@liquisio/wix-access 0.3.1 → 0.3.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/backend.js +2 -2
- package/package.json +1 -1
- package/public.js +3 -3
package/backend.js
CHANGED
|
@@ -1,3 +1,3 @@
|
|
|
1
|
-
var Yt=Object.create;var Y=Object.defineProperty;var Jt=Object.getOwnPropertyDescriptor;var Kt=Object.getOwnPropertyNames;var Zt=Object.getPrototypeOf,Ht=Object.prototype.hasOwnProperty;var Qt=(t,e)=>{for(var r in e)Y(t,r,{get:e[r],enumerable:!0})},st=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let s of Kt(e))!Ht.call(t,s)&&s!==r&&Y(t,s,{get:()=>e[s],enumerable:!(n=Jt(e,s))||n.enumerable});return t};var Wt=(t,e,r)=>(r=t!=null?Yt(Zt(t)):{},st(e||!t||!t.__esModule?Y(r,"default",{value:t,enumerable:!0}):r,t)),Xt=t=>st(Y({},"__esModule",{value:!0}),t);var Qr={};Qt(Qr,{CASES:()=>rt,CODES:()=>O,KIND:()=>$,PACKAGE_VERSION:()=>tt,PolicyError:()=>M,SCOPE:()=>w,WHEN:()=>I,abilityFor:()=>ce,abilityFromRules:()=>Qe,anonymous:()=>at,applyClauses:()=>le,assertDeclared:()=>Tt,assertGates:()=>Rt,backendMemberId:()=>Hr,backendPing:()=>Zr,can:()=>v,caseTable:()=>kt,createAccess:()=>Kr,createPrincipal:()=>q,deny:()=>C,denyOpaque:()=>j,filterFor:()=>ue,hasRole:()=>J,isDenial:()=>it,normaliseRoles:()=>fe,ok:()=>ot,parseGates:()=>Xe,permissionFor:()=>ut,resolvePlaceholders:()=>St,resolveSubjects:()=>Z,resolveWhere:()=>ae,rulesFor:()=>k,validatePolicy:()=>K,verifyGates:()=>et});module.exports=Xt(Qr);var nt=require("wix-members-backend"),Bt=Wt(require("wix-users-backend"),1),zt=require("@wix/data"),Gt=require("@wix/essentials");var O={FORBIDDEN:"FORBIDDEN",UNAUTHENTICATED:"UNAUTHENTICATED",UNVERIFIED:"UNVERIFIED",NOT_FOUND:"NOT_FOUND",INVALID_POLICY:"INVALID_POLICY",INVALID_ARGUMENT:"INVALID_ARGUMENT"},M=class extends Error{constructor(e){super(e),this.name="PolicyError",this.code=O.INVALID_POLICY}};function ot(t){return{ok:!0,data:t===void 0?null:t}}function C(t,e,r){let n={ok:!1,code:t||O.FORBIDDEN};return e&&(n.action=e),r&&(n.detail=r),n}var it=t=>!!t&&t.ok===!1;function j(t){return C(O.NOT_FOUND,t)}var $={VISITOR:"visitor",MEMBER:"member",CAPABILITY:"capability",SERVICE:"service"};function fe(t){if(!Array.isArray(t))return[];let e=[];for(let r of t){if(typeof r=="string"){e.push(r);continue}if(!r||typeof r!="object")continue;let n=r.title||r.name||r.roleKey;n&&e.push(n)}return e}function q(t){let e=t||{},r=e.memberId||null,n=fe(e.roles);return{kind:e.kind||(r?$.MEMBER:$.VISITOR),memberId:r,roles:n,subjects:Array.isArray(e.subjects)?e.subjects.slice():[],domain:e.domain&&typeof e.domain=="object"?e.domain:{},unverified:!!e.unverified}}var at=()=>q({kind:$.VISITOR}),J=(t,e)=>t.roles.indexOf(e)!==-1;var I={ANYONE:"anyone",ANONYMOUS:"anonymous",MEMBER:"member"},E=t=>!!t&&typeof t=="object"&&!Array.isArray(t),er=t=>Array.isArray(t)?t:[t];function h(t,e){throw new M("policy"+t+": "+e)}function tr(t,e){let r=".subjects."+t;E(e)||h(r,"must be an object");let s=["when","role","domain"].filter(o=>e[o]!==void 0);if(s.length===0&&h(r,'needs exactly one of when/role/domain \u2014 "{}" is ambiguous between a visitor and a member'),s.length>1&&h(r,"has "+s.join(" and ")+"; use exactly one"),e.when!==void 0){let o=[I.ANYONE,I.ANONYMOUS,I.MEMBER];o.indexOf(e.when)===-1&&h(r+".when","must be one of "+o.join(", ")+" (got "+JSON.stringify(e.when)+")")}e.role!==void 0&&typeof e.role!="string"&&h(r+".role","must be a string"),e.domain!==void 0&&typeof e.domain!="string"&&h(r+".domain","must be a string")}function rr(t,e,r){let n=".rules["+e+"]";E(t)||h(n,"must be an object"),typeof t.subject!="string"&&h(n+".subject","must be a string"),r.indexOf(t.subject)===-1&&h(n+".subject",'"'+t.subject+'" is not declared in policy.subjects'),t.actions===void 0&&h(n+".actions","is required");for(let s of er(t.actions))typeof s!="string"&&h(n+".actions","must be a string or an array of strings");typeof t.resource!="string"&&h(n+".resource","must be a string"),t.where!==void 0&&!E(t.where)&&h(n+".where","must be an object")}var ct=["Anyone","SiteMember","Admin"];function nr(t,e,r){let n=".api."+t;E(e)||h(n,"must be an object"),ct.indexOf(e.permission)===-1&&h(n+".permission","must be one of "+ct.join(", ")+" (got "+JSON.stringify(e.permission)+")"),e.ability!==void 0&&((!Array.isArray(e.ability)||e.ability.length!==2)&&h(n+".ability","must be [action, resource]"),(typeof e.ability[0]!="string"||typeof e.ability[1]!="string")&&h(n+".ability","both entries must be strings")),e.subject!==void 0&&r.indexOf(e.subject)===-1&&h(n+".subject",'"'+e.subject+'" is not declared in policy.subjects')}function K(t){if(!E(t))throw new M("policy must be an object");E(t.subjects)||h(".subjects","is required and must be an object");let e=Object.keys(t.subjects);e.length===0&&h(".subjects","declares no subjects");for(let r of e)tr(r,t.subjects[r]);if(Array.isArray(t.rules)||h(".rules","is required and must be an array"),t.rules.forEach((r,n)=>rr(r,n,e)),t.api!==void 0){E(t.api)||h(".api","must be an object");for(let r of Object.keys(t.api))nr(r,t.api[r],e)}return t.collections!==void 0&&!E(t.collections)&&h(".collections","must be an object"),t}function Z(t,e){let r=new Set(t.subjects||[]);for(let n of Object.keys(e.subjects)){let s=e.subjects[n];(s.when===I.ANYONE||s.when===I.ANONYMOUS&&!t.memberId||s.when===I.MEMBER&&t.memberId||s.role!==void 0&&t.roles.indexOf(s.role)!==-1||s.domain!==void 0&&t.domain[s.domain])&&r.add(n)}return Array.from(r)}function ut(t,e){let r=t.api&&t.api[e];return r?r.permission:null}var H=class{constructor(e,r){this.operator=e,this.value=r,Object.defineProperty(this,"t",{writable:!0})}get notes(){return this.t}addNote(e){this.t=this.t||[],this.t.push(e)}},L=class extends H{},S=class extends L{constructor(e,r){if(!Array.isArray(r))throw new Error(`"${e}" operator expects to receive an array of conditions`);super(e,r)}},N="__itself__",_=class extends H{constructor(e,r,n){super(e,n),this.field=r}},me=new L("__null__",null),he=Object.prototype.hasOwnProperty.call.bind(Object.prototype.hasOwnProperty);function sr(t,e){return e instanceof S&&e.operator===t}function ye(t,e){return e.length===1?e[0]:new S(t,(function r(n,s,o){let i=o||[];for(let a=0,c=s.length;a<c;a++){let l=s[a];sr(n,l)?r(n,l.value,i):i.push(l)}return i})(t,e))}var or=t=>t,lt=()=>Object.create(null),ft=Object.defineProperty(lt(),"__@type@__",{value:"ignore value"});function ir(t,e,r=!1){if(!t||t&&t.constructor!==Object)return!1;for(let n in t)if(he(t,n)&&he(e,n)&&(!r||t[n]!==ft))return!0;return!1}function ar(t){let e=[];for(let r in t)he(t,r)&&t[r]!==ft&&e.push(r);return e}function de(t,e){e!==me&&t.push(e)}var be=t=>ye("and",t);var Q={compound(t,e,r){let n=(Array.isArray(e)?e:[e]).map(s=>r.parse(s));return new S(t.name,n)},field:(t,e,r)=>new _(t.name,r.field,e),document:(t,e)=>new L(t.name,e)},B=class{constructor(e,r=lt()){this.o=void 0,this.s=void 0,this.i=void 0,this.u=void 0,this.h=void 0,this.parse=this.parse.bind(this),this.u={operatorToConditionName:r.operatorToConditionName||or,defaultOperatorName:r.defaultOperatorName||"eq",mergeFinalConditions:r.mergeFinalConditions||be},this.o=Object.keys(e).reduce((n,s)=>(n[s]=Object.assign({name:this.u.operatorToConditionName(s)},e[s]),n),{}),this.s=Object.assign({},r.fieldContext,{field:"",query:{},parse:this.parse,hasOperators:n=>ir(n,this.o,r.useIgnoreValue)}),this.i=Object.assign({},r.documentContext,{parse:this.parse,query:{}}),this.h=r.useIgnoreValue?ar:Object.keys}setParse(e){this.parse=e,this.s.parse=e,this.i.parse=e}parseField(e,r,n,s){let o=this.o[r];if(!o)throw new Error(`Unsupported operator "${r}"`);if(o.type!=="field")throw new Error(`Unexpected ${o.type} operator "${r}" at field level`);return this.s.field=e,this.s.query=s,this.parseInstruction(o,n,this.s)}parseInstruction(e,r,n){return typeof e.validate=="function"&&e.validate(e,r),(e.parse||Q[e.type])(e,r,n)}parseFieldOperators(e,r){let n=[],s=this.h(r);for(let o=0,i=s.length;o<i;o++){let a=s[o];if(!this.o[a])throw new Error(`Field query for "${e}" may contain only operators or a plain object as a value`);de(n,this.parseField(e,a,r[a],r))}return n}parse(e){let r=[],n=this.h(e);this.i.query=e;for(let s=0,o=n.length;s<o;s++){let i=n[s],a=e[i],c=this.o[i];if(c){if(c.type!=="document"&&c.type!=="compound")throw new Error(`Cannot use parsing instruction for operator "${i}" in "document" context as it is supposed to be used in "${c.type}" context`);de(r,this.parseInstruction(c,a,this.i))}else this.s.hasOperators(a)?r.push(...this.parseFieldOperators(i,a)):de(r,this.parseField(i,this.u.defaultOperatorName,a,e))}return this.u.mergeFinalConditions(r)}};function pe(t,e){let r=t[e];if(typeof r!="function")throw new Error(`Unable to interpret "${e}" condition. Did you forget to register interpreter for it?`);return r}function cr(t){return t.operator}function dt(t,e){let r=e,n=r&&r.getInterpreterName||cr,s;switch(r?r.numberOfArguments:0){case 1:s=i=>{let a=n(i,r);return pe(t,a)(i,o)};break;case 3:s=(i,a,c)=>{let l=n(i,r);return pe(t,l)(i,a,c,o)};break;default:s=(i,a)=>{let c=n(i,r);return pe(t,c)(i,a,o)}}let o=Object.assign({},r,{interpret:s});return o.interpret}function pt(t,e){return(r,...n)=>{let s=t(r,...n),o=e.bind(null,s);return o.ast=s,o}}var on=B.prototype.parseInstruction;function ht(t,e){if(!Array.isArray(e))throw new Error(`"${t.name}" expects value to be an array`)}function mt(t,e){if(ht(t,e),!e.length)throw new Error(`"${t.name}" expects to have at least one element in array`)}var ge=t=>(e,r)=>{if(typeof r!==t)throw new Error(`"${e.name}" expects value to be a "${t}"`)},yt={type:"compound",validate:mt,parse(t,e,{parse:r}){let n=e.map(s=>r(s));return ye(t.name,n)}},ur=yt,lr={type:"compound",validate:mt},fr={type:"field",validate(t,e){if(!(e&&(e instanceof RegExp||e.constructor===Object)))throw new Error(`"${t.name}" expects to receive either regular expression or object of field operators`)},parse(t,e,r){let n=e instanceof RegExp?new _("regex",r.field,e):r.parse(e,r);return new S(t.name,[n])}},xe={type:"field",validate(t,e){if(!e||e.constructor!==Object)throw new Error(`"${t.name}" expects to receive an object with nested query or field level operators`)},parse(t,e,{parse:r,field:n,hasOperators:s}){let o=s(e)?r(e,{field:N}):r(e);return new _(t.name,n,o)}},Oe={type:"field",validate:ge("number")},z={type:"field",validate:ht},ve=z,we=z,dr={type:"field",validate(t,e){if(!Array.isArray(e)||e.length!==2)throw new Error(`"${t.name}" expects an array with 2 numeric elements`)}},je={type:"field",validate:ge("boolean")},X={type:"field",validate:function(t,e){if(!(typeof e=="string"||typeof e=="number"||e instanceof Date))throw new Error(`"${t.name}" expects value to be comparable (i.e., string, number or date)`)}},G=X,Ae=G,$e=G,ee={type:"field"},Ee=ee,Ie={type:"field",validate(t,e){if(!(e instanceof RegExp)&&typeof e!="string")throw new Error(`"${t.name}" expects value to be a regular expression or a string that represents regular expression`)},parse(t,e,r){let n=typeof e=="string"?new RegExp(e,r.query.$options||""):e;return new _(t.name,r.field,n)}},Ne={type:"field",parse:()=>me},pr={type:"document",validate:ge("function")},hr=Object.freeze({__proto__:null,$and:yt,$or:ur,$nor:lr,$not:fr,$elemMatch:xe,$size:Oe,$in:z,$nin:ve,$all:we,$mod:dr,$exists:je,$gte:X,$gt:G,$lt:Ae,$lte:$e,$eq:ee,$ne:Ee,$regex:Ie,$options:Ne,$where:pr}),W=class extends B{constructor(e){super(e,{defaultOperatorName:"$eq",operatorToConditionName:r=>r.slice(1)})}parse(e,r){return r&&r.field?be(this.parseFieldOperators(r.field,e)):super.parse(e)}},te=hr;function Fe(t,e,r){for(let n=0,s=t.length;n<s;n++)if(r(t[n],e)===0)return!0;return!1}function Me(t,e){return Array.isArray(t)&&Number.isNaN(Number(e))}function bt(t,e,r){if(!Me(t,e))return r(t,e);let n=[];for(let s=0;s<t.length;s++){let o=r(t[s],e);o!==void 0&&(n=n.concat(o))}return n}function R(t){return(e,r,n)=>{let s=n.get(r,e.field);return Array.isArray(s)?s.some(o=>t(e,o,n)):t(e,s,n)}}var mr=Object.hasOwn||Object.prototype.hasOwnProperty.call.bind(Object.prototype.hasOwnProperty),yr=(t,e)=>t[e];function gt(t,e,r){let n=e.lastIndexOf(".");return n===-1?[t,e]:[r(t,e.slice(0,n)),e.slice(n+1)]}function br(t,e,r=yr){if(e===N)return t;if(!t)throw new Error(`Unable to get field "${e}" out of ${String(t)}.`);return(function(n,s,o){if(s.indexOf(".")===-1)return bt(n,s,o);let i=s.split("."),a=n;for(let c=0,l=i.length;c<l;c++)if(a=bt(a,i[c],o),!a||typeof a!="object")return c<l-1?void 0:a;return a})(t,e,r)}function Ce(t,e){return t===e?0:t>e?1:-1}function Se(t,e={}){return dt(t,Object.assign({get:br,compare:Ce},e))}var xt=(t,e,{interpret:r})=>t.value.some(n=>r(n,e)),gr=(t,e,r)=>!xt(t,e,r),_e=(t,e,{interpret:r})=>t.value.every(n=>r(n,e)),xr=(t,e,{interpret:r})=>!r(t.value[0],e),re=(t,e,{compare:r,get:n})=>{let s=n(e,t.field);return Array.isArray(s)&&!Array.isArray(t.value)?Fe(s,t.value,r):r(s,t.value)===0},Re=(t,e,r)=>!re(t,e,r),ke=R((t,e,r)=>{let n=r.compare(e,t.value);return n===0||n===-1}),De=R((t,e,r)=>r.compare(e,t.value)===-1),Pe=R((t,e,r)=>r.compare(e,t.value)===1),Te=R((t,e,r)=>{let n=r.compare(e,t.value);return n===0||n===1}),Ue=(t,e,{get:r})=>{if(t.field===N)return e!==void 0;let[n,s]=gt(e,t.field,r),o=i=>i==null?!!i===t.value:mr(i,s)===t.value;return Me(n,s)?n.some(o):o(n)},Or=R((t,e)=>typeof e=="number"&&e%t.value[0]===t.value[1]),qe=(t,e,{get:r})=>{let[n,s]=gt(e,t.field,r),o=i=>{let a=r(i,s);return Array.isArray(a)&&a.length===t.value};return t.field!==N&&Me(n,s)?n.some(o):o(n)},Le=R((t,e)=>typeof e=="string"&&t.value.test(e)),V=R((t,e,{compare:r})=>Fe(t.value,e,r)),Be=(t,e,r)=>!V(t,e,r),ze=(t,e,{compare:r,get:n})=>{let s=n(e,t.field);return Array.isArray(s)&&t.value.every(o=>Fe(s,o,r))},Ge=(t,e,{interpret:r,get:n})=>{let s=n(e,t.field);return Array.isArray(s)&&s.some(o=>r(t.value,o))},vr=(t,e)=>t.value.call(e),wr=Object.freeze({__proto__:null,or:xt,nor:gr,and:_e,not:xr,eq:re,ne:Re,lte:ke,lt:De,gt:Pe,gte:Te,exists:Ue,mod:Or,size:qe,regex:Le,within:V,nin:Be,all:ze,elemMatch:Ge,where:vr}),ne=Object.assign({},wr,{in:V}),dn=Se(ne);function Ot(t){return t===null||typeof t!="object"?t:t instanceof Date?t.getTime():t&&typeof t.toJSON=="function"?t.toJSON():t}var jr=(t,e)=>Ce(Ot(t),Ot(e));function se(t,e,r){let n=new W(t),s=Se(e,Object.assign({compare:jr},r));if(r&&r.forPrimitives){let o={field:N},i=n.parse;n.setParse(a=>i(a,o))}return pt(n.parse,s)}var bn=se(te,ne),gn=se(["$and","$or"].reduce((t,e)=>(t[e]=Object.assign({},t[e],{type:"field"}),t),Object.assign({},te,{$nor:Object.assign({},te.$nor,{type:"field",parse:Q.compound})})),ne,{forPrimitives:!0});var Et=Object.hasOwn||((t,e)=>Object.prototype.hasOwnProperty.call(t,e));function Ve(t){return Array.isArray(t)?t:[t]}var P="__caslSubjectType__";function It(t,e){if(e){if(!Et(e,P))Object.defineProperty(e,P,{value:t});else if(t!==e[P])throw new Error(`Trying to cast object to subject type ${t} but previously it was casted to ${e[P]}`)}return e}var ie=t=>{let e=typeof t;return e==="string"||e==="function"},Nt=t=>t.modelName||t.name;function Ar(t){return typeof t=="string"?t:Nt(t)}function Ft(t){return Et(t,P)?t[P]:Nt(t.constructor)}var vt={function:t=>t.constructor,string:Ft};function wt(t,e,r){for(let n=r;n<e.length;n++)t.push(e[n])}function jt(t,e){if(!t||!t.length)return e||[];if(!e||!e.length)return t||[];let r=0,n=0,s=[];for(;r<t.length&&n<e.length;)t[r].priority<e[n].priority?(s.push(t[r]),r++):t[r].priority>e[n].priority?(s.push(e[n]),n++):(s.push(t[r]),r++,n++);return wt(s,t,r),wt(s,e,n),s}function oe(t,e,r){let n=t.get(e);return n||(n=r(),t.set(e,n)),n}var $r=t=>t;function Er(t,e){let r;for(let n=0;n<t.length;n++){let s=e(t[n]);r&&s&&r.push(t[n]),s||(r??=t.slice(0,n))}return r||t}function Ir(t,e){if(Array.isArray(t.fields)&&!t.fields.length)throw new Error("`rawRule.fields` cannot be an empty array. https://bit.ly/390miLa");if(t.fields&&!e.fieldMatcher)throw new Error('You need to pass "fieldMatcher" option in order to restrict access by fields');if(t.conditions&&!e.conditionsMatcher)throw new Error('You need to pass "conditionsMatcher" option in order to restrict access by conditions')}var Ye=class{constructor(e,r,n=0){Ir(e,r),this.action=r.resolveAction(e.action),this.subject=e.subject,this.inverted=!!e.inverted,this.conditions=e.conditions,this.reason=e.reason,this.origin=e,this.fields=e.fields?Ve(e.fields):void 0,this.priority=n,this.t=r}i(){return this.conditions&&!this.o&&(this.o=this.t.conditionsMatcher(this.conditions)),this.o}get ast(){let e=this.i();return e?e.ast:void 0}matchesConditions(e){return this.conditions?!e||ie(e)?!this.inverted:this.i()(e):!0}matchesField(e){return this.fields?e?(this.u||(this.u=this.t.fieldMatcher(this.fields)),this.u(e)):!this.inverted:!0}};function Nr(t,e){let r={value:t,prev:e,next:null};return e&&(e.next=r),r}function Fr(t){t.next&&(t.next.prev=t.prev),t.prev&&(t.prev.next=t.next),t.next=t.prev=null}var At=()=>({rules:[],merged:!1}),$t=()=>new Map,Je=class{constructor(e=[],r={}){this.h=!1,this.l=new Map,this.p={conditionsMatcher:r.conditionsMatcher,fieldMatcher:r.fieldMatcher,resolveAction:r.resolveAction||$r},this.$=r.anyAction||"manage",this.A=r.anySubjectType||"all",this.m=e,this.M=!!r.detectSubjectType,this.j=r.detectSubjectType||Ft,this.v(e)}get rules(){return this.m}detectSubjectType(e){return ie(e)?e:e?this.j(e):this.A}update(e){let r={rules:e,ability:this,target:this};return this._("update",r),this.m=e,this.v(e),this._("updated",r),this}v(e){let r=new Map,n;for(let s=e.length-1;s>=0;s--){let o=e.length-s-1,i=new Ye(e[s],this.p,o),a=Ve(i.action),c=Ve(i.subject||this.A);!this.h&&i.fields&&(this.h=!0);for(let l=0;l<c.length;l++){let u=oe(r,c[l],$t);n===void 0&&(n=typeof c[l]),typeof c[l]!==n&&n!=="mixed"&&(n="mixed");for(let d=0;d<a.length;d++)oe(u,a[d],At).rules.push(i)}}if(this.l=r,n!=="mixed"&&!this.M){let s=vt[n]||vt.string;this.j=s}}possibleRulesFor(e,r=this.A){if(!ie(r))throw new Error('"possibleRulesFor" accepts only subject types (i.e., string or class) as the 2nd parameter');let n=oe(this.l,r,$t),s=oe(n,e,At);if(s.merged)return s.rules;let o=e!==this.$&&n.has(this.$)?n.get(this.$).rules:void 0,i=jt(s.rules,o);return r!==this.A&&(i=jt(i,this.possibleRulesFor(e,this.A))),s.rules=i,s.merged=!0,i}rulesFor(e,r,n){let s=this.possibleRulesFor(e,r);if(n&&typeof n!="string")throw new Error("The 3rd, `field` parameter is expected to be a string. See https://stalniy.github.io/casl/en/api/casl-ability#can-of-pure-ability for details");return this.h?Er(s,o=>o.matchesField(n)):s}actionsFor(e){if(!ie(e))throw new Error('"actionsFor" accepts only subject types (i.e., string or class) as a parameter');let r=new Set,n=this.l.get(e);n&&Array.from(n.keys()).forEach(o=>r.add(o));let s=e!==this.A?this.l.get(this.A):void 0;return s&&Array.from(s.keys()).forEach(o=>r.add(o)),Array.from(r)}on(e,r){this.F=this.F||new Map;let n=this.F,s=n.get(e)||null,o=Nr(r,s);return n.set(e,o),()=>{let i=n.get(e);!o.next&&!o.prev&&i===o?n.delete(e):o===i&&n.set(e,o.prev),Fr(o)}}_(e,r){if(!this.F)return;let n=this.F.get(e)||null,s=[];for(;n!==null;)s.push(n.value),n=n.prev;for(let o=0;o<s.length;o++)s[o](r)}},Ke=class extends Je{can(e,r,n){let s=this.relevantRuleFor(e,r,n);return!!s&&!s.inverted}relevantRuleFor(e,r,n){let s=this.detectSubjectType(r),o=this.rulesFor(e,s,n);for(let i=0,a=o.length;i<a;i++)if(o[i].matchesConditions(r))return o[i];return null}cannot(e,r,n){return!this.can(e,r,n)}},Mr={$eq:ee,$ne:Ee,$lt:Ae,$lte:$e,$gt:G,$gte:X,$in:z,$nin:ve,$all:we,$size:Oe,$regex:Ie,$options:Ne,$elemMatch:xe,$exists:je},Cr={eq:re,ne:Re,lt:De,lte:ke,gt:Pe,gte:Te,in:V,nin:Be,all:ze,size:qe,regex:Le,elemMatch:Ge,exists:Ue,and:_e};var Sr=se(Mr,Cr),_r=/[-/\\^$+?.()|[\]{}]/g,Rr=/\.?\*+\.?/g,kr=/\*+/,Dr=/\./g;function Pr(t,e,r){let n=r[0]==="*"||t[0]==="."&&t[t.length-1]==="."?"+":"*",s=t.indexOf("**")===-1?"[^.]":".",o=t.replace(Dr,"\\$&").replace(kr,s+n);return e+t.length===r.length?`(?:${o})?`:o}function Tr(t,e,r){return t==="."&&(r[e-1]==="*"||r[e+1]==="*")?t:`\\${t}`}function Ur(t){let e=t.map(n=>n.replace(_r,Tr).replace(Rr,Pr)),r=e.length>1?`(?:${e.join("|")})`:e[0];return new RegExp(`^${r}$`)}var qr=t=>{let e;return r=>(typeof e>"u"&&(e=t.every(n=>n.indexOf("*")===-1)?null:Ur(t)),e===null?t.indexOf(r)!==-1:e.test(r))};function Mt(t=[],e={}){return new Ke(t,Object.assign({conditionsMatcher:Sr,fieldMatcher:qr},e))}var Lr=t=>`Cannot execute "${t.action}" on "${t.subjectType}"`,Ct=function(e){this.message=e};Ct.prototype=Object.create(Error.prototype);var Ze=class extends Ct{static setDefaultMessage(e){this.P=typeof e=="string"?()=>e:e}static from(e){return new this(e)}constructor(e){super(""),this.ability=e,typeof Error.captureStackTrace=="function"&&(this.name="ForbiddenError",Error.captureStackTrace(this,this.constructor))}setMessage(e){return this.message=e,this}throwUnlessCan(e,r,n){let s=this.unlessCan(e,r,n);if(s)throw s}unlessCan(e,r,n){let s=this.ability.relevantRuleFor(e,r,n);if(s&&!s.inverted)return;this.action=e,this.subject=r,this.subjectType=Ar(this.ability.detectSubjectType(r)),this.field=n;let o=s?s.reason:"";return this.message=this.message||o||this.constructor.P(this),this}};Ze.P=Lr;var An=Object.freeze({__proto__:null});function He(t,e,r){if(t==null)return t;if(typeof t=="string"){if(t.indexOf("$principal.")!==0)return t;let s=t.slice(11).split(".").reduce((o,i)=>o==null?o:o[i],e);return s==null&&(r.unresolved=!0),s}if(Array.isArray(t))return t.map(n=>He(n,e,r));if(typeof t=="object"){let n={};for(let s of Object.keys(t))n[s]=He(t[s],e,r);return n}return t}function ae(t,e){let r={unresolved:!1};return{conditions:He(t,e,r),unresolved:r.unresolved}}function St(t,e){return ae(t,e).conditions}function k(t,e){let r=Z(t,e),n=[];for(let s of e.rules){if(r.indexOf(s.subject)===-1)continue;let o={action:s.actions,subject:s.resource};if(s.where){let{conditions:i,unresolved:a}=ae(s.where,t);if(a)continue;o.conditions=i}n.push(o)}return n}function Qe(t){return Mt(Array.isArray(t)?t:[])}function ce(t,e){return Qe(k(t,e))}function v(t,e,r,n){return n==null?t.can(e,r):t.can(e,It(r,Object.assign({},n)))}var w={ALL:"all",NONE:"none",FIELDS:"fields",AMBIGUOUS:"ambiguous"},_t={$in:"in",$nin:"nin",$ne:"ne",$gt:"gt",$gte:"gte",$lt:"lt",$lte:"lte"};function Br(t){let e=[];for(let r of Object.keys(t)){let n=t[r];if(n===null||typeof n!="object"||Array.isArray(n)){e.push({field:r,op:"eq",value:n});continue}let s=Object.keys(n);if(s.length!==1||!_t[s[0]])return null;e.push({field:r,op:_t[s[0]],value:n[s[0]]})}return e}var zr=(t,e)=>t==="manage"||t===e||Array.isArray(t)&&(t.indexOf(e)!==-1||t.indexOf("manage")!==-1),Gr=(t,e)=>t==="all"||t===e;function ue(t,e,r,n){let s=k(t,e).filter(i=>zr(i.action,r)&&Gr(i.subject,n));if(s.length===0)return{scope:w.NONE,clauses:[]};if(s.some(i=>!i.conditions))return{scope:w.ALL,clauses:[]};if(s.length>1)return{scope:w.AMBIGUOUS,clauses:[]};let o=Br(s[0].conditions);return o?{scope:w.FIELDS,clauses:o}:{scope:w.AMBIGUOUS,clauses:[]}}function le(t,e){let r=t;for(let n of e)n.op==="in"?r=r.hasSome(n.field,n.value):n.op==="nin"?r=r.not(r.hasSome(n.field,n.value)):r=r[n.op](n.field,n.value);return r}var We=/export\s+const\s+([A-Za-z0-9_$]+)\s*=\s*webMethod\s*\(\s*Permissions\s*\.\s*([A-Za-z0-9_$]+)/g,Vr=[[/export\s*{\s*[A-Za-z0-9_$,\s]+}/,"export { x } \u2014 the call and the export must be one statement"],[/export\s+const\s+[A-Za-z0-9_$]+\s*=\s*webMethod\s*\(\s*Permissions\s*\[/,"Permissions['X'] \u2014 the property must be dotted and literal"],[/export\s+const\s+[A-Za-z0-9_$]+\s*=\s*webMethod\s*\(\s*[A-Za-z0-9_$]+\s*\(/,"a computed permission \u2014 it must be written out as Permissions.LEVEL"]];function Xe(t){let e={},r=String(t||"");We.lastIndex=0;let n=We.exec(r);for(;n;)e[n[1]]=n[2],n=We.exec(r);return e}function et(t,e,r){let n=r||{},s=e&&e.api||{},o=Xe(t),i=String(t||""),a=[],c=[];for(let f of Object.keys(o)){let p=s[f];p?p.permission!==o[f]&&a.push({name:f,declared:p.permission,written:o[f]}):c.push({name:f,gate:o[f]})}let l=n.complete?Object.keys(s).filter(f=>!(f in o)):[],u=[];for(let[f,p]of Vr)f.test(i)&&u.push(p);return{ok:a.length+c.length+l.length+u.length===0,found:o,mismatched:a,undeclared:c,missing:l,suspect:u}}function Rt(t,e,r){let n=et(t,e,r);if(n.ok)return!0;let s=[];for(let o of n.mismatched)s.push(o.name+": policy says "+o.declared+", the export says "+o.written);for(let o of n.undeclared)s.push(o.name+": gated "+o.gate+" but missing from policy.api");for(let o of n.missing)s.push(o+": declared in policy.api but not exported here");for(let o of n.suspect)s.push("unreachable export shape \u2014 "+o);throw new Error(`wix-access: web-method gates do not match the policy:
|
|
1
|
+
var Yt=Object.create;var Y=Object.defineProperty;var Jt=Object.getOwnPropertyDescriptor;var Kt=Object.getOwnPropertyNames;var Zt=Object.getPrototypeOf,Ht=Object.prototype.hasOwnProperty;var Qt=(t,e)=>{for(var r in e)Y(t,r,{get:e[r],enumerable:!0})},st=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let s of Kt(e))!Ht.call(t,s)&&s!==r&&Y(t,s,{get:()=>e[s],enumerable:!(n=Jt(e,s))||n.enumerable});return t};var Wt=(t,e,r)=>(r=t!=null?Yt(Zt(t)):{},st(e||!t||!t.__esModule?Y(r,"default",{value:t,enumerable:!0}):r,t)),Xt=t=>st(Y({},"__esModule",{value:!0}),t);var Qr={};Qt(Qr,{CASES:()=>rt,CODES:()=>O,KIND:()=>$,PACKAGE_VERSION:()=>tt,PolicyError:()=>M,SCOPE:()=>w,WHEN:()=>I,abilityFor:()=>ce,abilityFromRules:()=>Qe,anonymous:()=>at,applyClauses:()=>le,assertDeclared:()=>Tt,assertGates:()=>Rt,backendMemberId:()=>Hr,backendPing:()=>Zr,can:()=>v,caseTable:()=>kt,createAccess:()=>Kr,createPrincipal:()=>q,deny:()=>C,denyOpaque:()=>j,filterFor:()=>ue,hasRole:()=>J,isDenial:()=>it,normaliseRoles:()=>fe,ok:()=>ot,parseGates:()=>Xe,permissionFor:()=>ut,resolvePlaceholders:()=>St,resolveSubjects:()=>Z,resolveWhere:()=>ae,rulesFor:()=>k,validatePolicy:()=>K,verifyGates:()=>et});module.exports=Xt(Qr);var nt=require("wix-members-backend"),Bt=Wt(require("wix-users-backend"),1),zt=require("@wix/data"),Gt=require("@wix/essentials");var O={FORBIDDEN:"FORBIDDEN",UNAUTHENTICATED:"UNAUTHENTICATED",UNVERIFIED:"UNVERIFIED",NOT_FOUND:"NOT_FOUND",INVALID_POLICY:"INVALID_POLICY",INVALID_ARGUMENT:"INVALID_ARGUMENT"},M=class extends Error{constructor(e){super(e),this.name="PolicyError",this.code=O.INVALID_POLICY}};function ot(t){return{ok:!0,data:t===void 0?null:t}}function C(t,e,r){let n={ok:!1,code:t||O.FORBIDDEN};return e&&(n.action=e),r&&(n.detail=r),n}var it=t=>!!t&&t.ok===!1;function j(t){return C(O.NOT_FOUND,t)}var $={VISITOR:"visitor",MEMBER:"member",CAPABILITY:"capability",SERVICE:"service"};function fe(t){if(!Array.isArray(t))return[];let e=[];for(let r of t){if(typeof r=="string"){e.push(r);continue}if(!r||typeof r!="object")continue;let n=r.title||r.name||r.roleKey;n&&e.push(n)}return e}function q(t){let e=t||{},r=e.memberId||null,n=fe(e.roles);return{kind:e.kind||(r?$.MEMBER:$.VISITOR),memberId:r,roles:n,subjects:Array.isArray(e.subjects)?e.subjects.slice():[],domain:e.domain&&typeof e.domain=="object"?e.domain:{},unverified:!!e.unverified}}var at=()=>q({kind:$.VISITOR}),J=(t,e)=>t.roles.indexOf(e)!==-1;var I={ANYONE:"anyone",ANONYMOUS:"anonymous",MEMBER:"member"},E=t=>!!t&&typeof t=="object"&&!Array.isArray(t),er=t=>Array.isArray(t)?t:[t];function h(t,e){throw new M("policy"+t+": "+e)}function tr(t,e){let r=".subjects."+t;E(e)||h(r,"must be an object");let s=["when","role","domain"].filter(o=>e[o]!==void 0);if(s.length===0&&h(r,'needs exactly one of when/role/domain \u2014 "{}" is ambiguous between a visitor and a member'),s.length>1&&h(r,"has "+s.join(" and ")+"; use exactly one"),e.when!==void 0){let o=[I.ANYONE,I.ANONYMOUS,I.MEMBER];o.indexOf(e.when)===-1&&h(r+".when","must be one of "+o.join(", ")+" (got "+JSON.stringify(e.when)+")")}e.role!==void 0&&typeof e.role!="string"&&h(r+".role","must be a string"),e.domain!==void 0&&typeof e.domain!="string"&&h(r+".domain","must be a string")}function rr(t,e,r){let n=".rules["+e+"]";E(t)||h(n,"must be an object"),typeof t.subject!="string"&&h(n+".subject","must be a string"),r.indexOf(t.subject)===-1&&h(n+".subject",'"'+t.subject+'" is not declared in policy.subjects'),t.actions===void 0&&h(n+".actions","is required");for(let s of er(t.actions))typeof s!="string"&&h(n+".actions","must be a string or an array of strings");typeof t.resource!="string"&&h(n+".resource","must be a string"),t.where!==void 0&&!E(t.where)&&h(n+".where","must be an object")}var ct=["Anyone","SiteMember","Admin"];function nr(t,e,r){let n=".api."+t;E(e)||h(n,"must be an object"),ct.indexOf(e.permission)===-1&&h(n+".permission","must be one of "+ct.join(", ")+" (got "+JSON.stringify(e.permission)+")"),e.ability!==void 0&&((!Array.isArray(e.ability)||e.ability.length!==2)&&h(n+".ability","must be [action, resource]"),(typeof e.ability[0]!="string"||typeof e.ability[1]!="string")&&h(n+".ability","both entries must be strings")),e.subject!==void 0&&r.indexOf(e.subject)===-1&&h(n+".subject",'"'+e.subject+'" is not declared in policy.subjects')}function K(t){if(!E(t))throw new M("policy must be an object");E(t.subjects)||h(".subjects","is required and must be an object");let e=Object.keys(t.subjects);e.length===0&&h(".subjects","declares no subjects");for(let r of e)tr(r,t.subjects[r]);if(Array.isArray(t.rules)||h(".rules","is required and must be an array"),t.rules.forEach((r,n)=>rr(r,n,e)),t.api!==void 0){E(t.api)||h(".api","must be an object");for(let r of Object.keys(t.api))nr(r,t.api[r],e)}return t.collections!==void 0&&!E(t.collections)&&h(".collections","must be an object"),t}function Z(t,e){let r=new Set(t.subjects||[]);for(let n of Object.keys(e.subjects)){let s=e.subjects[n];(s.when===I.ANYONE||s.when===I.ANONYMOUS&&!t.memberId||s.when===I.MEMBER&&t.memberId||s.role!==void 0&&t.roles.indexOf(s.role)!==-1||s.domain!==void 0&&t.domain[s.domain])&&r.add(n)}return Array.from(r)}function ut(t,e){let r=t.api&&t.api[e];return r?r.permission:null}var H=class{constructor(e,r){this.operator=e,this.value=r,Object.defineProperty(this,"t",{writable:!0})}get notes(){return this.t}addNote(e){this.t=this.t||[],this.t.push(e)}},L=class extends H{},S=class extends L{constructor(e,r){if(!Array.isArray(r))throw new Error(`"${e}" operator expects to receive an array of conditions`);super(e,r)}},N="__itself__",_=class extends H{constructor(e,r,n){super(e,n),this.field=r}},me=new L("__null__",null),he=Object.prototype.hasOwnProperty.call.bind(Object.prototype.hasOwnProperty);function sr(t,e){return e instanceof S&&e.operator===t}function ye(t,e){return e.length===1?e[0]:new S(t,(function r(n,s,o){let i=o||[];for(let c=0,u=s.length;c<u;c++){let l=s[c];sr(n,l)?r(n,l.value,i):i.push(l)}return i})(t,e))}var or=t=>t,lt=()=>Object.create(null),ft=Object.defineProperty(lt(),"__@type@__",{value:"ignore value"});function ir(t,e,r=!1){if(!t||t&&t.constructor!==Object)return!1;for(let n in t)if(he(t,n)&&he(e,n)&&(!r||t[n]!==ft))return!0;return!1}function ar(t){let e=[];for(let r in t)he(t,r)&&t[r]!==ft&&e.push(r);return e}function de(t,e){e!==me&&t.push(e)}var be=t=>ye("and",t);var Q={compound(t,e,r){let n=(Array.isArray(e)?e:[e]).map(s=>r.parse(s));return new S(t.name,n)},field:(t,e,r)=>new _(t.name,r.field,e),document:(t,e)=>new L(t.name,e)},B=class{constructor(e,r=lt()){this.o=void 0,this.s=void 0,this.i=void 0,this.u=void 0,this.h=void 0,this.parse=this.parse.bind(this),this.u={operatorToConditionName:r.operatorToConditionName||or,defaultOperatorName:r.defaultOperatorName||"eq",mergeFinalConditions:r.mergeFinalConditions||be},this.o=Object.keys(e).reduce((n,s)=>(n[s]=Object.assign({name:this.u.operatorToConditionName(s)},e[s]),n),{}),this.s=Object.assign({},r.fieldContext,{field:"",query:{},parse:this.parse,hasOperators:n=>ir(n,this.o,r.useIgnoreValue)}),this.i=Object.assign({},r.documentContext,{parse:this.parse,query:{}}),this.h=r.useIgnoreValue?ar:Object.keys}setParse(e){this.parse=e,this.s.parse=e,this.i.parse=e}parseField(e,r,n,s){let o=this.o[r];if(!o)throw new Error(`Unsupported operator "${r}"`);if(o.type!=="field")throw new Error(`Unexpected ${o.type} operator "${r}" at field level`);return this.s.field=e,this.s.query=s,this.parseInstruction(o,n,this.s)}parseInstruction(e,r,n){return typeof e.validate=="function"&&e.validate(e,r),(e.parse||Q[e.type])(e,r,n)}parseFieldOperators(e,r){let n=[],s=this.h(r);for(let o=0,i=s.length;o<i;o++){let c=s[o];if(!this.o[c])throw new Error(`Field query for "${e}" may contain only operators or a plain object as a value`);de(n,this.parseField(e,c,r[c],r))}return n}parse(e){let r=[],n=this.h(e);this.i.query=e;for(let s=0,o=n.length;s<o;s++){let i=n[s],c=e[i],u=this.o[i];if(u){if(u.type!=="document"&&u.type!=="compound")throw new Error(`Cannot use parsing instruction for operator "${i}" in "document" context as it is supposed to be used in "${u.type}" context`);de(r,this.parseInstruction(u,c,this.i))}else this.s.hasOperators(c)?r.push(...this.parseFieldOperators(i,c)):de(r,this.parseField(i,this.u.defaultOperatorName,c,e))}return this.u.mergeFinalConditions(r)}};function pe(t,e){let r=t[e];if(typeof r!="function")throw new Error(`Unable to interpret "${e}" condition. Did you forget to register interpreter for it?`);return r}function cr(t){return t.operator}function dt(t,e){let r=e,n=r&&r.getInterpreterName||cr,s;switch(r?r.numberOfArguments:0){case 1:s=i=>{let c=n(i,r);return pe(t,c)(i,o)};break;case 3:s=(i,c,u)=>{let l=n(i,r);return pe(t,l)(i,c,u,o)};break;default:s=(i,c)=>{let u=n(i,r);return pe(t,u)(i,c,o)}}let o=Object.assign({},r,{interpret:s});return o.interpret}function pt(t,e){return(r,...n)=>{let s=t(r,...n),o=e.bind(null,s);return o.ast=s,o}}var on=B.prototype.parseInstruction;function ht(t,e){if(!Array.isArray(e))throw new Error(`"${t.name}" expects value to be an array`)}function mt(t,e){if(ht(t,e),!e.length)throw new Error(`"${t.name}" expects to have at least one element in array`)}var ge=t=>(e,r)=>{if(typeof r!==t)throw new Error(`"${e.name}" expects value to be a "${t}"`)},yt={type:"compound",validate:mt,parse(t,e,{parse:r}){let n=e.map(s=>r(s));return ye(t.name,n)}},ur=yt,lr={type:"compound",validate:mt},fr={type:"field",validate(t,e){if(!(e&&(e instanceof RegExp||e.constructor===Object)))throw new Error(`"${t.name}" expects to receive either regular expression or object of field operators`)},parse(t,e,r){let n=e instanceof RegExp?new _("regex",r.field,e):r.parse(e,r);return new S(t.name,[n])}},xe={type:"field",validate(t,e){if(!e||e.constructor!==Object)throw new Error(`"${t.name}" expects to receive an object with nested query or field level operators`)},parse(t,e,{parse:r,field:n,hasOperators:s}){let o=s(e)?r(e,{field:N}):r(e);return new _(t.name,n,o)}},Oe={type:"field",validate:ge("number")},z={type:"field",validate:ht},ve=z,we=z,dr={type:"field",validate(t,e){if(!Array.isArray(e)||e.length!==2)throw new Error(`"${t.name}" expects an array with 2 numeric elements`)}},je={type:"field",validate:ge("boolean")},X={type:"field",validate:function(t,e){if(!(typeof e=="string"||typeof e=="number"||e instanceof Date))throw new Error(`"${t.name}" expects value to be comparable (i.e., string, number or date)`)}},G=X,Ae=G,$e=G,ee={type:"field"},Ee=ee,Ie={type:"field",validate(t,e){if(!(e instanceof RegExp)&&typeof e!="string")throw new Error(`"${t.name}" expects value to be a regular expression or a string that represents regular expression`)},parse(t,e,r){let n=typeof e=="string"?new RegExp(e,r.query.$options||""):e;return new _(t.name,r.field,n)}},Ne={type:"field",parse:()=>me},pr={type:"document",validate:ge("function")},hr=Object.freeze({__proto__:null,$and:yt,$or:ur,$nor:lr,$not:fr,$elemMatch:xe,$size:Oe,$in:z,$nin:ve,$all:we,$mod:dr,$exists:je,$gte:X,$gt:G,$lt:Ae,$lte:$e,$eq:ee,$ne:Ee,$regex:Ie,$options:Ne,$where:pr}),W=class extends B{constructor(e){super(e,{defaultOperatorName:"$eq",operatorToConditionName:r=>r.slice(1)})}parse(e,r){return r&&r.field?be(this.parseFieldOperators(r.field,e)):super.parse(e)}},te=hr;function Fe(t,e,r){for(let n=0,s=t.length;n<s;n++)if(r(t[n],e)===0)return!0;return!1}function Me(t,e){return Array.isArray(t)&&Number.isNaN(Number(e))}function bt(t,e,r){if(!Me(t,e))return r(t,e);let n=[];for(let s=0;s<t.length;s++){let o=r(t[s],e);o!==void 0&&(n=n.concat(o))}return n}function R(t){return(e,r,n)=>{let s=n.get(r,e.field);return Array.isArray(s)?s.some(o=>t(e,o,n)):t(e,s,n)}}var mr=Object.hasOwn||Object.prototype.hasOwnProperty.call.bind(Object.prototype.hasOwnProperty),yr=(t,e)=>t[e];function gt(t,e,r){let n=e.lastIndexOf(".");return n===-1?[t,e]:[r(t,e.slice(0,n)),e.slice(n+1)]}function br(t,e,r=yr){if(e===N)return t;if(!t)throw new Error(`Unable to get field "${e}" out of ${String(t)}.`);return(function(n,s,o){if(s.indexOf(".")===-1)return bt(n,s,o);let i=s.split("."),c=n;for(let u=0,l=i.length;u<l;u++)if(c=bt(c,i[u],o),!c||typeof c!="object")return u<l-1?void 0:c;return c})(t,e,r)}function Ce(t,e){return t===e?0:t>e?1:-1}function Se(t,e={}){return dt(t,Object.assign({get:br,compare:Ce},e))}var xt=(t,e,{interpret:r})=>t.value.some(n=>r(n,e)),gr=(t,e,r)=>!xt(t,e,r),_e=(t,e,{interpret:r})=>t.value.every(n=>r(n,e)),xr=(t,e,{interpret:r})=>!r(t.value[0],e),re=(t,e,{compare:r,get:n})=>{let s=n(e,t.field);return Array.isArray(s)&&!Array.isArray(t.value)?Fe(s,t.value,r):r(s,t.value)===0},Re=(t,e,r)=>!re(t,e,r),ke=R((t,e,r)=>{let n=r.compare(e,t.value);return n===0||n===-1}),De=R((t,e,r)=>r.compare(e,t.value)===-1),Pe=R((t,e,r)=>r.compare(e,t.value)===1),Te=R((t,e,r)=>{let n=r.compare(e,t.value);return n===0||n===1}),Ue=(t,e,{get:r})=>{if(t.field===N)return e!==void 0;let[n,s]=gt(e,t.field,r),o=i=>i==null?!!i===t.value:mr(i,s)===t.value;return Me(n,s)?n.some(o):o(n)},Or=R((t,e)=>typeof e=="number"&&e%t.value[0]===t.value[1]),qe=(t,e,{get:r})=>{let[n,s]=gt(e,t.field,r),o=i=>{let c=r(i,s);return Array.isArray(c)&&c.length===t.value};return t.field!==N&&Me(n,s)?n.some(o):o(n)},Le=R((t,e)=>typeof e=="string"&&t.value.test(e)),V=R((t,e,{compare:r})=>Fe(t.value,e,r)),Be=(t,e,r)=>!V(t,e,r),ze=(t,e,{compare:r,get:n})=>{let s=n(e,t.field);return Array.isArray(s)&&t.value.every(o=>Fe(s,o,r))},Ge=(t,e,{interpret:r,get:n})=>{let s=n(e,t.field);return Array.isArray(s)&&s.some(o=>r(t.value,o))},vr=(t,e)=>t.value.call(e),wr=Object.freeze({__proto__:null,or:xt,nor:gr,and:_e,not:xr,eq:re,ne:Re,lte:ke,lt:De,gt:Pe,gte:Te,exists:Ue,mod:Or,size:qe,regex:Le,within:V,nin:Be,all:ze,elemMatch:Ge,where:vr}),ne=Object.assign({},wr,{in:V}),dn=Se(ne);function Ot(t){return t===null||typeof t!="object"?t:t instanceof Date?t.getTime():t&&typeof t.toJSON=="function"?t.toJSON():t}var jr=(t,e)=>Ce(Ot(t),Ot(e));function se(t,e,r){let n=new W(t),s=Se(e,Object.assign({compare:jr},r));if(r&&r.forPrimitives){let o={field:N},i=n.parse;n.setParse(c=>i(c,o))}return pt(n.parse,s)}var bn=se(te,ne),gn=se(["$and","$or"].reduce((t,e)=>(t[e]=Object.assign({},t[e],{type:"field"}),t),Object.assign({},te,{$nor:Object.assign({},te.$nor,{type:"field",parse:Q.compound})})),ne,{forPrimitives:!0});var Et=Object.hasOwn||((t,e)=>Object.prototype.hasOwnProperty.call(t,e));function Ve(t){return Array.isArray(t)?t:[t]}var P="__caslSubjectType__";function It(t,e){if(e){if(!Et(e,P))Object.defineProperty(e,P,{value:t});else if(t!==e[P])throw new Error(`Trying to cast object to subject type ${t} but previously it was casted to ${e[P]}`)}return e}var ie=t=>{let e=typeof t;return e==="string"||e==="function"},Nt=t=>t.modelName||t.name;function Ar(t){return typeof t=="string"?t:Nt(t)}function Ft(t){return Et(t,P)?t[P]:Nt(t.constructor)}var vt={function:t=>t.constructor,string:Ft};function wt(t,e,r){for(let n=r;n<e.length;n++)t.push(e[n])}function jt(t,e){if(!t||!t.length)return e||[];if(!e||!e.length)return t||[];let r=0,n=0,s=[];for(;r<t.length&&n<e.length;)t[r].priority<e[n].priority?(s.push(t[r]),r++):t[r].priority>e[n].priority?(s.push(e[n]),n++):(s.push(t[r]),r++,n++);return wt(s,t,r),wt(s,e,n),s}function oe(t,e,r){let n=t.get(e);return n||(n=r(),t.set(e,n)),n}var $r=t=>t;function Er(t,e){let r;for(let n=0;n<t.length;n++){let s=e(t[n]);r&&s&&r.push(t[n]),s||(r??=t.slice(0,n))}return r||t}function Ir(t,e){if(Array.isArray(t.fields)&&!t.fields.length)throw new Error("`rawRule.fields` cannot be an empty array. https://bit.ly/390miLa");if(t.fields&&!e.fieldMatcher)throw new Error('You need to pass "fieldMatcher" option in order to restrict access by fields');if(t.conditions&&!e.conditionsMatcher)throw new Error('You need to pass "conditionsMatcher" option in order to restrict access by conditions')}var Ye=class{constructor(e,r,n=0){Ir(e,r),this.action=r.resolveAction(e.action),this.subject=e.subject,this.inverted=!!e.inverted,this.conditions=e.conditions,this.reason=e.reason,this.origin=e,this.fields=e.fields?Ve(e.fields):void 0,this.priority=n,this.t=r}i(){return this.conditions&&!this.o&&(this.o=this.t.conditionsMatcher(this.conditions)),this.o}get ast(){let e=this.i();return e?e.ast:void 0}matchesConditions(e){return this.conditions?!e||ie(e)?!this.inverted:this.i()(e):!0}matchesField(e){return this.fields?e?(this.u||(this.u=this.t.fieldMatcher(this.fields)),this.u(e)):!this.inverted:!0}};function Nr(t,e){let r={value:t,prev:e,next:null};return e&&(e.next=r),r}function Fr(t){t.next&&(t.next.prev=t.prev),t.prev&&(t.prev.next=t.next),t.next=t.prev=null}var At=()=>({rules:[],merged:!1}),$t=()=>new Map,Je=class{constructor(e=[],r={}){this.h=!1,this.l=new Map,this.p={conditionsMatcher:r.conditionsMatcher,fieldMatcher:r.fieldMatcher,resolveAction:r.resolveAction||$r},this.$=r.anyAction||"manage",this.A=r.anySubjectType||"all",this.m=e,this.M=!!r.detectSubjectType,this.j=r.detectSubjectType||Ft,this.v(e)}get rules(){return this.m}detectSubjectType(e){return ie(e)?e:e?this.j(e):this.A}update(e){let r={rules:e,ability:this,target:this};return this._("update",r),this.m=e,this.v(e),this._("updated",r),this}v(e){let r=new Map,n;for(let s=e.length-1;s>=0;s--){let o=e.length-s-1,i=new Ye(e[s],this.p,o),c=Ve(i.action),u=Ve(i.subject||this.A);!this.h&&i.fields&&(this.h=!0);for(let l=0;l<u.length;l++){let a=oe(r,u[l],$t);n===void 0&&(n=typeof u[l]),typeof u[l]!==n&&n!=="mixed"&&(n="mixed");for(let d=0;d<c.length;d++)oe(a,c[d],At).rules.push(i)}}if(this.l=r,n!=="mixed"&&!this.M){let s=vt[n]||vt.string;this.j=s}}possibleRulesFor(e,r=this.A){if(!ie(r))throw new Error('"possibleRulesFor" accepts only subject types (i.e., string or class) as the 2nd parameter');let n=oe(this.l,r,$t),s=oe(n,e,At);if(s.merged)return s.rules;let o=e!==this.$&&n.has(this.$)?n.get(this.$).rules:void 0,i=jt(s.rules,o);return r!==this.A&&(i=jt(i,this.possibleRulesFor(e,this.A))),s.rules=i,s.merged=!0,i}rulesFor(e,r,n){let s=this.possibleRulesFor(e,r);if(n&&typeof n!="string")throw new Error("The 3rd, `field` parameter is expected to be a string. See https://stalniy.github.io/casl/en/api/casl-ability#can-of-pure-ability for details");return this.h?Er(s,o=>o.matchesField(n)):s}actionsFor(e){if(!ie(e))throw new Error('"actionsFor" accepts only subject types (i.e., string or class) as a parameter');let r=new Set,n=this.l.get(e);n&&Array.from(n.keys()).forEach(o=>r.add(o));let s=e!==this.A?this.l.get(this.A):void 0;return s&&Array.from(s.keys()).forEach(o=>r.add(o)),Array.from(r)}on(e,r){this.F=this.F||new Map;let n=this.F,s=n.get(e)||null,o=Nr(r,s);return n.set(e,o),()=>{let i=n.get(e);!o.next&&!o.prev&&i===o?n.delete(e):o===i&&n.set(e,o.prev),Fr(o)}}_(e,r){if(!this.F)return;let n=this.F.get(e)||null,s=[];for(;n!==null;)s.push(n.value),n=n.prev;for(let o=0;o<s.length;o++)s[o](r)}},Ke=class extends Je{can(e,r,n){let s=this.relevantRuleFor(e,r,n);return!!s&&!s.inverted}relevantRuleFor(e,r,n){let s=this.detectSubjectType(r),o=this.rulesFor(e,s,n);for(let i=0,c=o.length;i<c;i++)if(o[i].matchesConditions(r))return o[i];return null}cannot(e,r,n){return!this.can(e,r,n)}},Mr={$eq:ee,$ne:Ee,$lt:Ae,$lte:$e,$gt:G,$gte:X,$in:z,$nin:ve,$all:we,$size:Oe,$regex:Ie,$options:Ne,$elemMatch:xe,$exists:je},Cr={eq:re,ne:Re,lt:De,lte:ke,gt:Pe,gte:Te,in:V,nin:Be,all:ze,size:qe,regex:Le,elemMatch:Ge,exists:Ue,and:_e};var Sr=se(Mr,Cr),_r=/[-/\\^$+?.()|[\]{}]/g,Rr=/\.?\*+\.?/g,kr=/\*+/,Dr=/\./g;function Pr(t,e,r){let n=r[0]==="*"||t[0]==="."&&t[t.length-1]==="."?"+":"*",s=t.indexOf("**")===-1?"[^.]":".",o=t.replace(Dr,"\\$&").replace(kr,s+n);return e+t.length===r.length?`(?:${o})?`:o}function Tr(t,e,r){return t==="."&&(r[e-1]==="*"||r[e+1]==="*")?t:`\\${t}`}function Ur(t){let e=t.map(n=>n.replace(_r,Tr).replace(Rr,Pr)),r=e.length>1?`(?:${e.join("|")})`:e[0];return new RegExp(`^${r}$`)}var qr=t=>{let e;return r=>(typeof e>"u"&&(e=t.every(n=>n.indexOf("*")===-1)?null:Ur(t)),e===null?t.indexOf(r)!==-1:e.test(r))};function Mt(t=[],e={}){return new Ke(t,Object.assign({conditionsMatcher:Sr,fieldMatcher:qr},e))}var Lr=t=>`Cannot execute "${t.action}" on "${t.subjectType}"`,Ct=function(e){this.message=e};Ct.prototype=Object.create(Error.prototype);var Ze=class extends Ct{static setDefaultMessage(e){this.P=typeof e=="string"?()=>e:e}static from(e){return new this(e)}constructor(e){super(""),this.ability=e,typeof Error.captureStackTrace=="function"&&(this.name="ForbiddenError",Error.captureStackTrace(this,this.constructor))}setMessage(e){return this.message=e,this}throwUnlessCan(e,r,n){let s=this.unlessCan(e,r,n);if(s)throw s}unlessCan(e,r,n){let s=this.ability.relevantRuleFor(e,r,n);if(s&&!s.inverted)return;this.action=e,this.subject=r,this.subjectType=Ar(this.ability.detectSubjectType(r)),this.field=n;let o=s?s.reason:"";return this.message=this.message||o||this.constructor.P(this),this}};Ze.P=Lr;var An=Object.freeze({__proto__:null});function He(t,e,r){if(t==null)return t;if(typeof t=="string"){if(t.indexOf("$principal.")!==0)return t;let s=t.slice(11).split(".").reduce((o,i)=>o==null?o:o[i],e);return s==null&&(r.unresolved=!0),s}if(Array.isArray(t))return t.map(n=>He(n,e,r));if(typeof t=="object"){let n={};for(let s of Object.keys(t))n[s]=He(t[s],e,r);return n}return t}function ae(t,e){let r={unresolved:!1};return{conditions:He(t,e,r),unresolved:r.unresolved}}function St(t,e){return ae(t,e).conditions}function k(t,e){let r=Z(t,e),n=[];for(let s of e.rules){if(r.indexOf(s.subject)===-1)continue;let o={action:s.actions,subject:s.resource};if(s.where){let{conditions:i,unresolved:c}=ae(s.where,t);if(c)continue;o.conditions=i}n.push(o)}return n}function Qe(t){return Mt(Array.isArray(t)?t:[])}function ce(t,e){return Qe(k(t,e))}function v(t,e,r,n){return n==null?t.can(e,r):t.can(e,It(r,Object.assign({},n)))}var w={ALL:"all",NONE:"none",FIELDS:"fields",AMBIGUOUS:"ambiguous"},_t={$in:"in",$nin:"nin",$ne:"ne",$gt:"gt",$gte:"gte",$lt:"lt",$lte:"lte"};function Br(t){let e=[];for(let r of Object.keys(t)){let n=t[r];if(n===null||typeof n!="object"||Array.isArray(n)){e.push({field:r,op:"eq",value:n});continue}let s=Object.keys(n);if(s.length!==1||!_t[s[0]])return null;e.push({field:r,op:_t[s[0]],value:n[s[0]]})}return e}var zr=(t,e)=>t==="manage"||t===e||Array.isArray(t)&&(t.indexOf(e)!==-1||t.indexOf("manage")!==-1),Gr=(t,e)=>t==="all"||t===e;function ue(t,e,r,n){let s=k(t,e).filter(i=>zr(i.action,r)&&Gr(i.subject,n));if(s.length===0)return{scope:w.NONE,clauses:[]};if(s.some(i=>!i.conditions))return{scope:w.ALL,clauses:[]};if(s.length>1)return{scope:w.AMBIGUOUS,clauses:[]};let o=Br(s[0].conditions);return o?{scope:w.FIELDS,clauses:o}:{scope:w.AMBIGUOUS,clauses:[]}}function le(t,e){let r=t;for(let n of e)n.op==="in"?r=r.hasSome(n.field,n.value):n.op==="nin"?r=r.not(r.hasSome(n.field,n.value)):r=r[n.op](n.field,n.value);return r}var We=/export\s+const\s+([A-Za-z0-9_$]+)\s*=\s*webMethod\s*\(\s*Permissions\s*\.\s*([A-Za-z0-9_$]+)/g,Vr=[[/export\s*{\s*[A-Za-z0-9_$,\s]+}/,"export { x } \u2014 the call and the export must be one statement"],[/export\s+const\s+[A-Za-z0-9_$]+\s*=\s*webMethod\s*\(\s*Permissions\s*\[/,"Permissions['X'] \u2014 the property must be dotted and literal"],[/export\s+const\s+[A-Za-z0-9_$]+\s*=\s*webMethod\s*\(\s*[A-Za-z0-9_$]+\s*\(/,"a computed permission \u2014 it must be written out as Permissions.LEVEL"]];function Xe(t){let e={},r=String(t||"");We.lastIndex=0;let n=We.exec(r);for(;n;)e[n[1]]=n[2],n=We.exec(r);return e}function et(t,e,r){let n=r||{},s=e&&e.api||{},o=Xe(t),i=String(t||""),c=[],u=[];for(let f of Object.keys(o)){let p=s[f];p?p.permission!==o[f]&&c.push({name:f,declared:p.permission,written:o[f]}):u.push({name:f,gate:o[f]})}let l=n.complete?Object.keys(s).filter(f=>!(f in o)):[],a=[];for(let[f,p]of Vr)f.test(i)&&a.push(p);return{ok:c.length+u.length+l.length+a.length===0,found:o,mismatched:c,undeclared:u,missing:l,suspect:a}}function Rt(t,e,r){let n=et(t,e,r);if(n.ok)return!0;let s=[];for(let o of n.mismatched)s.push(o.name+": policy says "+o.declared+", the export says "+o.written);for(let o of n.undeclared)s.push(o.name+": gated "+o.gate+" but missing from policy.api");for(let o of n.missing)s.push(o+": declared in policy.api but not exported here");for(let o of n.suspect)s.push("unreachable export shape \u2014 "+o);throw new Error(`wix-access: web-method gates do not match the policy:
|
|
2
2
|
`+s.join(`
|
|
3
|
-
`))}var tt="0.3.
|
|
3
|
+
`))}var tt="0.3.2";var rt=[{action:"read",type:"Booking",object:{customerId:"m-1"}},{action:"read",type:"Booking",object:{customerId:"m-2"}},{action:"cancel",type:"Booking",object:{customerId:"m-1"}},{action:"delete",type:"Booking",object:{customerId:"m-1"}},{action:"manage",type:"Vendor",object:{_id:"v-1"}}];function kt(t){return rt.map(e=>({action:e.action,type:e.type,object:e.object,can:v(t,e.action,e.type,e.object)}))}function Dt(t,e){let{wixUsers:r,currentMember:n}=t,s=e&&e.enrich||null,o=e&&e.onError||null;return async function(){let c=null,u=!1,l=!1;try{c=r.currentUser&&r.currentUser.id||null,u=!!(r.currentUser&&r.currentUser.loggedIn)}catch(f){l=!0,o&&o("resolveCaller.id",f)}let a=[];if(c)try{a=await n.getRoles()}catch(f){l=!0,o&&o("resolveCaller.roles",f)}let d=q({kind:c?$.MEMBER:$.VISITOR,memberId:c,roles:a,unverified:l});if(d.loggedIn=u,s)try{let f=await s(d);f&&typeof f=="object"&&(d.domain=f)}catch(f){d.unverified=!0,o&&o("resolveCaller.enrich",f)}return d}}var Yr="Admin";function Pt(t,e,r){let n=r.resolveCaller,s=r.abilityFor,o=r.audit||null;function i(u,l,a,d){return o&&o({event:"access.denied",action:u,code:l,caller:a?a.memberId:null,detail:d||null}),C(l,u)}function c(u,l,a){return l==="Anyone"?null:a.memberId?l==="Admin"&&!J(a,Yr)?i(u,O.FORBIDDEN,a,{gate:l}):null:i(u,O.UNAUTHENTICATED,a)}return function(l,a,d){let f=t.api&&t.api[l]||null;if(!f)throw new Error('wix-access: web method "'+l+'" is not declared in policy.api. Add it, or the gate it runs behind is undocumented.');let p=d||{},y=f.permission,b=f.ability||null,m=p.strip||[];return async function(...x){let g=await n();if(g.unverified)return i(l,O.UNVERIFIED,g);let F=c(l,y,g);if(F)return F;let T=x.map(A=>{if(!A||typeof A!="object"||Array.isArray(A))return A;let U=Object.assign({},A);for(let Vt of m)delete U[Vt];return U}),D=null;if(b){let[A,U]=b;if(p.load){if(D=await p.load(...T),!D)return i(l,O.NOT_FOUND,g);if(!v(s(g),A,U,D))return j(l)}else if(!v(s(g),A,U))return i(l,O.FORBIDDEN,g)}return a({principal:g,subject:D},...T)}}}function Tt(t,e){let r=Object.keys(t&&t.api||{}),n=e.filter(s=>r.indexOf(s)===-1);if(n.length)throw new Error("wix-access: web methods missing from policy.api: "+n.join(", "));return!0}var Ut=100,Jr=100;function qt(t,e,r){let{items:n,auth:s}=e,o=r.abilityFor,i={query:(...a)=>s.elevate(n.query)(...a),get:(...a)=>s.elevate(n.get)(...a),insert:(...a)=>s.elevate(n.insert)(...a),update:(...a)=>s.elevate(n.update)(...a),remove:(...a)=>s.elevate(n.remove)(...a)},c=a=>{let d=t.collections&&t.collections[a]||null;return d&&d.owner?d.owner:null},u=a=>{let d=t.collections&&t.collections[a]||null;return d&&d.resource||a};async function l(a,d){let f=[],p=await a.limit(Math.min(d||Ut,Ut)).find(),y=0;for(;p;){for(let b of p.items)f.push(b);if(d&&f.length>=d)return f.slice(0,d);if(!p.hasNext||!p.hasNext()||++y>=Jr)break;p=await p.next()}return f}return{async query(a,d){let{principal:f,action:p="read",limit:y}=d,b=u(a),m=ue(f,t,p,b);if(m.scope===w.NONE)return{ok:!0,data:[],scope:m.scope};let x=i.query(a);m.scope===w.FIELDS&&(x=le(x,m.clauses));let g=await l(x,m.scope===w.AMBIGUOUS?null:y);if(m.scope!==w.AMBIGUOUS)return{ok:!0,data:g,scope:m.scope};let F=o(f),T=g.filter(D=>v(F,p,b,D));return{ok:!0,data:y?T.slice(0,y):T,scope:m.scope}},async get(a,d,f){let{principal:p,action:y="read"}=f,b=u(a),m=await i.get(a,d);return m?v(o(p),y,b,m)?{ok:!0,data:m}:j(y):j(y)},async insert(a,d,f){let{principal:p,action:y="create"}=f,b=u(a),m=c(a),x=Object.assign({},d);return m&&p.memberId&&(x[m]=p.memberId),v(o(p),y,b,x)?{ok:!0,data:await i.insert(a,x)}:C(O.FORBIDDEN,y)},async update(a,d,f,p){let{principal:y,action:b="update"}=p,m=u(a),x=await i.get(a,d);if(!x)return j(b);if(!v(o(y),b,m,x))return j(b);let g=c(a),F=Object.assign({},x,f,{_id:d});return g&&(F[g]=x[g]),{ok:!0,data:await i.update(a,F)}},async remove(a,d,f){let{principal:p,action:y="delete"}=f,b=u(a),m=await i.get(a,d);return m?v(o(p),y,b,m)?{ok:!0,data:await i.remove(a,d)}:j(y):j(y)}}}function Lt(t,e,r){K(t);let n=r||{},s=Dt(e,{enrich:n.enrich,onError:n.onError}),o=u=>ce(u,t),i=Pt(t,e,{resolveCaller:s,abilityFor:o,audit:n.audit}),c=qt(t,e,{abilityFor:o});return{policy:t,resolveCaller:s,abilityFor:o,guard:i,db:c,gateFor:u=>{let l=t.api&&t.api[u]||null;return l?l.permission:null},rulesForCaller:async()=>k(await s(),t)}}function Kr(t,e){let r=e||{},n=Object.assign({wixUsers:Bt.default,currentMember:nt.currentMember,items:zt.items,auth:Gt.auth},r.deps||{});return Lt(t,n,r)}function Zr(){return{ok:!0,side:"backend",version:tt}}async function Hr(){try{let t=await nt.currentMember.getMember();return t&&t._id||null}catch{return null}}0&&(module.exports={CASES,CODES,KIND,PACKAGE_VERSION,PolicyError,SCOPE,WHEN,abilityFor,abilityFromRules,anonymous,applyClauses,assertDeclared,assertGates,backendMemberId,backendPing,can,caseTable,createAccess,createPrincipal,deny,denyOpaque,filterFor,hasRole,isDenial,normaliseRoles,ok,parseGates,permissionFor,resolvePlaceholders,resolveSubjects,resolveWhere,rulesFor,validatePolicy,verifyGates});
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@liquisio/wix-access",
|
|
3
|
-
"version": "0.3.
|
|
3
|
+
"version": "0.3.2",
|
|
4
4
|
"description": "One authorization policy for Wix, serving the web-method gate, backend, database and page code. Built against measured platform behaviour.",
|
|
5
5
|
"main": "./index.js",
|
|
6
6
|
"types": "./types.d.ts",
|
package/public.js
CHANGED
|
@@ -1,3 +1,3 @@
|
|
|
1
|
-
var Q=Object.defineProperty;var _t=Object.getOwnPropertyDescriptor;var Rt=Object.getOwnPropertyNames;var Pt=Object.prototype.hasOwnProperty;var Tt=(t,e)=>{for(var s in e)Q(t,s,{get:e[s],enumerable:!0})},kt=(t,e,s,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let r of Rt(e))!Pt.call(t,r)&&r!==s&&Q(t,r,{get:()=>e[r],enumerable:!(n=_t(e,r))||n.enumerable});return t};var Dt=t=>kt(Q({},"__esModule",{value:!0}),t);var _s={};Tt(_s,{CASES:()=>Ve,CODES:()=>E,KIND:()=>F,PACKAGE_VERSION:()=>Be,PolicyError:()=>x,SCOPE:()=>w,WHEN:()=>y,abilityFor:()=>wt,abilityFromRules:()=>N,anonymous:()=>Ke,applyClauses:()=>It,assertGates:()=>Nt,can:()=>$,caseTable:()=>Ft,createAccess:()=>St,createPrincipal:()=>ee,deny:()=>W,denyOpaque:()=>He,filterFor:()=>Et,frontendRoleTitles:()=>Cs,hasRole:()=>Qe,isDenial:()=>Ze,normaliseRoles:()=>X,ok:()=>Je,parseGates:()=>qe,permissionFor:()=>et,publicPing:()=>Ss,resolvePlaceholders:()=>$t,resolveSubjects:()=>k,resolveWhere:()=>H,rulesFor:()=>P,validatePolicy:()=>Xe,verifyGates:()=>ze});module.exports=Dt(_s);var Ct=require("wix-members-frontend");var E={FORBIDDEN:"FORBIDDEN",UNAUTHENTICATED:"UNAUTHENTICATED",UNVERIFIED:"UNVERIFIED",NOT_FOUND:"NOT_FOUND",INVALID_POLICY:"INVALID_POLICY",INVALID_ARGUMENT:"INVALID_ARGUMENT"},x=class extends Error{constructor(e){super(e),this.name="PolicyError",this.code=E.INVALID_POLICY}};function Je(t){return{ok:!0,data:t===void 0?null:t}}function W(t,e,s){let n={ok:!1,code:t||E.FORBIDDEN};return e&&(n.action=e),s&&(n.detail=s),n}var Ze=t=>!!t&&t.ok===!1;function He(t){return W(E.NOT_FOUND,t)}var F={VISITOR:"visitor",MEMBER:"member",CAPABILITY:"capability",SERVICE:"service"};function X(t){if(!Array.isArray(t))return[];let e=[];for(let s of t){if(typeof s=="string"){e.push(s);continue}if(!s||typeof s!="object")continue;let n=s.title||s.name||s.roleKey;n&&e.push(n)}return e}function ee(t){let e=t||{},s=e.memberId||null,n=X(e.roles);return{kind:e.kind||(s?F.MEMBER:F.VISITOR),memberId:s,roles:n,subjects:Array.isArray(e.subjects)?e.subjects.slice():[],domain:e.domain&&typeof e.domain=="object"?e.domain:{},unverified:!!e.unverified}}var Ke=()=>ee({kind:F.VISITOR}),Qe=(t,e)=>t.roles.indexOf(e)!==-1;var y={ANYONE:"anyone",ANONYMOUS:"anonymous",MEMBER:"member"},m=t=>!!t&&typeof t=="object"&&!Array.isArray(t),Ut=t=>Array.isArray(t)?t:[t];function l(t,e){throw new x("policy"+t+": "+e)}function Lt(t,e){let s=".subjects."+t;m(e)||l(s,"must be an object");let r=["when","role","domain"].filter(o=>e[o]!==void 0);if(r.length===0&&l(s,'needs exactly one of when/role/domain \u2014 "{}" is ambiguous between a visitor and a member'),r.length>1&&l(s,"has "+r.join(" and ")+"; use exactly one"),e.when!==void 0){let o=[y.ANYONE,y.ANONYMOUS,y.MEMBER];o.indexOf(e.when)===-1&&l(s+".when","must be one of "+o.join(", ")+" (got "+JSON.stringify(e.when)+")")}e.role!==void 0&&typeof e.role!="string"&&l(s+".role","must be a string"),e.domain!==void 0&&typeof e.domain!="string"&&l(s+".domain","must be a string")}function qt(t,e,s){let n=".rules["+e+"]";m(t)||l(n,"must be an object"),typeof t.subject!="string"&&l(n+".subject","must be a string"),s.indexOf(t.subject)===-1&&l(n+".subject",'"'+t.subject+'" is not declared in policy.subjects'),t.actions===void 0&&l(n+".actions","is required");for(let r of Ut(t.actions))typeof r!="string"&&l(n+".actions","must be a string or an array of strings");typeof t.resource!="string"&&l(n+".resource","must be a string"),t.where!==void 0&&!m(t.where)&&l(n+".where","must be an object")}var We=["Anyone","SiteMember","Admin"];function zt(t,e,s){let n=".api."+t;m(e)||l(n,"must be an object"),We.indexOf(e.permission)===-1&&l(n+".permission","must be one of "+We.join(", ")+" (got "+JSON.stringify(e.permission)+")"),e.ability!==void 0&&((!Array.isArray(e.ability)||e.ability.length!==2)&&l(n+".ability","must be [action, resource]"),(typeof e.ability[0]!="string"||typeof e.ability[1]!="string")&&l(n+".ability","both entries must be strings")),e.subject!==void 0&&s.indexOf(e.subject)===-1&&l(n+".subject",'"'+e.subject+'" is not declared in policy.subjects')}function Xe(t){if(!m(t))throw new x("policy must be an object");m(t.subjects)||l(".subjects","is required and must be an object");let e=Object.keys(t.subjects);e.length===0&&l(".subjects","declares no subjects");for(let s of e)Lt(s,t.subjects[s]);if(Array.isArray(t.rules)||l(".rules","is required and must be an array"),t.rules.forEach((s,n)=>qt(s,n,e)),t.api!==void 0){m(t.api)||l(".api","must be an object");for(let s of Object.keys(t.api))zt(s,t.api[s],e)}return t.collections!==void 0&&!m(t.collections)&&l(".collections","must be an object"),t}function k(t,e){let s=new Set(t.subjects||[]);for(let n of Object.keys(e.subjects)){let r=e.subjects[n];(r.when===y.ANYONE||r.when===y.ANONYMOUS&&!t.memberId||r.when===y.MEMBER&&t.memberId||r.role!==void 0&&t.roles.indexOf(r.role)!==-1||r.domain!==void 0&&t.domain[r.domain])&&s.add(n)}return Array.from(s)}function et(t,e){let s=t.api&&t.api[e];return s?s.permission:null}var D=class{constructor(e,s){this.operator=e,this.value=s,Object.defineProperty(this,"t",{writable:!0})}get notes(){return this.t}addNote(e){this.t=this.t||[],this.t.push(e)}},M=class extends D{},O=class extends M{constructor(e,s){if(!Array.isArray(s))throw new Error(`"${e}" operator expects to receive an array of conditions`);super(e,s)}},b="__itself__",j=class extends D{constructor(e,s,n){super(e,n),this.field=s}},re=new M("__null__",null),ne=Object.prototype.hasOwnProperty.call.bind(Object.prototype.hasOwnProperty);function Bt(t,e){return e instanceof O&&e.operator===t}function oe(t,e){return e.length===1?e[0]:new O(t,(function s(n,r,o){let i=o||[];for(let a=0,u=r.length;a<u;a++){let f=r[a];Bt(n,f)?s(n,f.value,i):i.push(f)}return i})(t,e))}var Vt=t=>t,tt=()=>Object.create(null),st=Object.defineProperty(tt(),"__@type@__",{value:"ignore value"});function Gt(t,e,s=!1){if(!t||t&&t.constructor!==Object)return!1;for(let n in t)if(ne(t,n)&&ne(e,n)&&(!s||t[n]!==st))return!0;return!1}function Yt(t){let e=[];for(let s in t)ne(t,s)&&t[s]!==st&&e.push(s);return e}function te(t,e){e!==re&&t.push(e)}var ie=t=>oe("and",t);var U={compound(t,e,s){let n=(Array.isArray(e)?e:[e]).map(r=>s.parse(r));return new O(t.name,n)},field:(t,e,s)=>new j(t.name,s.field,e),document:(t,e)=>new M(t.name,e)},S=class{constructor(e,s=tt()){this.o=void 0,this.s=void 0,this.i=void 0,this.u=void 0,this.h=void 0,this.parse=this.parse.bind(this),this.u={operatorToConditionName:s.operatorToConditionName||Vt,defaultOperatorName:s.defaultOperatorName||"eq",mergeFinalConditions:s.mergeFinalConditions||ie},this.o=Object.keys(e).reduce((n,r)=>(n[r]=Object.assign({name:this.u.operatorToConditionName(r)},e[r]),n),{}),this.s=Object.assign({},s.fieldContext,{field:"",query:{},parse:this.parse,hasOperators:n=>Gt(n,this.o,s.useIgnoreValue)}),this.i=Object.assign({},s.documentContext,{parse:this.parse,query:{}}),this.h=s.useIgnoreValue?Yt:Object.keys}setParse(e){this.parse=e,this.s.parse=e,this.i.parse=e}parseField(e,s,n,r){let o=this.o[s];if(!o)throw new Error(`Unsupported operator "${s}"`);if(o.type!=="field")throw new Error(`Unexpected ${o.type} operator "${s}" at field level`);return this.s.field=e,this.s.query=r,this.parseInstruction(o,n,this.s)}parseInstruction(e,s,n){return typeof e.validate=="function"&&e.validate(e,s),(e.parse||U[e.type])(e,s,n)}parseFieldOperators(e,s){let n=[],r=this.h(s);for(let o=0,i=r.length;o<i;o++){let a=r[o];if(!this.o[a])throw new Error(`Field query for "${e}" may contain only operators or a plain object as a value`);te(n,this.parseField(e,a,s[a],s))}return n}parse(e){let s=[],n=this.h(e);this.i.query=e;for(let r=0,o=n.length;r<o;r++){let i=n[r],a=e[i],u=this.o[i];if(u){if(u.type!=="document"&&u.type!=="compound")throw new Error(`Cannot use parsing instruction for operator "${i}" in "document" context as it is supposed to be used in "${u.type}" context`);te(s,this.parseInstruction(u,a,this.i))}else this.s.hasOperators(a)?s.push(...this.parseFieldOperators(i,a)):te(s,this.parseField(i,this.u.defaultOperatorName,a,e))}return this.u.mergeFinalConditions(s)}};function se(t,e){let s=t[e];if(typeof s!="function")throw new Error(`Unable to interpret "${e}" condition. Did you forget to register interpreter for it?`);return s}function Jt(t){return t.operator}function nt(t,e){let s=e,n=s&&s.getInterpreterName||Jt,r;switch(s?s.numberOfArguments:0){case 1:r=i=>{let a=n(i,s);return se(t,a)(i,o)};break;case 3:r=(i,a,u)=>{let f=n(i,s);return se(t,f)(i,a,u,o)};break;default:r=(i,a)=>{let u=n(i,s);return se(t,u)(i,a,o)}}let o=Object.assign({},s,{interpret:r});return o.interpret}function rt(t,e){return(s,...n)=>{let r=t(s,...n),o=e.bind(null,r);return o.ast=r,o}}var qs=S.prototype.parseInstruction;function ot(t,e){if(!Array.isArray(e))throw new Error(`"${t.name}" expects value to be an array`)}function it(t,e){if(ot(t,e),!e.length)throw new Error(`"${t.name}" expects to have at least one element in array`)}var ae=t=>(e,s)=>{if(typeof s!==t)throw new Error(`"${e.name}" expects value to be a "${t}"`)},at={type:"compound",validate:it,parse(t,e,{parse:s}){let n=e.map(r=>s(r));return oe(t.name,n)}},Zt=at,Ht={type:"compound",validate:it},Kt={type:"field",validate(t,e){if(!(e&&(e instanceof RegExp||e.constructor===Object)))throw new Error(`"${t.name}" expects to receive either regular expression or object of field operators`)},parse(t,e,s){let n=e instanceof RegExp?new j("regex",s.field,e):s.parse(e,s);return new O(t.name,[n])}},ce={type:"field",validate(t,e){if(!e||e.constructor!==Object)throw new Error(`"${t.name}" expects to receive an object with nested query or field level operators`)},parse(t,e,{parse:s,field:n,hasOperators:r}){let o=r(e)?s(e,{field:b}):s(e);return new j(t.name,n,o)}},ue={type:"field",validate:ae("number")},C={type:"field",validate:ot},le=C,fe=C,Qt={type:"field",validate(t,e){if(!Array.isArray(e)||e.length!==2)throw new Error(`"${t.name}" expects an array with 2 numeric elements`)}},pe={type:"field",validate:ae("boolean")},q={type:"field",validate:function(t,e){if(!(typeof e=="string"||typeof e=="number"||e instanceof Date))throw new Error(`"${t.name}" expects value to be comparable (i.e., string, number or date)`)}},_=q,de=_,he=_,z={type:"field"},me=z,ye={type:"field",validate(t,e){if(!(e instanceof RegExp)&&typeof e!="string")throw new Error(`"${t.name}" expects value to be a regular expression or a string that represents regular expression`)},parse(t,e,s){let n=typeof e=="string"?new RegExp(e,s.query.$options||""):e;return new j(t.name,s.field,n)}},be={type:"field",parse:()=>re},Wt={type:"document",validate:ae("function")},Xt=Object.freeze({__proto__:null,$and:at,$or:Zt,$nor:Ht,$not:Kt,$elemMatch:ce,$size:ue,$in:C,$nin:le,$all:fe,$mod:Qt,$exists:pe,$gte:q,$gt:_,$lt:de,$lte:he,$eq:z,$ne:me,$regex:ye,$options:be,$where:Wt}),L=class extends S{constructor(e){super(e,{defaultOperatorName:"$eq",operatorToConditionName:s=>s.slice(1)})}parse(e,s){return s&&s.field?ie(this.parseFieldOperators(s.field,e)):super.parse(e)}},B=Xt;function ge(t,e,s){for(let n=0,r=t.length;n<r;n++)if(s(t[n],e)===0)return!0;return!1}function xe(t,e){return Array.isArray(t)&&Number.isNaN(Number(e))}function ct(t,e,s){if(!xe(t,e))return s(t,e);let n=[];for(let r=0;r<t.length;r++){let o=s(t[r],e);o!==void 0&&(n=n.concat(o))}return n}function v(t){return(e,s,n)=>{let r=n.get(s,e.field);return Array.isArray(r)?r.some(o=>t(e,o,n)):t(e,r,n)}}var es=Object.hasOwn||Object.prototype.hasOwnProperty.call.bind(Object.prototype.hasOwnProperty),ts=(t,e)=>t[e];function ut(t,e,s){let n=e.lastIndexOf(".");return n===-1?[t,e]:[s(t,e.slice(0,n)),e.slice(n+1)]}function ss(t,e,s=ts){if(e===b)return t;if(!t)throw new Error(`Unable to get field "${e}" out of ${String(t)}.`);return(function(n,r,o){if(r.indexOf(".")===-1)return ct(n,r,o);let i=r.split("."),a=n;for(let u=0,f=i.length;u<f;u++)if(a=ct(a,i[u],o),!a||typeof a!="object")return u<f-1?void 0:a;return a})(t,e,s)}function Oe(t,e){return t===e?0:t>e?1:-1}function je(t,e={}){return nt(t,Object.assign({get:ss,compare:Oe},e))}var lt=(t,e,{interpret:s})=>t.value.some(n=>s(n,e)),ns=(t,e,s)=>!lt(t,e,s),ve=(t,e,{interpret:s})=>t.value.every(n=>s(n,e)),rs=(t,e,{interpret:s})=>!s(t.value[0],e),V=(t,e,{compare:s,get:n})=>{let r=n(e,t.field);return Array.isArray(r)&&!Array.isArray(t.value)?ge(r,t.value,s):s(r,t.value)===0},$e=(t,e,s)=>!V(t,e,s),we=v((t,e,s)=>{let n=s.compare(e,t.value);return n===0||n===-1}),Ae=v((t,e,s)=>s.compare(e,t.value)===-1),Ee=v((t,e,s)=>s.compare(e,t.value)===1),Ie=v((t,e,s)=>{let n=s.compare(e,t.value);return n===0||n===1}),Ne=(t,e,{get:s})=>{if(t.field===b)return e!==void 0;let[n,r]=ut(e,t.field,s),o=i=>i==null?!!i===t.value:es(i,r)===t.value;return xe(n,r)?n.some(o):o(n)},os=v((t,e)=>typeof e=="number"&&e%t.value[0]===t.value[1]),Fe=(t,e,{get:s})=>{let[n,r]=ut(e,t.field,s),o=i=>{let a=s(i,r);return Array.isArray(a)&&a.length===t.value};return t.field!==b&&xe(n,r)?n.some(o):o(n)},Me=v((t,e)=>typeof e=="string"&&t.value.test(e)),R=v((t,e,{compare:s})=>ge(t.value,e,s)),Se=(t,e,s)=>!R(t,e,s),Ce=(t,e,{compare:s,get:n})=>{let r=n(e,t.field);return Array.isArray(r)&&t.value.every(o=>ge(r,o,s))},_e=(t,e,{interpret:s,get:n})=>{let r=n(e,t.field);return Array.isArray(r)&&r.some(o=>s(t.value,o))},is=(t,e)=>t.value.call(e),as=Object.freeze({__proto__:null,or:lt,nor:ns,and:ve,not:rs,eq:V,ne:$e,lte:we,lt:Ae,gt:Ee,gte:Ie,exists:Ne,mod:os,size:Fe,regex:Me,within:R,nin:Se,all:Ce,elemMatch:_e,where:is}),G=Object.assign({},as,{in:R}),Js=je(G);function ft(t){return t===null||typeof t!="object"?t:t instanceof Date?t.getTime():t&&typeof t.toJSON=="function"?t.toJSON():t}var cs=(t,e)=>Oe(ft(t),ft(e));function Y(t,e,s){let n=new L(t),r=je(e,Object.assign({compare:cs},s));if(s&&s.forPrimitives){let o={field:b},i=n.parse;n.setParse(a=>i(a,o))}return rt(n.parse,r)}var Ws=Y(B,G),Xs=Y(["$and","$or"].reduce((t,e)=>(t[e]=Object.assign({},t[e],{type:"field"}),t),Object.assign({},B,{$nor:Object.assign({},B.$nor,{type:"field",parse:U.compound})})),G,{forPrimitives:!0});var bt=Object.hasOwn||((t,e)=>Object.prototype.hasOwnProperty.call(t,e));function Re(t){return Array.isArray(t)?t:[t]}var I="__caslSubjectType__";function gt(t,e){if(e){if(!bt(e,I))Object.defineProperty(e,I,{value:t});else if(t!==e[I])throw new Error(`Trying to cast object to subject type ${t} but previously it was casted to ${e[I]}`)}return e}var Z=t=>{let e=typeof t;return e==="string"||e==="function"},xt=t=>t.modelName||t.name;function us(t){return typeof t=="string"?t:xt(t)}function Ot(t){return bt(t,I)?t[I]:xt(t.constructor)}var pt={function:t=>t.constructor,string:Ot};function dt(t,e,s){for(let n=s;n<e.length;n++)t.push(e[n])}function ht(t,e){if(!t||!t.length)return e||[];if(!e||!e.length)return t||[];let s=0,n=0,r=[];for(;s<t.length&&n<e.length;)t[s].priority<e[n].priority?(r.push(t[s]),s++):t[s].priority>e[n].priority?(r.push(e[n]),n++):(r.push(t[s]),s++,n++);return dt(r,t,s),dt(r,e,n),r}function J(t,e,s){let n=t.get(e);return n||(n=s(),t.set(e,n)),n}var ls=t=>t;function fs(t,e){let s;for(let n=0;n<t.length;n++){let r=e(t[n]);s&&r&&s.push(t[n]),r||(s??(s=t.slice(0,n)))}return s||t}function ps(t,e){if(Array.isArray(t.fields)&&!t.fields.length)throw new Error("`rawRule.fields` cannot be an empty array. https://bit.ly/390miLa");if(t.fields&&!e.fieldMatcher)throw new Error('You need to pass "fieldMatcher" option in order to restrict access by fields');if(t.conditions&&!e.conditionsMatcher)throw new Error('You need to pass "conditionsMatcher" option in order to restrict access by conditions')}var Pe=class{constructor(e,s,n=0){ps(e,s),this.action=s.resolveAction(e.action),this.subject=e.subject,this.inverted=!!e.inverted,this.conditions=e.conditions,this.reason=e.reason,this.origin=e,this.fields=e.fields?Re(e.fields):void 0,this.priority=n,this.t=s}i(){return this.conditions&&!this.o&&(this.o=this.t.conditionsMatcher(this.conditions)),this.o}get ast(){let e=this.i();return e?e.ast:void 0}matchesConditions(e){return this.conditions?!e||Z(e)?!this.inverted:this.i()(e):!0}matchesField(e){return this.fields?e?(this.u||(this.u=this.t.fieldMatcher(this.fields)),this.u(e)):!this.inverted:!0}};function ds(t,e){let s={value:t,prev:e,next:null};return e&&(e.next=s),s}function hs(t){t.next&&(t.next.prev=t.prev),t.prev&&(t.prev.next=t.next),t.next=t.prev=null}var mt=()=>({rules:[],merged:!1}),yt=()=>new Map,Te=class{constructor(e=[],s={}){this.h=!1,this.l=new Map,this.p={conditionsMatcher:s.conditionsMatcher,fieldMatcher:s.fieldMatcher,resolveAction:s.resolveAction||ls},this.$=s.anyAction||"manage",this.A=s.anySubjectType||"all",this.m=e,this.M=!!s.detectSubjectType,this.j=s.detectSubjectType||Ot,this.v(e)}get rules(){return this.m}detectSubjectType(e){return Z(e)?e:e?this.j(e):this.A}update(e){let s={rules:e,ability:this,target:this};return this._("update",s),this.m=e,this.v(e),this._("updated",s),this}v(e){let s=new Map,n;for(let r=e.length-1;r>=0;r--){let o=e.length-r-1,i=new Pe(e[r],this.p,o),a=Re(i.action),u=Re(i.subject||this.A);!this.h&&i.fields&&(this.h=!0);for(let f=0;f<u.length;f++){let h=J(s,u[f],yt);n===void 0&&(n=typeof u[f]),typeof u[f]!==n&&n!=="mixed"&&(n="mixed");for(let A=0;A<a.length;A++)J(h,a[A],mt).rules.push(i)}}if(this.l=s,n!=="mixed"&&!this.M){let r=pt[n]||pt.string;this.j=r}}possibleRulesFor(e,s=this.A){if(!Z(s))throw new Error('"possibleRulesFor" accepts only subject types (i.e., string or class) as the 2nd parameter');let n=J(this.l,s,yt),r=J(n,e,mt);if(r.merged)return r.rules;let o=e!==this.$&&n.has(this.$)?n.get(this.$).rules:void 0,i=ht(r.rules,o);return s!==this.A&&(i=ht(i,this.possibleRulesFor(e,this.A))),r.rules=i,r.merged=!0,i}rulesFor(e,s,n){let r=this.possibleRulesFor(e,s);if(n&&typeof n!="string")throw new Error("The 3rd, `field` parameter is expected to be a string. See https://stalniy.github.io/casl/en/api/casl-ability#can-of-pure-ability for details");return this.h?fs(r,o=>o.matchesField(n)):r}actionsFor(e){if(!Z(e))throw new Error('"actionsFor" accepts only subject types (i.e., string or class) as a parameter');let s=new Set,n=this.l.get(e);n&&Array.from(n.keys()).forEach(o=>s.add(o));let r=e!==this.A?this.l.get(this.A):void 0;return r&&Array.from(r.keys()).forEach(o=>s.add(o)),Array.from(s)}on(e,s){this.F=this.F||new Map;let n=this.F,r=n.get(e)||null,o=ds(s,r);return n.set(e,o),()=>{let i=n.get(e);!o.next&&!o.prev&&i===o?n.delete(e):o===i&&n.set(e,o.prev),hs(o)}}_(e,s){if(!this.F)return;let n=this.F.get(e)||null,r=[];for(;n!==null;)r.push(n.value),n=n.prev;for(let o=0;o<r.length;o++)r[o](s)}},ke=class extends Te{can(e,s,n){let r=this.relevantRuleFor(e,s,n);return!!r&&!r.inverted}relevantRuleFor(e,s,n){let r=this.detectSubjectType(s),o=this.rulesFor(e,r,n);for(let i=0,a=o.length;i<a;i++)if(o[i].matchesConditions(s))return o[i];return null}cannot(e,s,n){return!this.can(e,s,n)}},ms={$eq:z,$ne:me,$lt:de,$lte:he,$gt:_,$gte:q,$in:C,$nin:le,$all:fe,$size:ue,$regex:ye,$options:be,$elemMatch:ce,$exists:pe},ys={eq:V,ne:$e,lt:Ae,lte:we,gt:Ee,gte:Ie,in:R,nin:Se,all:Ce,size:Fe,regex:Me,elemMatch:_e,exists:Ne,and:ve};var bs=Y(ms,ys),gs=/[-/\\^$+?.()|[\]{}]/g,xs=/\.?\*+\.?/g,Os=/\*+/,js=/\./g;function vs(t,e,s){let n=s[0]==="*"||t[0]==="."&&t[t.length-1]==="."?"+":"*",r=t.indexOf("**")===-1?"[^.]":".",o=t.replace(js,"\\$&").replace(Os,r+n);return e+t.length===s.length?`(?:${o})?`:o}function $s(t,e,s){return t==="."&&(s[e-1]==="*"||s[e+1]==="*")?t:`\\${t}`}function ws(t){let e=t.map(n=>n.replace(gs,$s).replace(xs,vs)),s=e.length>1?`(?:${e.join("|")})`:e[0];return new RegExp(`^${s}$`)}var As=t=>{let e;return s=>(typeof e>"u"&&(e=t.every(n=>n.indexOf("*")===-1)?null:ws(t)),e===null?t.indexOf(s)!==-1:e.test(s))};function jt(t=[],e={}){return new ke(t,Object.assign({conditionsMatcher:bs,fieldMatcher:As},e))}var Es=t=>`Cannot execute "${t.action}" on "${t.subjectType}"`,vt=function(e){this.message=e};vt.prototype=Object.create(Error.prototype);var De=class extends vt{static setDefaultMessage(e){this.P=typeof e=="string"?()=>e:e}static from(e){return new this(e)}constructor(e){super(""),this.ability=e,typeof Error.captureStackTrace=="function"&&(this.name="ForbiddenError",Error.captureStackTrace(this,this.constructor))}setMessage(e){return this.message=e,this}throwUnlessCan(e,s,n){let r=this.unlessCan(e,s,n);if(r)throw r}unlessCan(e,s,n){let r=this.ability.relevantRuleFor(e,s,n);if(r&&!r.inverted)return;this.action=e,this.subject=s,this.subjectType=us(this.ability.detectSubjectType(s)),this.field=n;let o=r?r.reason:"";return this.message=this.message||o||this.constructor.P(this),this}};De.P=Es;var on=Object.freeze({__proto__:null});function Ue(t,e,s){if(t==null)return t;if(typeof t=="string"){if(t.indexOf("$principal.")!==0)return t;let r=t.slice(11).split(".").reduce((o,i)=>o==null?o:o[i],e);return r==null&&(s.unresolved=!0),r}if(Array.isArray(t))return t.map(n=>Ue(n,e,s));if(typeof t=="object"){let n={};for(let r of Object.keys(t))n[r]=Ue(t[r],e,s);return n}return t}function H(t,e){let s={unresolved:!1};return{conditions:Ue(t,e,s),unresolved:s.unresolved}}function $t(t,e){return H(t,e).conditions}function P(t,e){let s=k(t,e),n=[];for(let r of e.rules){if(s.indexOf(r.subject)===-1)continue;let o={action:r.actions,subject:r.resource};if(r.where){let{conditions:i,unresolved:a}=H(r.where,t);if(a)continue;o.conditions=i}n.push(o)}return n}function N(t){return jt(Array.isArray(t)?t:[])}function wt(t,e){return N(P(t,e))}function $(t,e,s,n){return n==null?t.can(e,s):t.can(e,gt(s,Object.assign({},n)))}var w={ALL:"all",NONE:"none",FIELDS:"fields",AMBIGUOUS:"ambiguous"},At={$in:"in",$nin:"nin",$ne:"ne",$gt:"gt",$gte:"gte",$lt:"lt",$lte:"lte"};function Is(t){let e=[];for(let s of Object.keys(t)){let n=t[s];if(n===null||typeof n!="object"||Array.isArray(n)){e.push({field:s,op:"eq",value:n});continue}let r=Object.keys(n);if(r.length!==1||!At[r[0]])return null;e.push({field:s,op:At[r[0]],value:n[r[0]]})}return e}var Ns=(t,e)=>t==="manage"||t===e||Array.isArray(t)&&(t.indexOf(e)!==-1||t.indexOf("manage")!==-1),Fs=(t,e)=>t==="all"||t===e;function Et(t,e,s,n){let r=P(t,e).filter(i=>Ns(i.action,s)&&Fs(i.subject,n));if(r.length===0)return{scope:w.NONE,clauses:[]};if(r.some(i=>!i.conditions))return{scope:w.ALL,clauses:[]};if(r.length>1)return{scope:w.AMBIGUOUS,clauses:[]};let o=Is(r[0].conditions);return o?{scope:w.FIELDS,clauses:o}:{scope:w.AMBIGUOUS,clauses:[]}}function It(t,e){let s=t;for(let n of e)n.op==="in"?s=s.hasSome(n.field,n.value):n.op==="nin"?s=s.not(s.hasSome(n.field,n.value)):s=s[n.op](n.field,n.value);return s}var Le=/export\s+const\s+([A-Za-z0-9_$]+)\s*=\s*webMethod\s*\(\s*Permissions\s*\.\s*([A-Za-z0-9_$]+)/g,Ms=[[/export\s*{\s*[A-Za-z0-9_$,\s]+}/,"export { x } \u2014 the call and the export must be one statement"],[/export\s+const\s+[A-Za-z0-9_$]+\s*=\s*webMethod\s*\(\s*Permissions\s*\[/,"Permissions['X'] \u2014 the property must be dotted and literal"],[/export\s+const\s+[A-Za-z0-9_$]+\s*=\s*webMethod\s*\(\s*[A-Za-z0-9_$]+\s*\(/,"a computed permission \u2014 it must be written out as Permissions.LEVEL"]];function qe(t){let e={},s=String(t||"");Le.lastIndex=0;let n=Le.exec(s);for(;n;)e[n[1]]=n[2],n=Le.exec(s);return e}function ze(t,e,s){let n=s||{},r=e&&e.api||{},o=qe(t),i=String(t||""),a=[],u=[];for(let p of Object.keys(o)){let c=r[p];c?c.permission!==o[p]&&a.push({name:p,declared:c.permission,written:o[p]}):u.push({name:p,gate:o[p]})}let f=n.complete?Object.keys(r).filter(p=>!(p in o)):[],h=[];for(let[p,c]of Ms)p.test(i)&&h.push(c);return{ok:a.length+u.length+f.length+h.length===0,found:o,mismatched:a,undeclared:u,missing:f,suspect:h}}function Nt(t,e,s){let n=ze(t,e,s);if(n.ok)return!0;let r=[];for(let o of n.mismatched)r.push(o.name+": policy says "+o.declared+", the export says "+o.written);for(let o of n.undeclared)r.push(o.name+": gated "+o.gate+" but missing from policy.api");for(let o of n.missing)r.push(o+": declared in policy.api but not exported here");for(let o of n.suspect)r.push("unreachable export shape \u2014 "+o);throw new Error(`wix-access: web-method gates do not match the policy:
|
|
2
|
-
`+
|
|
3
|
-
`))}var
|
|
1
|
+
var X=Object.defineProperty;var Rt=Object.getOwnPropertyDescriptor;var _t=Object.getOwnPropertyNames;var Pt=Object.prototype.hasOwnProperty;var Tt=(t,e)=>{for(var s in e)X(t,s,{get:e[s],enumerable:!0})},kt=(t,e,s,r)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of _t(e))!Pt.call(t,n)&&n!==s&&X(t,n,{get:()=>e[n],enumerable:!(r=Rt(e,n))||r.enumerable});return t};var Dt=t=>kt(X({},"__esModule",{value:!0}),t);var Rs={};Tt(Rs,{CASES:()=>Ye,CODES:()=>E,KIND:()=>F,PACKAGE_VERSION:()=>Ge,PolicyError:()=>x,SCOPE:()=>w,WHEN:()=>y,abilityFor:()=>wt,abilityFromRules:()=>N,anonymous:()=>Ke,applyClauses:()=>It,assertGates:()=>Nt,can:()=>$,caseTable:()=>Ft,createAccess:()=>St,createPrincipal:()=>se,deny:()=>ee,denyOpaque:()=>He,filterFor:()=>Et,frontendRoleTitles:()=>Cs,hasRole:()=>Qe,isDenial:()=>k,normaliseRoles:()=>te,ok:()=>Ze,parseGates:()=>Be,permissionFor:()=>et,publicPing:()=>Ss,resolvePlaceholders:()=>$t,resolveSubjects:()=>D,resolveWhere:()=>K,rulesFor:()=>P,validatePolicy:()=>Xe,verifyGates:()=>Ve});module.exports=Dt(Rs);var Ct=require("wix-members-frontend");var E={FORBIDDEN:"FORBIDDEN",UNAUTHENTICATED:"UNAUTHENTICATED",UNVERIFIED:"UNVERIFIED",NOT_FOUND:"NOT_FOUND",INVALID_POLICY:"INVALID_POLICY",INVALID_ARGUMENT:"INVALID_ARGUMENT"},x=class extends Error{constructor(e){super(e),this.name="PolicyError",this.code=E.INVALID_POLICY}};function Ze(t){return{ok:!0,data:t===void 0?null:t}}function ee(t,e,s){let r={ok:!1,code:t||E.FORBIDDEN};return e&&(r.action=e),s&&(r.detail=s),r}var k=t=>!!t&&t.ok===!1;function He(t){return ee(E.NOT_FOUND,t)}var F={VISITOR:"visitor",MEMBER:"member",CAPABILITY:"capability",SERVICE:"service"};function te(t){if(!Array.isArray(t))return[];let e=[];for(let s of t){if(typeof s=="string"){e.push(s);continue}if(!s||typeof s!="object")continue;let r=s.title||s.name||s.roleKey;r&&e.push(r)}return e}function se(t){let e=t||{},s=e.memberId||null,r=te(e.roles);return{kind:e.kind||(s?F.MEMBER:F.VISITOR),memberId:s,roles:r,subjects:Array.isArray(e.subjects)?e.subjects.slice():[],domain:e.domain&&typeof e.domain=="object"?e.domain:{},unverified:!!e.unverified}}var Ke=()=>se({kind:F.VISITOR}),Qe=(t,e)=>t.roles.indexOf(e)!==-1;var y={ANYONE:"anyone",ANONYMOUS:"anonymous",MEMBER:"member"},m=t=>!!t&&typeof t=="object"&&!Array.isArray(t),Ut=t=>Array.isArray(t)?t:[t];function f(t,e){throw new x("policy"+t+": "+e)}function Lt(t,e){let s=".subjects."+t;m(e)||f(s,"must be an object");let n=["when","role","domain"].filter(o=>e[o]!==void 0);if(n.length===0&&f(s,'needs exactly one of when/role/domain \u2014 "{}" is ambiguous between a visitor and a member'),n.length>1&&f(s,"has "+n.join(" and ")+"; use exactly one"),e.when!==void 0){let o=[y.ANYONE,y.ANONYMOUS,y.MEMBER];o.indexOf(e.when)===-1&&f(s+".when","must be one of "+o.join(", ")+" (got "+JSON.stringify(e.when)+")")}e.role!==void 0&&typeof e.role!="string"&&f(s+".role","must be a string"),e.domain!==void 0&&typeof e.domain!="string"&&f(s+".domain","must be a string")}function qt(t,e,s){let r=".rules["+e+"]";m(t)||f(r,"must be an object"),typeof t.subject!="string"&&f(r+".subject","must be a string"),s.indexOf(t.subject)===-1&&f(r+".subject",'"'+t.subject+'" is not declared in policy.subjects'),t.actions===void 0&&f(r+".actions","is required");for(let n of Ut(t.actions))typeof n!="string"&&f(r+".actions","must be a string or an array of strings");typeof t.resource!="string"&&f(r+".resource","must be a string"),t.where!==void 0&&!m(t.where)&&f(r+".where","must be an object")}var We=["Anyone","SiteMember","Admin"];function zt(t,e,s){let r=".api."+t;m(e)||f(r,"must be an object"),We.indexOf(e.permission)===-1&&f(r+".permission","must be one of "+We.join(", ")+" (got "+JSON.stringify(e.permission)+")"),e.ability!==void 0&&((!Array.isArray(e.ability)||e.ability.length!==2)&&f(r+".ability","must be [action, resource]"),(typeof e.ability[0]!="string"||typeof e.ability[1]!="string")&&f(r+".ability","both entries must be strings")),e.subject!==void 0&&s.indexOf(e.subject)===-1&&f(r+".subject",'"'+e.subject+'" is not declared in policy.subjects')}function Xe(t){if(!m(t))throw new x("policy must be an object");m(t.subjects)||f(".subjects","is required and must be an object");let e=Object.keys(t.subjects);e.length===0&&f(".subjects","declares no subjects");for(let s of e)Lt(s,t.subjects[s]);if(Array.isArray(t.rules)||f(".rules","is required and must be an array"),t.rules.forEach((s,r)=>qt(s,r,e)),t.api!==void 0){m(t.api)||f(".api","must be an object");for(let s of Object.keys(t.api))zt(s,t.api[s],e)}return t.collections!==void 0&&!m(t.collections)&&f(".collections","must be an object"),t}function D(t,e){let s=new Set(t.subjects||[]);for(let r of Object.keys(e.subjects)){let n=e.subjects[r];(n.when===y.ANYONE||n.when===y.ANONYMOUS&&!t.memberId||n.when===y.MEMBER&&t.memberId||n.role!==void 0&&t.roles.indexOf(n.role)!==-1||n.domain!==void 0&&t.domain[n.domain])&&s.add(r)}return Array.from(s)}function et(t,e){let s=t.api&&t.api[e];return s?s.permission:null}var U=class{constructor(e,s){this.operator=e,this.value=s,Object.defineProperty(this,"t",{writable:!0})}get notes(){return this.t}addNote(e){this.t=this.t||[],this.t.push(e)}},M=class extends U{},O=class extends M{constructor(e,s){if(!Array.isArray(s))throw new Error(`"${e}" operator expects to receive an array of conditions`);super(e,s)}},b="__itself__",j=class extends U{constructor(e,s,r){super(e,r),this.field=s}},ie=new M("__null__",null),oe=Object.prototype.hasOwnProperty.call.bind(Object.prototype.hasOwnProperty);function Bt(t,e){return e instanceof O&&e.operator===t}function ae(t,e){return e.length===1?e[0]:new O(t,(function s(r,n,o){let i=o||[];for(let a=0,u=n.length;a<u;a++){let l=n[a];Bt(r,l)?s(r,l.value,i):i.push(l)}return i})(t,e))}var Vt=t=>t,tt=()=>Object.create(null),st=Object.defineProperty(tt(),"__@type@__",{value:"ignore value"});function Gt(t,e,s=!1){if(!t||t&&t.constructor!==Object)return!1;for(let r in t)if(oe(t,r)&&oe(e,r)&&(!s||t[r]!==st))return!0;return!1}function Yt(t){let e=[];for(let s in t)oe(t,s)&&t[s]!==st&&e.push(s);return e}function re(t,e){e!==ie&&t.push(e)}var ce=t=>ae("and",t);var L={compound(t,e,s){let r=(Array.isArray(e)?e:[e]).map(n=>s.parse(n));return new O(t.name,r)},field:(t,e,s)=>new j(t.name,s.field,e),document:(t,e)=>new M(t.name,e)},S=class{constructor(e,s=tt()){this.o=void 0,this.s=void 0,this.i=void 0,this.u=void 0,this.h=void 0,this.parse=this.parse.bind(this),this.u={operatorToConditionName:s.operatorToConditionName||Vt,defaultOperatorName:s.defaultOperatorName||"eq",mergeFinalConditions:s.mergeFinalConditions||ce},this.o=Object.keys(e).reduce((r,n)=>(r[n]=Object.assign({name:this.u.operatorToConditionName(n)},e[n]),r),{}),this.s=Object.assign({},s.fieldContext,{field:"",query:{},parse:this.parse,hasOperators:r=>Gt(r,this.o,s.useIgnoreValue)}),this.i=Object.assign({},s.documentContext,{parse:this.parse,query:{}}),this.h=s.useIgnoreValue?Yt:Object.keys}setParse(e){this.parse=e,this.s.parse=e,this.i.parse=e}parseField(e,s,r,n){let o=this.o[s];if(!o)throw new Error(`Unsupported operator "${s}"`);if(o.type!=="field")throw new Error(`Unexpected ${o.type} operator "${s}" at field level`);return this.s.field=e,this.s.query=n,this.parseInstruction(o,r,this.s)}parseInstruction(e,s,r){return typeof e.validate=="function"&&e.validate(e,s),(e.parse||L[e.type])(e,s,r)}parseFieldOperators(e,s){let r=[],n=this.h(s);for(let o=0,i=n.length;o<i;o++){let a=n[o];if(!this.o[a])throw new Error(`Field query for "${e}" may contain only operators or a plain object as a value`);re(r,this.parseField(e,a,s[a],s))}return r}parse(e){let s=[],r=this.h(e);this.i.query=e;for(let n=0,o=r.length;n<o;n++){let i=r[n],a=e[i],u=this.o[i];if(u){if(u.type!=="document"&&u.type!=="compound")throw new Error(`Cannot use parsing instruction for operator "${i}" in "document" context as it is supposed to be used in "${u.type}" context`);re(s,this.parseInstruction(u,a,this.i))}else this.s.hasOperators(a)?s.push(...this.parseFieldOperators(i,a)):re(s,this.parseField(i,this.u.defaultOperatorName,a,e))}return this.u.mergeFinalConditions(s)}};function ne(t,e){let s=t[e];if(typeof s!="function")throw new Error(`Unable to interpret "${e}" condition. Did you forget to register interpreter for it?`);return s}function Jt(t){return t.operator}function rt(t,e){let s=e,r=s&&s.getInterpreterName||Jt,n;switch(s?s.numberOfArguments:0){case 1:n=i=>{let a=r(i,s);return ne(t,a)(i,o)};break;case 3:n=(i,a,u)=>{let l=r(i,s);return ne(t,l)(i,a,u,o)};break;default:n=(i,a)=>{let u=r(i,s);return ne(t,u)(i,a,o)}}let o=Object.assign({},s,{interpret:n});return o.interpret}function nt(t,e){return(s,...r)=>{let n=t(s,...r),o=e.bind(null,n);return o.ast=n,o}}var qs=S.prototype.parseInstruction;function ot(t,e){if(!Array.isArray(e))throw new Error(`"${t.name}" expects value to be an array`)}function it(t,e){if(ot(t,e),!e.length)throw new Error(`"${t.name}" expects to have at least one element in array`)}var ue=t=>(e,s)=>{if(typeof s!==t)throw new Error(`"${e.name}" expects value to be a "${t}"`)},at={type:"compound",validate:it,parse(t,e,{parse:s}){let r=e.map(n=>s(n));return ae(t.name,r)}},Zt=at,Ht={type:"compound",validate:it},Kt={type:"field",validate(t,e){if(!(e&&(e instanceof RegExp||e.constructor===Object)))throw new Error(`"${t.name}" expects to receive either regular expression or object of field operators`)},parse(t,e,s){let r=e instanceof RegExp?new j("regex",s.field,e):s.parse(e,s);return new O(t.name,[r])}},le={type:"field",validate(t,e){if(!e||e.constructor!==Object)throw new Error(`"${t.name}" expects to receive an object with nested query or field level operators`)},parse(t,e,{parse:s,field:r,hasOperators:n}){let o=n(e)?s(e,{field:b}):s(e);return new j(t.name,r,o)}},fe={type:"field",validate:ue("number")},C={type:"field",validate:ot},pe=C,de=C,Qt={type:"field",validate(t,e){if(!Array.isArray(e)||e.length!==2)throw new Error(`"${t.name}" expects an array with 2 numeric elements`)}},he={type:"field",validate:ue("boolean")},z={type:"field",validate:function(t,e){if(!(typeof e=="string"||typeof e=="number"||e instanceof Date))throw new Error(`"${t.name}" expects value to be comparable (i.e., string, number or date)`)}},R=z,me=R,ye=R,B={type:"field"},be=B,ge={type:"field",validate(t,e){if(!(e instanceof RegExp)&&typeof e!="string")throw new Error(`"${t.name}" expects value to be a regular expression or a string that represents regular expression`)},parse(t,e,s){let r=typeof e=="string"?new RegExp(e,s.query.$options||""):e;return new j(t.name,s.field,r)}},xe={type:"field",parse:()=>ie},Wt={type:"document",validate:ue("function")},Xt=Object.freeze({__proto__:null,$and:at,$or:Zt,$nor:Ht,$not:Kt,$elemMatch:le,$size:fe,$in:C,$nin:pe,$all:de,$mod:Qt,$exists:he,$gte:z,$gt:R,$lt:me,$lte:ye,$eq:B,$ne:be,$regex:ge,$options:xe,$where:Wt}),q=class extends S{constructor(e){super(e,{defaultOperatorName:"$eq",operatorToConditionName:s=>s.slice(1)})}parse(e,s){return s&&s.field?ce(this.parseFieldOperators(s.field,e)):super.parse(e)}},V=Xt;function Oe(t,e,s){for(let r=0,n=t.length;r<n;r++)if(s(t[r],e)===0)return!0;return!1}function je(t,e){return Array.isArray(t)&&Number.isNaN(Number(e))}function ct(t,e,s){if(!je(t,e))return s(t,e);let r=[];for(let n=0;n<t.length;n++){let o=s(t[n],e);o!==void 0&&(r=r.concat(o))}return r}function v(t){return(e,s,r)=>{let n=r.get(s,e.field);return Array.isArray(n)?n.some(o=>t(e,o,r)):t(e,n,r)}}var es=Object.hasOwn||Object.prototype.hasOwnProperty.call.bind(Object.prototype.hasOwnProperty),ts=(t,e)=>t[e];function ut(t,e,s){let r=e.lastIndexOf(".");return r===-1?[t,e]:[s(t,e.slice(0,r)),e.slice(r+1)]}function ss(t,e,s=ts){if(e===b)return t;if(!t)throw new Error(`Unable to get field "${e}" out of ${String(t)}.`);return(function(r,n,o){if(n.indexOf(".")===-1)return ct(r,n,o);let i=n.split("."),a=r;for(let u=0,l=i.length;u<l;u++)if(a=ct(a,i[u],o),!a||typeof a!="object")return u<l-1?void 0:a;return a})(t,e,s)}function ve(t,e){return t===e?0:t>e?1:-1}function $e(t,e={}){return rt(t,Object.assign({get:ss,compare:ve},e))}var lt=(t,e,{interpret:s})=>t.value.some(r=>s(r,e)),rs=(t,e,s)=>!lt(t,e,s),we=(t,e,{interpret:s})=>t.value.every(r=>s(r,e)),ns=(t,e,{interpret:s})=>!s(t.value[0],e),G=(t,e,{compare:s,get:r})=>{let n=r(e,t.field);return Array.isArray(n)&&!Array.isArray(t.value)?Oe(n,t.value,s):s(n,t.value)===0},Ae=(t,e,s)=>!G(t,e,s),Ee=v((t,e,s)=>{let r=s.compare(e,t.value);return r===0||r===-1}),Ie=v((t,e,s)=>s.compare(e,t.value)===-1),Ne=v((t,e,s)=>s.compare(e,t.value)===1),Fe=v((t,e,s)=>{let r=s.compare(e,t.value);return r===0||r===1}),Me=(t,e,{get:s})=>{if(t.field===b)return e!==void 0;let[r,n]=ut(e,t.field,s),o=i=>i==null?!!i===t.value:es(i,n)===t.value;return je(r,n)?r.some(o):o(r)},os=v((t,e)=>typeof e=="number"&&e%t.value[0]===t.value[1]),Se=(t,e,{get:s})=>{let[r,n]=ut(e,t.field,s),o=i=>{let a=s(i,n);return Array.isArray(a)&&a.length===t.value};return t.field!==b&&je(r,n)?r.some(o):o(r)},Ce=v((t,e)=>typeof e=="string"&&t.value.test(e)),_=v((t,e,{compare:s})=>Oe(t.value,e,s)),Re=(t,e,s)=>!_(t,e,s),_e=(t,e,{compare:s,get:r})=>{let n=r(e,t.field);return Array.isArray(n)&&t.value.every(o=>Oe(n,o,s))},Pe=(t,e,{interpret:s,get:r})=>{let n=r(e,t.field);return Array.isArray(n)&&n.some(o=>s(t.value,o))},is=(t,e)=>t.value.call(e),as=Object.freeze({__proto__:null,or:lt,nor:rs,and:we,not:ns,eq:G,ne:Ae,lte:Ee,lt:Ie,gt:Ne,gte:Fe,exists:Me,mod:os,size:Se,regex:Ce,within:_,nin:Re,all:_e,elemMatch:Pe,where:is}),Y=Object.assign({},as,{in:_}),Js=$e(Y);function ft(t){return t===null||typeof t!="object"?t:t instanceof Date?t.getTime():t&&typeof t.toJSON=="function"?t.toJSON():t}var cs=(t,e)=>ve(ft(t),ft(e));function J(t,e,s){let r=new q(t),n=$e(e,Object.assign({compare:cs},s));if(s&&s.forPrimitives){let o={field:b},i=r.parse;r.setParse(a=>i(a,o))}return nt(r.parse,n)}var Ws=J(V,Y),Xs=J(["$and","$or"].reduce((t,e)=>(t[e]=Object.assign({},t[e],{type:"field"}),t),Object.assign({},V,{$nor:Object.assign({},V.$nor,{type:"field",parse:L.compound})})),Y,{forPrimitives:!0});var bt=Object.hasOwn||((t,e)=>Object.prototype.hasOwnProperty.call(t,e));function Te(t){return Array.isArray(t)?t:[t]}var I="__caslSubjectType__";function gt(t,e){if(e){if(!bt(e,I))Object.defineProperty(e,I,{value:t});else if(t!==e[I])throw new Error(`Trying to cast object to subject type ${t} but previously it was casted to ${e[I]}`)}return e}var H=t=>{let e=typeof t;return e==="string"||e==="function"},xt=t=>t.modelName||t.name;function us(t){return typeof t=="string"?t:xt(t)}function Ot(t){return bt(t,I)?t[I]:xt(t.constructor)}var pt={function:t=>t.constructor,string:Ot};function dt(t,e,s){for(let r=s;r<e.length;r++)t.push(e[r])}function ht(t,e){if(!t||!t.length)return e||[];if(!e||!e.length)return t||[];let s=0,r=0,n=[];for(;s<t.length&&r<e.length;)t[s].priority<e[r].priority?(n.push(t[s]),s++):t[s].priority>e[r].priority?(n.push(e[r]),r++):(n.push(t[s]),s++,r++);return dt(n,t,s),dt(n,e,r),n}function Z(t,e,s){let r=t.get(e);return r||(r=s(),t.set(e,r)),r}var ls=t=>t;function fs(t,e){let s;for(let r=0;r<t.length;r++){let n=e(t[r]);s&&n&&s.push(t[r]),n||(s??(s=t.slice(0,r)))}return s||t}function ps(t,e){if(Array.isArray(t.fields)&&!t.fields.length)throw new Error("`rawRule.fields` cannot be an empty array. https://bit.ly/390miLa");if(t.fields&&!e.fieldMatcher)throw new Error('You need to pass "fieldMatcher" option in order to restrict access by fields');if(t.conditions&&!e.conditionsMatcher)throw new Error('You need to pass "conditionsMatcher" option in order to restrict access by conditions')}var ke=class{constructor(e,s,r=0){ps(e,s),this.action=s.resolveAction(e.action),this.subject=e.subject,this.inverted=!!e.inverted,this.conditions=e.conditions,this.reason=e.reason,this.origin=e,this.fields=e.fields?Te(e.fields):void 0,this.priority=r,this.t=s}i(){return this.conditions&&!this.o&&(this.o=this.t.conditionsMatcher(this.conditions)),this.o}get ast(){let e=this.i();return e?e.ast:void 0}matchesConditions(e){return this.conditions?!e||H(e)?!this.inverted:this.i()(e):!0}matchesField(e){return this.fields?e?(this.u||(this.u=this.t.fieldMatcher(this.fields)),this.u(e)):!this.inverted:!0}};function ds(t,e){let s={value:t,prev:e,next:null};return e&&(e.next=s),s}function hs(t){t.next&&(t.next.prev=t.prev),t.prev&&(t.prev.next=t.next),t.next=t.prev=null}var mt=()=>({rules:[],merged:!1}),yt=()=>new Map,De=class{constructor(e=[],s={}){this.h=!1,this.l=new Map,this.p={conditionsMatcher:s.conditionsMatcher,fieldMatcher:s.fieldMatcher,resolveAction:s.resolveAction||ls},this.$=s.anyAction||"manage",this.A=s.anySubjectType||"all",this.m=e,this.M=!!s.detectSubjectType,this.j=s.detectSubjectType||Ot,this.v(e)}get rules(){return this.m}detectSubjectType(e){return H(e)?e:e?this.j(e):this.A}update(e){let s={rules:e,ability:this,target:this};return this._("update",s),this.m=e,this.v(e),this._("updated",s),this}v(e){let s=new Map,r;for(let n=e.length-1;n>=0;n--){let o=e.length-n-1,i=new ke(e[n],this.p,o),a=Te(i.action),u=Te(i.subject||this.A);!this.h&&i.fields&&(this.h=!0);for(let l=0;l<u.length;l++){let h=Z(s,u[l],yt);r===void 0&&(r=typeof u[l]),typeof u[l]!==r&&r!=="mixed"&&(r="mixed");for(let A=0;A<a.length;A++)Z(h,a[A],mt).rules.push(i)}}if(this.l=s,r!=="mixed"&&!this.M){let n=pt[r]||pt.string;this.j=n}}possibleRulesFor(e,s=this.A){if(!H(s))throw new Error('"possibleRulesFor" accepts only subject types (i.e., string or class) as the 2nd parameter');let r=Z(this.l,s,yt),n=Z(r,e,mt);if(n.merged)return n.rules;let o=e!==this.$&&r.has(this.$)?r.get(this.$).rules:void 0,i=ht(n.rules,o);return s!==this.A&&(i=ht(i,this.possibleRulesFor(e,this.A))),n.rules=i,n.merged=!0,i}rulesFor(e,s,r){let n=this.possibleRulesFor(e,s);if(r&&typeof r!="string")throw new Error("The 3rd, `field` parameter is expected to be a string. See https://stalniy.github.io/casl/en/api/casl-ability#can-of-pure-ability for details");return this.h?fs(n,o=>o.matchesField(r)):n}actionsFor(e){if(!H(e))throw new Error('"actionsFor" accepts only subject types (i.e., string or class) as a parameter');let s=new Set,r=this.l.get(e);r&&Array.from(r.keys()).forEach(o=>s.add(o));let n=e!==this.A?this.l.get(this.A):void 0;return n&&Array.from(n.keys()).forEach(o=>s.add(o)),Array.from(s)}on(e,s){this.F=this.F||new Map;let r=this.F,n=r.get(e)||null,o=ds(s,n);return r.set(e,o),()=>{let i=r.get(e);!o.next&&!o.prev&&i===o?r.delete(e):o===i&&r.set(e,o.prev),hs(o)}}_(e,s){if(!this.F)return;let r=this.F.get(e)||null,n=[];for(;r!==null;)n.push(r.value),r=r.prev;for(let o=0;o<n.length;o++)n[o](s)}},Ue=class extends De{can(e,s,r){let n=this.relevantRuleFor(e,s,r);return!!n&&!n.inverted}relevantRuleFor(e,s,r){let n=this.detectSubjectType(s),o=this.rulesFor(e,n,r);for(let i=0,a=o.length;i<a;i++)if(o[i].matchesConditions(s))return o[i];return null}cannot(e,s,r){return!this.can(e,s,r)}},ms={$eq:B,$ne:be,$lt:me,$lte:ye,$gt:R,$gte:z,$in:C,$nin:pe,$all:de,$size:fe,$regex:ge,$options:xe,$elemMatch:le,$exists:he},ys={eq:G,ne:Ae,lt:Ie,lte:Ee,gt:Ne,gte:Fe,in:_,nin:Re,all:_e,size:Se,regex:Ce,elemMatch:Pe,exists:Me,and:we};var bs=J(ms,ys),gs=/[-/\\^$+?.()|[\]{}]/g,xs=/\.?\*+\.?/g,Os=/\*+/,js=/\./g;function vs(t,e,s){let r=s[0]==="*"||t[0]==="."&&t[t.length-1]==="."?"+":"*",n=t.indexOf("**")===-1?"[^.]":".",o=t.replace(js,"\\$&").replace(Os,n+r);return e+t.length===s.length?`(?:${o})?`:o}function $s(t,e,s){return t==="."&&(s[e-1]==="*"||s[e+1]==="*")?t:`\\${t}`}function ws(t){let e=t.map(r=>r.replace(gs,$s).replace(xs,vs)),s=e.length>1?`(?:${e.join("|")})`:e[0];return new RegExp(`^${s}$`)}var As=t=>{let e;return s=>(typeof e>"u"&&(e=t.every(r=>r.indexOf("*")===-1)?null:ws(t)),e===null?t.indexOf(s)!==-1:e.test(s))};function jt(t=[],e={}){return new Ue(t,Object.assign({conditionsMatcher:bs,fieldMatcher:As},e))}var Es=t=>`Cannot execute "${t.action}" on "${t.subjectType}"`,vt=function(e){this.message=e};vt.prototype=Object.create(Error.prototype);var Le=class extends vt{static setDefaultMessage(e){this.P=typeof e=="string"?()=>e:e}static from(e){return new this(e)}constructor(e){super(""),this.ability=e,typeof Error.captureStackTrace=="function"&&(this.name="ForbiddenError",Error.captureStackTrace(this,this.constructor))}setMessage(e){return this.message=e,this}throwUnlessCan(e,s,r){let n=this.unlessCan(e,s,r);if(n)throw n}unlessCan(e,s,r){let n=this.ability.relevantRuleFor(e,s,r);if(n&&!n.inverted)return;this.action=e,this.subject=s,this.subjectType=us(this.ability.detectSubjectType(s)),this.field=r;let o=n?n.reason:"";return this.message=this.message||o||this.constructor.P(this),this}};Le.P=Es;var or=Object.freeze({__proto__:null});function qe(t,e,s){if(t==null)return t;if(typeof t=="string"){if(t.indexOf("$principal.")!==0)return t;let n=t.slice(11).split(".").reduce((o,i)=>o==null?o:o[i],e);return n==null&&(s.unresolved=!0),n}if(Array.isArray(t))return t.map(r=>qe(r,e,s));if(typeof t=="object"){let r={};for(let n of Object.keys(t))r[n]=qe(t[n],e,s);return r}return t}function K(t,e){let s={unresolved:!1};return{conditions:qe(t,e,s),unresolved:s.unresolved}}function $t(t,e){return K(t,e).conditions}function P(t,e){let s=D(t,e),r=[];for(let n of e.rules){if(s.indexOf(n.subject)===-1)continue;let o={action:n.actions,subject:n.resource};if(n.where){let{conditions:i,unresolved:a}=K(n.where,t);if(a)continue;o.conditions=i}r.push(o)}return r}function N(t){return jt(Array.isArray(t)?t:[])}function wt(t,e){return N(P(t,e))}function $(t,e,s,r){return r==null?t.can(e,s):t.can(e,gt(s,Object.assign({},r)))}var w={ALL:"all",NONE:"none",FIELDS:"fields",AMBIGUOUS:"ambiguous"},At={$in:"in",$nin:"nin",$ne:"ne",$gt:"gt",$gte:"gte",$lt:"lt",$lte:"lte"};function Is(t){let e=[];for(let s of Object.keys(t)){let r=t[s];if(r===null||typeof r!="object"||Array.isArray(r)){e.push({field:s,op:"eq",value:r});continue}let n=Object.keys(r);if(n.length!==1||!At[n[0]])return null;e.push({field:s,op:At[n[0]],value:r[n[0]]})}return e}var Ns=(t,e)=>t==="manage"||t===e||Array.isArray(t)&&(t.indexOf(e)!==-1||t.indexOf("manage")!==-1),Fs=(t,e)=>t==="all"||t===e;function Et(t,e,s,r){let n=P(t,e).filter(i=>Ns(i.action,s)&&Fs(i.subject,r));if(n.length===0)return{scope:w.NONE,clauses:[]};if(n.some(i=>!i.conditions))return{scope:w.ALL,clauses:[]};if(n.length>1)return{scope:w.AMBIGUOUS,clauses:[]};let o=Is(n[0].conditions);return o?{scope:w.FIELDS,clauses:o}:{scope:w.AMBIGUOUS,clauses:[]}}function It(t,e){let s=t;for(let r of e)r.op==="in"?s=s.hasSome(r.field,r.value):r.op==="nin"?s=s.not(s.hasSome(r.field,r.value)):s=s[r.op](r.field,r.value);return s}var ze=/export\s+const\s+([A-Za-z0-9_$]+)\s*=\s*webMethod\s*\(\s*Permissions\s*\.\s*([A-Za-z0-9_$]+)/g,Ms=[[/export\s*{\s*[A-Za-z0-9_$,\s]+}/,"export { x } \u2014 the call and the export must be one statement"],[/export\s+const\s+[A-Za-z0-9_$]+\s*=\s*webMethod\s*\(\s*Permissions\s*\[/,"Permissions['X'] \u2014 the property must be dotted and literal"],[/export\s+const\s+[A-Za-z0-9_$]+\s*=\s*webMethod\s*\(\s*[A-Za-z0-9_$]+\s*\(/,"a computed permission \u2014 it must be written out as Permissions.LEVEL"]];function Be(t){let e={},s=String(t||"");ze.lastIndex=0;let r=ze.exec(s);for(;r;)e[r[1]]=r[2],r=ze.exec(s);return e}function Ve(t,e,s){let r=s||{},n=e&&e.api||{},o=Be(t),i=String(t||""),a=[],u=[];for(let p of Object.keys(o)){let c=n[p];c?c.permission!==o[p]&&a.push({name:p,declared:c.permission,written:o[p]}):u.push({name:p,gate:o[p]})}let l=r.complete?Object.keys(n).filter(p=>!(p in o)):[],h=[];for(let[p,c]of Ms)p.test(i)&&h.push(c);return{ok:a.length+u.length+l.length+h.length===0,found:o,mismatched:a,undeclared:u,missing:l,suspect:h}}function Nt(t,e,s){let r=Ve(t,e,s);if(r.ok)return!0;let n=[];for(let o of r.mismatched)n.push(o.name+": policy says "+o.declared+", the export says "+o.written);for(let o of r.undeclared)n.push(o.name+": gated "+o.gate+" but missing from policy.api");for(let o of r.missing)n.push(o+": declared in policy.api but not exported here");for(let o of r.suspect)n.push("unreachable export shape \u2014 "+o);throw new Error(`wix-access: web-method gates do not match the policy:
|
|
2
|
+
`+n.join(`
|
|
3
|
+
`))}var Ge="0.3.2";var Ye=[{action:"read",type:"Booking",object:{customerId:"m-1"}},{action:"read",type:"Booking",object:{customerId:"m-2"}},{action:"cancel",type:"Booking",object:{customerId:"m-1"}},{action:"delete",type:"Booking",object:{customerId:"m-1"}},{action:"manage",type:"Vendor",object:{_id:"v-1"}}];function Ft(t){return Ye.map(e=>({action:e.action,type:e.type,object:e.object,can:$(t,e.action,e.type,e.object)}))}var Q=N([]),Mt="wix-access: createAccess({ fetchRules }) needs your web method, e.g. import { getMyAbilities } from 'backend/access.web'. The package cannot import it for you \u2014 that specifier only resolves inside your project. If it is imported and still not a function, build the kit inside onReady and pass an arrow: fetchRules: (...a) => getMyAbilities(...a).";function St(t){let e=t||{},s=e.fetchRules,r=e.onError||null,n=typeof s!="function",o=Q,i=[],a=!1,u=!1,l=null,h=null;async function A(){if(n)return i=[],o=Q,u=!0,l=Mt,a=!0,r&&r(new Error(Mt)),p;try{let c=await s();if(k(c))return i=[],o=Q,u=!0,l="rules refused: "+(c.code||"FORBIDDEN"),a=!0,r&&r(new Error(l)),p;i=Array.isArray(c)?c:[],o=N(i),u=!1}catch(c){i=[],o=Q,u=!0,l=String(c&&c.message||c),r&&r(c)}return a=!0,p}let p={ready(){return a?Promise.resolve(p):(h||(h=A().then(c=>(h=null,c))),h)},refresh(){return a=!1,u=!1,l=null,h=null,p.ready()},can:(c,d,g)=>$(o,c,d,g),cannot:(c,d,g)=>!$(o,c,d,g),rules:()=>i.slice(),get loaded(){return a},get failed(){return u},get reason(){return l},guard(c,d,g,T,W){let Je=p.can(d,g,T);return p.apply(c,Je,W),Je},apply(c,d,g){if(!c)return d;let T=g||"hide";try{T==="disable"?d&&c.enable?c.enable():!d&&c.disable&&c.disable():T==="collapse"?d&&c.expand?c.expand():!d&&c.collapse&&c.collapse():d&&c.show?c.show():!d&&c.hide&&c.hide()}catch(W){r&&r(W)}return d}};return p}function Ss(){return{ok:!0,side:"public",version:Ge}}async function Cs(){try{return(await Ct.currentMember.getRoles()).map(e=>e.title)}catch{return[]}}0&&(module.exports={CASES,CODES,KIND,PACKAGE_VERSION,PolicyError,SCOPE,WHEN,abilityFor,abilityFromRules,anonymous,applyClauses,assertGates,can,caseTable,createAccess,createPrincipal,deny,denyOpaque,filterFor,frontendRoleTitles,hasRole,isDenial,normaliseRoles,ok,parseGates,permissionFor,publicPing,resolvePlaceholders,resolveSubjects,resolveWhere,rulesFor,validatePolicy,verifyGates});
|