@ngageoint/mage.service 6.2.2

package/lib/permissions/permissions.events.js

@@ -0,0 +1,154 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EventFeedsPermissionService = exports.defaultEventPermissionsService = exports.EventPermissionServiceImpl = void 0;
+const app_api_errors_1 = require("../app.api/app.api.errors");
+const entities_permissions_1 = require("../entities/authorization/entities.permissions");
+const entities_events_1 = require("../entities/events/entities.events");
+const event_1 = __importDefault(require("../models/event"));
+const access_1 = __importDefault(require("../access"));
+const adapters_events_db_mongoose_1 = require("../adapters/events/adapters.events.db.mongoose");
+/**
+ * TODO: This should not depend explicitly on the MongooseMageEventRepository,
+ * but the MageEventRepository interface instead.  However, a large number of
+ * tests mock a very specific chain of Mongoose model methods, so to avoid
+ * breaking those tests for now, this class will use the Mongoose event model
+ * directly to populate event teams.
+ */
+class EventPermissionServiceImpl {
+    constructor(eventRepo) {
+        this.eventRepo = eventRepo;
+    }
+    ensureEventUpdatePermission(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const eventContext = context;
+            if (eventContext.event) {
+                return yield this.authorizeEventAccess(eventContext.event, eventContext.requestingPrincipal(), entities_permissions_1.MageEventPermission.UPDATE_EVENT, entities_events_1.EventAccessType.Update);
+            }
+            return (0, app_api_errors_1.permissionDenied)(entities_permissions_1.MageEventPermission.UPDATE_EVENT, String(context.requestingPrincipal()));
+        });
+    }
+    ensureEventReadPermission(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const eventContext = context;
+            if (eventContext.event) {
+                return yield this.authorizeEventAccess(eventContext.event, eventContext.requestingPrincipal(), entities_permissions_1.MageEventPermission.READ_EVENT_USER, entities_events_1.EventAccessType.Read);
+            }
+            return (0, app_api_errors_1.permissionDenied)(entities_permissions_1.MageEventPermission.READ_EVENT_USER, String(context.requestingPrincipal()));
+        });
+    }
+    /**
+     * Check for the given app-level permission on the role of the given user.
+     * If present, grant the user access.  If not, check for the given event-
+     * level permission on the ACL of the given event.  If present, grant the
+     * user access.  Otherwise, deny access.
+     * @param event
+     * @param user
+     * @param appPermission
+     * @param eventPermission
+     * @returns
+     */
+    authorizeEventAccess(event, user, appPermission, eventPermission) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (access_1.default.userHasPermission(user, appPermission)) {
+                return null;
+            }
+            const hasEventAclPermission = yield this.userHasEventPermission(event, user.id, eventPermission);
+            if (hasEventAclPermission) {
+                return null;
+            }
+            return (0, app_api_errors_1.permissionDenied)(appPermission, user.username, String(event.id));
+        });
+    }
+    userHasEventPermission(event, userId, eventPermission) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (eventPermission === entities_events_1.EventAccessType.Read && (yield this.userIsParticipantInEvent(event, userId))) {
+                return true;
+            }
+            let userEventRole = event.acl[userId];
+            if (typeof userEventRole === 'object') {
+                userEventRole = userEventRole.role;
+            }
+            const userRoleHasPermission = (0, entities_events_1.rolesWithPermission)(eventPermission).some(role => role === userEventRole);
+            return userRoleHasPermission;
+        });
+    }
+    /**
+     * Check whether the given user is a member of any of the given MAGE event's
+     * teams.
+     * TODO: This is arguably an entity-layer function, but is here for now as
+     * the concept of team membership only really has value in access control
+     * decisions, currently.
+     * @param event
+     * @param userId
+     * @returns
+     */
+    userIsParticipantInEvent(event, userId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const teams = yield this.resolveTeamsForEvent(event);
+            return teams.some(team => team.userIds.indexOf(userId) !== -1);
+        });
+    }
+    resolveTeamsForEvent(event) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const teams = yield this.eventRepo.findTeamsInEvent(event);
+            return teams;
+        });
+    }
+}
+exports.EventPermissionServiceImpl = EventPermissionServiceImpl;
+exports.defaultEventPermissionsService = new EventPermissionServiceImpl(new adapters_events_db_mongoose_1.MongooseMageEventRepository(event_1.default.Model));
+class EventFeedsPermissionService {
+    constructor(eventRepo, eventPermissions) {
+        this.eventRepo = eventRepo;
+        this.eventPermissions = eventPermissions;
+    }
+    ensureFetchFeedContentPermissionFor(context, feed) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this.eventPermissions.ensureEventReadPermission(context);
+        });
+    }
+    ensureListServiceTypesPermissionFor(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return (0, app_api_errors_1.permissionDenied)(entities_permissions_1.allPermissions.FEEDS_LIST_SERVICE_TYPES, context.requestingPrincipal().username);
+        });
+    }
+    ensureCreateServicePermissionFor(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return (0, app_api_errors_1.permissionDenied)(entities_permissions_1.allPermissions.FEEDS_CREATE_SERVICE, context.requestingPrincipal().username);
+        });
+    }
+    ensureListServicesPermissionFor(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return (0, app_api_errors_1.permissionDenied)(entities_permissions_1.allPermissions.FEEDS_LIST_SERVICES, context.requestingPrincipal().username);
+        });
+    }
+    ensureListTopicsPermissionFor(context, service) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return (0, app_api_errors_1.permissionDenied)(entities_permissions_1.allPermissions.FEEDS_LIST_TOPICS, context.requestingPrincipal().username);
+        });
+    }
+    ensureCreateFeedPermissionFor(context, service) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return (0, app_api_errors_1.permissionDenied)(entities_permissions_1.allPermissions.FEEDS_CREATE_FEED, context.requestingPrincipal().username);
+        });
+    }
+    ensureListAllFeedsPermissionFor(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return (0, app_api_errors_1.permissionDenied)(entities_permissions_1.allPermissions.FEEDS_LIST_ALL, context.requestingPrincipal().username);
+        });
+    }
+}
+exports.EventFeedsPermissionService = EventFeedsPermissionService;
+//# sourceMappingURL=permissions.events.js.map

package/lib/permissions/permissions.events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.events.js","sourceRoot":"","sources":["../../src/permissions/permissions.events.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAGA,8DAAmF;AAEnF,yFAAmH;AAEnH,wEAA8H;AAC9H,4DAAwC;AACxC,uDAA8B;AAE9B,gGAA4F;AAgB5F;;;;;;GAMG;AACH,MAAa,0BAA0B;IAErC,YAAqB,SAAsC;QAAtC,cAAS,GAAT,SAAS,CAA6B;IAAG,CAAC;IAEzD,2BAA2B,CAAC,OAA0B;;YAC1D,MAAM,YAAY,GAAG,OAA8B,CAAA;YACnD,IAAI,YAAY,CAAC,KAAK,EAAE;gBACtB,OAAO,MAAM,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,mBAAmB,EAAE,EAAE,0CAAmB,CAAC,YAAY,EAAE,iCAAe,CAAC,MAAM,CAAC,CAAA;aACzJ;YACD,OAAO,IAAA,iCAAgB,EAAC,0CAAmB,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAA;QAClG,CAAC;KAAA;IAEK,yBAAyB,CAAC,OAA0B;;YACxD,MAAM,YAAY,GAAG,OAA8B,CAAA;YACnD,IAAI,YAAY,CAAC,KAAK,EAAE;gBACtB,OAAO,MAAM,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,mBAAmB,EAAE,EAAE,0CAAmB,CAAC,eAAe,EAAE,iCAAe,CAAC,IAAI,CAAC,CAAA;aAC1J;YACD,OAAO,IAAA,iCAAgB,EAAC,0CAAmB,CAAC,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAA;QACrG,CAAC;KAAA;IAED;;;;;;;;;;OAUG;IACG,oBAAoB,CAAC,KAAyC,EAAE,IAAkB,EAAE,aAA4B,EAAE,eAAgC;;YACtJ,IAAI,gBAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE;gBACjD,OAAO,IAAI,CAAA;aACZ;YACD,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC,CAAA;YAChG,IAAI,qBAAqB,EAAE;gBACzB,OAAO,IAAI,CAAA;aACZ;YACD,OAAO,IAAA,iCAAgB,EAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;QACzE,CAAC;KAAA;IAEK,sBAAsB,CAAC,KAAyC,EAAE,MAAc,EAAE,eAAgC;;YACtH,IAAI,eAAe,KAAK,iCAAe,CAAC,IAAI,KAAI,MAAM,IAAI,CAAC,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA,EAAE;gBAClG,OAAO,IAAI,CAAA;aACZ;YACD,IAAI,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACrC,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE;gBACrC,aAAa,GAAG,aAAa,CAAC,IAAI,CAAA;aACnC;YACD,MAAM,qBAAqB,GAAG,IAAA,qCAAmB,EAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,aAAa,CAAC,CAAA;YACvG,OAAO,qBAAqB,CAAA;QAC9B,CAAC;KAAA;IAED;;;;;;;;;OASG;IACG,wBAAwB,CAAC,KAAyC,EAAE,MAAc;;YACtF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAA;YACpD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAChE,CAAC;KAAA;IAEa,oBAAoB,CAAC,KAAyC;;YAC1E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAA;YAC1D,OAAO,KAAM,CAAA;QACf,CAAC;KAAA;CACF;AAzED,gEAyEC;AAEY,QAAA,8BAA8B,GAAG,IAAI,0BAA0B,CAAC,IAAI,yDAA2B,CAAC,eAAU,CAAC,KAAK,CAAC,CAAC,CAAA;AAE/H,MAAa,2BAA2B;IAEtC,YAAqB,SAA8B,EAAW,gBAA4C;QAArF,cAAS,GAAT,SAAS,CAAqB;QAAW,qBAAgB,GAAhB,gBAAgB,CAA4B;IAAG,CAAC;IAExG,mCAAmC,CAAC,OAA4B,EAAE,IAAY;;YAClF,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAA;QACvE,CAAC;KAAA;IACK,mCAAmC,CAAC,OAA4B;;YACpE,OAAO,IAAA,iCAAgB,EAAC,qCAAc,CAAC,wBAAwB,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC,QAAQ,CAAC,CAAA;QAC1G,CAAC;KAAA;IACK,gCAAgC,CAAC,OAA4B;;YACjE,OAAO,IAAA,iCAAgB,EAAC,qCAAc,CAAC,oBAAoB,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC,QAAQ,CAAC,CAAA;QACtG,CAAC;KAAA;IACK,+BAA+B,CAAC,OAA4B;;YAChE,OAAO,IAAA,iCAAgB,EAAC,qCAAc,CAAC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC,QAAQ,CAAC,CAAA;QACrG,CAAC;KAAA;IACK,6BAA6B,CAAC,OAA4B,EAAE,OAAe;;YAC/E,OAAO,IAAA,iCAAgB,EAAC,qCAAc,CAAC,iBAAiB,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC,QAAQ,CAAC,CAAA;QACnG,CAAC;KAAA;IACK,6BAA6B,CAAC,OAA4B,EAAE,OAAe;;YAC/E,OAAO,IAAA,iCAAgB,EAAC,qCAAc,CAAC,iBAAiB,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC,QAAQ,CAAC,CAAA;QACnG,CAAC;KAAA;IACK,+BAA+B,CAAC,OAA4B;;YAChE,OAAO,IAAA,iCAAgB,EAAC,qCAAc,CAAC,cAAc,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC,QAAQ,CAAC,CAAA;QAChG,CAAC;KAAA;CACF;AAzBD,kEAyBC"}

package/lib/permissions/permissions.feeds.d.ts

@@ -0,0 +1,19 @@
+import { FeedsPermissionService } from '../app.api/feeds/app.api.feeds';
+import { PermissionDeniedError } from '../app.api/app.api.errors';
+import { AppRequestContext } from '../app.api/app.api.global';
+import { FeedServiceId } from '../entities/feeds/entities.feeds';
+import { UserWithRole } from './permissions.role-based.base';
+/**
+ * This permission service relies on the user and role that the I/O adapter
+ * layer has previously fetched from the database.
+ */
+export declare class PreFetchedUserRoleFeedsPermissionService implements FeedsPermissionService {
+    ensureListServiceTypesPermissionFor(context: AppRequestContext<UserWithRole>): Promise<PermissionDeniedError | null>;
+    ensureCreateServicePermissionFor(context: AppRequestContext<UserWithRole>): Promise<PermissionDeniedError | null>;
+    ensureListServicesPermissionFor(context: AppRequestContext<UserWithRole>): Promise<PermissionDeniedError | null>;
+    ensureListTopicsPermissionFor(context: AppRequestContext<UserWithRole>, service: FeedServiceId): Promise<PermissionDeniedError | null>;
+    ensureCreateFeedPermissionFor(context: AppRequestContext<UserWithRole>, service: FeedServiceId): Promise<PermissionDeniedError | null>;
+    ensureListAllFeedsPermissionFor(context: AppRequestContext<UserWithRole>): Promise<PermissionDeniedError | null>;
+    ensureFetchFeedContentPermissionFor(context: AppRequestContext<UserWithRole>): Promise<PermissionDeniedError | null>;
+}
+//# sourceMappingURL=permissions.feeds.d.ts.map

package/lib/permissions/permissions.feeds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.feeds.d.ts","sourceRoot":"","sources":["../../src/permissions/permissions.feeds.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AACvE,OAAO,EAAE,qBAAqB,EAAoB,MAAM,2BAA2B,CAAA;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAE7D,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAA;AAChE,OAAO,EAAE,YAAY,EAAkC,MAAM,+BAA+B,CAAA;AAG5F;;;GAGG;AACH,qBAAa,wCAAyC,YAAW,sBAAsB;IAE/E,mCAAmC,CAAC,OAAO,EAAE,iBAAiB,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAIpH,gCAAgC,CAAC,OAAO,EAAE,iBAAiB,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAIjH,+BAA+B,CAAC,OAAO,EAAE,iBAAiB,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAIhH,6BAA6B,CAAC,OAAO,EAAE,iBAAiB,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAItI,6BAA6B,CAAC,OAAO,EAAE,iBAAiB,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAItI,+BAA+B,CAAC,OAAO,EAAE,iBAAiB,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAIhH,mCAAmC,CAAC,OAAO,EAAE,iBAAiB,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;CAG3H"}

package/lib/permissions/permissions.feeds.js

@@ -0,0 +1,58 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PreFetchedUserRoleFeedsPermissionService = void 0;
+const app_api_errors_1 = require("../app.api/app.api.errors");
+const entities_permissions_1 = require("../entities/authorization/entities.permissions");
+const permissions_role_based_base_1 = require("./permissions.role-based.base");
+/**
+ * This permission service relies on the user and role that the I/O adapter
+ * layer has previously fetched from the database.
+ */
+class PreFetchedUserRoleFeedsPermissionService {
+    ensureListServiceTypesPermissionFor(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return (0, permissions_role_based_base_1.ensureContextUserHasPermission)(context, entities_permissions_1.FeedsPermission.FEEDS_LIST_SERVICE_TYPES);
+        });
+    }
+    ensureCreateServicePermissionFor(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return (0, permissions_role_based_base_1.ensureContextUserHasPermission)(context, entities_permissions_1.FeedsPermission.FEEDS_CREATE_SERVICE);
+        });
+    }
+    ensureListServicesPermissionFor(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return (0, permissions_role_based_base_1.ensureContextUserHasPermission)(context, entities_permissions_1.FeedsPermission.FEEDS_LIST_SERVICES);
+        });
+    }
+    ensureListTopicsPermissionFor(context, service) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return (0, permissions_role_based_base_1.ensureContextUserHasPermission)(context, entities_permissions_1.FeedsPermission.FEEDS_LIST_TOPICS);
+        });
+    }
+    ensureCreateFeedPermissionFor(context, service) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return (0, permissions_role_based_base_1.ensureContextUserHasPermission)(context, entities_permissions_1.FeedsPermission.FEEDS_CREATE_FEED);
+        });
+    }
+    ensureListAllFeedsPermissionFor(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return (0, permissions_role_based_base_1.ensureContextUserHasPermission)(context, entities_permissions_1.FeedsPermission.FEEDS_LIST_ALL);
+        });
+    }
+    ensureFetchFeedContentPermissionFor(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return (0, app_api_errors_1.permissionDenied)(entities_permissions_1.FeedsPermission.FEEDS_FETCH_CONTENT, context.requestingPrincipal().username);
+        });
+    }
+}
+exports.PreFetchedUserRoleFeedsPermissionService = PreFetchedUserRoleFeedsPermissionService;
+//# sourceMappingURL=permissions.feeds.js.map

package/lib/permissions/permissions.feeds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.feeds.js","sourceRoot":"","sources":["../../src/permissions/permissions.feeds.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,8DAAmF;AAEnF,yFAAgF;AAEhF,+EAA4F;AAG5F;;;GAGG;AACH,MAAa,wCAAwC;IAE7C,mCAAmC,CAAC,OAAwC;;YAChF,OAAO,IAAA,4DAA8B,EAAC,OAAO,EAAE,sCAAe,CAAC,wBAAwB,CAAC,CAAA;QAC1F,CAAC;KAAA;IAEK,gCAAgC,CAAC,OAAwC;;YAC7E,OAAO,IAAA,4DAA8B,EAAC,OAAO,EAAE,sCAAe,CAAC,oBAAoB,CAAC,CAAA;QACtF,CAAC;KAAA;IAEK,+BAA+B,CAAC,OAAwC;;YAC5E,OAAO,IAAA,4DAA8B,EAAC,OAAO,EAAE,sCAAe,CAAC,mBAAmB,CAAC,CAAA;QACrF,CAAC;KAAA;IAEK,6BAA6B,CAAC,OAAwC,EAAE,OAAsB;;YAClG,OAAO,IAAA,4DAA8B,EAAC,OAAO,EAAE,sCAAe,CAAC,iBAAiB,CAAC,CAAA;QACnF,CAAC;KAAA;IAEK,6BAA6B,CAAC,OAAwC,EAAE,OAAsB;;YAClG,OAAO,IAAA,4DAA8B,EAAC,OAAO,EAAE,sCAAe,CAAC,iBAAiB,CAAC,CAAA;QACnF,CAAC;KAAA;IAEK,+BAA+B,CAAC,OAAwC;;YAC5E,OAAO,IAAA,4DAA8B,EAAC,OAAO,EAAE,sCAAe,CAAC,cAAc,CAAC,CAAA;QAChF,CAAC;KAAA;IAEK,mCAAmC,CAAC,OAAwC;;YAChF,OAAO,IAAA,iCAAgB,EAAC,sCAAe,CAAC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC,QAAQ,CAAC,CAAA;QACtG,CAAC;KAAA;CACF;AA7BD,4FA6BC"}

package/lib/permissions/permissions.icons.d.ts

@@ -0,0 +1,9 @@
+import { PermissionDeniedError } from '../app.api/app.api.errors';
+import { AppRequestContext } from '../app.api/app.api.global';
+import { StaticIconPermissionService } from '../app.api/icons/app.api.icons';
+import { UserWithRole } from './permissions.role-based.base';
+export declare class RoleBasedStaticIconPermissionService implements StaticIconPermissionService {
+    ensureCreateStaticIconPermission(ctx: AppRequestContext<UserWithRole>): Promise<null | PermissionDeniedError>;
+    ensureGetStaticIconPermission(ctx: AppRequestContext<UserWithRole>): Promise<null | PermissionDeniedError>;
+}
+//# sourceMappingURL=permissions.icons.d.ts.map

package/lib/permissions/permissions.icons.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.icons.d.ts","sourceRoot":"","sources":["../../src/permissions/permissions.icons.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAA;AAE5E,OAAO,EAAE,YAAY,EAAkC,MAAM,+BAA+B,CAAA;AAG5F,qBAAa,oCAAqC,YAAW,2BAA2B;IAEhF,gCAAgC,CAAC,GAAG,EAAE,iBAAiB,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,qBAAqB,CAAC;IAI7G,6BAA6B,CAAC,GAAG,EAAE,iBAAiB,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,qBAAqB,CAAC;CAGjH"}

package/lib/permissions/permissions.icons.js

@@ -0,0 +1,28 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleBasedStaticIconPermissionService = void 0;
+const entities_permissions_1 = require("../entities/authorization/entities.permissions");
+const permissions_role_based_base_1 = require("./permissions.role-based.base");
+class RoleBasedStaticIconPermissionService {
+    ensureCreateStaticIconPermission(ctx) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return (0, permissions_role_based_base_1.ensureContextUserHasPermission)(ctx, entities_permissions_1.StaticIconPermission.STATIC_ICON_WRITE);
+        });
+    }
+    ensureGetStaticIconPermission(ctx) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return null;
+        });
+    }
+}
+exports.RoleBasedStaticIconPermissionService = RoleBasedStaticIconPermissionService;
+//# sourceMappingURL=permissions.icons.js.map

package/lib/permissions/permissions.icons.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.icons.js","sourceRoot":"","sources":["../../src/permissions/permissions.icons.ts"],"names":[],"mappings":";;;;;;;;;;;;AAGA,yFAAqF;AACrF,+EAA4F;AAG5F,MAAa,oCAAoC;IAEzC,gCAAgC,CAAC,GAAoC;;YACzE,OAAO,IAAA,4DAA8B,EAAC,GAAG,EAAE,2CAAoB,CAAC,iBAAiB,CAAC,CAAA;QACpF,CAAC;KAAA;IAEK,6BAA6B,CAAC,GAAoC;;YACtE,OAAO,IAAI,CAAA;QACb,CAAC;KAAA;CACF;AATD,oFASC"}

package/lib/permissions/permissions.observations.d.ts

@@ -0,0 +1,14 @@
+import { PermissionDeniedError } from '../app.api/app.api.errors';
+import { ObservationPermissionService, ObservationRequestContext } from '../app.api/observations/app.api.observations';
+import { AttachmentId, Observation } from '../entities/observations/entities.observations';
+import { EventPermissionServiceImpl } from './permissions.events';
+import { UserWithRole } from './permissions.role-based.base';
+export declare class ObservationPermissionsServiceImpl implements ObservationPermissionService {
+    private eventPermissions;
+    constructor(eventPermissions: EventPermissionServiceImpl);
+    ensureCreateObservationPermission(context: ObservationRequestContext<UserWithRole>): Promise<PermissionDeniedError | null>;
+    ensureUpdateObservationPermission(context: ObservationRequestContext<UserWithRole>): Promise<PermissionDeniedError | null>;
+    ensureReadObservationPermission(context: ObservationRequestContext<UserWithRole>): Promise<PermissionDeniedError | null>;
+    ensureStoreAttachmentContentPermission(context: ObservationRequestContext<UserWithRole>, observation: Observation, attachmentId: AttachmentId): Promise<PermissionDeniedError | null>;
+}
+//# sourceMappingURL=permissions.observations.d.ts.map

package/lib/permissions/permissions.observations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.observations.d.ts","sourceRoot":"","sources":["../../src/permissions/permissions.observations.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AACnF,OAAO,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAA;AAGtH,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gDAAgD,CAAA;AAC1F,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,EAAkC,YAAY,EAAE,MAAM,+BAA+B,CAAA;AAE5F,qBAAa,iCAAkC,YAAW,4BAA4B;IAExE,OAAO,CAAC,gBAAgB;gBAAhB,gBAAgB,EAAE,0BAA0B;IAE1D,iCAAiC,CAAC,OAAO,EAAE,yBAAyB,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAU1H,iCAAiC,CAAC,OAAO,EAAE,yBAAyB,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAa1H,+BAA+B,CAAC,OAAO,EAAE,yBAAyB,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAcxH,sCAAsC,CAAC,OAAO,EAAE,yBAAyB,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;CA4C5L"}

package/lib/permissions/permissions.observations.js

@@ -0,0 +1,113 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ObservationPermissionsServiceImpl = void 0;
+const access_1 = __importDefault(require("../access"));
+const app_api_errors_1 = require("../app.api/app.api.errors");
+const entities_permissions_1 = require("../entities/authorization/entities.permissions");
+const entities_events_1 = require("../entities/events/entities.events");
+const permissions_role_based_base_1 = require("./permissions.role-based.base");
+class ObservationPermissionsServiceImpl {
+    constructor(eventPermissions) {
+        this.eventPermissions = eventPermissions;
+    }
+    ensureCreateObservationPermission(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const denied = yield (0, permissions_role_based_base_1.ensureContextUserHasPermission)(context, entities_permissions_1.ObservationPermission.CREATE_OBSERVATION);
+            if (denied) {
+                return denied;
+            }
+            const user = context.requestingPrincipal();
+            const isParticipant = yield this.eventPermissions.userIsParticipantInEvent(context.mageEvent, user.id);
+            return isParticipant ? null : (0, app_api_errors_1.permissionDenied)(entities_permissions_1.ObservationPermission.CREATE_OBSERVATION, user.id);
+        });
+    }
+    ensureUpdateObservationPermission(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const user = context.requestingPrincipal();
+            if (access_1.default.userHasPermission(user, entities_permissions_1.ObservationPermission.UPDATE_OBSERVATION_ALL)) {
+                return null;
+            }
+            if (access_1.default.userHasPermission(user, entities_permissions_1.ObservationPermission.UPDATE_OBSERVATION_EVENT)) {
+                if (yield this.eventPermissions.userHasEventPermission(context.mageEvent, user.id, entities_events_1.EventAccessType.Read)) {
+                    return null;
+                }
+            }
+            return (0, app_api_errors_1.permissionDenied)('UPDATE_OBSERVATION', user.id);
+        });
+    }
+    ensureReadObservationPermission(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const user = context.requestingPrincipal();
+            if (access_1.default.userHasPermission(user, entities_permissions_1.ObservationPermission.READ_OBSERVATION_ALL)) {
+                return null;
+            }
+            if (access_1.default.userHasPermission(user, entities_permissions_1.ObservationPermission.READ_OBSERVATION_EVENT)) {
+                // Make sure I am part of this event
+                if (yield this.eventPermissions.userHasEventPermission(context.mageEvent, user.id, entities_events_1.EventAccessType.Read)) {
+                    return null;
+                }
+            }
+            return (0, app_api_errors_1.permissionDenied)('READ_OBSERVATION', user.id);
+        });
+    }
+    ensureStoreAttachmentContentPermission(context, observation, attachmentId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const user = context.requestingPrincipal();
+            const attachment = observation.attachmentFor(attachmentId);
+            if (!attachment) {
+                return null;
+            }
+            const hasUpdatePermission = yield this.ensureUpdateObservationPermission(context).then(x => x === null);
+            const contentExists = !!attachment.contentLocator;
+            if (contentExists) {
+                if (hasUpdatePermission) {
+                    return null;
+                }
+            }
+            else {
+                if (hasUpdatePermission) {
+                    return null;
+                }
+                /*
+                TODO:
+                This create permission check preserves backward compatibility for a MAGE
+                client that uses a role with permission only to create observations, but
+                not update them.  Adding attachments requires two or more requests, one
+                to create the observation document with attachment meta-data embdedded in
+                form field entries, and one request per attachment to save the content of
+                the attachment(s).  Hence, to support the create-only role, the old
+                attachment submission code checked for observation create permission
+                instead of observation update permission to ensure that users with the
+                create-only role could still add attachment content to observations they
+                created.
+          
+                This permission check should go away when we implement fully custom roles
+                and permissions management, however, we may also need to implement some
+                kind of transaction mechanism to group all the requests for submitting an
+                observation with attachments, whether creating or updating.  This could
+                be some token that the service returns and the API client submits with
+                each request until the observation submission is complete.
+                */
+                const isContextUserCreator = observation.userId === user.id;
+                if (isContextUserCreator && (yield this.ensureCreateObservationPermission(context).then(x => x === null))) {
+                    return null;
+                }
+            }
+            return (0, app_api_errors_1.permissionDenied)('STORE_ATTACHMENT_CONTENT', user.id, `observation ${observation.id}, attachment ${attachmentId}`);
+        });
+    }
+}
+exports.ObservationPermissionsServiceImpl = ObservationPermissionsServiceImpl;
+//# sourceMappingURL=permissions.observations.js.map

package/lib/permissions/permissions.observations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.observations.js","sourceRoot":"","sources":["../../src/permissions/permissions.observations.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,uDAA8B;AAC9B,8DAAmF;AAEnF,yFAAsF;AACtF,wEAAoE;AAGpE,+EAA4F;AAE5F,MAAa,iCAAiC;IAE5C,YAAoB,gBAA4C;QAA5C,qBAAgB,GAAhB,gBAAgB,CAA4B;IAAG,CAAC;IAE9D,iCAAiC,CAAC,OAAgD;;YACtF,MAAM,MAAM,GAAG,MAAM,IAAA,4DAA8B,EAAC,OAAO,EAAE,4CAAqB,CAAC,kBAAkB,CAAC,CAAA;YACtG,IAAI,MAAM,EAAE;gBACV,OAAO,MAAM,CAAA;aACd;YACD,MAAM,IAAI,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAA;YAC1C,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;YACtG,OAAO,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,iCAAgB,EAAC,4CAAqB,CAAC,kBAAkB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QACnG,CAAC;KAAA;IAEK,iCAAiC,CAAC,OAAgD;;YACtF,MAAM,IAAI,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAA;YAC1C,IAAI,gBAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,4CAAqB,CAAC,sBAAsB,CAAC,EAAE;gBAChF,OAAO,IAAI,CAAA;aACZ;YACD,IAAI,gBAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,4CAAqB,CAAC,wBAAwB,CAAC,EAAE;gBAClF,IAAI,MAAM,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,iCAAe,CAAC,IAAI,CAAC,EAAE;oBACxG,OAAO,IAAI,CAAA;iBACZ;aACF;YACD,OAAO,IAAA,iCAAgB,EAAC,oBAAoB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QACxD,CAAC;KAAA;IAEK,+BAA+B,CAAC,OAAgD;;YACpF,MAAM,IAAI,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAA;YAC1C,IAAI,gBAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,4CAAqB,CAAC,oBAAoB,CAAC,EAAE;gBAC9E,OAAO,IAAI,CAAA;aACZ;YACD,IAAI,gBAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,4CAAqB,CAAC,sBAAsB,CAAC,EAAE;gBAChF,oCAAoC;gBACpC,IAAI,MAAM,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,iCAAe,CAAC,IAAI,CAAC,EAAE;oBACxG,OAAO,IAAI,CAAA;iBACZ;aACF;YACD,OAAO,IAAA,iCAAgB,EAAC,kBAAkB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QACtD,CAAC;KAAA;IAEK,sCAAsC,CAAC,OAAgD,EAAE,WAAwB,EAAE,YAA0B;;YACjJ,MAAM,IAAI,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAA;YAC1C,MAAM,UAAU,GAAG,WAAW,CAAC,aAAa,CAAC,YAAY,CAAC,CAAA;YAC1D,IAAI,CAAC,UAAU,EAAE;gBACf,OAAO,IAAI,CAAA;aACZ;YACD,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,iCAAiC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAA;YACvG,MAAM,aAAa,GAAG,CAAC,CAAC,UAAU,CAAC,cAAc,CAAA;YACjD,IAAI,aAAa,EAAE;gBACjB,IAAI,mBAAmB,EAAE;oBACvB,OAAO,IAAI,CAAA;iBACZ;aACF;iBACI;gBACH,IAAI,mBAAmB,EAAE;oBACvB,OAAO,IAAI,CAAA;iBACZ;gBACD;;;;;;;;;;;;;;;;;;;kBAmBE;gBACF,MAAM,oBAAoB,GAAG,WAAW,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,CAAA;gBAC3D,IAAI,oBAAoB,KAAI,MAAM,IAAI,CAAC,iCAAiC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAA,EAAE;oBACvG,OAAO,IAAI,CAAA;iBACZ;aACF;YACD,OAAO,IAAA,iCAAgB,EAAC,0BAA0B,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,WAAW,CAAC,EAAE,gBAAgB,YAAY,EAAE,CAAC,CAAA;QAC3H,CAAC;KAAA;CACF;AArFD,8EAqFC"}

package/lib/permissions/permissions.role-based.base.d.ts

@@ -0,0 +1,15 @@
+import { UserDocument } from '../models/user';
+import { RoleDocument } from '../models/role';
+import { AppRequestContext } from '../app.api/app.api.global';
+import { PermissionDeniedError } from '../app.api/app.api.errors';
+import { AnyPermission } from '../entities/authorization/entities.permissions';
+/**
+ * TODO: This should not be statically linked to the Mongoose Document type but
+ * for now this is the quick and dirty way because the legacy web adapter layer
+ * puts the user Mongoose document on the request.
+ */
+export declare type UserWithRole = UserDocument & {
+    roleId: RoleDocument;
+};
+export declare function ensureContextUserHasPermission(context: AppRequestContext<UserWithRole>, permission: AnyPermission): null | PermissionDeniedError;
+//# sourceMappingURL=permissions.role-based.base.d.ts.map

package/lib/permissions/permissions.role-based.base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.role-based.base.d.ts","sourceRoot":"","sources":["../../src/permissions/permissions.role-based.base.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,EAAE,qBAAqB,EAAoB,MAAM,2BAA2B,CAAA;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAA;AAE9E;;;;GAIG;AACH,oBAAY,YAAY,GAAG,YAAY,GAAG;IACxC,MAAM,EAAE,YAAY,CAAA;CACrB,CAAA;AAED,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,iBAAiB,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,aAAa,GAAG,IAAI,GAAG,qBAAqB,CAOhJ"}

package/lib/permissions/permissions.role-based.base.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureContextUserHasPermission = void 0;
+const app_api_errors_1 = require("../app.api/app.api.errors");
+function ensureContextUserHasPermission(context, permission) {
+    const user = context.requestingPrincipal();
+    const role = user.roleId;
+    if (role.permissions.includes(permission)) {
+        return null;
+    }
+    return (0, app_api_errors_1.permissionDenied)(permission, user.username);
+}
+exports.ensureContextUserHasPermission = ensureContextUserHasPermission;
+//# sourceMappingURL=permissions.role-based.base.js.map

package/lib/permissions/permissions.role-based.base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.role-based.base.js","sourceRoot":"","sources":["../../src/permissions/permissions.role-based.base.ts"],"names":[],"mappings":";;;AAGA,8DAAmF;AAYnF,SAAgB,8BAA8B,CAAC,OAAwC,EAAE,UAAyB;IAChH,MAAM,IAAI,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAA;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAA;IACxB,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE;QACzC,OAAO,IAAI,CAAA;KACZ;IACD,OAAO,IAAA,iCAAgB,EAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;AACpD,CAAC;AAPD,wEAOC"}

package/lib/permissions/permissions.users.d.ts

@@ -0,0 +1,8 @@
+import { UsersPermissionService } from '../app.api/users/app.api.users';
+import { AppRequestContext } from '../app.api/app.api.global';
+import { UserWithRole } from './permissions.role-based.base';
+import { PermissionDeniedError } from '../app.api/app.api.errors';
+export declare class RoleBasedUsersPermissionService implements UsersPermissionService {
+    ensureReadUsersPermission(context: AppRequestContext<UserWithRole>): Promise<null | PermissionDeniedError>;
+}
+//# sourceMappingURL=permissions.users.d.ts.map

package/lib/permissions/permissions.users.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.users.d.ts","sourceRoot":"","sources":["../../src/permissions/permissions.users.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAE7D,OAAO,EAAE,YAAY,EAAkC,MAAM,+BAA+B,CAAA;AAC5F,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AAGjE,qBAAa,+BAAgC,YAAW,sBAAsB;IACtE,yBAAyB,CAAC,OAAO,EAAE,iBAAiB,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,qBAAqB,CAAC;CAGjH"}

package/lib/permissions/permissions.users.js

@@ -0,0 +1,23 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleBasedUsersPermissionService = void 0;
+const entities_permissions_1 = require("../entities/authorization/entities.permissions");
+const permissions_role_based_base_1 = require("./permissions.role-based.base");
+class RoleBasedUsersPermissionService {
+    ensureReadUsersPermission(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return (0, permissions_role_based_base_1.ensureContextUserHasPermission)(context, entities_permissions_1.UsersPermission.READ_USER);
+        });
+    }
+}
+exports.RoleBasedUsersPermissionService = RoleBasedUsersPermissionService;
+//# sourceMappingURL=permissions.users.js.map

package/lib/permissions/permissions.users.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.users.js","sourceRoot":"","sources":["../../src/permissions/permissions.users.ts"],"names":[],"mappings":";;;;;;;;;;;;AAEA,yFAAgF;AAChF,+EAA4F;AAI5F,MAAa,+BAA+B;IACpC,yBAAyB,CAAC,OAAwC;;YACtE,OAAO,IAAA,4DAA8B,EAAC,OAAO,EAAE,sCAAe,CAAC,SAAS,CAAC,CAAA;QAC3E,CAAC;KAAA;CACF;AAJD,0EAIC"}

package/lib/plugins.api/index.d.ts

@@ -0,0 +1,55 @@
+/**
+ * `InjectionToken` is an interface that any value can implement.  A unique
+ * symbol primitive is a good choice for a provider to use as an injection
+ * token to ensure the token cannot be duplicated.  The unused generic
+ * parameter serves only to denote the type that MAGE injects for the token.
+ */
+export interface InjectionToken<T> {
+}
+export declare type InjectedTypeOf<T> = T extends InjectionToken<infer S> ? S : never;
+export declare type InjectionRequest<Services> = {
+    [key: string]: InjectionToken<Services>;
+};
+export declare type Injection<Req extends InjectionRequest<any>> = {
+    [key in keyof Req]: InjectedTypeOf<Req[key]>;
+};
+/**
+ * Export this structure from a plugin module to inject infrastructure
+ * services from the core MAGE service.  This usually is to inject one or more
+ * repositories to interact with the MAGE database.
+ */
+export declare type InitPluginHook<Req = undefined> = Req extends InjectionRequest<infer Services> ? {
+    /**
+     * Specify the services to inject with a dictionary of string keys to
+     * {@link InjectionToken} values.
+     */
+    inject: InjectionRequest<Services>;
+    /**
+     * MAGE injects the {@link InitPluginHook.inject | requested services} in
+     * the object argument to this method.  The keys of the object are the same
+     * as those that {@link InitPluginHook.inject} define, and the values are
+     * the services corresponding to the injection tokens associated with those
+     * keys.
+     *
+     * This method can use the injected services to initialize more plugin hooks,
+     * and return those hooks so MAGE can integrate them accordingly.
+     */
+    init(services: Injection<Req>): Promise<any>;
+} : {
+    inject?: undefined;
+    init(): Promise<any>;
+};
+import { EnsureJson } from '../entities/entities.json_types';
+/**
+ * `PluginStateRepository` is a basic repository that supports persistence of a
+ * single JSON document that MAGE ties to a plugin ID.  Plugins can use this
+ * repository to store and update configuration or whatever snapshot-oriented
+ * state the plugin requires.
+ */
+export interface PluginStateRepository<State extends object> {
+    put(state: EnsureJson<State>): Promise<EnsureJson<State>>;
+    patch(state: Partial<EnsureJson<State>>): Promise<EnsureJson<State>>;
+    get(): Promise<EnsureJson<State> | null>;
+}
+export declare const PluginStateRepositoryToken: InjectionToken<PluginStateRepository<any>>;
+//# sourceMappingURL=index.d.ts.map

package/lib/plugins.api/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/plugins.api/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,WAAW,cAAc,CAAC,CAAC;CAChC;AAED,oBAAY,cAAc,CAAC,CAAC,IAAI,CAAC,SAAS,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;AAE7E,oBAAY,gBAAgB,CAAC,QAAQ,IAAI;IACvC,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;CACxC,CAAA;AAED,oBAAY,SAAS,CAAC,GAAG,SAAS,gBAAgB,CAAC,GAAG,CAAC,IAAI;KACxD,GAAG,IAAI,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;CAC7C,CAAA;AAED;;;;GAIG;AACH,oBAAY,cAAc,CAAC,GAAG,GAAG,SAAS,IACxC,GAAG,SAAS,gBAAgB,CAAC,MAAM,QAAQ,CAAC,GAAG;IAC7C;;;OAGG;IACH,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACnC;;;;;;;;;OASG;IACH,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;CAC7C,GAAG;IACF,MAAM,CAAC,EAAE,SAAS,CAAA;IAClB,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,CAAA;CACrB,CAAA;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAA;AAE5D;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB,CAAC,KAAK,SAAS,MAAM;IACzD,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IACzD,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IACpE,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAA;CACzC;AAED,eAAO,MAAM,0BAA0B,EAAE,cAAc,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAyC,CAAA"}

package/lib/plugins.api/index.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PluginStateRepositoryToken = void 0;
+exports.PluginStateRepositoryToken = Symbol('InjectPluginStateRepository');
+//# sourceMappingURL=index.js.map

package/lib/plugins.api/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/plugins.api/index.ts"],"names":[],"mappings":";;;AA6Da,QAAA,0BAA0B,GAA+C,MAAM,CAAC,6BAA6B,CAAC,CAAA"}

package/lib/plugins.api/plugins.api.db.d.ts

@@ -0,0 +1,7 @@
+import mongoose from 'mongoose';
+import { InjectionToken } from '.';
+export interface GetDbConnection {
+    (): Promise<mongoose.Connection>;
+}
+export declare const MongooseDbConnectionToken: InjectionToken<GetDbConnection>;
+//# sourceMappingURL=plugins.api.db.d.ts.map

package/lib/plugins.api/plugins.api.db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugins.api.db.d.ts","sourceRoot":"","sources":["../../src/plugins.api/plugins.api.db.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,GAAG,CAAA;AAElC,MAAM,WAAW,eAAe;IAC9B,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;CACjC;AAED,eAAO,MAAM,yBAAyB,EAAE,cAAc,CAAC,eAAe,CAAwC,CAAA"}

package/lib/plugins.api/plugins.api.db.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MongooseDbConnectionToken = void 0;
+exports.MongooseDbConnectionToken = Symbol('InjectMongooseDbConnection');
+//# sourceMappingURL=plugins.api.db.js.map

package/lib/plugins.api/plugins.api.db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugins.api.db.js","sourceRoot":"","sources":["../../src/plugins.api/plugins.api.db.ts"],"names":[],"mappings":";;;AAOa,QAAA,yBAAyB,GAAoC,MAAM,CAAC,4BAA4B,CAAC,CAAA"}