@liquisio/wix-access 0.5.1 → 0.5.2

package/README.md

@@ -189,8 +189,13 @@ await db.transfer('Bookings', bookingId, rightMemberId, { principal })
   `createAccess(policy, { namespace: '@scope/app/' })`; the gateway tries the exact id
   first, then the id without the namespace. Without the option a namespaced id finds no
   policy entry, so nothing is stamped and every rule misses — every write is refused.
-- `update` keeps both fields as stored and refuses `onBehalfOf`; ownership moves only by
-  `transfer`, which checks `assignOwner` against the row before and after the move.
+- `update` is checked against the stored row and against the row as it will be, so it
+  cannot move a row out of what the caller may act on. It keeps `actor` as stored. It
+  changes the owner only for a caller holding `assignOwner` on the row before and after
+  (audited as `access.transfer`); for anyone else the owner stays as stored, the refusal is
+  audited, and the rest of the update applies. `transfer` does the same move on its own.
+- `update(…, { merge: (existing, changes) => row })` replaces the shallow merge — for
+  nested fields that must merge deeply, or history that must not duplicate.
 - Every delegated insert and every transfer reaches the `audit` sink as `access.onBehalf`
   or `access.transfer`, `system` ones included. An audit sink that throws does not fail
   the write — it goes to `onError('audit', error)` instead.

package/backend.d.ts

@@ -75,6 +75,14 @@ export interface InsertOptions extends DbOptions {
     system?: boolean
 }
 
+export interface UpdateOptions extends DbOptions {
+    /**
+     * Replaces the default shallow merge. Receives the stored row and the changes, returns
+     * the row to write. The actor field is restored afterwards whatever it returns.
+     */
+    merge?: (existing: Record<string, unknown>, changes: Record<string, unknown>) => Record<string, unknown>
+}
+
 export interface TransferOptions {
     principal: Principal
     /** Skip the `assignOwner` check for a server-decided move. Still audited. */
@@ -88,8 +96,12 @@ export interface Db {
     query(collection: string, opts: DbOptions): Promise<{ ok: true; data: unknown[]; scope: Scope }>
     get(collection: string, id: string, opts: DbOptions): Promise<Result<unknown>>
     insert(collection: string, record: Record<string, unknown>, opts: InsertOptions): Promise<Result<unknown>>
-    /** Never changes the owner or actor field; refuses `onBehalfOf` — use `transfer`. */
-    update(collection: string, id: string, changes: Record<string, unknown>, opts: DbOptions): Promise<Result<unknown>>
+    /**
+     * Checked against the stored row and the row as it will be. Never changes the actor
+     * field. Changes the owner only for a caller holding `assignOwner` (audited as a
+     * transfer); otherwise keeps it and audits the refusal. Refuses `onBehalfOf`.
+     */
+    update(collection: string, id: string, changes: Record<string, unknown>, opts: UpdateOptions): Promise<Result<unknown>>
     /** Moves a row to another owner, or to none with `null`. */
     transfer(collection: string, id: string, newOwner: string | null, opts: TransferOptions): Promise<Result<unknown>>
     remove(collection: string, id: string, opts: DbOptions): Promise<Result<unknown>>

package/backend.js

@@ -1,3 +1,3 @@
-var tr=Object.create;var ee=Object.defineProperty;var rr=Object.getOwnPropertyDescriptor;var nr=Object.getOwnPropertyNames;var sr=Object.getPrototypeOf,or=Object.prototype.hasOwnProperty;var ir=(t,e)=>{for(var r in e)ee(t,r,{get:e[r],enumerable:!0})},pt=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let s of nr(e))!or.call(t,s)&&s!==r&&ee(t,s,{get:()=>e[s],enumerable:!(n=rr(e,s))||n.enumerable});return t};var ar=(t,e,r)=>(r=t!=null?tr(sr(t)):{},pt(e||!t||!t.__esModule?ee(r,"default",{value:t,enumerable:!0}):r,t)),cr=t=>pt(ee({},"__esModule",{value:!0}),t);var un={};ir(un,{ASSIGN_OWNER:()=>F,CASES:()=>lt,CODES:()=>w,KIND:()=>D,PACKAGE_VERSION:()=>ut,PolicyError:()=>P,SCOPE:()=>C,WHEN:()=>k,abilityFor:()=>me,abilityFromRules:()=>ot,anonymous:()=>yt,applyClauses:()=>be,applyGates:()=>Vt,assertDeclared:()=>Jt,assertGates:()=>Gt,backendMemberId:()=>cn,backendPing:()=>an,can:()=>j,caseTable:()=>zt,createAccess:()=>on,createPrincipal:()=>W,deny:()=>I,denyOpaque:()=>N,filterFor:()=>ye,hasRole:()=>te,isDenial:()=>mt,normaliseRoles:()=>Oe,ok:()=>ht,parseGates:()=>at,permissionFor:()=>gt,resolvePlaceholders:()=>Bt,resolveSubjects:()=>V,resolveWhere:()=>he,rulesFor:()=>q,validatePolicy:()=>re,verifyGates:()=>ct});module.exports=cr(un);var ft=require("wix-members-backend"),Qt=ar(require("wix-users-backend"),1),Xt=require("@wix/data"),er=require("@wix/essentials");var w={FORBIDDEN:"FORBIDDEN",UNAUTHENTICATED:"UNAUTHENTICATED",UNVERIFIED:"UNVERIFIED",NOT_FOUND:"NOT_FOUND",INVALID_POLICY:"INVALID_POLICY",INVALID_ARGUMENT:"INVALID_ARGUMENT"},P=class extends Error{constructor(e){super(e),this.name="PolicyError",this.code=w.INVALID_POLICY}};function ht(t){return{ok:!0,data:t===void 0?null:t}}function I(t,e,r){let n={ok:!1,code:t||w.FORBIDDEN};return e&&(n.action=e),r&&(n.detail=r),n}var mt=t=>!!t&&t.ok===!1;function N(t){return I(w.NOT_FOUND,t)}var D={VISITOR:"visitor",MEMBER:"member",CAPABILITY:"capability",SERVICE:"service"};function Oe(t){if(!Array.isArray(t))return[];let e=[];for(let r of t){if(typeof r=="string"){e.push(r);continue}if(!r||typeof r!="object")continue;let n=r.title||r.name||r.roleKey;n&&e.push(n)}return e}function W(t){let e=t||{},r=e.memberId||null,n=Oe(e.roles);return{kind:e.kind||(r?D.MEMBER:D.VISITOR),memberId:r,roles:n,subjects:Array.isArray(e.subjects)?e.subjects.slice():[],domain:e.domain&&typeof e.domain=="object"?e.domain:{},unverified:!!e.unverified}}var yt=()=>W({kind:D.VISITOR}),te=(t,e)=>t.roles.indexOf(e)!==-1;var k={ANYONE:"anyone",ANONYMOUS:"anonymous",MEMBER:"member"},_=t=>!!t&&typeof t=="object"&&!Array.isArray(t),ur=t=>Array.isArray(t)?t:[t];function b(t,e){throw new P("policy"+t+": "+e)}function lr(t,e){let r=".subjects."+t;_(e)||b(r,"must be an object");let s=["when","role","domain"].filter(o=>e[o]!==void 0);if(s.length===0&&b(r,'needs exactly one of when/role/domain \u2014 "{}" is ambiguous between a visitor and a member'),s.length>1&&b(r,"has "+s.join(" and ")+"; use exactly one"),e.when!==void 0){let o=[k.ANYONE,k.ANONYMOUS,k.MEMBER];o.indexOf(e.when)===-1&&b(r+".when","must be one of "+o.join(", ")+" (got "+JSON.stringify(e.when)+")")}e.role!==void 0&&typeof e.role!="string"&&b(r+".role","must be a string"),e.domain!==void 0&&typeof e.domain!="string"&&b(r+".domain","must be a string")}function fr(t,e,r){let n=".rules["+e+"]";_(t)||b(n,"must be an object"),typeof t.subject!="string"&&b(n+".subject","must be a string"),r.indexOf(t.subject)===-1&&b(n+".subject",'"'+t.subject+'" is not declared in policy.subjects'),t.actions===void 0&&b(n+".actions","is required");for(let s of ur(t.actions))typeof s!="string"&&b(n+".actions","must be a string or an array of strings");typeof t.resource!="string"&&b(n+".resource","must be a string"),t.where!==void 0&&!_(t.where)&&b(n+".where","must be an object")}var bt=["Anyone","SiteMember","Admin"];function dr(t,e,r){let n=".api."+t;_(e)||b(n,"must be an object"),bt.indexOf(e.permission)===-1&&b(n+".permission","must be one of "+bt.join(", ")+" (got "+JSON.stringify(e.permission)+")"),e.ability!==void 0&&((!Array.isArray(e.ability)||e.ability.length!==2)&&b(n+".ability","must be [action, resource]"),(typeof e.ability[0]!="string"||typeof e.ability[1]!="string")&&b(n+".ability","both entries must be strings")),e.subject!==void 0&&r.indexOf(e.subject)===-1&&b(n+".subject",'"'+e.subject+'" is not declared in policy.subjects')}var pr=["resource","owner","actor","tenant","profile"];function hr(t,e){let r=".collections."+t;_(e)||b(r,"must be an object");for(let n of pr)e[n]!==void 0&&(typeof e[n]!="string"||!e[n])&&b(r+"."+n,"must be a non-empty string");e.owner!==void 0&&e.owner===e.actor&&b(r,'owner and actor must be different fields (both are "'+e.owner+'")')}function re(t){if(!_(t))throw new P("policy must be an object");_(t.subjects)||b(".subjects","is required and must be an object");let e=Object.keys(t.subjects);e.length===0&&b(".subjects","declares no subjects");for(let r of e)lr(r,t.subjects[r]);if(Array.isArray(t.rules)||b(".rules","is required and must be an array"),t.rules.forEach((r,n)=>fr(r,n,e)),t.api!==void 0){_(t.api)||b(".api","must be an object");for(let r of Object.keys(t.api))dr(r,t.api[r],e)}if(t.collections!==void 0){_(t.collections)||b(".collections","must be an object");for(let r of Object.keys(t.collections))hr(r,t.collections[r])}return t}function V(t,e){let r=new Set(t.subjects||[]);for(let n of Object.keys(e.subjects)){let s=e.subjects[n];(s.when===k.ANYONE||s.when===k.ANONYMOUS&&!t.memberId||s.when===k.MEMBER&&t.memberId||s.role!==void 0&&t.roles.indexOf(s.role)!==-1||s.domain!==void 0&&t.domain[s.domain])&&r.add(n)}return Array.from(r)}function gt(t,e){let r=t.api&&t.api[e];return r?r.permission:null}var ne=class{constructor(e,r){this.operator=e,this.value=r,Object.defineProperty(this,"t",{writable:!0})}get notes(){return this.t}addNote(e){this.t=this.t||[],this.t.push(e)}},J=class extends ne{},U=class extends J{constructor(e,r){if(!Array.isArray(r))throw new Error(`"${e}" operator expects to receive an array of conditions`);super(e,r)}},T="__itself__",L=class extends ne{constructor(e,r,n){super(e,n),this.field=r}},je=new J("__null__",null),ve=Object.prototype.hasOwnProperty.call.bind(Object.prototype.hasOwnProperty);function mr(t,e){return e instanceof U&&e.operator===t}function Ae(t,e){return e.length===1?e[0]:new U(t,(function r(n,s,o){let i=o||[];for(let c=0,l=s.length;c<l;c++){let u=s[c];mr(n,u)?r(n,u.value,i):i.push(u)}return i})(t,e))}var yr=t=>t,Ot=()=>Object.create(null),xt=Object.defineProperty(Ot(),"__@type@__",{value:"ignore value"});function br(t,e,r=!1){if(!t||t&&t.constructor!==Object)return!1;for(let n in t)if(ve(t,n)&&ve(e,n)&&(!r||t[n]!==xt))return!0;return!1}function gr(t){let e=[];for(let r in t)ve(t,r)&&t[r]!==xt&&e.push(r);return e}function xe(t,e){e!==je&&t.push(e)}var Ee=t=>Ae("and",t);var se={compound(t,e,r){let n=(Array.isArray(e)?e:[e]).map(s=>r.parse(s));return new U(t.name,n)},field:(t,e,r)=>new L(t.name,r.field,e),document:(t,e)=>new J(t.name,e)},K=class{constructor(e,r=Ot()){this.o=void 0,this.s=void 0,this.i=void 0,this.u=void 0,this.h=void 0,this.parse=this.parse.bind(this),this.u={operatorToConditionName:r.operatorToConditionName||yr,defaultOperatorName:r.defaultOperatorName||"eq",mergeFinalConditions:r.mergeFinalConditions||Ee},this.o=Object.keys(e).reduce((n,s)=>(n[s]=Object.assign({name:this.u.operatorToConditionName(s)},e[s]),n),{}),this.s=Object.assign({},r.fieldContext,{field:"",query:{},parse:this.parse,hasOperators:n=>br(n,this.o,r.useIgnoreValue)}),this.i=Object.assign({},r.documentContext,{parse:this.parse,query:{}}),this.h=r.useIgnoreValue?gr:Object.keys}setParse(e){this.parse=e,this.s.parse=e,this.i.parse=e}parseField(e,r,n,s){let o=this.o[r];if(!o)throw new Error(`Unsupported operator "${r}"`);if(o.type!=="field")throw new Error(`Unexpected ${o.type} operator "${r}" at field level`);return this.s.field=e,this.s.query=s,this.parseInstruction(o,n,this.s)}parseInstruction(e,r,n){return typeof e.validate=="function"&&e.validate(e,r),(e.parse||se[e.type])(e,r,n)}parseFieldOperators(e,r){let n=[],s=this.h(r);for(let o=0,i=s.length;o<i;o++){let c=s[o];if(!this.o[c])throw new Error(`Field query for "${e}" may contain only operators or a plain object as a value`);xe(n,this.parseField(e,c,r[c],r))}return n}parse(e){let r=[],n=this.h(e);this.i.query=e;for(let s=0,o=n.length;s<o;s++){let i=n[s],c=e[i],l=this.o[i];if(l){if(l.type!=="document"&&l.type!=="compound")throw new Error(`Cannot use parsing instruction for operator "${i}" in "document" context as it is supposed to be used in  "${l.type}" context`);xe(r,this.parseInstruction(l,c,this.i))}else this.s.hasOperators(c)?r.push(...this.parseFieldOperators(i,c)):xe(r,this.parseField(i,this.u.defaultOperatorName,c,e))}return this.u.mergeFinalConditions(r)}};function we(t,e){let r=t[e];if(typeof r!="function")throw new Error(`Unable to interpret "${e}" condition. Did you forget to register interpreter for it?`);return r}function Or(t){return t.operator}function wt(t,e){let r=e,n=r&&r.getInterpreterName||Or,s;switch(r?r.numberOfArguments:0){case 1:s=i=>{let c=n(i,r);return we(t,c)(i,o)};break;case 3:s=(i,c,l)=>{let u=n(i,r);return we(t,u)(i,c,l,o)};break;default:s=(i,c)=>{let l=n(i,r);return we(t,l)(i,c,o)}}let o=Object.assign({},r,{interpret:s});return o.interpret}function vt(t,e){return(r,...n)=>{let s=t(r,...n),o=e.bind(null,s);return o.ast=s,o}}var bn=K.prototype.parseInstruction;function jt(t,e){if(!Array.isArray(e))throw new Error(`"${t.name}" expects value to be an array`)}function At(t,e){if(jt(t,e),!e.length)throw new Error(`"${t.name}" expects to have at least one element in array`)}var $e=t=>(e,r)=>{if(typeof r!==t)throw new Error(`"${e.name}" expects value to be a "${t}"`)},Et={type:"compound",validate:At,parse(t,e,{parse:r}){let n=e.map(s=>r(s));return Ae(t.name,n)}},xr=Et,wr={type:"compound",validate:At},vr={type:"field",validate(t,e){if(!(e&&(e instanceof RegExp||e.constructor===Object)))throw new Error(`"${t.name}" expects to receive either regular expression or object of field operators`)},parse(t,e,r){let n=e instanceof RegExp?new L("regex",r.field,e):r.parse(e,r);return new U(t.name,[n])}},Ie={type:"field",validate(t,e){if(!e||e.constructor!==Object)throw new Error(`"${t.name}" expects to receive an object with nested query or field level operators`)},parse(t,e,{parse:r,field:n,hasOperators:s}){let o=s(e)?r(e,{field:T}):r(e);return new L(t.name,n,o)}},Ne={type:"field",validate:$e("number")},Z={type:"field",validate:jt},Fe=Z,Me=Z,jr={type:"field",validate(t,e){if(!Array.isArray(e)||e.length!==2)throw new Error(`"${t.name}" expects an array with 2 numeric elements`)}},Ce={type:"field",validate:$e("boolean")},ie={type:"field",validate:function(t,e){if(!(typeof e=="string"||typeof e=="number"||e instanceof Date))throw new Error(`"${t.name}" expects value to be comparable (i.e., string, number or date)`)}},H=ie,Se=H,_e=H,ae={type:"field"},Re=ae,De={type:"field",validate(t,e){if(!(e instanceof RegExp)&&typeof e!="string")throw new Error(`"${t.name}" expects value to be a regular expression or a string that represents regular expression`)},parse(t,e,r){let n=typeof e=="string"?new RegExp(e,r.query.$options||""):e;return new L(t.name,r.field,n)}},ke={type:"field",parse:()=>je},Ar={type:"document",validate:$e("function")},Er=Object.freeze({__proto__:null,$and:Et,$or:xr,$nor:wr,$not:vr,$elemMatch:Ie,$size:Ne,$in:Z,$nin:Fe,$all:Me,$mod:jr,$exists:Ce,$gte:ie,$gt:H,$lt:Se,$lte:_e,$eq:ae,$ne:Re,$regex:De,$options:ke,$where:Ar}),oe=class extends K{constructor(e){super(e,{defaultOperatorName:"$eq",operatorToConditionName:r=>r.slice(1)})}parse(e,r){return r&&r.field?Ee(this.parseFieldOperators(r.field,e)):super.parse(e)}},ce=Er;function Te(t,e,r){for(let n=0,s=t.length;n<s;n++)if(r(t[n],e)===0)return!0;return!1}function Pe(t,e){return Array.isArray(t)&&Number.isNaN(Number(e))}function $t(t,e,r){if(!Pe(t,e))return r(t,e);let n=[];for(let s=0;s<t.length;s++){let o=r(t[s],e);o!==void 0&&(n=n.concat(o))}return n}function B(t){return(e,r,n)=>{let s=n.get(r,e.field);return Array.isArray(s)?s.some(o=>t(e,o,n)):t(e,s,n)}}var $r=Object.hasOwn||Object.prototype.hasOwnProperty.call.bind(Object.prototype.hasOwnProperty),Ir=(t,e)=>t[e];function It(t,e,r){let n=e.lastIndexOf(".");return n===-1?[t,e]:[r(t,e.slice(0,n)),e.slice(n+1)]}function Nr(t,e,r=Ir){if(e===T)return t;if(!t)throw new Error(`Unable to get field "${e}" out of ${String(t)}.`);return(function(n,s,o){if(s.indexOf(".")===-1)return $t(n,s,o);let i=s.split("."),c=n;for(let l=0,u=i.length;l<u;l++)if(c=$t(c,i[l],o),!c||typeof c!="object")return l<u-1?void 0:c;return c})(t,e,r)}function Ue(t,e){return t===e?0:t>e?1:-1}function Le(t,e={}){return wt(t,Object.assign({get:Nr,compare:Ue},e))}var Nt=(t,e,{interpret:r})=>t.value.some(n=>r(n,e)),Fr=(t,e,r)=>!Nt(t,e,r),Be=(t,e,{interpret:r})=>t.value.every(n=>r(n,e)),Mr=(t,e,{interpret:r})=>!r(t.value[0],e),ue=(t,e,{compare:r,get:n})=>{let s=n(e,t.field);return Array.isArray(s)&&!Array.isArray(t.value)?Te(s,t.value,r):r(s,t.value)===0},qe=(t,e,r)=>!ue(t,e,r),Ge=B((t,e,r)=>{let n=r.compare(e,t.value);return n===0||n===-1}),Ve=B((t,e,r)=>r.compare(e,t.value)===-1),ze=B((t,e,r)=>r.compare(e,t.value)===1),Ye=B((t,e,r)=>{let n=r.compare(e,t.value);return n===0||n===1}),We=(t,e,{get:r})=>{if(t.field===T)return e!==void 0;let[n,s]=It(e,t.field,r),o=i=>i==null?!!i===t.value:$r(i,s)===t.value;return Pe(n,s)?n.some(o):o(n)},Cr=B((t,e)=>typeof e=="number"&&e%t.value[0]===t.value[1]),Je=(t,e,{get:r})=>{let[n,s]=It(e,t.field,r),o=i=>{let c=r(i,s);return Array.isArray(c)&&c.length===t.value};return t.field!==T&&Pe(n,s)?n.some(o):o(n)},Ke=B((t,e)=>typeof e=="string"&&t.value.test(e)),Q=B((t,e,{compare:r})=>Te(t.value,e,r)),Ze=(t,e,r)=>!Q(t,e,r),He=(t,e,{compare:r,get:n})=>{let s=n(e,t.field);return Array.isArray(s)&&t.value.every(o=>Te(s,o,r))},Qe=(t,e,{interpret:r,get:n})=>{let s=n(e,t.field);return Array.isArray(s)&&s.some(o=>r(t.value,o))},Sr=(t,e)=>t.value.call(e),_r=Object.freeze({__proto__:null,or:Nt,nor:Fr,and:Be,not:Mr,eq:ue,ne:qe,lte:Ge,lt:Ve,gt:ze,gte:Ye,exists:We,mod:Cr,size:Je,regex:Ke,within:Q,nin:Ze,all:He,elemMatch:Qe,where:Sr}),le=Object.assign({},_r,{in:Q}),jn=Le(le);function Ft(t){return t===null||typeof t!="object"?t:t instanceof Date?t.getTime():t&&typeof t.toJSON=="function"?t.toJSON():t}var Rr=(t,e)=>Ue(Ft(t),Ft(e));function fe(t,e,r){let n=new oe(t),s=Le(e,Object.assign({compare:Rr},r));if(r&&r.forPrimitives){let o={field:T},i=n.parse;n.setParse(c=>i(c,o))}return vt(n.parse,s)}var Nn=fe(ce,le),Fn=fe(["$and","$or"].reduce((t,e)=>(t[e]=Object.assign({},t[e],{type:"field"}),t),Object.assign({},ce,{$nor:Object.assign({},ce.$nor,{type:"field",parse:se.compound})})),le,{forPrimitives:!0});var Dt=Object.hasOwn||((t,e)=>Object.prototype.hasOwnProperty.call(t,e));function Xe(t){return Array.isArray(t)?t:[t]}var z="__caslSubjectType__";function kt(t,e){if(e){if(!Dt(e,z))Object.defineProperty(e,z,{value:t});else if(t!==e[z])throw new Error(`Trying to cast object to subject type ${t} but previously it was casted to ${e[z]}`)}return e}var pe=t=>{let e=typeof t;return e==="string"||e==="function"},Tt=t=>t.modelName||t.name;function Dr(t){return typeof t=="string"?t:Tt(t)}function Pt(t){return Dt(t,z)?t[z]:Tt(t.constructor)}var Mt={function:t=>t.constructor,string:Pt};function Ct(t,e,r){for(let n=r;n<e.length;n++)t.push(e[n])}function St(t,e){if(!t||!t.length)return e||[];if(!e||!e.length)return t||[];let r=0,n=0,s=[];for(;r<t.length&&n<e.length;)t[r].priority<e[n].priority?(s.push(t[r]),r++):t[r].priority>e[n].priority?(s.push(e[n]),n++):(s.push(t[r]),r++,n++);return Ct(s,t,r),Ct(s,e,n),s}function de(t,e,r){let n=t.get(e);return n||(n=r(),t.set(e,n)),n}var kr=t=>t;function Tr(t,e){let r;for(let n=0;n<t.length;n++){let s=e(t[n]);r&&s&&r.push(t[n]),s||(r??=t.slice(0,n))}return r||t}function Pr(t,e){if(Array.isArray(t.fields)&&!t.fields.length)throw new Error("`rawRule.fields` cannot be an empty array. https://bit.ly/390miLa");if(t.fields&&!e.fieldMatcher)throw new Error('You need to pass "fieldMatcher" option in order to restrict access by fields');if(t.conditions&&!e.conditionsMatcher)throw new Error('You need to pass "conditionsMatcher" option in order to restrict access by conditions')}var et=class{constructor(e,r,n=0){Pr(e,r),this.action=r.resolveAction(e.action),this.subject=e.subject,this.inverted=!!e.inverted,this.conditions=e.conditions,this.reason=e.reason,this.origin=e,this.fields=e.fields?Xe(e.fields):void 0,this.priority=n,this.t=r}i(){return this.conditions&&!this.o&&(this.o=this.t.conditionsMatcher(this.conditions)),this.o}get ast(){let e=this.i();return e?e.ast:void 0}matchesConditions(e){return this.conditions?!e||pe(e)?!this.inverted:this.i()(e):!0}matchesField(e){return this.fields?e?(this.u||(this.u=this.t.fieldMatcher(this.fields)),this.u(e)):!this.inverted:!0}};function Ur(t,e){let r={value:t,prev:e,next:null};return e&&(e.next=r),r}function Lr(t){t.next&&(t.next.prev=t.prev),t.prev&&(t.prev.next=t.next),t.next=t.prev=null}var _t=()=>({rules:[],merged:!1}),Rt=()=>new Map,tt=class{constructor(e=[],r={}){this.h=!1,this.l=new Map,this.p={conditionsMatcher:r.conditionsMatcher,fieldMatcher:r.fieldMatcher,resolveAction:r.resolveAction||kr},this.$=r.anyAction||"manage",this.A=r.anySubjectType||"all",this.m=e,this.M=!!r.detectSubjectType,this.j=r.detectSubjectType||Pt,this.v(e)}get rules(){return this.m}detectSubjectType(e){return pe(e)?e:e?this.j(e):this.A}update(e){let r={rules:e,ability:this,target:this};return this._("update",r),this.m=e,this.v(e),this._("updated",r),this}v(e){let r=new Map,n;for(let s=e.length-1;s>=0;s--){let o=e.length-s-1,i=new et(e[s],this.p,o),c=Xe(i.action),l=Xe(i.subject||this.A);!this.h&&i.fields&&(this.h=!0);for(let u=0;u<l.length;u++){let g=de(r,l[u],Rt);n===void 0&&(n=typeof l[u]),typeof l[u]!==n&&n!=="mixed"&&(n="mixed");for(let v=0;v<c.length;v++)de(g,c[v],_t).rules.push(i)}}if(this.l=r,n!=="mixed"&&!this.M){let s=Mt[n]||Mt.string;this.j=s}}possibleRulesFor(e,r=this.A){if(!pe(r))throw new Error('"possibleRulesFor" accepts only subject types (i.e., string or class) as the 2nd parameter');let n=de(this.l,r,Rt),s=de(n,e,_t);if(s.merged)return s.rules;let o=e!==this.$&&n.has(this.$)?n.get(this.$).rules:void 0,i=St(s.rules,o);return r!==this.A&&(i=St(i,this.possibleRulesFor(e,this.A))),s.rules=i,s.merged=!0,i}rulesFor(e,r,n){let s=this.possibleRulesFor(e,r);if(n&&typeof n!="string")throw new Error("The 3rd, `field` parameter is expected to be a string. See https://stalniy.github.io/casl/en/api/casl-ability#can-of-pure-ability for details");return this.h?Tr(s,o=>o.matchesField(n)):s}actionsFor(e){if(!pe(e))throw new Error('"actionsFor" accepts only subject types (i.e., string or class) as a parameter');let r=new Set,n=this.l.get(e);n&&Array.from(n.keys()).forEach(o=>r.add(o));let s=e!==this.A?this.l.get(this.A):void 0;return s&&Array.from(s.keys()).forEach(o=>r.add(o)),Array.from(r)}on(e,r){this.F=this.F||new Map;let n=this.F,s=n.get(e)||null,o=Ur(r,s);return n.set(e,o),()=>{let i=n.get(e);!o.next&&!o.prev&&i===o?n.delete(e):o===i&&n.set(e,o.prev),Lr(o)}}_(e,r){if(!this.F)return;let n=this.F.get(e)||null,s=[];for(;n!==null;)s.push(n.value),n=n.prev;for(let o=0;o<s.length;o++)s[o](r)}},rt=class extends tt{can(e,r,n){let s=this.relevantRuleFor(e,r,n);return!!s&&!s.inverted}relevantRuleFor(e,r,n){let s=this.detectSubjectType(r),o=this.rulesFor(e,s,n);for(let i=0,c=o.length;i<c;i++)if(o[i].matchesConditions(r))return o[i];return null}cannot(e,r,n){return!this.can(e,r,n)}},Br={$eq:ae,$ne:Re,$lt:Se,$lte:_e,$gt:H,$gte:ie,$in:Z,$nin:Fe,$all:Me,$size:Ne,$regex:De,$options:ke,$elemMatch:Ie,$exists:Ce},qr={eq:ue,ne:qe,lt:Ve,lte:Ge,gt:ze,gte:Ye,in:Q,nin:Ze,all:He,size:Je,regex:Ke,elemMatch:Qe,exists:We,and:Be};var Gr=fe(Br,qr),Vr=/[-/\\^$+?.()|[\]{}]/g,zr=/\.?\*+\.?/g,Yr=/\*+/,Wr=/\./g;function Jr(t,e,r){let n=r[0]==="*"||t[0]==="."&&t[t.length-1]==="."?"+":"*",s=t.indexOf("**")===-1?"[^.]":".",o=t.replace(Wr,"\\$&").replace(Yr,s+n);return e+t.length===r.length?`(?:${o})?`:o}function Kr(t,e,r){return t==="."&&(r[e-1]==="*"||r[e+1]==="*")?t:`\\${t}`}function Zr(t){let e=t.map(n=>n.replace(Vr,Kr).replace(zr,Jr)),r=e.length>1?`(?:${e.join("|")})`:e[0];return new RegExp(`^${r}$`)}var Hr=t=>{let e;return r=>(typeof e>"u"&&(e=t.every(n=>n.indexOf("*")===-1)?null:Zr(t)),e===null?t.indexOf(r)!==-1:e.test(r))};function Ut(t=[],e={}){return new rt(t,Object.assign({conditionsMatcher:Gr,fieldMatcher:Hr},e))}var Qr=t=>`Cannot execute "${t.action}" on "${t.subjectType}"`,Lt=function(e){this.message=e};Lt.prototype=Object.create(Error.prototype);var nt=class extends Lt{static setDefaultMessage(e){this.P=typeof e=="string"?()=>e:e}static from(e){return new this(e)}constructor(e){super(""),this.ability=e,typeof Error.captureStackTrace=="function"&&(this.name="ForbiddenError",Error.captureStackTrace(this,this.constructor))}setMessage(e){return this.message=e,this}throwUnlessCan(e,r,n){let s=this.unlessCan(e,r,n);if(s)throw s}unlessCan(e,r,n){let s=this.ability.relevantRuleFor(e,r,n);if(s&&!s.inverted)return;this.action=e,this.subject=r,this.subjectType=Dr(this.ability.detectSubjectType(r)),this.field=n;let o=s?s.reason:"";return this.message=this.message||o||this.constructor.P(this),this}};nt.P=Qr;var Dn=Object.freeze({__proto__:null});function st(t,e,r){if(t==null)return t;if(typeof t=="string"){if(t.indexOf("$principal.")!==0)return t;let s=t.slice(11).split(".").reduce((o,i)=>o==null?o:o[i],e);return s==null&&(r.unresolved=!0),s}if(Array.isArray(t))return t.map(n=>st(n,e,r));if(typeof t=="object"){let n={};for(let s of Object.keys(t))n[s]=st(t[s],e,r);return n}return t}function he(t,e){let r={unresolved:!1};return{conditions:st(t,e,r),unresolved:r.unresolved}}function Bt(t,e){return he(t,e).conditions}function q(t,e){let r=V(t,e),n=[];for(let s of e.rules){if(r.indexOf(s.subject)===-1)continue;let o={action:s.actions,subject:s.resource};if(s.where){let{conditions:i,unresolved:c}=he(s.where,t);if(c)continue;o.conditions=i}n.push(o)}return n}function ot(t){return Ut(Array.isArray(t)?t:[])}function me(t,e){return ot(q(t,e))}function j(t,e,r,n){return n==null?t.can(e,r):t.can(e,kt(r,Object.assign({},n)))}var C={ALL:"all",NONE:"none",FIELDS:"fields",AMBIGUOUS:"ambiguous"},qt={$in:"in",$nin:"nin",$ne:"ne",$gt:"gt",$gte:"gte",$lt:"lt",$lte:"lte"};function Xr(t){let e=[];for(let r of Object.keys(t)){let n=t[r];if(n===null||typeof n!="object"||Array.isArray(n)){e.push({field:r,op:"eq",value:n});continue}let s=Object.keys(n);if(s.length!==1||!qt[s[0]])return null;e.push({field:r,op:qt[s[0]],value:n[s[0]]})}return e}var en=(t,e)=>t==="manage"||t===e||Array.isArray(t)&&(t.indexOf(e)!==-1||t.indexOf("manage")!==-1),tn=(t,e)=>t==="all"||t===e;function ye(t,e,r,n){let s=q(t,e).filter(i=>en(i.action,r)&&tn(i.subject,n));if(s.length===0)return{scope:C.NONE,clauses:[]};if(s.some(i=>!i.conditions))return{scope:C.ALL,clauses:[]};if(s.length>1)return{scope:C.AMBIGUOUS,clauses:[]};let o=Xr(s[0].conditions);return o?{scope:C.FIELDS,clauses:o}:{scope:C.AMBIGUOUS,clauses:[]}}function be(t,e){let r=t;for(let n of e)n.op==="in"?r=r.hasSome(n.field,n.value):n.op==="nin"?r=r.not(r.hasSome(n.field,n.value)):r=r[n.op](n.field,n.value);return r}var it=/export\s+const\s+([A-Za-z0-9_$]+)\s*=\s*webMethod\s*\(\s*Permissions\s*\.\s*([A-Za-z0-9_$]+)/g,rn=[[/export\s*{\s*[A-Za-z0-9_$,\s]+}/,"export { x } \u2014 the call and the export must be one statement"],[/export\s+const\s+[A-Za-z0-9_$]+\s*=\s*webMethod\s*\(\s*Permissions\s*\[/,"Permissions['X'] \u2014 the property must be dotted and literal"],[/export\s+const\s+[A-Za-z0-9_$]+\s*=\s*webMethod\s*\(\s*[A-Za-z0-9_$]+\s*\(/,"a computed permission \u2014 it must be written out as Permissions.LEVEL"]];function at(t){let e={},r=String(t||"");it.lastIndex=0;let n=it.exec(r);for(;n;)e[n[1]]=n[2],n=it.exec(r);return e}function ct(t,e,r){let n=r||{},s=e&&e.api||{},o=at(t),i=String(t||""),c=[],l=[];for(let h of Object.keys(o)){let M=s[h];M?M.permission!==o[h]&&c.push({name:h,declared:M.permission,written:o[h]}):l.push({name:h,gate:o[h]})}let u=n.complete?Object.keys(s).filter(h=>!(h in o)):[],g=[];for(let[h,M]of rn)h.test(i)&&g.push(M);return{ok:c.length+l.length+u.length+g.length===0,found:o,mismatched:c,undeclared:l,missing:u,suspect:g}}function Gt(t,e,r){let n=ct(t,e,r);if(n.ok)return!0;let s=[];for(let o of n.mismatched)s.push(o.name+": policy says "+o.declared+", the export says "+o.written);for(let o of n.undeclared)s.push(o.name+": gated "+o.gate+" but missing from policy.api");for(let o of n.missing)s.push(o+": declared in policy.api but not exported here");for(let o of n.suspect)s.push("unreachable export shape \u2014 "+o);throw new Error(`wix-access: web-method gates do not match the policy:
+var sr=Object.create;var re=Object.defineProperty;var or=Object.getOwnPropertyDescriptor;var ir=Object.getOwnPropertyNames;var ar=Object.getPrototypeOf,cr=Object.prototype.hasOwnProperty;var ur=(t,e)=>{for(var r in e)re(t,r,{get:e[r],enumerable:!0})},mt=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let s of ir(e))!cr.call(t,s)&&s!==r&&re(t,s,{get:()=>e[s],enumerable:!(n=or(e,s))||n.enumerable});return t};var lr=(t,e,r)=>(r=t!=null?sr(ar(t)):{},mt(e||!t||!t.__esModule?re(r,"default",{value:t,enumerable:!0}):r,t)),fr=t=>mt(re({},"__esModule",{value:!0}),t);var dn={};ur(dn,{ASSIGN_OWNER:()=>$,CASES:()=>dt,CODES:()=>b,KIND:()=>P,PACKAGE_VERSION:()=>ft,PolicyError:()=>q,SCOPE:()=>S,WHEN:()=>U,abilityFor:()=>be,abilityFromRules:()=>at,anonymous:()=>gt,applyClauses:()=>Oe,applyGates:()=>Yt,assertDeclared:()=>Zt,assertGates:()=>zt,backendMemberId:()=>fn,backendPing:()=>ln,can:()=>A,caseTable:()=>Wt,createAccess:()=>un,createPrincipal:()=>K,deny:()=>N,denyOpaque:()=>M,filterFor:()=>ge,hasRole:()=>ne,isDenial:()=>bt,normaliseRoles:()=>xe,ok:()=>yt,parseGates:()=>ut,permissionFor:()=>wt,resolvePlaceholders:()=>Gt,resolveSubjects:()=>W,resolveWhere:()=>ye,rulesFor:()=>Y,validatePolicy:()=>se,verifyGates:()=>lt});module.exports=fr(dn);var pt=require("wix-members-backend"),er=lr(require("wix-users-backend"),1),tr=require("@wix/data"),rr=require("@wix/essentials");var b={FORBIDDEN:"FORBIDDEN",UNAUTHENTICATED:"UNAUTHENTICATED",UNVERIFIED:"UNVERIFIED",NOT_FOUND:"NOT_FOUND",INVALID_POLICY:"INVALID_POLICY",INVALID_ARGUMENT:"INVALID_ARGUMENT"},q=class extends Error{constructor(e){super(e),this.name="PolicyError",this.code=b.INVALID_POLICY}};function yt(t){return{ok:!0,data:t===void 0?null:t}}function N(t,e,r){let n={ok:!1,code:t||b.FORBIDDEN};return e&&(n.action=e),r&&(n.detail=r),n}var bt=t=>!!t&&t.ok===!1;function M(t){return N(b.NOT_FOUND,t)}var P={VISITOR:"visitor",MEMBER:"member",CAPABILITY:"capability",SERVICE:"service"};function xe(t){if(!Array.isArray(t))return[];let e=[];for(let r of t){if(typeof r=="string"){e.push(r);continue}if(!r||typeof r!="object")continue;let n=r.title||r.name||r.roleKey;n&&e.push(n)}return e}function K(t){let e=t||{},r=e.memberId||null,n=xe(e.roles);return{kind:e.kind||(r?P.MEMBER:P.VISITOR),memberId:r,roles:n,subjects:Array.isArray(e.subjects)?e.subjects.slice():[],domain:e.domain&&typeof e.domain=="object"?e.domain:{},unverified:!!e.unverified}}var gt=()=>K({kind:P.VISITOR}),ne=(t,e)=>t.roles.indexOf(e)!==-1;var U={ANYONE:"anyone",ANONYMOUS:"anonymous",MEMBER:"member"},_=t=>!!t&&typeof t=="object"&&!Array.isArray(t),dr=t=>Array.isArray(t)?t:[t];function g(t,e){throw new q("policy"+t+": "+e)}function pr(t,e){let r=".subjects."+t;_(e)||g(r,"must be an object");let s=["when","role","domain"].filter(o=>e[o]!==void 0);if(s.length===0&&g(r,'needs exactly one of when/role/domain \u2014 "{}" is ambiguous between a visitor and a member'),s.length>1&&g(r,"has "+s.join(" and ")+"; use exactly one"),e.when!==void 0){let o=[U.ANYONE,U.ANONYMOUS,U.MEMBER];o.indexOf(e.when)===-1&&g(r+".when","must be one of "+o.join(", ")+" (got "+JSON.stringify(e.when)+")")}e.role!==void 0&&typeof e.role!="string"&&g(r+".role","must be a string"),e.domain!==void 0&&typeof e.domain!="string"&&g(r+".domain","must be a string")}function hr(t,e,r){let n=".rules["+e+"]";_(t)||g(n,"must be an object"),typeof t.subject!="string"&&g(n+".subject","must be a string"),r.indexOf(t.subject)===-1&&g(n+".subject",'"'+t.subject+'" is not declared in policy.subjects'),t.actions===void 0&&g(n+".actions","is required");for(let s of dr(t.actions))typeof s!="string"&&g(n+".actions","must be a string or an array of strings");typeof t.resource!="string"&&g(n+".resource","must be a string"),t.where!==void 0&&!_(t.where)&&g(n+".where","must be an object")}var Ot=["Anyone","SiteMember","Admin"];function mr(t,e,r){let n=".api."+t;_(e)||g(n,"must be an object"),Ot.indexOf(e.permission)===-1&&g(n+".permission","must be one of "+Ot.join(", ")+" (got "+JSON.stringify(e.permission)+")"),e.ability!==void 0&&((!Array.isArray(e.ability)||e.ability.length!==2)&&g(n+".ability","must be [action, resource]"),(typeof e.ability[0]!="string"||typeof e.ability[1]!="string")&&g(n+".ability","both entries must be strings")),e.subject!==void 0&&r.indexOf(e.subject)===-1&&g(n+".subject",'"'+e.subject+'" is not declared in policy.subjects')}var yr=["resource","owner","actor","tenant","profile"];function br(t,e){let r=".collections."+t;_(e)||g(r,"must be an object");for(let n of yr)e[n]!==void 0&&(typeof e[n]!="string"||!e[n])&&g(r+"."+n,"must be a non-empty string");e.owner!==void 0&&e.owner===e.actor&&g(r,'owner and actor must be different fields (both are "'+e.owner+'")')}function se(t){if(!_(t))throw new q("policy must be an object");_(t.subjects)||g(".subjects","is required and must be an object");let e=Object.keys(t.subjects);e.length===0&&g(".subjects","declares no subjects");for(let r of e)pr(r,t.subjects[r]);if(Array.isArray(t.rules)||g(".rules","is required and must be an array"),t.rules.forEach((r,n)=>hr(r,n,e)),t.api!==void 0){_(t.api)||g(".api","must be an object");for(let r of Object.keys(t.api))mr(r,t.api[r],e)}if(t.collections!==void 0){_(t.collections)||g(".collections","must be an object");for(let r of Object.keys(t.collections))br(r,t.collections[r])}return t}function W(t,e){let r=new Set(t.subjects||[]);for(let n of Object.keys(e.subjects)){let s=e.subjects[n];(s.when===U.ANYONE||s.when===U.ANONYMOUS&&!t.memberId||s.when===U.MEMBER&&t.memberId||s.role!==void 0&&t.roles.indexOf(s.role)!==-1||s.domain!==void 0&&t.domain[s.domain])&&r.add(n)}return Array.from(r)}function wt(t,e){let r=t.api&&t.api[e];return r?r.permission:null}var oe=class{constructor(e,r){this.operator=e,this.value=r,Object.defineProperty(this,"t",{writable:!0})}get notes(){return this.t}addNote(e){this.t=this.t||[],this.t.push(e)}},Z=class extends oe{},G=class extends Z{constructor(e,r){if(!Array.isArray(r))throw new Error(`"${e}" operator expects to receive an array of conditions`);super(e,r)}},B="__itself__",V=class extends oe{constructor(e,r,n){super(e,n),this.field=r}},Ee=new Z("__null__",null),Ae=Object.prototype.hasOwnProperty.call.bind(Object.prototype.hasOwnProperty);function gr(t,e){return e instanceof G&&e.operator===t}function $e(t,e){return e.length===1?e[0]:new G(t,(function r(n,s,o){let i=o||[];for(let c=0,l=s.length;c<l;c++){let u=s[c];gr(n,u)?r(n,u.value,i):i.push(u)}return i})(t,e))}var Or=t=>t,xt=()=>Object.create(null),vt=Object.defineProperty(xt(),"__@type@__",{value:"ignore value"});function wr(t,e,r=!1){if(!t||t&&t.constructor!==Object)return!1;for(let n in t)if(Ae(t,n)&&Ae(e,n)&&(!r||t[n]!==vt))return!0;return!1}function xr(t){let e=[];for(let r in t)Ae(t,r)&&t[r]!==vt&&e.push(r);return e}function ve(t,e){e!==Ee&&t.push(e)}var Ie=t=>$e("and",t);var ie={compound(t,e,r){let n=(Array.isArray(e)?e:[e]).map(s=>r.parse(s));return new G(t.name,n)},field:(t,e,r)=>new V(t.name,r.field,e),document:(t,e)=>new Z(t.name,e)},H=class{constructor(e,r=xt()){this.o=void 0,this.s=void 0,this.i=void 0,this.u=void 0,this.h=void 0,this.parse=this.parse.bind(this),this.u={operatorToConditionName:r.operatorToConditionName||Or,defaultOperatorName:r.defaultOperatorName||"eq",mergeFinalConditions:r.mergeFinalConditions||Ie},this.o=Object.keys(e).reduce((n,s)=>(n[s]=Object.assign({name:this.u.operatorToConditionName(s)},e[s]),n),{}),this.s=Object.assign({},r.fieldContext,{field:"",query:{},parse:this.parse,hasOperators:n=>wr(n,this.o,r.useIgnoreValue)}),this.i=Object.assign({},r.documentContext,{parse:this.parse,query:{}}),this.h=r.useIgnoreValue?xr:Object.keys}setParse(e){this.parse=e,this.s.parse=e,this.i.parse=e}parseField(e,r,n,s){let o=this.o[r];if(!o)throw new Error(`Unsupported operator "${r}"`);if(o.type!=="field")throw new Error(`Unexpected ${o.type} operator "${r}" at field level`);return this.s.field=e,this.s.query=s,this.parseInstruction(o,n,this.s)}parseInstruction(e,r,n){return typeof e.validate=="function"&&e.validate(e,r),(e.parse||ie[e.type])(e,r,n)}parseFieldOperators(e,r){let n=[],s=this.h(r);for(let o=0,i=s.length;o<i;o++){let c=s[o];if(!this.o[c])throw new Error(`Field query for "${e}" may contain only operators or a plain object as a value`);ve(n,this.parseField(e,c,r[c],r))}return n}parse(e){let r=[],n=this.h(e);this.i.query=e;for(let s=0,o=n.length;s<o;s++){let i=n[s],c=e[i],l=this.o[i];if(l){if(l.type!=="document"&&l.type!=="compound")throw new Error(`Cannot use parsing instruction for operator "${i}" in "document" context as it is supposed to be used in  "${l.type}" context`);ve(r,this.parseInstruction(l,c,this.i))}else this.s.hasOperators(c)?r.push(...this.parseFieldOperators(i,c)):ve(r,this.parseField(i,this.u.defaultOperatorName,c,e))}return this.u.mergeFinalConditions(r)}};function je(t,e){let r=t[e];if(typeof r!="function")throw new Error(`Unable to interpret "${e}" condition. Did you forget to register interpreter for it?`);return r}function vr(t){return t.operator}function jt(t,e){let r=e,n=r&&r.getInterpreterName||vr,s;switch(r?r.numberOfArguments:0){case 1:s=i=>{let c=n(i,r);return je(t,c)(i,o)};break;case 3:s=(i,c,l)=>{let u=n(i,r);return je(t,u)(i,c,l,o)};break;default:s=(i,c)=>{let l=n(i,r);return je(t,l)(i,c,o)}}let o=Object.assign({},r,{interpret:s});return o.interpret}function At(t,e){return(r,...n)=>{let s=t(r,...n),o=e.bind(null,s);return o.ast=s,o}}var wn=H.prototype.parseInstruction;function Et(t,e){if(!Array.isArray(e))throw new Error(`"${t.name}" expects value to be an array`)}function $t(t,e){if(Et(t,e),!e.length)throw new Error(`"${t.name}" expects to have at least one element in array`)}var Ne=t=>(e,r)=>{if(typeof r!==t)throw new Error(`"${e.name}" expects value to be a "${t}"`)},It={type:"compound",validate:$t,parse(t,e,{parse:r}){let n=e.map(s=>r(s));return $e(t.name,n)}},jr=It,Ar={type:"compound",validate:$t},Er={type:"field",validate(t,e){if(!(e&&(e instanceof RegExp||e.constructor===Object)))throw new Error(`"${t.name}" expects to receive either regular expression or object of field operators`)},parse(t,e,r){let n=e instanceof RegExp?new V("regex",r.field,e):r.parse(e,r);return new G(t.name,[n])}},Fe={type:"field",validate(t,e){if(!e||e.constructor!==Object)throw new Error(`"${t.name}" expects to receive an object with nested query or field level operators`)},parse(t,e,{parse:r,field:n,hasOperators:s}){let o=s(e)?r(e,{field:B}):r(e);return new V(t.name,n,o)}},Me={type:"field",validate:Ne("number")},Q={type:"field",validate:Et},Ce=Q,Se=Q,$r={type:"field",validate(t,e){if(!Array.isArray(e)||e.length!==2)throw new Error(`"${t.name}" expects an array with 2 numeric elements`)}},De={type:"field",validate:Ne("boolean")},ce={type:"field",validate:function(t,e){if(!(typeof e=="string"||typeof e=="number"||e instanceof Date))throw new Error(`"${t.name}" expects value to be comparable (i.e., string, number or date)`)}},X=ce,Re=X,_e=X,ue={type:"field"},ke=ue,Te={type:"field",validate(t,e){if(!(e instanceof RegExp)&&typeof e!="string")throw new Error(`"${t.name}" expects value to be a regular expression or a string that represents regular expression`)},parse(t,e,r){let n=typeof e=="string"?new RegExp(e,r.query.$options||""):e;return new V(t.name,r.field,n)}},Pe={type:"field",parse:()=>Ee},Ir={type:"document",validate:Ne("function")},Nr=Object.freeze({__proto__:null,$and:It,$or:jr,$nor:Ar,$not:Er,$elemMatch:Fe,$size:Me,$in:Q,$nin:Ce,$all:Se,$mod:$r,$exists:De,$gte:ce,$gt:X,$lt:Re,$lte:_e,$eq:ue,$ne:ke,$regex:Te,$options:Pe,$where:Ir}),ae=class extends H{constructor(e){super(e,{defaultOperatorName:"$eq",operatorToConditionName:r=>r.slice(1)})}parse(e,r){return r&&r.field?Ie(this.parseFieldOperators(r.field,e)):super.parse(e)}},le=Nr;function Ue(t,e,r){for(let n=0,s=t.length;n<s;n++)if(r(t[n],e)===0)return!0;return!1}function Be(t,e){return Array.isArray(t)&&Number.isNaN(Number(e))}function Nt(t,e,r){if(!Be(t,e))return r(t,e);let n=[];for(let s=0;s<t.length;s++){let o=r(t[s],e);o!==void 0&&(n=n.concat(o))}return n}function z(t){return(e,r,n)=>{let s=n.get(r,e.field);return Array.isArray(s)?s.some(o=>t(e,o,n)):t(e,s,n)}}var Fr=Object.hasOwn||Object.prototype.hasOwnProperty.call.bind(Object.prototype.hasOwnProperty),Mr=(t,e)=>t[e];function Ft(t,e,r){let n=e.lastIndexOf(".");return n===-1?[t,e]:[r(t,e.slice(0,n)),e.slice(n+1)]}function Cr(t,e,r=Mr){if(e===B)return t;if(!t)throw new Error(`Unable to get field "${e}" out of ${String(t)}.`);return(function(n,s,o){if(s.indexOf(".")===-1)return Nt(n,s,o);let i=s.split("."),c=n;for(let l=0,u=i.length;l<u;l++)if(c=Nt(c,i[l],o),!c||typeof c!="object")return l<u-1?void 0:c;return c})(t,e,r)}function Le(t,e){return t===e?0:t>e?1:-1}function qe(t,e={}){return jt(t,Object.assign({get:Cr,compare:Le},e))}var Mt=(t,e,{interpret:r})=>t.value.some(n=>r(n,e)),Sr=(t,e,r)=>!Mt(t,e,r),Ge=(t,e,{interpret:r})=>t.value.every(n=>r(n,e)),Dr=(t,e,{interpret:r})=>!r(t.value[0],e),fe=(t,e,{compare:r,get:n})=>{let s=n(e,t.field);return Array.isArray(s)&&!Array.isArray(t.value)?Ue(s,t.value,r):r(s,t.value)===0},Ve=(t,e,r)=>!fe(t,e,r),ze=z((t,e,r)=>{let n=r.compare(e,t.value);return n===0||n===-1}),Ye=z((t,e,r)=>r.compare(e,t.value)===-1),We=z((t,e,r)=>r.compare(e,t.value)===1),Je=z((t,e,r)=>{let n=r.compare(e,t.value);return n===0||n===1}),Ke=(t,e,{get:r})=>{if(t.field===B)return e!==void 0;let[n,s]=Ft(e,t.field,r),o=i=>i==null?!!i===t.value:Fr(i,s)===t.value;return Be(n,s)?n.some(o):o(n)},Rr=z((t,e)=>typeof e=="number"&&e%t.value[0]===t.value[1]),Ze=(t,e,{get:r})=>{let[n,s]=Ft(e,t.field,r),o=i=>{let c=r(i,s);return Array.isArray(c)&&c.length===t.value};return t.field!==B&&Be(n,s)?n.some(o):o(n)},He=z((t,e)=>typeof e=="string"&&t.value.test(e)),ee=z((t,e,{compare:r})=>Ue(t.value,e,r)),Qe=(t,e,r)=>!ee(t,e,r),Xe=(t,e,{compare:r,get:n})=>{let s=n(e,t.field);return Array.isArray(s)&&t.value.every(o=>Ue(s,o,r))},et=(t,e,{interpret:r,get:n})=>{let s=n(e,t.field);return Array.isArray(s)&&s.some(o=>r(t.value,o))},_r=(t,e)=>t.value.call(e),kr=Object.freeze({__proto__:null,or:Mt,nor:Sr,and:Ge,not:Dr,eq:fe,ne:Ve,lte:ze,lt:Ye,gt:We,gte:Je,exists:Ke,mod:Rr,size:Ze,regex:He,within:ee,nin:Qe,all:Xe,elemMatch:et,where:_r}),de=Object.assign({},kr,{in:ee}),$n=qe(de);function Ct(t){return t===null||typeof t!="object"?t:t instanceof Date?t.getTime():t&&typeof t.toJSON=="function"?t.toJSON():t}var Tr=(t,e)=>Le(Ct(t),Ct(e));function pe(t,e,r){let n=new ae(t),s=qe(e,Object.assign({compare:Tr},r));if(r&&r.forPrimitives){let o={field:B},i=n.parse;n.setParse(c=>i(c,o))}return At(n.parse,s)}var Cn=pe(le,de),Sn=pe(["$and","$or"].reduce((t,e)=>(t[e]=Object.assign({},t[e],{type:"field"}),t),Object.assign({},le,{$nor:Object.assign({},le.$nor,{type:"field",parse:ie.compound})})),de,{forPrimitives:!0});var Tt=Object.hasOwn||((t,e)=>Object.prototype.hasOwnProperty.call(t,e));function tt(t){return Array.isArray(t)?t:[t]}var J="__caslSubjectType__";function Pt(t,e){if(e){if(!Tt(e,J))Object.defineProperty(e,J,{value:t});else if(t!==e[J])throw new Error(`Trying to cast object to subject type ${t} but previously it was casted to ${e[J]}`)}return e}var me=t=>{let e=typeof t;return e==="string"||e==="function"},Ut=t=>t.modelName||t.name;function Pr(t){return typeof t=="string"?t:Ut(t)}function Bt(t){return Tt(t,J)?t[J]:Ut(t.constructor)}var St={function:t=>t.constructor,string:Bt};function Dt(t,e,r){for(let n=r;n<e.length;n++)t.push(e[n])}function Rt(t,e){if(!t||!t.length)return e||[];if(!e||!e.length)return t||[];let r=0,n=0,s=[];for(;r<t.length&&n<e.length;)t[r].priority<e[n].priority?(s.push(t[r]),r++):t[r].priority>e[n].priority?(s.push(e[n]),n++):(s.push(t[r]),r++,n++);return Dt(s,t,r),Dt(s,e,n),s}function he(t,e,r){let n=t.get(e);return n||(n=r(),t.set(e,n)),n}var Ur=t=>t;function Br(t,e){let r;for(let n=0;n<t.length;n++){let s=e(t[n]);r&&s&&r.push(t[n]),s||(r??=t.slice(0,n))}return r||t}function Lr(t,e){if(Array.isArray(t.fields)&&!t.fields.length)throw new Error("`rawRule.fields` cannot be an empty array. https://bit.ly/390miLa");if(t.fields&&!e.fieldMatcher)throw new Error('You need to pass "fieldMatcher" option in order to restrict access by fields');if(t.conditions&&!e.conditionsMatcher)throw new Error('You need to pass "conditionsMatcher" option in order to restrict access by conditions')}var rt=class{constructor(e,r,n=0){Lr(e,r),this.action=r.resolveAction(e.action),this.subject=e.subject,this.inverted=!!e.inverted,this.conditions=e.conditions,this.reason=e.reason,this.origin=e,this.fields=e.fields?tt(e.fields):void 0,this.priority=n,this.t=r}i(){return this.conditions&&!this.o&&(this.o=this.t.conditionsMatcher(this.conditions)),this.o}get ast(){let e=this.i();return e?e.ast:void 0}matchesConditions(e){return this.conditions?!e||me(e)?!this.inverted:this.i()(e):!0}matchesField(e){return this.fields?e?(this.u||(this.u=this.t.fieldMatcher(this.fields)),this.u(e)):!this.inverted:!0}};function qr(t,e){let r={value:t,prev:e,next:null};return e&&(e.next=r),r}function Gr(t){t.next&&(t.next.prev=t.prev),t.prev&&(t.prev.next=t.next),t.next=t.prev=null}var _t=()=>({rules:[],merged:!1}),kt=()=>new Map,nt=class{constructor(e=[],r={}){this.h=!1,this.l=new Map,this.p={conditionsMatcher:r.conditionsMatcher,fieldMatcher:r.fieldMatcher,resolveAction:r.resolveAction||Ur},this.$=r.anyAction||"manage",this.A=r.anySubjectType||"all",this.m=e,this.M=!!r.detectSubjectType,this.j=r.detectSubjectType||Bt,this.v(e)}get rules(){return this.m}detectSubjectType(e){return me(e)?e:e?this.j(e):this.A}update(e){let r={rules:e,ability:this,target:this};return this._("update",r),this.m=e,this.v(e),this._("updated",r),this}v(e){let r=new Map,n;for(let s=e.length-1;s>=0;s--){let o=e.length-s-1,i=new rt(e[s],this.p,o),c=tt(i.action),l=tt(i.subject||this.A);!this.h&&i.fields&&(this.h=!0);for(let u=0;u<l.length;u++){let O=he(r,l[u],kt);n===void 0&&(n=typeof l[u]),typeof l[u]!==n&&n!=="mixed"&&(n="mixed");for(let E=0;E<c.length;E++)he(O,c[E],_t).rules.push(i)}}if(this.l=r,n!=="mixed"&&!this.M){let s=St[n]||St.string;this.j=s}}possibleRulesFor(e,r=this.A){if(!me(r))throw new Error('"possibleRulesFor" accepts only subject types (i.e., string or class) as the 2nd parameter');let n=he(this.l,r,kt),s=he(n,e,_t);if(s.merged)return s.rules;let o=e!==this.$&&n.has(this.$)?n.get(this.$).rules:void 0,i=Rt(s.rules,o);return r!==this.A&&(i=Rt(i,this.possibleRulesFor(e,this.A))),s.rules=i,s.merged=!0,i}rulesFor(e,r,n){let s=this.possibleRulesFor(e,r);if(n&&typeof n!="string")throw new Error("The 3rd, `field` parameter is expected to be a string. See https://stalniy.github.io/casl/en/api/casl-ability#can-of-pure-ability for details");return this.h?Br(s,o=>o.matchesField(n)):s}actionsFor(e){if(!me(e))throw new Error('"actionsFor" accepts only subject types (i.e., string or class) as a parameter');let r=new Set,n=this.l.get(e);n&&Array.from(n.keys()).forEach(o=>r.add(o));let s=e!==this.A?this.l.get(this.A):void 0;return s&&Array.from(s.keys()).forEach(o=>r.add(o)),Array.from(r)}on(e,r){this.F=this.F||new Map;let n=this.F,s=n.get(e)||null,o=qr(r,s);return n.set(e,o),()=>{let i=n.get(e);!o.next&&!o.prev&&i===o?n.delete(e):o===i&&n.set(e,o.prev),Gr(o)}}_(e,r){if(!this.F)return;let n=this.F.get(e)||null,s=[];for(;n!==null;)s.push(n.value),n=n.prev;for(let o=0;o<s.length;o++)s[o](r)}},st=class extends nt{can(e,r,n){let s=this.relevantRuleFor(e,r,n);return!!s&&!s.inverted}relevantRuleFor(e,r,n){let s=this.detectSubjectType(r),o=this.rulesFor(e,s,n);for(let i=0,c=o.length;i<c;i++)if(o[i].matchesConditions(r))return o[i];return null}cannot(e,r,n){return!this.can(e,r,n)}},Vr={$eq:ue,$ne:ke,$lt:Re,$lte:_e,$gt:X,$gte:ce,$in:Q,$nin:Ce,$all:Se,$size:Me,$regex:Te,$options:Pe,$elemMatch:Fe,$exists:De},zr={eq:fe,ne:Ve,lt:Ye,lte:ze,gt:We,gte:Je,in:ee,nin:Qe,all:Xe,size:Ze,regex:He,elemMatch:et,exists:Ke,and:Ge};var Yr=pe(Vr,zr),Wr=/[-/\\^$+?.()|[\]{}]/g,Jr=/\.?\*+\.?/g,Kr=/\*+/,Zr=/\./g;function Hr(t,e,r){let n=r[0]==="*"||t[0]==="."&&t[t.length-1]==="."?"+":"*",s=t.indexOf("**")===-1?"[^.]":".",o=t.replace(Zr,"\\$&").replace(Kr,s+n);return e+t.length===r.length?`(?:${o})?`:o}function Qr(t,e,r){return t==="."&&(r[e-1]==="*"||r[e+1]==="*")?t:`\\${t}`}function Xr(t){let e=t.map(n=>n.replace(Wr,Qr).replace(Jr,Hr)),r=e.length>1?`(?:${e.join("|")})`:e[0];return new RegExp(`^${r}$`)}var en=t=>{let e;return r=>(typeof e>"u"&&(e=t.every(n=>n.indexOf("*")===-1)?null:Xr(t)),e===null?t.indexOf(r)!==-1:e.test(r))};function Lt(t=[],e={}){return new st(t,Object.assign({conditionsMatcher:Yr,fieldMatcher:en},e))}var tn=t=>`Cannot execute "${t.action}" on "${t.subjectType}"`,qt=function(e){this.message=e};qt.prototype=Object.create(Error.prototype);var ot=class extends qt{static setDefaultMessage(e){this.P=typeof e=="string"?()=>e:e}static from(e){return new this(e)}constructor(e){super(""),this.ability=e,typeof Error.captureStackTrace=="function"&&(this.name="ForbiddenError",Error.captureStackTrace(this,this.constructor))}setMessage(e){return this.message=e,this}throwUnlessCan(e,r,n){let s=this.unlessCan(e,r,n);if(s)throw s}unlessCan(e,r,n){let s=this.ability.relevantRuleFor(e,r,n);if(s&&!s.inverted)return;this.action=e,this.subject=r,this.subjectType=Pr(this.ability.detectSubjectType(r)),this.field=n;let o=s?s.reason:"";return this.message=this.message||o||this.constructor.P(this),this}};ot.P=tn;var Pn=Object.freeze({__proto__:null});function it(t,e,r){if(t==null)return t;if(typeof t=="string"){if(t.indexOf("$principal.")!==0)return t;let s=t.slice(11).split(".").reduce((o,i)=>o==null?o:o[i],e);return s==null&&(r.unresolved=!0),s}if(Array.isArray(t))return t.map(n=>it(n,e,r));if(typeof t=="object"){let n={};for(let s of Object.keys(t))n[s]=it(t[s],e,r);return n}return t}function ye(t,e){let r={unresolved:!1};return{conditions:it(t,e,r),unresolved:r.unresolved}}function Gt(t,e){return ye(t,e).conditions}function Y(t,e){let r=W(t,e),n=[];for(let s of e.rules){if(r.indexOf(s.subject)===-1)continue;let o={action:s.actions,subject:s.resource};if(s.where){let{conditions:i,unresolved:c}=ye(s.where,t);if(c)continue;o.conditions=i}n.push(o)}return n}function at(t){return Lt(Array.isArray(t)?t:[])}function be(t,e){return at(Y(t,e))}function A(t,e,r,n){return n==null?t.can(e,r):t.can(e,Pt(r,Object.assign({},n)))}var S={ALL:"all",NONE:"none",FIELDS:"fields",AMBIGUOUS:"ambiguous"},Vt={$in:"in",$nin:"nin",$ne:"ne",$gt:"gt",$gte:"gte",$lt:"lt",$lte:"lte"};function rn(t){let e=[];for(let r of Object.keys(t)){let n=t[r];if(n===null||typeof n!="object"||Array.isArray(n)){e.push({field:r,op:"eq",value:n});continue}let s=Object.keys(n);if(s.length!==1||!Vt[s[0]])return null;e.push({field:r,op:Vt[s[0]],value:n[s[0]]})}return e}var nn=(t,e)=>t==="manage"||t===e||Array.isArray(t)&&(t.indexOf(e)!==-1||t.indexOf("manage")!==-1),sn=(t,e)=>t==="all"||t===e;function ge(t,e,r,n){let s=Y(t,e).filter(i=>nn(i.action,r)&&sn(i.subject,n));if(s.length===0)return{scope:S.NONE,clauses:[]};if(s.some(i=>!i.conditions))return{scope:S.ALL,clauses:[]};if(s.length>1)return{scope:S.AMBIGUOUS,clauses:[]};let o=rn(s[0].conditions);return o?{scope:S.FIELDS,clauses:o}:{scope:S.AMBIGUOUS,clauses:[]}}function Oe(t,e){let r=t;for(let n of e)n.op==="in"?r=r.hasSome(n.field,n.value):n.op==="nin"?r=r.not(r.hasSome(n.field,n.value)):r=r[n.op](n.field,n.value);return r}var ct=/export\s+const\s+([A-Za-z0-9_$]+)\s*=\s*webMethod\s*\(\s*Permissions\s*\.\s*([A-Za-z0-9_$]+)/g,on=[[/export\s*{\s*[A-Za-z0-9_$,\s]+}/,"export { x } \u2014 the call and the export must be one statement"],[/export\s+const\s+[A-Za-z0-9_$]+\s*=\s*webMethod\s*\(\s*Permissions\s*\[/,"Permissions['X'] \u2014 the property must be dotted and literal"],[/export\s+const\s+[A-Za-z0-9_$]+\s*=\s*webMethod\s*\(\s*[A-Za-z0-9_$]+\s*\(/,"a computed permission \u2014 it must be written out as Permissions.LEVEL"]];function ut(t){let e={},r=String(t||"");ct.lastIndex=0;let n=ct.exec(r);for(;n;)e[n[1]]=n[2],n=ct.exec(r);return e}function lt(t,e,r){let n=r||{},s=e&&e.api||{},o=ut(t),i=String(t||""),c=[],l=[];for(let y of Object.keys(o)){let C=s[y];C?C.permission!==o[y]&&c.push({name:y,declared:C.permission,written:o[y]}):l.push({name:y,gate:o[y]})}let u=n.complete?Object.keys(s).filter(y=>!(y in o)):[],O=[];for(let[y,C]of on)y.test(i)&&O.push(C);return{ok:c.length+l.length+u.length+O.length===0,found:o,mismatched:c,undeclared:l,missing:u,suspect:O}}function zt(t,e,r){let n=lt(t,e,r);if(n.ok)return!0;let s=[];for(let o of n.mismatched)s.push(o.name+": policy says "+o.declared+", the export says "+o.written);for(let o of n.undeclared)s.push(o.name+": gated "+o.gate+" but missing from policy.api");for(let o of n.missing)s.push(o+": declared in policy.api but not exported here");for(let o of n.suspect)s.push("unreachable export shape \u2014 "+o);throw new Error(`wix-access: web-method gates do not match the policy:
   `+s.join(`
-  `))}function Vt(t,e){let r=e&&e.api||{},n=t||{},s={},o=[];for(let i of Object.keys(n)){let c=n[i],l=r[i];if(!l){o.push(i);continue}if(typeof c!="function"){o.push(i+" (not a function: "+typeof c+")");continue}try{c.permission=l.permission,s[i]=l.permission}catch(u){o.push(i+" (could not stamp: "+String(u&&u.message)+")")}}if(o.length)throw new Error("wix-access: applyGates could not gate: "+o.join(", ")+". Every exported web method must be declared in policy.api.");return s}var ut="0.5.1";var lt=[{action:"read",type:"Booking",object:{customerId:"m-1"}},{action:"read",type:"Booking",object:{customerId:"m-2"}},{action:"cancel",type:"Booking",object:{customerId:"m-1"}},{action:"delete",type:"Booking",object:{customerId:"m-1"}},{action:"manage",type:"Vendor",object:{_id:"v-1"}}];function zt(t){return lt.map(e=>({action:e.action,type:e.type,object:e.object,can:j(t,e.action,e.type,e.object)}))}function Yt(t,e){let{wixUsers:r,currentMember:n}=t,s=e&&e.enrich||null,o=e&&e.onError||null;return async function(){let c=null,l=!1,u=!1;try{c=r.currentUser&&r.currentUser.id||null,l=!!(r.currentUser&&r.currentUser.loggedIn)}catch(h){u=!0,o&&o("resolveCaller.id",h)}let g=[];if(c)try{g=await n.getRoles()}catch(h){u=!0,o&&o("resolveCaller.roles",h)}let v=W({kind:c?D.MEMBER:D.VISITOR,memberId:c,roles:g,unverified:u});if(v.loggedIn=l,s)try{let h=await s(v);h&&typeof h=="object"&&(v.domain=h)}catch(h){v.unverified=!0,o&&o("resolveCaller.enrich",h)}return v}}var nn="Admin";function Wt(t,e,r){let n=r.resolveCaller,s=r.abilityFor,o=r.audit||null;function i(l,u,g,v){return o&&o({event:"access.denied",action:l,code:u,caller:g?g.memberId:null,detail:v||null}),I(u,l)}function c(l,u,g){return u==="Anyone"?null:g.memberId?u==="Admin"&&!te(g,nn)?i(l,w.FORBIDDEN,g,{gate:u}):null:i(l,w.UNAUTHENTICATED,g)}return function(u,g,v){let h=t.api&&t.api[u]||null;if(!h)throw new Error('wix-access: web method "'+u+'" is not declared in policy.api. Add it, or the gate it runs behind is undocumented.');let M=v||{},R=h.permission,X=h.ability||null,a=M.strip||[];return async function(...f){let p=await n();if(p.unverified)return i(u,w.UNVERIFIED,p);let O=c(u,R,p);if(O)return O;let m=f.map(d=>{if(!d||typeof d!="object"||Array.isArray(d))return d;let x=Object.assign({},d);for(let A of a)delete x[A];return x}),y=null;if(X){let[d,x]=X;if(M.load){if(y=await M.load(...m),!y)return i(u,w.NOT_FOUND,p);if(!j(s(p),d,x,y))return N(u)}else if(!j(s(p),d,x))return i(u,w.FORBIDDEN,p)}return g({principal:p,subject:y},...m)}}}function Jt(t,e){let r=Object.keys(t&&t.api||{}),n=e.filter(s=>r.indexOf(s)===-1);if(n.length)throw new Error("wix-access: web methods missing from policy.api: "+n.join(", "));return!0}var Kt=100,sn=100,F="assignOwner";function Zt(t,e,r){let{items:n,auth:s}=e,o=r.abilityFor,i=r.audit||null,c=r.onError||null;function l(a){if(i)try{i(a)}catch(f){c&&c("audit",f)}}let u={query:(...a)=>s.elevate(n.query)(...a),get:(...a)=>s.elevate(n.get)(...a),insert:(...a)=>s.elevate(n.insert)(...a),update:(...a)=>s.elevate(n.update)(...a),remove:(...a)=>s.elevate(n.remove)(...a)},g=r.namespace||null,v=a=>{let f=t.collections||{};return f[a]?f[a]:g&&typeof a=="string"&&a.indexOf(g)===0&&f[a.slice(g.length)]||null},h=a=>{let f=v(a);return f&&f.owner?f.owner:null},M=a=>{let f=v(a);return f&&f.actor?f.actor:null},R=a=>{let f=v(a);return f&&f.resource||a};async function X(a,f){let p=[],O=await a.limit(Math.min(f||Kt,Kt)).find(),m=0;for(;O;){for(let y of O.items)p.push(y);if(f&&p.length>=f)return p.slice(0,f);if(!O.hasNext||!O.hasNext()||++m>=sn)break;O=await O.next()}return p}return{async query(a,f){let{principal:p,action:O="read",limit:m}=f,y=R(a),d=ye(p,t,O,y);if(d.scope===C.NONE)return{ok:!0,data:[],scope:d.scope};let x=u.query(a);d.scope===C.FIELDS&&(x=be(x,d.clauses));let A=await X(x,d.scope===C.AMBIGUOUS?null:m);if(d.scope!==C.AMBIGUOUS)return{ok:!0,data:A,scope:d.scope};let E=o(p),$=A.filter(S=>j(E,O,y,S));return{ok:!0,data:m?$.slice(0,m):$,scope:d.scope}},async get(a,f,p){let{principal:O,action:m="read"}=p,y=R(a),d=await u.get(a,f);return d?j(o(O),m,y,d)?{ok:!0,data:d}:N(m):N(m)},async insert(a,f,p){let{principal:O,action:m="create",onBehalfOf:y,system:d=!1}=p,x=R(a),A=h(a),E=M(a),$=O.memberId||null;if(y!==void 0){if(!A)return I(w.INVALID_ARGUMENT,m,{reason:a+" declares no owner field"});if(typeof y!="string"||!y)return I(w.INVALID_ARGUMENT,m,{reason:"onBehalfOf must be a member id"})}else if(d)return I(w.INVALID_ARGUMENT,m,{reason:"system is only meaningful with onBehalfOf"});let S=Object.assign({},f),G=y!==void 0?y:$,Y=G!==$;A&&(S[A]=G),E&&(S[E]=$);let dt=o(O);if(Y&&!d&&!j(dt,F,x,S))return l({event:"access.denied",action:F,code:w.FORBIDDEN,caller:$,detail:{collection:a,owner:G}}),I(w.FORBIDDEN,F);if(!j(dt,m,x,S))return I(w.FORBIDDEN,m);let ge=await u.insert(a,S);return Y&&l({event:"access.onBehalf",action:m,caller:$,owner:G,system:d,collection:a,id:ge&&ge._id}),{ok:!0,data:ge}},async update(a,f,p,O){let{principal:m,action:y="update"}=O;if(O.onBehalfOf!==void 0)return I(w.INVALID_ARGUMENT,y,{reason:"update never changes the owner; use transfer"});let d=R(a),x=await u.get(a,f);if(!x)return N(y);if(!j(o(m),y,d,x))return N(y);let A=h(a),E=M(a),$=Object.assign({},x,p,{_id:f});return A&&($[A]=x[A]),E&&($[E]=x[E]),{ok:!0,data:await u.update(a,$)}},async transfer(a,f,p,O){let{principal:m,system:y=!1}=O,d=R(a),x=h(a),A=m.memberId||null;if(!x)return I(w.INVALID_ARGUMENT,F,{reason:a+" declares no owner field"});if(p!==null&&(typeof p!="string"||!p))return I(w.INVALID_ARGUMENT,F,{reason:"newOwner must be a member id or null"});let E=await u.get(a,f);if(!E)return N(F);let $=Object.assign({},E,{_id:f,[x]:p});if(!y){let Y=o(m);if(!j(Y,F,d,E)||!j(Y,F,d,$))return l({event:"access.denied",action:F,code:w.FORBIDDEN,caller:A,detail:{collection:a,id:f}}),N(F)}let S=E[x]===void 0?null:E[x];if(S===p)return{ok:!0,data:E};let G=await u.update(a,$);return l({event:"access.transfer",action:F,caller:A,from:S,owner:p,system:y,collection:a,id:f}),{ok:!0,data:G}},async remove(a,f,p){let{principal:O,action:m="delete"}=p,y=R(a),d=await u.get(a,f);return d?j(o(O),m,y,d)?{ok:!0,data:await u.remove(a,f)}:N(m):N(m)}}}function Ht(t,e,r){re(t);let n=r||{};if(n.namespace!==void 0&&(typeof n.namespace!="string"||!n.namespace))throw new Error('wix-access: options.namespace must be a non-empty string, e.g. "@scope/app/"');let s=Yt(e,{enrich:n.enrich,onError:n.onError}),o=async()=>{let u=await s();return u.subjects=V(u,t),u},i=u=>me(u,t),c=Wt(t,e,{resolveCaller:o,abilityFor:i,audit:n.audit}),l=Zt(t,e,{abilityFor:i,audit:n.audit,onError:n.onError,namespace:n.namespace});return{policy:t,resolveCaller:o,abilityFor:i,guard:c,db:l,gateFor:u=>{let g=t.api&&t.api[u]||null;return g?g.permission:null},rulesForCaller:async()=>q(await o(),t)}}function on(t,e){let r=e||{},n=Object.assign({wixUsers:Qt.default,currentMember:ft.currentMember,items:Xt.items,auth:er.auth},r.deps||{});return Ht(t,n,r)}function an(){return{ok:!0,side:"backend",version:ut}}async function cn(){try{let t=await ft.currentMember.getMember();return t&&t._id||null}catch{return null}}0&&(module.exports={ASSIGN_OWNER,CASES,CODES,KIND,PACKAGE_VERSION,PolicyError,SCOPE,WHEN,abilityFor,abilityFromRules,anonymous,applyClauses,applyGates,assertDeclared,assertGates,backendMemberId,backendPing,can,caseTable,createAccess,createPrincipal,deny,denyOpaque,filterFor,hasRole,isDenial,normaliseRoles,ok,parseGates,permissionFor,resolvePlaceholders,resolveSubjects,resolveWhere,rulesFor,validatePolicy,verifyGates});
+  `))}function Yt(t,e){let r=e&&e.api||{},n=t||{},s={},o=[];for(let i of Object.keys(n)){let c=n[i],l=r[i];if(!l){o.push(i);continue}if(typeof c!="function"){o.push(i+" (not a function: "+typeof c+")");continue}try{c.permission=l.permission,s[i]=l.permission}catch(u){o.push(i+" (could not stamp: "+String(u&&u.message)+")")}}if(o.length)throw new Error("wix-access: applyGates could not gate: "+o.join(", ")+". Every exported web method must be declared in policy.api.");return s}var ft="0.5.2";var dt=[{action:"read",type:"Booking",object:{customerId:"m-1"}},{action:"read",type:"Booking",object:{customerId:"m-2"}},{action:"cancel",type:"Booking",object:{customerId:"m-1"}},{action:"delete",type:"Booking",object:{customerId:"m-1"}},{action:"manage",type:"Vendor",object:{_id:"v-1"}}];function Wt(t){return dt.map(e=>({action:e.action,type:e.type,object:e.object,can:A(t,e.action,e.type,e.object)}))}function Jt(t,e){let{wixUsers:r,currentMember:n}=t,s=e&&e.enrich||null,o=e&&e.onError||null;return async function(){let c=null,l=!1,u=!1;try{c=r.currentUser&&r.currentUser.id||null,l=!!(r.currentUser&&r.currentUser.loggedIn)}catch(y){u=!0,o&&o("resolveCaller.id",y)}let O=[];if(c)try{O=await n.getRoles()}catch(y){u=!0,o&&o("resolveCaller.roles",y)}let E=K({kind:c?P.MEMBER:P.VISITOR,memberId:c,roles:O,unverified:u});if(E.loggedIn=l,s)try{let y=await s(E);y&&typeof y=="object"&&(E.domain=y)}catch(y){E.unverified=!0,o&&o("resolveCaller.enrich",y)}return E}}var an="Admin";function Kt(t,e,r){let n=r.resolveCaller,s=r.abilityFor,o=r.audit||null;function i(l,u,O,E){return o&&o({event:"access.denied",action:l,code:u,caller:O?O.memberId:null,detail:E||null}),N(u,l)}function c(l,u,O){return u==="Anyone"?null:O.memberId?u==="Admin"&&!ne(O,an)?i(l,b.FORBIDDEN,O,{gate:u}):null:i(l,b.UNAUTHENTICATED,O)}return function(u,O,E){let y=t.api&&t.api[u]||null;if(!y)throw new Error('wix-access: web method "'+u+'" is not declared in policy.api. Add it, or the gate it runs behind is undocumented.');let C=E||{},k=y.permission,te=y.ability||null,a=C.strip||[];return async function(...f){let p=await n();if(p.unverified)return i(u,b.UNVERIFIED,p);let w=c(u,k,p);if(w)return w;let m=f.map(d=>{if(!d||typeof d!="object"||Array.isArray(d))return d;let x=Object.assign({},d);for(let v of a)delete x[v];return x}),h=null;if(te){let[d,x]=te;if(C.load){if(h=await C.load(...m),!h)return i(u,b.NOT_FOUND,p);if(!A(s(p),d,x,h))return M(u)}else if(!A(s(p),d,x))return i(u,b.FORBIDDEN,p)}return O({principal:p,subject:h},...m)}}}function Zt(t,e){let r=Object.keys(t&&t.api||{}),n=e.filter(s=>r.indexOf(s)===-1);if(n.length)throw new Error("wix-access: web methods missing from policy.api: "+n.join(", "));return!0}var Ht=100,cn=100,$="assignOwner";function Qt(t,e,r){let{items:n,auth:s}=e,o=r.abilityFor,i=r.audit||null,c=r.onError||null;function l(a){if(i)try{i(a)}catch(f){c&&c("audit",f)}}let u={query:(...a)=>s.elevate(n.query)(...a),get:(...a)=>s.elevate(n.get)(...a),insert:(...a)=>s.elevate(n.insert)(...a),update:(...a)=>s.elevate(n.update)(...a),remove:(...a)=>s.elevate(n.remove)(...a)},O=r.namespace||null,E=a=>{let f=t.collections||{};return f[a]?f[a]:O&&typeof a=="string"&&a.indexOf(O)===0&&f[a.slice(O.length)]||null},y=a=>{let f=E(a);return f&&f.owner?f.owner:null},C=a=>{let f=E(a);return f&&f.actor?f.actor:null},k=a=>{let f=E(a);return f&&f.resource||a};async function te(a,f){let p=[],w=await a.limit(Math.min(f||Ht,Ht)).find(),m=0;for(;w;){for(let h of w.items)p.push(h);if(f&&p.length>=f)return p.slice(0,f);if(!w.hasNext||!w.hasNext()||++m>=cn)break;w=await w.next()}return p}return{async query(a,f){let{principal:p,action:w="read",limit:m}=f,h=k(a),d=ge(p,t,w,h);if(d.scope===S.NONE)return{ok:!0,data:[],scope:d.scope};let x=u.query(a);d.scope===S.FIELDS&&(x=Oe(x,d.clauses));let v=await te(x,d.scope===S.AMBIGUOUS?null:m);if(d.scope!==S.AMBIGUOUS)return{ok:!0,data:v,scope:d.scope};let I=o(p),j=v.filter(F=>A(I,w,h,F));return{ok:!0,data:m?j.slice(0,m):j,scope:d.scope}},async get(a,f,p){let{principal:w,action:m="read"}=p,h=k(a),d=await u.get(a,f);return d?A(o(w),m,h,d)?{ok:!0,data:d}:M(m):M(m)},async insert(a,f,p){let{principal:w,action:m="create",onBehalfOf:h,system:d=!1}=p,x=k(a),v=y(a),I=C(a),j=w.memberId||null;if(h!==void 0){if(!v)return N(b.INVALID_ARGUMENT,m,{reason:a+" declares no owner field"});if(typeof h!="string"||!h)return N(b.INVALID_ARGUMENT,m,{reason:"onBehalfOf must be a member id"})}else if(d)return N(b.INVALID_ARGUMENT,m,{reason:"system is only meaningful with onBehalfOf"});let F=Object.assign({},f),R=h!==void 0?h:j,L=R!==j;v&&(F[v]=R),I&&(F[I]=j);let D=o(w);if(L&&!d&&!A(D,$,x,F))return l({event:"access.denied",action:$,code:b.FORBIDDEN,caller:j,detail:{collection:a,owner:R}}),N(b.FORBIDDEN,$);if(!A(D,m,x,F))return N(b.FORBIDDEN,m);let T=await u.insert(a,F);return L&&l({event:"access.onBehalf",action:m,caller:j,owner:R,system:d,collection:a,id:T&&T._id}),{ok:!0,data:T}},async update(a,f,p,w){let{principal:m,action:h="update",merge:d}=w;if(w.onBehalfOf!==void 0)return N(b.INVALID_ARGUMENT,h,{reason:"onBehalfOf is for insert; an update carries the new owner in its changes"});if(d!==void 0&&typeof d!="function")return N(b.INVALID_ARGUMENT,h,{reason:"merge must be a function (existing, changes) => row"});let x=k(a),v=await u.get(a,f);if(!v)return M(h);let I=o(m);if(!A(I,h,x,v))return M(h);let j=y(a),F=C(a),R=m.memberId||null,L=d?d(v,p):Object.assign({},v,p),D=Object.assign({},L,{_id:f});F&&(D[F]=v[F]);let T=null;if(j){let ht=v[j]===void 0?null:v[j],we=D[j]===void 0?null:D[j];we!==ht&&(A(I,$,x,v)&&A(I,$,x,D)?T={from:ht,to:we}:(D[j]=v[j],l({event:"access.denied",action:$,code:b.FORBIDDEN,caller:R,detail:{collection:a,id:f,owner:we}})))}if(!A(I,h,x,D))return N(b.FORBIDDEN,h);let nr=await u.update(a,D);return T&&l({event:"access.transfer",action:$,caller:R,from:T.from,owner:T.to,system:!1,collection:a,id:f}),{ok:!0,data:nr}},async transfer(a,f,p,w){let{principal:m,system:h=!1}=w,d=k(a),x=y(a),v=m.memberId||null;if(!x)return N(b.INVALID_ARGUMENT,$,{reason:a+" declares no owner field"});if(p!==null&&(typeof p!="string"||!p))return N(b.INVALID_ARGUMENT,$,{reason:"newOwner must be a member id or null"});let I=await u.get(a,f);if(!I)return M($);let j=Object.assign({},I,{_id:f,[x]:p});if(!h){let L=o(m);if(!A(L,$,d,I)||!A(L,$,d,j))return l({event:"access.denied",action:$,code:b.FORBIDDEN,caller:v,detail:{collection:a,id:f}}),M($)}let F=I[x]===void 0?null:I[x];if(F===p)return{ok:!0,data:I};let R=await u.update(a,j);return l({event:"access.transfer",action:$,caller:v,from:F,owner:p,system:h,collection:a,id:f}),{ok:!0,data:R}},async remove(a,f,p){let{principal:w,action:m="delete"}=p,h=k(a),d=await u.get(a,f);return d?A(o(w),m,h,d)?{ok:!0,data:await u.remove(a,f)}:M(m):M(m)}}}function Xt(t,e,r){se(t);let n=r||{};if(n.namespace!==void 0&&(typeof n.namespace!="string"||!n.namespace))throw new Error('wix-access: options.namespace must be a non-empty string, e.g. "@scope/app/"');let s=Jt(e,{enrich:n.enrich,onError:n.onError}),o=async()=>{let u=await s();return u.subjects=W(u,t),u},i=u=>be(u,t),c=Kt(t,e,{resolveCaller:o,abilityFor:i,audit:n.audit}),l=Qt(t,e,{abilityFor:i,audit:n.audit,onError:n.onError,namespace:n.namespace});return{policy:t,resolveCaller:o,abilityFor:i,guard:c,db:l,gateFor:u=>{let O=t.api&&t.api[u]||null;return O?O.permission:null},rulesForCaller:async()=>Y(await o(),t)}}function un(t,e){let r=e||{},n=Object.assign({wixUsers:er.default,currentMember:pt.currentMember,items:tr.items,auth:rr.auth},r.deps||{});return Xt(t,n,r)}function ln(){return{ok:!0,side:"backend",version:ft}}async function fn(){try{let t=await pt.currentMember.getMember();return t&&t._id||null}catch{return null}}0&&(module.exports={ASSIGN_OWNER,CASES,CODES,KIND,PACKAGE_VERSION,PolicyError,SCOPE,WHEN,abilityFor,abilityFromRules,anonymous,applyClauses,applyGates,assertDeclared,assertGates,backendMemberId,backendPing,can,caseTable,createAccess,createPrincipal,deny,denyOpaque,filterFor,hasRole,isDenial,normaliseRoles,ok,parseGates,permissionFor,resolvePlaceholders,resolveSubjects,resolveWhere,rulesFor,validatePolicy,verifyGates});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@liquisio/wix-access",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "One authorization policy for Wix, serving the web-method gate, backend, database and page code. Built against measured platform behaviour.",
   "main": "./index.js",
   "types": "./types.d.ts",

package/public.js

@@ -1,3 +1,3 @@
 var X=Object.defineProperty;var Rt=Object.getOwnPropertyDescriptor;var Tt=Object.getOwnPropertyNames;var Pt=Object.prototype.hasOwnProperty;var kt=(t,e)=>{for(var n in e)X(t,n,{get:e[n],enumerable:!0})},Dt=(t,e,n,s)=>{if(e&&typeof e=="object"||typeof e=="function")for(let r of Tt(e))!Pt.call(t,r)&&r!==n&&X(t,r,{get:()=>e[r],enumerable:!(s=Rt(e,r))||s.enumerable});return t};var Lt=t=>Dt(X({},"__esModule",{value:!0}),t);var kn={};kt(kn,{CASES:()=>Ye,CODES:()=>E,KIND:()=>F,PACKAGE_VERSION:()=>Ge,PolicyError:()=>x,SCOPE:()=>$,WHEN:()=>y,abilityFor:()=>$t,abilityFromRules:()=>N,anonymous:()=>Ke,applyClauses:()=>It,applyGates:()=>Ft,assertGates:()=>Nt,can:()=>w,caseTable:()=>Mt,createAccess:()=>Ct,createPrincipal:()=>ne,deny:()=>ee,denyOpaque:()=>He,filterFor:()=>Et,frontendRoleTitles:()=>Pn,hasRole:()=>Qe,isDenial:()=>k,normaliseRoles:()=>te,ok:()=>Ze,parseGates:()=>Be,permissionFor:()=>et,publicPing:()=>Tn,resolvePlaceholders:()=>wt,resolveSubjects:()=>D,resolveWhere:()=>K,rulesFor:()=>T,validatePolicy:()=>Xe,verifyGates:()=>Ve});module.exports=Lt(kn);var _t=require("wix-members-frontend");var E={FORBIDDEN:"FORBIDDEN",UNAUTHENTICATED:"UNAUTHENTICATED",UNVERIFIED:"UNVERIFIED",NOT_FOUND:"NOT_FOUND",INVALID_POLICY:"INVALID_POLICY",INVALID_ARGUMENT:"INVALID_ARGUMENT"},x=class extends Error{constructor(e){super(e),this.name="PolicyError",this.code=E.INVALID_POLICY}};function Ze(t){return{ok:!0,data:t===void 0?null:t}}function ee(t,e,n){let s={ok:!1,code:t||E.FORBIDDEN};return e&&(s.action=e),n&&(s.detail=n),s}var k=t=>!!t&&t.ok===!1;function He(t){return ee(E.NOT_FOUND,t)}var F={VISITOR:"visitor",MEMBER:"member",CAPABILITY:"capability",SERVICE:"service"};function te(t){if(!Array.isArray(t))return[];let e=[];for(let n of t){if(typeof n=="string"){e.push(n);continue}if(!n||typeof n!="object")continue;let s=n.title||n.name||n.roleKey;s&&e.push(s)}return e}function ne(t){let e=t||{},n=e.memberId||null,s=te(e.roles);return{kind:e.kind||(n?F.MEMBER:F.VISITOR),memberId:n,roles:s,subjects:Array.isArray(e.subjects)?e.subjects.slice():[],domain:e.domain&&typeof e.domain=="object"?e.domain:{},unverified:!!e.unverified}}var Ke=()=>ne({kind:F.VISITOR}),Qe=(t,e)=>t.roles.indexOf(e)!==-1;var y={ANYONE:"anyone",ANONYMOUS:"anonymous",MEMBER:"member"},m=t=>!!t&&typeof t=="object"&&!Array.isArray(t),Ut=t=>Array.isArray(t)?t:[t];function f(t,e){throw new x("policy"+t+": "+e)}function qt(t,e){let n=".subjects."+t;m(e)||f(n,"must be an object");let r=["when","role","domain"].filter(o=>e[o]!==void 0);if(r.length===0&&f(n,'needs exactly one of when/role/domain \u2014 "{}" is ambiguous between a visitor and a member'),r.length>1&&f(n,"has "+r.join(" and ")+"; use exactly one"),e.when!==void 0){let o=[y.ANYONE,y.ANONYMOUS,y.MEMBER];o.indexOf(e.when)===-1&&f(n+".when","must be one of "+o.join(", ")+" (got "+JSON.stringify(e.when)+")")}e.role!==void 0&&typeof e.role!="string"&&f(n+".role","must be a string"),e.domain!==void 0&&typeof e.domain!="string"&&f(n+".domain","must be a string")}function zt(t,e,n){let s=".rules["+e+"]";m(t)||f(s,"must be an object"),typeof t.subject!="string"&&f(s+".subject","must be a string"),n.indexOf(t.subject)===-1&&f(s+".subject",'"'+t.subject+'" is not declared in policy.subjects'),t.actions===void 0&&f(s+".actions","is required");for(let r of Ut(t.actions))typeof r!="string"&&f(s+".actions","must be a string or an array of strings");typeof t.resource!="string"&&f(s+".resource","must be a string"),t.where!==void 0&&!m(t.where)&&f(s+".where","must be an object")}var We=["Anyone","SiteMember","Admin"];function Bt(t,e,n){let s=".api."+t;m(e)||f(s,"must be an object"),We.indexOf(e.permission)===-1&&f(s+".permission","must be one of "+We.join(", ")+" (got "+JSON.stringify(e.permission)+")"),e.ability!==void 0&&((!Array.isArray(e.ability)||e.ability.length!==2)&&f(s+".ability","must be [action, resource]"),(typeof e.ability[0]!="string"||typeof e.ability[1]!="string")&&f(s+".ability","both entries must be strings")),e.subject!==void 0&&n.indexOf(e.subject)===-1&&f(s+".subject",'"'+e.subject+'" is not declared in policy.subjects')}var Vt=["resource","owner","actor","tenant","profile"];function Gt(t,e){let n=".collections."+t;m(e)||f(n,"must be an object");for(let s of Vt)e[s]!==void 0&&(typeof e[s]!="string"||!e[s])&&f(n+"."+s,"must be a non-empty string");e.owner!==void 0&&e.owner===e.actor&&f(n,'owner and actor must be different fields (both are "'+e.owner+'")')}function Xe(t){if(!m(t))throw new x("policy must be an object");m(t.subjects)||f(".subjects","is required and must be an object");let e=Object.keys(t.subjects);e.length===0&&f(".subjects","declares no subjects");for(let n of e)qt(n,t.subjects[n]);if(Array.isArray(t.rules)||f(".rules","is required and must be an array"),t.rules.forEach((n,s)=>zt(n,s,e)),t.api!==void 0){m(t.api)||f(".api","must be an object");for(let n of Object.keys(t.api))Bt(n,t.api[n],e)}if(t.collections!==void 0){m(t.collections)||f(".collections","must be an object");for(let n of Object.keys(t.collections))Gt(n,t.collections[n])}return t}function D(t,e){let n=new Set(t.subjects||[]);for(let s of Object.keys(e.subjects)){let r=e.subjects[s];(r.when===y.ANYONE||r.when===y.ANONYMOUS&&!t.memberId||r.when===y.MEMBER&&t.memberId||r.role!==void 0&&t.roles.indexOf(r.role)!==-1||r.domain!==void 0&&t.domain[r.domain])&&n.add(s)}return Array.from(n)}function et(t,e){let n=t.api&&t.api[e];return n?n.permission:null}var L=class{constructor(e,n){this.operator=e,this.value=n,Object.defineProperty(this,"t",{writable:!0})}get notes(){return this.t}addNote(e){this.t=this.t||[],this.t.push(e)}},M=class extends L{},O=class extends M{constructor(e,n){if(!Array.isArray(n))throw new Error(`"${e}" operator expects to receive an array of conditions`);super(e,n)}},b="__itself__",j=class extends L{constructor(e,n,s){super(e,s),this.field=n}},ie=new M("__null__",null),oe=Object.prototype.hasOwnProperty.call.bind(Object.prototype.hasOwnProperty);function Yt(t,e){return e instanceof O&&e.operator===t}function ae(t,e){return e.length===1?e[0]:new O(t,(function n(s,r,o){let i=o||[];for(let a=0,u=r.length;a<u;a++){let l=r[a];Yt(s,l)?n(s,l.value,i):i.push(l)}return i})(t,e))}var Jt=t=>t,tt=()=>Object.create(null),nt=Object.defineProperty(tt(),"__@type@__",{value:"ignore value"});function Zt(t,e,n=!1){if(!t||t&&t.constructor!==Object)return!1;for(let s in t)if(oe(t,s)&&oe(e,s)&&(!n||t[s]!==nt))return!0;return!1}function Ht(t){let e=[];for(let n in t)oe(t,n)&&t[n]!==nt&&e.push(n);return e}function se(t,e){e!==ie&&t.push(e)}var ce=t=>ae("and",t);var U={compound(t,e,n){let s=(Array.isArray(e)?e:[e]).map(r=>n.parse(r));return new O(t.name,s)},field:(t,e,n)=>new j(t.name,n.field,e),document:(t,e)=>new M(t.name,e)},S=class{constructor(e,n=tt()){this.o=void 0,this.s=void 0,this.i=void 0,this.u=void 0,this.h=void 0,this.parse=this.parse.bind(this),this.u={operatorToConditionName:n.operatorToConditionName||Jt,defaultOperatorName:n.defaultOperatorName||"eq",mergeFinalConditions:n.mergeFinalConditions||ce},this.o=Object.keys(e).reduce((s,r)=>(s[r]=Object.assign({name:this.u.operatorToConditionName(r)},e[r]),s),{}),this.s=Object.assign({},n.fieldContext,{field:"",query:{},parse:this.parse,hasOperators:s=>Zt(s,this.o,n.useIgnoreValue)}),this.i=Object.assign({},n.documentContext,{parse:this.parse,query:{}}),this.h=n.useIgnoreValue?Ht:Object.keys}setParse(e){this.parse=e,this.s.parse=e,this.i.parse=e}parseField(e,n,s,r){let o=this.o[n];if(!o)throw new Error(`Unsupported operator "${n}"`);if(o.type!=="field")throw new Error(`Unexpected ${o.type} operator "${n}" at field level`);return this.s.field=e,this.s.query=r,this.parseInstruction(o,s,this.s)}parseInstruction(e,n,s){return typeof e.validate=="function"&&e.validate(e,n),(e.parse||U[e.type])(e,n,s)}parseFieldOperators(e,n){let s=[],r=this.h(n);for(let o=0,i=r.length;o<i;o++){let a=r[o];if(!this.o[a])throw new Error(`Field query for "${e}" may contain only operators or a plain object as a value`);se(s,this.parseField(e,a,n[a],n))}return s}parse(e){let n=[],s=this.h(e);this.i.query=e;for(let r=0,o=s.length;r<o;r++){let i=s[r],a=e[i],u=this.o[i];if(u){if(u.type!=="document"&&u.type!=="compound")throw new Error(`Cannot use parsing instruction for operator "${i}" in "document" context as it is supposed to be used in  "${u.type}" context`);se(n,this.parseInstruction(u,a,this.i))}else this.s.hasOperators(a)?n.push(...this.parseFieldOperators(i,a)):se(n,this.parseField(i,this.u.defaultOperatorName,a,e))}return this.u.mergeFinalConditions(n)}};function re(t,e){let n=t[e];if(typeof n!="function")throw new Error(`Unable to interpret "${e}" condition. Did you forget to register interpreter for it?`);return n}function Kt(t){return t.operator}function st(t,e){let n=e,s=n&&n.getInterpreterName||Kt,r;switch(n?n.numberOfArguments:0){case 1:r=i=>{let a=s(i,n);return re(t,a)(i,o)};break;case 3:r=(i,a,u)=>{let l=s(i,n);return re(t,l)(i,a,u,o)};break;default:r=(i,a)=>{let u=s(i,n);return re(t,u)(i,a,o)}}let o=Object.assign({},n,{interpret:r});return o.interpret}function rt(t,e){return(n,...s)=>{let r=t(n,...s),o=e.bind(null,r);return o.ast=r,o}}var Gn=S.prototype.parseInstruction;function ot(t,e){if(!Array.isArray(e))throw new Error(`"${t.name}" expects value to be an array`)}function it(t,e){if(ot(t,e),!e.length)throw new Error(`"${t.name}" expects to have at least one element in array`)}var ue=t=>(e,n)=>{if(typeof n!==t)throw new Error(`"${e.name}" expects value to be a "${t}"`)},at={type:"compound",validate:it,parse(t,e,{parse:n}){let s=e.map(r=>n(r));return ae(t.name,s)}},Qt=at,Wt={type:"compound",validate:it},Xt={type:"field",validate(t,e){if(!(e&&(e instanceof RegExp||e.constructor===Object)))throw new Error(`"${t.name}" expects to receive either regular expression or object of field operators`)},parse(t,e,n){let s=e instanceof RegExp?new j("regex",n.field,e):n.parse(e,n);return new O(t.name,[s])}},le={type:"field",validate(t,e){if(!e||e.constructor!==Object)throw new Error(`"${t.name}" expects to receive an object with nested query or field level operators`)},parse(t,e,{parse:n,field:s,hasOperators:r}){let o=r(e)?n(e,{field:b}):n(e);return new j(t.name,s,o)}},fe={type:"field",validate:ue("number")},C={type:"field",validate:ot},pe=C,de=C,en={type:"field",validate(t,e){if(!Array.isArray(e)||e.length!==2)throw new Error(`"${t.name}" expects an array with 2 numeric elements`)}},he={type:"field",validate:ue("boolean")},z={type:"field",validate:function(t,e){if(!(typeof e=="string"||typeof e=="number"||e instanceof Date))throw new Error(`"${t.name}" expects value to be comparable (i.e., string, number or date)`)}},_=z,me=_,ye=_,B={type:"field"},be=B,ge={type:"field",validate(t,e){if(!(e instanceof RegExp)&&typeof e!="string")throw new Error(`"${t.name}" expects value to be a regular expression or a string that represents regular expression`)},parse(t,e,n){let s=typeof e=="string"?new RegExp(e,n.query.$options||""):e;return new j(t.name,n.field,s)}},xe={type:"field",parse:()=>ie},tn={type:"document",validate:ue("function")},nn=Object.freeze({__proto__:null,$and:at,$or:Qt,$nor:Wt,$not:Xt,$elemMatch:le,$size:fe,$in:C,$nin:pe,$all:de,$mod:en,$exists:he,$gte:z,$gt:_,$lt:me,$lte:ye,$eq:B,$ne:be,$regex:ge,$options:xe,$where:tn}),q=class extends S{constructor(e){super(e,{defaultOperatorName:"$eq",operatorToConditionName:n=>n.slice(1)})}parse(e,n){return n&&n.field?ce(this.parseFieldOperators(n.field,e)):super.parse(e)}},V=nn;function Oe(t,e,n){for(let s=0,r=t.length;s<r;s++)if(n(t[s],e)===0)return!0;return!1}function je(t,e){return Array.isArray(t)&&Number.isNaN(Number(e))}function ct(t,e,n){if(!je(t,e))return n(t,e);let s=[];for(let r=0;r<t.length;r++){let o=n(t[r],e);o!==void 0&&(s=s.concat(o))}return s}function v(t){return(e,n,s)=>{let r=s.get(n,e.field);return Array.isArray(r)?r.some(o=>t(e,o,s)):t(e,r,s)}}var sn=Object.hasOwn||Object.prototype.hasOwnProperty.call.bind(Object.prototype.hasOwnProperty),rn=(t,e)=>t[e];function ut(t,e,n){let s=e.lastIndexOf(".");return s===-1?[t,e]:[n(t,e.slice(0,s)),e.slice(s+1)]}function on(t,e,n=rn){if(e===b)return t;if(!t)throw new Error(`Unable to get field "${e}" out of ${String(t)}.`);return(function(s,r,o){if(r.indexOf(".")===-1)return ct(s,r,o);let i=r.split("."),a=s;for(let u=0,l=i.length;u<l;u++)if(a=ct(a,i[u],o),!a||typeof a!="object")return u<l-1?void 0:a;return a})(t,e,n)}function ve(t,e){return t===e?0:t>e?1:-1}function we(t,e={}){return st(t,Object.assign({get:on,compare:ve},e))}var lt=(t,e,{interpret:n})=>t.value.some(s=>n(s,e)),an=(t,e,n)=>!lt(t,e,n),$e=(t,e,{interpret:n})=>t.value.every(s=>n(s,e)),cn=(t,e,{interpret:n})=>!n(t.value[0],e),G=(t,e,{compare:n,get:s})=>{let r=s(e,t.field);return Array.isArray(r)&&!Array.isArray(t.value)?Oe(r,t.value,n):n(r,t.value)===0},Ae=(t,e,n)=>!G(t,e,n),Ee=v((t,e,n)=>{let s=n.compare(e,t.value);return s===0||s===-1}),Ie=v((t,e,n)=>n.compare(e,t.value)===-1),Ne=v((t,e,n)=>n.compare(e,t.value)===1),Fe=v((t,e,n)=>{let s=n.compare(e,t.value);return s===0||s===1}),Me=(t,e,{get:n})=>{if(t.field===b)return e!==void 0;let[s,r]=ut(e,t.field,n),o=i=>i==null?!!i===t.value:sn(i,r)===t.value;return je(s,r)?s.some(o):o(s)},un=v((t,e)=>typeof e=="number"&&e%t.value[0]===t.value[1]),Se=(t,e,{get:n})=>{let[s,r]=ut(e,t.field,n),o=i=>{let a=n(i,r);return Array.isArray(a)&&a.length===t.value};return t.field!==b&&je(s,r)?s.some(o):o(s)},Ce=v((t,e)=>typeof e=="string"&&t.value.test(e)),R=v((t,e,{compare:n})=>Oe(t.value,e,n)),_e=(t,e,n)=>!R(t,e,n),Re=(t,e,{compare:n,get:s})=>{let r=s(e,t.field);return Array.isArray(r)&&t.value.every(o=>Oe(r,o,n))},Te=(t,e,{interpret:n,get:s})=>{let r=s(e,t.field);return Array.isArray(r)&&r.some(o=>n(t.value,o))},ln=(t,e)=>t.value.call(e),fn=Object.freeze({__proto__:null,or:lt,nor:an,and:$e,not:cn,eq:G,ne:Ae,lte:Ee,lt:Ie,gt:Ne,gte:Fe,exists:Me,mod:un,size:Se,regex:Ce,within:R,nin:_e,all:Re,elemMatch:Te,where:ln}),Y=Object.assign({},fn,{in:R}),Qn=we(Y);function ft(t){return t===null||typeof t!="object"?t:t instanceof Date?t.getTime():t&&typeof t.toJSON=="function"?t.toJSON():t}var pn=(t,e)=>ve(ft(t),ft(e));function J(t,e,n){let s=new q(t),r=we(e,Object.assign({compare:pn},n));if(n&&n.forPrimitives){let o={field:b},i=s.parse;s.setParse(a=>i(a,o))}return rt(s.parse,r)}var ns=J(V,Y),ss=J(["$and","$or"].reduce((t,e)=>(t[e]=Object.assign({},t[e],{type:"field"}),t),Object.assign({},V,{$nor:Object.assign({},V.$nor,{type:"field",parse:U.compound})})),Y,{forPrimitives:!0});var bt=Object.hasOwn||((t,e)=>Object.prototype.hasOwnProperty.call(t,e));function Pe(t){return Array.isArray(t)?t:[t]}var I="__caslSubjectType__";function gt(t,e){if(e){if(!bt(e,I))Object.defineProperty(e,I,{value:t});else if(t!==e[I])throw new Error(`Trying to cast object to subject type ${t} but previously it was casted to ${e[I]}`)}return e}var H=t=>{let e=typeof t;return e==="string"||e==="function"},xt=t=>t.modelName||t.name;function dn(t){return typeof t=="string"?t:xt(t)}function Ot(t){return bt(t,I)?t[I]:xt(t.constructor)}var pt={function:t=>t.constructor,string:Ot};function dt(t,e,n){for(let s=n;s<e.length;s++)t.push(e[s])}function ht(t,e){if(!t||!t.length)return e||[];if(!e||!e.length)return t||[];let n=0,s=0,r=[];for(;n<t.length&&s<e.length;)t[n].priority<e[s].priority?(r.push(t[n]),n++):t[n].priority>e[s].priority?(r.push(e[s]),s++):(r.push(t[n]),n++,s++);return dt(r,t,n),dt(r,e,s),r}function Z(t,e,n){let s=t.get(e);return s||(s=n(),t.set(e,s)),s}var hn=t=>t;function mn(t,e){let n;for(let s=0;s<t.length;s++){let r=e(t[s]);n&&r&&n.push(t[s]),r||(n??(n=t.slice(0,s)))}return n||t}function yn(t,e){if(Array.isArray(t.fields)&&!t.fields.length)throw new Error("`rawRule.fields` cannot be an empty array. https://bit.ly/390miLa");if(t.fields&&!e.fieldMatcher)throw new Error('You need to pass "fieldMatcher" option in order to restrict access by fields');if(t.conditions&&!e.conditionsMatcher)throw new Error('You need to pass "conditionsMatcher" option in order to restrict access by conditions')}var ke=class{constructor(e,n,s=0){yn(e,n),this.action=n.resolveAction(e.action),this.subject=e.subject,this.inverted=!!e.inverted,this.conditions=e.conditions,this.reason=e.reason,this.origin=e,this.fields=e.fields?Pe(e.fields):void 0,this.priority=s,this.t=n}i(){return this.conditions&&!this.o&&(this.o=this.t.conditionsMatcher(this.conditions)),this.o}get ast(){let e=this.i();return e?e.ast:void 0}matchesConditions(e){return this.conditions?!e||H(e)?!this.inverted:this.i()(e):!0}matchesField(e){return this.fields?e?(this.u||(this.u=this.t.fieldMatcher(this.fields)),this.u(e)):!this.inverted:!0}};function bn(t,e){let n={value:t,prev:e,next:null};return e&&(e.next=n),n}function gn(t){t.next&&(t.next.prev=t.prev),t.prev&&(t.prev.next=t.next),t.next=t.prev=null}var mt=()=>({rules:[],merged:!1}),yt=()=>new Map,De=class{constructor(e=[],n={}){this.h=!1,this.l=new Map,this.p={conditionsMatcher:n.conditionsMatcher,fieldMatcher:n.fieldMatcher,resolveAction:n.resolveAction||hn},this.$=n.anyAction||"manage",this.A=n.anySubjectType||"all",this.m=e,this.M=!!n.detectSubjectType,this.j=n.detectSubjectType||Ot,this.v(e)}get rules(){return this.m}detectSubjectType(e){return H(e)?e:e?this.j(e):this.A}update(e){let n={rules:e,ability:this,target:this};return this._("update",n),this.m=e,this.v(e),this._("updated",n),this}v(e){let n=new Map,s;for(let r=e.length-1;r>=0;r--){let o=e.length-r-1,i=new ke(e[r],this.p,o),a=Pe(i.action),u=Pe(i.subject||this.A);!this.h&&i.fields&&(this.h=!0);for(let l=0;l<u.length;l++){let h=Z(n,u[l],yt);s===void 0&&(s=typeof u[l]),typeof u[l]!==s&&s!=="mixed"&&(s="mixed");for(let A=0;A<a.length;A++)Z(h,a[A],mt).rules.push(i)}}if(this.l=n,s!=="mixed"&&!this.M){let r=pt[s]||pt.string;this.j=r}}possibleRulesFor(e,n=this.A){if(!H(n))throw new Error('"possibleRulesFor" accepts only subject types (i.e., string or class) as the 2nd parameter');let s=Z(this.l,n,yt),r=Z(s,e,mt);if(r.merged)return r.rules;let o=e!==this.$&&s.has(this.$)?s.get(this.$).rules:void 0,i=ht(r.rules,o);return n!==this.A&&(i=ht(i,this.possibleRulesFor(e,this.A))),r.rules=i,r.merged=!0,i}rulesFor(e,n,s){let r=this.possibleRulesFor(e,n);if(s&&typeof s!="string")throw new Error("The 3rd, `field` parameter is expected to be a string. See https://stalniy.github.io/casl/en/api/casl-ability#can-of-pure-ability for details");return this.h?mn(r,o=>o.matchesField(s)):r}actionsFor(e){if(!H(e))throw new Error('"actionsFor" accepts only subject types (i.e., string or class) as a parameter');let n=new Set,s=this.l.get(e);s&&Array.from(s.keys()).forEach(o=>n.add(o));let r=e!==this.A?this.l.get(this.A):void 0;return r&&Array.from(r.keys()).forEach(o=>n.add(o)),Array.from(n)}on(e,n){this.F=this.F||new Map;let s=this.F,r=s.get(e)||null,o=bn(n,r);return s.set(e,o),()=>{let i=s.get(e);!o.next&&!o.prev&&i===o?s.delete(e):o===i&&s.set(e,o.prev),gn(o)}}_(e,n){if(!this.F)return;let s=this.F.get(e)||null,r=[];for(;s!==null;)r.push(s.value),s=s.prev;for(let o=0;o<r.length;o++)r[o](n)}},Le=class extends De{can(e,n,s){let r=this.relevantRuleFor(e,n,s);return!!r&&!r.inverted}relevantRuleFor(e,n,s){let r=this.detectSubjectType(n),o=this.rulesFor(e,r,s);for(let i=0,a=o.length;i<a;i++)if(o[i].matchesConditions(n))return o[i];return null}cannot(e,n,s){return!this.can(e,n,s)}},xn={$eq:B,$ne:be,$lt:me,$lte:ye,$gt:_,$gte:z,$in:C,$nin:pe,$all:de,$size:fe,$regex:ge,$options:xe,$elemMatch:le,$exists:he},On={eq:G,ne:Ae,lt:Ie,lte:Ee,gt:Ne,gte:Fe,in:R,nin:_e,all:Re,size:Se,regex:Ce,elemMatch:Te,exists:Me,and:$e};var jn=J(xn,On),vn=/[-/\\^$+?.()|[\]{}]/g,wn=/\.?\*+\.?/g,$n=/\*+/,An=/\./g;function En(t,e,n){let s=n[0]==="*"||t[0]==="."&&t[t.length-1]==="."?"+":"*",r=t.indexOf("**")===-1?"[^.]":".",o=t.replace(An,"\\$&").replace($n,r+s);return e+t.length===n.length?`(?:${o})?`:o}function In(t,e,n){return t==="."&&(n[e-1]==="*"||n[e+1]==="*")?t:`\\${t}`}function Nn(t){let e=t.map(s=>s.replace(vn,In).replace(wn,En)),n=e.length>1?`(?:${e.join("|")})`:e[0];return new RegExp(`^${n}$`)}var Fn=t=>{let e;return n=>(typeof e>"u"&&(e=t.every(s=>s.indexOf("*")===-1)?null:Nn(t)),e===null?t.indexOf(n)!==-1:e.test(n))};function jt(t=[],e={}){return new Le(t,Object.assign({conditionsMatcher:jn,fieldMatcher:Fn},e))}var Mn=t=>`Cannot execute "${t.action}" on "${t.subjectType}"`,vt=function(e){this.message=e};vt.prototype=Object.create(Error.prototype);var Ue=class extends vt{static setDefaultMessage(e){this.P=typeof e=="string"?()=>e:e}static from(e){return new this(e)}constructor(e){super(""),this.ability=e,typeof Error.captureStackTrace=="function"&&(this.name="ForbiddenError",Error.captureStackTrace(this,this.constructor))}setMessage(e){return this.message=e,this}throwUnlessCan(e,n,s){let r=this.unlessCan(e,n,s);if(r)throw r}unlessCan(e,n,s){let r=this.ability.relevantRuleFor(e,n,s);if(r&&!r.inverted)return;this.action=e,this.subject=n,this.subjectType=dn(this.ability.detectSubjectType(n)),this.field=s;let o=r?r.reason:"";return this.message=this.message||o||this.constructor.P(this),this}};Ue.P=Mn;var us=Object.freeze({__proto__:null});function qe(t,e,n){if(t==null)return t;if(typeof t=="string"){if(t.indexOf("$principal.")!==0)return t;let r=t.slice(11).split(".").reduce((o,i)=>o==null?o:o[i],e);return r==null&&(n.unresolved=!0),r}if(Array.isArray(t))return t.map(s=>qe(s,e,n));if(typeof t=="object"){let s={};for(let r of Object.keys(t))s[r]=qe(t[r],e,n);return s}return t}function K(t,e){let n={unresolved:!1};return{conditions:qe(t,e,n),unresolved:n.unresolved}}function wt(t,e){return K(t,e).conditions}function T(t,e){let n=D(t,e),s=[];for(let r of e.rules){if(n.indexOf(r.subject)===-1)continue;let o={action:r.actions,subject:r.resource};if(r.where){let{conditions:i,unresolved:a}=K(r.where,t);if(a)continue;o.conditions=i}s.push(o)}return s}function N(t){return jt(Array.isArray(t)?t:[])}function $t(t,e){return N(T(t,e))}function w(t,e,n,s){return s==null?t.can(e,n):t.can(e,gt(n,Object.assign({},s)))}var $={ALL:"all",NONE:"none",FIELDS:"fields",AMBIGUOUS:"ambiguous"},At={$in:"in",$nin:"nin",$ne:"ne",$gt:"gt",$gte:"gte",$lt:"lt",$lte:"lte"};function Sn(t){let e=[];for(let n of Object.keys(t)){let s=t[n];if(s===null||typeof s!="object"||Array.isArray(s)){e.push({field:n,op:"eq",value:s});continue}let r=Object.keys(s);if(r.length!==1||!At[r[0]])return null;e.push({field:n,op:At[r[0]],value:s[r[0]]})}return e}var Cn=(t,e)=>t==="manage"||t===e||Array.isArray(t)&&(t.indexOf(e)!==-1||t.indexOf("manage")!==-1),_n=(t,e)=>t==="all"||t===e;function Et(t,e,n,s){let r=T(t,e).filter(i=>Cn(i.action,n)&&_n(i.subject,s));if(r.length===0)return{scope:$.NONE,clauses:[]};if(r.some(i=>!i.conditions))return{scope:$.ALL,clauses:[]};if(r.length>1)return{scope:$.AMBIGUOUS,clauses:[]};let o=Sn(r[0].conditions);return o?{scope:$.FIELDS,clauses:o}:{scope:$.AMBIGUOUS,clauses:[]}}function It(t,e){let n=t;for(let s of e)s.op==="in"?n=n.hasSome(s.field,s.value):s.op==="nin"?n=n.not(n.hasSome(s.field,s.value)):n=n[s.op](s.field,s.value);return n}var ze=/export\s+const\s+([A-Za-z0-9_$]+)\s*=\s*webMethod\s*\(\s*Permissions\s*\.\s*([A-Za-z0-9_$]+)/g,Rn=[[/export\s*{\s*[A-Za-z0-9_$,\s]+}/,"export { x } \u2014 the call and the export must be one statement"],[/export\s+const\s+[A-Za-z0-9_$]+\s*=\s*webMethod\s*\(\s*Permissions\s*\[/,"Permissions['X'] \u2014 the property must be dotted and literal"],[/export\s+const\s+[A-Za-z0-9_$]+\s*=\s*webMethod\s*\(\s*[A-Za-z0-9_$]+\s*\(/,"a computed permission \u2014 it must be written out as Permissions.LEVEL"]];function Be(t){let e={},n=String(t||"");ze.lastIndex=0;let s=ze.exec(n);for(;s;)e[s[1]]=s[2],s=ze.exec(n);return e}function Ve(t,e,n){let s=n||{},r=e&&e.api||{},o=Be(t),i=String(t||""),a=[],u=[];for(let p of Object.keys(o)){let c=r[p];c?c.permission!==o[p]&&a.push({name:p,declared:c.permission,written:o[p]}):u.push({name:p,gate:o[p]})}let l=s.complete?Object.keys(r).filter(p=>!(p in o)):[],h=[];for(let[p,c]of Rn)p.test(i)&&h.push(c);return{ok:a.length+u.length+l.length+h.length===0,found:o,mismatched:a,undeclared:u,missing:l,suspect:h}}function Nt(t,e,n){let s=Ve(t,e,n);if(s.ok)return!0;let r=[];for(let o of s.mismatched)r.push(o.name+": policy says "+o.declared+", the export says "+o.written);for(let o of s.undeclared)r.push(o.name+": gated "+o.gate+" but missing from policy.api");for(let o of s.missing)r.push(o+": declared in policy.api but not exported here");for(let o of s.suspect)r.push("unreachable export shape \u2014 "+o);throw new Error(`wix-access: web-method gates do not match the policy:
   `+r.join(`
-  `))}function Ft(t,e){let n=e&&e.api||{},s=t||{},r={},o=[];for(let i of Object.keys(s)){let a=s[i],u=n[i];if(!u){o.push(i);continue}if(typeof a!="function"){o.push(i+" (not a function: "+typeof a+")");continue}try{a.permission=u.permission,r[i]=u.permission}catch(l){o.push(i+" (could not stamp: "+String(l&&l.message)+")")}}if(o.length)throw new Error("wix-access: applyGates could not gate: "+o.join(", ")+". Every exported web method must be declared in policy.api.");return r}var Ge="0.5.1";var Ye=[{action:"read",type:"Booking",object:{customerId:"m-1"}},{action:"read",type:"Booking",object:{customerId:"m-2"}},{action:"cancel",type:"Booking",object:{customerId:"m-1"}},{action:"delete",type:"Booking",object:{customerId:"m-1"}},{action:"manage",type:"Vendor",object:{_id:"v-1"}}];function Mt(t){return Ye.map(e=>({action:e.action,type:e.type,object:e.object,can:w(t,e.action,e.type,e.object)}))}var Q=N([]),St="wix-access: createAccess({ fetchRules }) needs your web method, e.g. import { getMyAbilities } from 'backend/access.web'. The package cannot import it for you \u2014 that specifier only resolves inside your project. If it is imported and still not a function, build the kit inside onReady and pass an arrow: fetchRules: (...a) => getMyAbilities(...a).";function Ct(t){let e=t||{},n=e.fetchRules,s=e.onError||null,r=typeof n!="function",o=Q,i=[],a=!1,u=!1,l=null,h=null;async function A(){if(r)return i=[],o=Q,u=!0,l=St,a=!0,s&&s(new Error(St)),p;try{let c=await n();if(k(c))return i=[],o=Q,u=!0,l="rules refused: "+(c.code||"FORBIDDEN"),a=!0,s&&s(new Error(l)),p;i=Array.isArray(c)?c:[],o=N(i),u=!1}catch(c){i=[],o=Q,u=!0,l=String(c&&c.message||c),s&&s(c)}return a=!0,p}let p={ready(){return a?Promise.resolve(p):(h||(h=A().then(c=>(h=null,c))),h)},refresh(){return a=!1,u=!1,l=null,h=null,p.ready()},can:(c,d,g)=>w(o,c,d,g),cannot:(c,d,g)=>!w(o,c,d,g),rules:()=>i.slice(),get loaded(){return a},get failed(){return u},get reason(){return l},guard(c,d,g,P,W){let Je=p.can(d,g,P);return p.apply(c,Je,W),Je},apply(c,d,g){if(!c)return d;let P=g||"hide";try{P==="disable"?d&&c.enable?c.enable():!d&&c.disable&&c.disable():P==="collapse"?d&&c.expand?c.expand():!d&&c.collapse&&c.collapse():d&&c.show?c.show():!d&&c.hide&&c.hide()}catch(W){s&&s(W)}return d}};return p}function Tn(){return{ok:!0,side:"public",version:Ge}}async function Pn(){try{return(await _t.currentMember.getRoles()).map(e=>e.title)}catch{return[]}}0&&(module.exports={CASES,CODES,KIND,PACKAGE_VERSION,PolicyError,SCOPE,WHEN,abilityFor,abilityFromRules,anonymous,applyClauses,applyGates,assertGates,can,caseTable,createAccess,createPrincipal,deny,denyOpaque,filterFor,frontendRoleTitles,hasRole,isDenial,normaliseRoles,ok,parseGates,permissionFor,publicPing,resolvePlaceholders,resolveSubjects,resolveWhere,rulesFor,validatePolicy,verifyGates});
+  `))}function Ft(t,e){let n=e&&e.api||{},s=t||{},r={},o=[];for(let i of Object.keys(s)){let a=s[i],u=n[i];if(!u){o.push(i);continue}if(typeof a!="function"){o.push(i+" (not a function: "+typeof a+")");continue}try{a.permission=u.permission,r[i]=u.permission}catch(l){o.push(i+" (could not stamp: "+String(l&&l.message)+")")}}if(o.length)throw new Error("wix-access: applyGates could not gate: "+o.join(", ")+". Every exported web method must be declared in policy.api.");return r}var Ge="0.5.2";var Ye=[{action:"read",type:"Booking",object:{customerId:"m-1"}},{action:"read",type:"Booking",object:{customerId:"m-2"}},{action:"cancel",type:"Booking",object:{customerId:"m-1"}},{action:"delete",type:"Booking",object:{customerId:"m-1"}},{action:"manage",type:"Vendor",object:{_id:"v-1"}}];function Mt(t){return Ye.map(e=>({action:e.action,type:e.type,object:e.object,can:w(t,e.action,e.type,e.object)}))}var Q=N([]),St="wix-access: createAccess({ fetchRules }) needs your web method, e.g. import { getMyAbilities } from 'backend/access.web'. The package cannot import it for you \u2014 that specifier only resolves inside your project. If it is imported and still not a function, build the kit inside onReady and pass an arrow: fetchRules: (...a) => getMyAbilities(...a).";function Ct(t){let e=t||{},n=e.fetchRules,s=e.onError||null,r=typeof n!="function",o=Q,i=[],a=!1,u=!1,l=null,h=null;async function A(){if(r)return i=[],o=Q,u=!0,l=St,a=!0,s&&s(new Error(St)),p;try{let c=await n();if(k(c))return i=[],o=Q,u=!0,l="rules refused: "+(c.code||"FORBIDDEN"),a=!0,s&&s(new Error(l)),p;i=Array.isArray(c)?c:[],o=N(i),u=!1}catch(c){i=[],o=Q,u=!0,l=String(c&&c.message||c),s&&s(c)}return a=!0,p}let p={ready(){return a?Promise.resolve(p):(h||(h=A().then(c=>(h=null,c))),h)},refresh(){return a=!1,u=!1,l=null,h=null,p.ready()},can:(c,d,g)=>w(o,c,d,g),cannot:(c,d,g)=>!w(o,c,d,g),rules:()=>i.slice(),get loaded(){return a},get failed(){return u},get reason(){return l},guard(c,d,g,P,W){let Je=p.can(d,g,P);return p.apply(c,Je,W),Je},apply(c,d,g){if(!c)return d;let P=g||"hide";try{P==="disable"?d&&c.enable?c.enable():!d&&c.disable&&c.disable():P==="collapse"?d&&c.expand?c.expand():!d&&c.collapse&&c.collapse():d&&c.show?c.show():!d&&c.hide&&c.hide()}catch(W){s&&s(W)}return d}};return p}function Tn(){return{ok:!0,side:"public",version:Ge}}async function Pn(){try{return(await _t.currentMember.getRoles()).map(e=>e.title)}catch{return[]}}0&&(module.exports={CASES,CODES,KIND,PACKAGE_VERSION,PolicyError,SCOPE,WHEN,abilityFor,abilityFromRules,anonymous,applyClauses,applyGates,assertGates,can,caseTable,createAccess,createPrincipal,deny,denyOpaque,filterFor,frontendRoleTitles,hasRole,isDenial,normaliseRoles,ok,parseGates,permissionFor,publicPing,resolvePlaceholders,resolveSubjects,resolveWhere,rulesFor,validatePolicy,verifyGates});