;\n  const orgRow = assignments.find((row) => row.contentId === null);\n  const listed = orgRow ? roles.get(orgRow.roleKey) : undefined;\n  const orgRole = listed?.levels.includes('org') ? listed : undefined;\n  const orgSet = orgRole ? withImplied(orgRole.permissions) : new Set<Permission>();\n  const content = new Map<ContentId, ContentEntry>();\n  for (const row of assignments) {\n    if (row.contentId === null || row.contentType === null) {\n      continue;\n    }\n    const role = roles.get(row.roleKey);\n    if (!role || !role.levels.includes(row.contentType)) {\n      continue;\n    }\n    const type = row.contentType;\n    const own = role.permissions.filter((permission) => permissionAbout(permission) === type);\n    const expanded = [...withImplied(own)].filter(\n      (permission) => permissionAbout(permission) === type,\n    );\n    content.set(row.contentId, {\n      permissions: intersect(new Set(expanded), scopes),\n      role: refOf(role),\n    });\n  }\n  const owner = orgRow?.roleKey === OWNER_ROLE_KEY && orgRole !== undefined;\n  return new ResolvedPermissions(\n    intersect(orgSet, scopes),\n    orgRole\n      ? refOf(orgRole)\n      : roles.get(MEMBER_ROLE_KEY)\n        ? refOf(roles.get(MEMBER_ROLE_KEY)!)\n        : MEMBER_REF,\n    content,\n    owner && scopes === null,\n    scopes !== null,\n  );\n}\n\nexport function systemPermissions(): ResolvedPermissions {\n  return new ResolvedPermissions(\n    new Set(ALL_PERMISSIONS),\n    { key: 'system', name: 'System', team: false },\n    new Map(),\n    false,\n    false,\n  );\n}\n"],"mappings":";;;;AAwBA,MAAM,aAAsB;CAAE,KAAK;CAAiB,MAAM;CAAU,MAAM;AAAM;AAEhF,SAAS,MAAM,MAAwB;CACrC,OAAO;EAAE,KAAK,KAAK;EAAK,MAAM,KAAK;EAAM,MAAM,KAAK;CAAK;AAC3D;AAEA,SAAS,UAAU,KAAsB,QAAiD;CACxF,IAAI,CAAC,QACH,OAAO;CAET,OAAO,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,QAAQ,eAAe,OAAO,IAAI,UAAU,CAAC,CAAC;AACxE;AAEA,IAAa,sBAAb,MAAiE;CAE5C;CACA;CACA;CACA;CACA;CALnB,YACE,KACA,SACA,SACA,OACA,OACA;EALiB,KAAA,MAAA;EACA,KAAA,UAAA;EACA,KAAA,UAAA;EACA,KAAA,QAAA;EACA,KAAA,QAAA;CAChB;CAEH,IAAI,YAAwB,IAAyB;EACnD,IAAI,KAAK,IAAI,IAAI,UAAU,GACzB,OAAO;EAET,OAAO,OAAO,KAAA,MAAc,KAAK,QAAQ,IAAI,EAAE,CAAC,EAAE,YAAY,IAAI,UAAU,KAAK;CACnF;CAEA,QAAQ,YAAwB,IAAsB;EACpD,IAAI,CAAC,KAAK,IAAI,YAAY,EAAE,GAC1B,MAAM,OAAO,OAAO,IAAI,eAAe,YAAY,YAAY,GAAG;GAChE;GACA,GAAI,OAAO,KAAA,KAAa,EAAE,WAAW,GAAG;EAC1C,CAAC;CAEL;CAEA,SAAS,YAAiC;EACxC,IAAI,KAAK,IAAI,IAAI,UAAU,GACzB,OAAO;EAET,KAAK,MAAM,SAAS,KAAK,QAAQ,OAAO,GACtC,IAAI,MAAM,YAAY,IAAI,UAAU,GAClC,OAAO;EAGX,OAAO;CACT;CAEA,MAAM,YAAgE;EACpE,IAAI,KAAK,IAAI,IAAI,UAAU,GACzB,OAAO;GAAE,KAAK;GAAM,SAAS,CAAC;EAAE;EAElC,MAAM,UAAuB,CAAC;EAC9B,KAAK,MAAM,CAAC,IAAI,UAAU,KAAK,SAC7B,IAAI,MAAM,YAAY,IAAI,UAAU,GAClC,QAAQ,KAAK,EAAE;EAGnB,OAAO;GAAE,KAAK;GAAO;EAAQ;CAC/B;CAEA,OAAO,IAAyB;EAC9B,IAAI,OAAO,KAAA,GAAW;GACpB,MAAM,QAAQ,KAAK,QAAQ,IAAI,EAAE;GACjC,IAAI,OACF,OAAO,MAAM;EAEjB;EACA,OAAO,KAAK;CACd;CAEA,UAAmB;EACjB,OAAO,KAAK;CACd;CAEA,UAAmB;EACjB,OAAO,KAAK;CACd;CAEA,iBAA+B;EAC7B,OAAO,gBAAgB,QAAQ,eAAe,KAAK,IAAI,IAAI,UAAU,CAAC;CACxE;CAEA,qBAAsD;EACpD,MAAM,MAAuC,CAAC;EAC9C,KAAK,MAAM,CAAC,IAAI,UAAU,KAAK,SAC7B,IAAI,MAAM,gBAAgB,QAAQ,eAAe,MAAM,YAAY,IAAI,UAAU,CAAC;EAEpF,OAAO;CACT;CAEA,OAAO,IAAyB;EAC9B,IAAI,OAAO,KAAA,KAAa,KAAK,QAAQ,IAAI,EAAE,CAAC,EAAE,KAAK,MACjD,OAAO;EAET,OAAO,KAAK,QAAQ;CACtB;AACF;AAEA,SAAgB,mBAAmB,EACjC,aACA,OACA,eACoC;CACpC,MAAM,SAAS,cAAc,YAAY,WAAW,IAAI;CACxD,MAAM,SAAS,YAAY,MAAM,QAAQ,IAAI,cAAc,IAAI;CAC/D,MAAM,SAAS,SAAS,MAAM,IAAI,OAAO,OAAO,IAAI,KAAA;CACpD,MAAM,UAAU,QAAQ,OAAO,SAAS,KAAK,IAAI,SAAS,KAAA;CAC1D,MAAM,SAAS,UAAU,YAAY,QAAQ,WAAW,oBAAI,IAAI,IAAgB;CAChF,MAAM,0BAAU,IAAI,IAA6B;CACjD,KAAK,MAAM,OAAO,aAAa;EAC7B,IAAI,IAAI,cAAc,QAAQ,IAAI,gBAAgB,MAChD;EAEF,MAAM,OAAO,MAAM,IAAI,IAAI,OAAO;EAClC,IAAI,CAAC,QAAQ,CAAC,KAAK,OAAO,SAAS,IAAI,WAAW,GAChD;EAEF,MAAM,OAAO,IAAI;EAEjB,MAAM,WAAW,CAAC,GAAG,YADT,KAAK,YAAY,QAAQ,eAAe,gBAAgB,UAAU,MAAM,IACjD,CAAC,CAAC,CAAC,CAAC,QACpC,eAAe,gBAAgB,UAAU,MAAM,IAClD;EACA,QAAQ,IAAI,IAAI,WAAW;GACzB,aAAa,UAAU,IAAI,IAAI,QAAQ,GAAG,MAAM;GAChD,MAAM,MAAM,IAAI;EAClB,CAAC;CACH;CACA,MAAM,QAAQ,QAAQ,YAAA,WAA8B,YAAY,KAAA;CAChE,OAAO,IAAI,oBACT,UAAU,QAAQ,MAAM,GACxB,UACI,MAAM,OAAO,IACb,MAAM,IAAA,QAAmB,IACvB,MAAM,MAAM,IAAI,eAAe,CAAE,IACjC,YACN,SACA,SAAS,WAAW,MACpB,WAAW,IACb;AACF;AAEA,SAAgB,oBAAyC;CACvD,OAAO,IAAI,oBACT,IAAI,IAAI,eAAe,GACvB;EAAE,KAAK;EAAU,MAAM;EAAU,MAAM;CAAM,mBAC7C,IAAI,IAAI,GACR,OACA,KACF;AACF"}