@rockster/core 0.0.2 → 0.1.0

package/access/services/scope-access.service.d.ts

@@ -0,0 +1,11 @@
+import { RepositoryService } from "../../database/services/repository.service";
+import { IScopeAccess } from "@rockster/common/access";
+import { Repository } from "../../database/interfaces/repository";
+export declare class ScopeAccessService extends RepositoryService<IScopeAccess> {
+    protected repository: Repository<IScopeAccess>;
+    protected noCtxQuery: string;
+    protected withCtxQuery: string;
+    getAllUserKeys(userId: string): Promise<string[]>;
+    getKeysWithCtx(contextId: string, userId: string): Promise<string[]>;
+    updateKeys(type: 'group' | 'user', contextName: string, contextId: string, targetId: string, keys: string[]): Promise<void>;
+}

package/access/services/scope-access.service.js

@@ -0,0 +1,89 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScopeAccessService = void 0;
+const class_injector_1 = require("@rockster/class-injector");
+const repository_service_1 = require("../../database/services/repository.service");
+const inject_repository_decorator_1 = require("../../database/decorators/inject-repository.decorator");
+const scope_access_1 = require("../entities/scope-access");
+const generate_entity_id_1 = require("../../database/functions/generate-entity-id");
+const normalize_scope_keys_1 = require("../functions/normalize-scope-keys");
+let ScopeAccessService = class ScopeAccessService extends repository_service_1.RepositoryService {
+    constructor() {
+        super(...arguments);
+        this.noCtxQuery = `
+   select distinct sa.key
+   from scope_access sa
+   where sa.key is not null
+     and sa.user_id = $1
+
+   union
+
+   select distinct sa.key
+   from scope_access sa
+   join scope_group_user sgu
+     on sgu.group_id = sa.group_id
+   where sa.key is not null
+     and sgu.user_id = $1;
+   `;
+        this.withCtxQuery = `
+   select distinct sa.key
+   from scope_access sa
+   where sa.key is not null
+     and sa.user_id = $1
+     and sa.context_id = $2
+
+   union
+
+   select distinct sa.key
+   from scope_access sa
+   join scope_group_user sgu
+     on sgu.group_id = sa.group_id
+   where sa.key is not null
+     and sgu.user_id = $1
+     and sa.context_id = $2;
+   `;
+    }
+    async getAllUserKeys(userId) {
+        const rows = await this.repository.query(this.noCtxQuery, [userId]);
+        return rows.map(r => r.k);
+    }
+    async getKeysWithCtx(contextId, userId) {
+        const rows = await this.repository.query(this.withCtxQuery, [userId, contextId]);
+        return rows.map(row => row.key);
+    }
+    async updateKeys(type, contextName, contextId, targetId, keys) {
+        const keyName = type === 'group' ? 'groupId' : 'userId';
+        await this.repository.delete({
+            [keyName]: targetId,
+            contextId,
+            contextName
+        });
+        const validKeys = (0, normalize_scope_keys_1.normalizeScopeKeys)(keys);
+        const accessKeys = validKeys.map(key => ({
+            id: (0, generate_entity_id_1.generateEntityId)(scope_access_1.ScopeAccess),
+            [keyName]: targetId,
+            contextName: contextName,
+            contextId: contextId,
+            key: key
+        }));
+        await this.repository.save(accessKeys);
+    }
+};
+exports.ScopeAccessService = ScopeAccessService;
+__decorate([
+    (0, inject_repository_decorator_1.InjectRepository)(() => scope_access_1.ScopeAccess),
+    __metadata("design:type", Object)
+], ScopeAccessService.prototype, "repository", void 0);
+exports.ScopeAccessService = ScopeAccessService = __decorate([
+    (0, class_injector_1.Injectable)()
+], ScopeAccessService);
+//# sourceMappingURL=scope-access.service.js.map

package/access/services/scope-access.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-access.service.js","sourceRoot":"./","sources":["access/services/scope-access.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6DAAsD;AACtD,mFAA+E;AAE/E,uGAAyF;AAEzF,2DAAuD;AACvD,oFAA+E;AAC/E,4EAAuE;AAGhE,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,sCAA+B;IAAhE;;QAKM,eAAU,GAAG;;;;;;;;;;;;;;IActB,CAAC;QAEQ,iBAAY,GAAG;;;;;;;;;;;;;;;;IAgBxB,CAAC;IA+CL,CAAC;IA7CE,KAAK,CAAC,cAAc,CAAC,MAAc;QAChC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACrC,IAAI,CAAC,UAAU,EACf,CAAC,MAAM,CAAC,CACV,CAAC;QAEF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAa,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,SAAiB,EAAE,MAAc;QACnD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACrC,IAAI,CAAC,YAAY,EACjB,CAAC,MAAM,EAAE,SAAS,CAAC,CACrB,CAAC;QAEF,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAa,CAAA;IAC9C,CAAC;IAED,KAAK,CAAC,UAAU,CACb,IAAsB,EACtB,WAAmB,EACnB,SAAiB,EACjB,QAAgB,EAChB,IAAc;QAEd,MAAM,OAAO,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QAExD,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAC1B,CAAC,OAAO,CAAC,EAAE,QAAQ;YACnB,SAAS;YACT,WAAW;SACb,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,IAAA,yCAAkB,EAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtC,EAAE,EAAE,IAAA,qCAAgB,EAAC,0BAAW,CAAC;YACjC,CAAC,OAAO,CAAC,EAAE,QAAQ;YACnB,WAAW,EAAE,WAAW;YACxB,SAAS,EAAE,SAAS;YACpB,GAAG,EAAE,GAAG;SACO,CAAA,CAAC,CAAC;QAEpB,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;CACH,CAAA;AApFY,gDAAkB;AAGlB;IADT,IAAA,8CAAgB,EAAC,GAAG,EAAE,CAAC,0BAAW,CAAC;;sDACW;6BAHrC,kBAAkB;IAD9B,IAAA,2BAAU,GAAE;GACA,kBAAkB,CAoF9B"}

package/access/services/scope-group-user.service.d.ts

@@ -0,0 +1,8 @@
+import { RepositoryService } from "../../database/services/repository.service";
+import { IScopeGroupUser } from "@rockster/common/access";
+import { Repository } from "../../database/interfaces/repository";
+export declare class ScopeGroupUserService extends RepositoryService<IScopeGroupUser> {
+    protected repository: Repository<IScopeGroupUser>;
+    addIfNotExists(groupId: string, userId: string): Promise<IScopeGroupUser>;
+    byContext(userId: string, contextName: string, contextId?: string): Promise<IScopeGroupUser[]>;
+}

package/access/services/scope-group-user.service.js

@@ -0,0 +1,49 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScopeGroupUserService = void 0;
+const class_injector_1 = require("@rockster/class-injector");
+const repository_service_1 = require("../../database/services/repository.service");
+const inject_repository_decorator_1 = require("../../database/decorators/inject-repository.decorator");
+const scope_group_user_1 = require("../entities/scope-group-user");
+const generate_entity_id_1 = require("../../database/functions/generate-entity-id");
+const scope_group_1 = require("../entities/scope-group");
+let ScopeGroupUserService = class ScopeGroupUserService extends repository_service_1.RepositoryService {
+    async addIfNotExists(groupId, userId) {
+        const groupUser = await this.repository.findOneBy({ groupId, userId });
+        if (groupUser)
+            return groupUser;
+        return this.repository.save({
+            id: (0, generate_entity_id_1.generateEntityId)(scope_group_user_1.ScopeGroupUser),
+            groupId: groupId,
+            userId: userId
+        });
+    }
+    async byContext(userId, contextName, contextId) {
+        return this
+            .repository
+            .createQueryBuilder('scopeGroupUser')
+            .leftJoin(scope_group_1.ScopeGroup, 'scopeGroup', '"scopeGroup".id = "scopeGroupUser".group_id')
+            .where(`"scopeGroup".context_name = '${contextName}' 
+            AND "scopeGroupUser".user_id = '${userId}'
+            ${!contextId ? '' : `AND "scopeGroup".context_id = '${contextId}'`}`)
+            .getMany();
+    }
+};
+exports.ScopeGroupUserService = ScopeGroupUserService;
+__decorate([
+    (0, inject_repository_decorator_1.InjectRepository)(() => scope_group_user_1.ScopeGroupUser),
+    __metadata("design:type", Object)
+], ScopeGroupUserService.prototype, "repository", void 0);
+exports.ScopeGroupUserService = ScopeGroupUserService = __decorate([
+    (0, class_injector_1.Injectable)()
+], ScopeGroupUserService);
+//# sourceMappingURL=scope-group-user.service.js.map

package/access/services/scope-group-user.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-group-user.service.js","sourceRoot":"./","sources":["access/services/scope-group-user.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6DAAsD;AACtD,mFAA+E;AAE/E,uGAAyF;AAEzF,mEAA8D;AAC9D,oFAA+E;AAC/E,yDAAqD;AAG9C,IAAM,qBAAqB,GAA3B,MAAM,qBAAsB,SAAQ,sCAAkC;IAK1E,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,MAAc;QACjD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACvE,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QAChC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YACzB,EAAE,EAAE,IAAA,qCAAgB,EAAC,iCAAc,CAAC;YACpC,OAAO,EAAE,OAAO;YAChB,MAAM,EAAE,MAAM;SAChB,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,WAAmB,EAAE,SAAkB;QACpE,OAAO,IAAI;aACP,UAAU;aACV,kBAAkB,CAAC,gBAAgB,CAAC;aACpC,QAAQ,CACN,wBAAU,EACV,YAAY,EACZ,6CAA6C,CAC/C;aACA,KAAK,CAAC,gCAAgC,WAAW;8CACb,MAAM;cACtC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kCAAkC,SAAS,GAAG,EAAE,CAAC;aACvE,OAAO,EAAE,CAAC;IACjB,CAAC;CACH,CAAA;AA7BY,sDAAqB;AAGrB;IADT,IAAA,8CAAgB,EAAC,GAAG,EAAE,CAAC,iCAAc,CAAC;;yDACW;gCAHxC,qBAAqB;IADjC,IAAA,2BAAU,GAAE;GACA,qBAAqB,CA6BjC"}

package/access/services/scope-group.service.d.ts

@@ -0,0 +1,17 @@
+import { RepositoryService } from "../../database/services/repository.service";
+import { IScopeGroup } from "@rockster/common/access";
+import { Repository } from "../../database/interfaces/repository";
+import { ScopeAccessProfileService } from "./scope-access-profile.service";
+import { ScopeAccessService } from "./scope-access.service";
+export declare class ScopeGroupService extends RepositoryService<IScopeGroup> {
+    protected readonly scopeAccessProfileService: ScopeAccessProfileService;
+    protected readonly scopeAccessService: ScopeAccessService;
+    protected repository: Repository<IScopeGroup>;
+    constructor(scopeAccessProfileService: ScopeAccessProfileService, scopeAccessService: ScopeAccessService);
+    /**
+     * Applies the group's linked access profile keys for the given context
+     * (filtered by scope_key.context_name), merging with existing group keys.
+     */
+    applyAccessProfileToGroupContext(groupId: string, contextName: string, contextId: string): Promise<string[]>;
+    getUserGroups(userId: string, contextName: string, contextId?: string): Promise<IScopeGroup[]>;
+}

package/access/services/scope-group.service.js

@@ -0,0 +1,75 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScopeGroupService = void 0;
+const class_injector_1 = require("@rockster/class-injector");
+const repository_service_1 = require("../../database/services/repository.service");
+const inject_repository_decorator_1 = require("../../database/decorators/inject-repository.decorator");
+const scope_group_1 = require("../entities/scope-group");
+const scope_group_user_1 = require("../entities/scope-group-user");
+const scope_access_profile_service_1 = require("./scope-access-profile.service");
+const scope_access_service_1 = require("./scope-access.service");
+const normalize_scope_keys_1 = require("../functions/normalize-scope-keys");
+let ScopeGroupService = class ScopeGroupService extends repository_service_1.RepositoryService {
+    constructor(scopeAccessProfileService, scopeAccessService) {
+        super();
+        this.scopeAccessProfileService = scopeAccessProfileService;
+        this.scopeAccessService = scopeAccessService;
+    }
+    /**
+     * Applies the group's linked access profile keys for the given context
+     * (filtered by scope_key.context_name), merging with existing group keys.
+     */
+    async applyAccessProfileToGroupContext(groupId, contextName, contextId) {
+        const group = await this.repository.findOneBy({ id: groupId });
+        if (!group?.scopeAccessProfileId) {
+            return [];
+        }
+        const profileKeys = await this.scopeAccessProfileService.getKeysForContext(group.scopeAccessProfileId, contextName);
+        if (!profileKeys.length) {
+            return [];
+        }
+        const existingRows = await this.scopeAccessService.getMany({
+            where: {
+                groupId,
+                contextName,
+                contextId,
+            },
+        });
+        const existingKeys = existingRows
+            .map((row) => row.key)
+            .filter((key) => Boolean(key));
+        const mergedKeys = (0, normalize_scope_keys_1.normalizeScopeKeys)([...existingKeys, ...profileKeys]);
+        await this.scopeAccessService.updateKeys("group", contextName, contextId, groupId, mergedKeys);
+        return mergedKeys;
+    }
+    async getUserGroups(userId, contextName, contextId) {
+        return this
+            .repository
+            .createQueryBuilder('scopeGroup')
+            .leftJoin(scope_group_user_1.ScopeGroupUser, 'scopeGroupUser', '"scopeGroup".id = "scopeGroupUser".group_id')
+            .where(`"scopeGroupUser".user_id = '${userId}'
+            AND "scopeGroup".context_name = '${contextName}'
+            ${!contextId ? '' : `AND "scopeGroup".context_id = '${contextId}'`}`)
+            .getMany();
+    }
+};
+exports.ScopeGroupService = ScopeGroupService;
+__decorate([
+    (0, inject_repository_decorator_1.InjectRepository)(() => scope_group_1.ScopeGroup),
+    __metadata("design:type", Object)
+], ScopeGroupService.prototype, "repository", void 0);
+exports.ScopeGroupService = ScopeGroupService = __decorate([
+    (0, class_injector_1.Injectable)(),
+    __metadata("design:paramtypes", [scope_access_profile_service_1.ScopeAccessProfileService,
+        scope_access_service_1.ScopeAccessService])
+], ScopeGroupService);
+//# sourceMappingURL=scope-group.service.js.map

package/access/services/scope-group.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-group.service.js","sourceRoot":"./","sources":["access/services/scope-group.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6DAAsD;AACtD,mFAA+E;AAE/E,uGAAyF;AAEzF,yDAAqD;AACrD,mEAA8D;AAC9D,iFAA2E;AAC3E,iEAA4D;AAC5D,4EAAuE;AAGhE,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,sCAA8B;IAKlE,YACsB,yBAAoD,EACpD,kBAAsC;QAEzD,KAAK,EAAE,CAAC;QAHW,8BAAyB,GAAzB,yBAAyB,CAA2B;QACpD,uBAAkB,GAAlB,kBAAkB,CAAoB;IAG5D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gCAAgC,CACnC,OAAe,EACf,WAAmB,EACnB,SAAiB;QAEjB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,EAAE,oBAAoB,EAAE,CAAC;YAChC,OAAO,EAAE,CAAC;QACb,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CACvE,KAAK,CAAC,oBAAoB,EAC1B,WAAW,CACb,CAAC;QAEF,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YACvB,OAAO,EAAE,CAAC;QACb,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;YACxD,KAAK,EAAE;gBACJ,OAAO;gBACP,WAAW;gBACX,SAAS;aACX;SACH,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,YAAY;aAC7B,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;aACrB,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAEjD,MAAM,UAAU,GAAG,IAAA,yCAAkB,EAAC,CAAC,GAAG,YAAY,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC;QAEzE,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CACrC,OAAO,EACP,WAAW,EACX,SAAS,EACT,OAAO,EACP,UAAU,CACZ,CAAC;QAEF,OAAO,UAAU,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,WAAmB,EAAE,SAAkB;QACxE,OAAO,IAAI;aACP,UAAU;aACV,kBAAkB,CAAC,YAAY,CAAC;aAChC,QAAQ,CACN,iCAAc,EACd,gBAAgB,EAChB,6CAA6C,CAC/C;aACA,KAAK,CAAC,+BAA+B,MAAM;+CACN,WAAW;cAC5C,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kCAAkC,SAAS,GAAG,EAAE,CAAC;aACvE,OAAO,EAAE,CAAC;IACjB,CAAC;CACH,CAAA;AA1EY,8CAAiB;AAGjB;IADT,IAAA,8CAAgB,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;;qDACW;4BAHpC,iBAAiB;IAD7B,IAAA,2BAAU,GAAE;qCAOuC,wDAAyB;QAChC,yCAAkB;GAPlD,iBAAiB,CA0E7B"}

package/access/services/scope-key.service.d.ts

@@ -0,0 +1,9 @@
+import { ScopeKey } from "../entities/scope-key";
+import { RepositoryService } from "../../database/services/repository.service";
+import { Repository } from "../../database/interfaces/repository";
+import { Logger } from "@rockster/logger";
+export declare class ScopeKeyService extends RepositoryService<ScopeKey> {
+    protected logger: Logger;
+    protected repository: Repository<ScopeKey>;
+    updateAll(): Promise<void>;
+}

package/access/services/scope-key.service.js

@@ -0,0 +1,52 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScopeKeyService = void 0;
+const class_injector_1 = require("@rockster/class-injector");
+const scope_key_1 = require("../entities/scope-key");
+const repository_service_1 = require("../../database/services/repository.service");
+const inject_repository_decorator_1 = require("../../database/decorators/inject-repository.decorator");
+const env_1 = require("../env");
+const logger_1 = require("@rockster/logger");
+let ScopeKeyService = class ScopeKeyService extends repository_service_1.RepositoryService {
+    constructor() {
+        super(...arguments);
+        this.logger = new logger_1.Logger('Access');
+    }
+    async updateAll() {
+        const scopes = env_1.env.scopesKeys.entries();
+        for (const [name, keys] of scopes) {
+            for (const key of keys) {
+                const exists = await this
+                    .repository
+                    .findOneBy({
+                    contextName: name,
+                    name: key.name
+                });
+                if (!exists)
+                    await this.repository.save({
+                        contextName: name,
+                        name: key.name
+                    });
+            }
+            this.logger.log(`Scope [${name}] keys successfully updated`);
+        }
+    }
+};
+exports.ScopeKeyService = ScopeKeyService;
+__decorate([
+    (0, inject_repository_decorator_1.InjectRepository)(() => scope_key_1.ScopeKey),
+    __metadata("design:type", Object)
+], ScopeKeyService.prototype, "repository", void 0);
+exports.ScopeKeyService = ScopeKeyService = __decorate([
+    (0, class_injector_1.Injectable)()
+], ScopeKeyService);
+//# sourceMappingURL=scope-key.service.js.map

package/access/services/scope-key.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-key.service.js","sourceRoot":"./","sources":["access/services/scope-key.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6DAAsD;AACtD,qDAAiD;AACjD,mFAA+E;AAC/E,uGAAyF;AAEzF,gCAA6B;AAC7B,6CAA0C;AAGnC,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,sCAA2B;IAAzD;;QAEM,WAAM,GAAG,IAAI,eAAM,CAAC,QAAQ,CAAC,CAAC;IA8B3C,CAAC;IAzBE,KAAK,CAAC,SAAS;QACZ,MAAM,MAAM,GAAG,SAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAExC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC;YAEjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBAEtB,MAAM,MAAM,GAAG,MAAM,IAAI;qBACrB,UAAU;qBACV,SAAS,CAAC;oBACR,WAAW,EAAE,IAAI;oBACjB,IAAI,EAAE,GAAG,CAAC,IAAI;iBAChB,CAAC,CAAC;gBAEN,IAAI,CAAC,MAAM;oBAER,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;wBACxB,WAAW,EAAE,IAAI;wBACjB,IAAI,EAAE,GAAG,CAAC,IAAI;qBAChB,CAAC,CAAA;YACR,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,6BAA6B,CAAC,CAAC;QAChE,CAAC;IACJ,CAAC;CACH,CAAA;AAhCY,0CAAe;AAKf;IADT,IAAA,8CAAgB,EAAC,GAAG,EAAE,CAAC,oBAAQ,CAAC;;mDACU;0BALjC,eAAe;IAD3B,IAAA,2BAAU,GAAE;GACA,eAAe,CAgC3B"}

package/access/services/scope-owner.service.d.ts

@@ -0,0 +1,10 @@
+import { RepositoryService } from "../../database/services/repository.service";
+import { IScopeOwner } from "@rockster/common/access";
+import { Repository } from "../../database/interfaces/repository";
+export declare class ScopeOwnerService extends RepositoryService<IScopeOwner> {
+    protected repository: Repository<IScopeOwner>;
+    getIsOwner(contextName: string, userId: string, contextId?: string): Promise<boolean>;
+    findOwnerUserIds(contextName: string, contextId: string | undefined, userIds: string[]): Promise<Set<string>>;
+    /** True when the user owns any context (used to gate global IAM resources). */
+    getHasAnyOwnership(userId: string): Promise<boolean>;
+}

package/access/services/scope-owner.service.js

@@ -0,0 +1,60 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScopeOwnerService = void 0;
+const class_injector_1 = require("@rockster/class-injector");
+const repository_service_1 = require("../../database/services/repository.service");
+const inject_repository_decorator_1 = require("../../database/decorators/inject-repository.decorator");
+const scope_owner_1 = require("../entities/scope-owner");
+const typeorm_1 = require("typeorm");
+let ScopeOwnerService = class ScopeOwnerService extends repository_service_1.RepositoryService {
+    async getIsOwner(contextName, userId, contextId) {
+        const normalizedContextId = contextId == null || contextId === "" ? undefined : contextId;
+        const exists = await this.repository.findOneBy({
+            contextId: normalizedContextId,
+            contextName: contextName,
+            userId: userId
+        });
+        return !!exists;
+    }
+    async findOwnerUserIds(contextName, contextId, userIds) {
+        if (!userIds.length) {
+            return new Set();
+        }
+        const normalizedContextId = contextId == null || contextId === "" ? undefined : contextId;
+        const where = {
+            contextName,
+            userId: (0, typeorm_1.In)(userIds),
+        };
+        if (normalizedContextId != null) {
+            where.contextId = normalizedContextId;
+        }
+        const owners = await this.repository.find({
+            where,
+            select: ['userId'],
+        });
+        return new Set(owners.map((owner) => owner.userId));
+    }
+    /** True when the user owns any context (used to gate global IAM resources). */
+    async getHasAnyOwnership(userId) {
+        const exists = await this.repository.findOneBy({ userId });
+        return !!exists;
+    }
+};
+exports.ScopeOwnerService = ScopeOwnerService;
+__decorate([
+    (0, inject_repository_decorator_1.InjectRepository)(() => scope_owner_1.ScopeOwner),
+    __metadata("design:type", Object)
+], ScopeOwnerService.prototype, "repository", void 0);
+exports.ScopeOwnerService = ScopeOwnerService = __decorate([
+    (0, class_injector_1.Injectable)()
+], ScopeOwnerService);
+//# sourceMappingURL=scope-owner.service.js.map

package/access/services/scope-owner.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-owner.service.js","sourceRoot":"./","sources":["access/services/scope-owner.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6DAAsD;AACtD,mFAA+E;AAE/E,uGAAyF;AAEzF,yDAAqD;AACrD,qCAA6B;AAGtB,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,sCAA8B;IAKlE,KAAK,CAAC,UAAU,CACb,WAAmB,EACnB,MAAc,EACd,SAAkB;QAElB,MAAM,mBAAmB,GACtB,SAAS,IAAI,IAAI,IAAI,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAEjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAC5C,SAAS,EAAE,mBAAmB;YAC9B,WAAW,EAAE,WAAW;YACxB,MAAM,EAAE,MAAM;SAChB,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,MAAM,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,gBAAgB,CACnB,WAAmB,EACnB,SAA6B,EAC7B,OAAiB;QAEjB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,IAAI,GAAG,EAAE,CAAC;QACpB,CAAC;QAED,MAAM,mBAAmB,GACtB,SAAS,IAAI,IAAI,IAAI,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAEjE,MAAM,KAAK,GAA4B;YACpC,WAAW;YACX,MAAM,EAAE,IAAA,YAAE,EAAC,OAAO,CAAC;SACrB,CAAC;QAEF,IAAI,mBAAmB,IAAI,IAAI,EAAE,CAAC;YAC/B,KAAK,CAAC,SAAS,GAAG,mBAAmB,CAAC;QACzC,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YACvC,KAAK;YACL,MAAM,EAAE,CAAC,QAAQ,CAAC;SACpB,CAAC,CAAC;QAEH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,kBAAkB,CAAC,MAAc;QACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC,CAAC,MAAM,CAAC;IACnB,CAAC;CACH,CAAA;AAxDY,8CAAiB;AAGjB;IADT,IAAA,8CAAgB,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;;qDACW;4BAHpC,iBAAiB;IAD7B,IAAA,2BAAU,GAAE;GACA,iBAAiB,CAwD7B"}

package/access/services/scope-service.d.ts

@@ -0,0 +1,10 @@
+import { ScopeGroupUserService } from "./scope-group-user.service";
+import { ScopeAccessService } from "./scope-access.service";
+import { ScopeOwnerService } from "./scope-owner.service";
+export declare class ScopeService {
+    protected scopeGroupUserService: ScopeGroupUserService;
+    protected scopeAccessService: ScopeAccessService;
+    protected scopeOwnerService: ScopeOwnerService;
+    constructor(scopeGroupUserService: ScopeGroupUserService, scopeAccessService: ScopeAccessService, scopeOwnerService: ScopeOwnerService);
+    removeUser(userId: string, contextName: string, contextId?: string): Promise<void>;
+}

package/access/services/scope-service.js

@@ -0,0 +1,52 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScopeService = void 0;
+const class_injector_1 = require("@rockster/class-injector");
+const scope_group_user_service_1 = require("./scope-group-user.service");
+const scope_access_service_1 = require("./scope-access.service");
+const scope_owner_service_1 = require("./scope-owner.service");
+let ScopeService = class ScopeService {
+    constructor(scopeGroupUserService, scopeAccessService, scopeOwnerService) {
+        this.scopeGroupUserService = scopeGroupUserService;
+        this.scopeAccessService = scopeAccessService;
+        this.scopeOwnerService = scopeOwnerService;
+    }
+    async removeUser(userId, contextName, contextId) {
+        const groups = await this
+            .scopeGroupUserService
+            .byContext(userId, contextName, contextId);
+        await Promise.all(groups.map(async (group) => {
+            await this.scopeGroupUserService.removeBy({
+                groupId: group.groupId,
+                userId: group.userId
+            });
+        }));
+        await this.scopeOwnerService.removeBy({
+            contextName: contextName,
+            contextId: contextId,
+            userId: userId
+        });
+        await this.scopeAccessService.removeBy({
+            userId: userId,
+            contextId: contextId,
+            contextName: contextName
+        });
+    }
+};
+exports.ScopeService = ScopeService;
+exports.ScopeService = ScopeService = __decorate([
+    (0, class_injector_1.Injectable)(),
+    __metadata("design:paramtypes", [scope_group_user_service_1.ScopeGroupUserService,
+        scope_access_service_1.ScopeAccessService,
+        scope_owner_service_1.ScopeOwnerService])
+], ScopeService);
+//# sourceMappingURL=scope-service.js.map

package/access/services/scope-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-service.js","sourceRoot":"./","sources":["access/services/scope-service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6DAAsD;AACtD,yEAAmE;AACnE,iEAA4D;AAC5D,+DAA0D;AAGnD,IAAM,YAAY,GAAlB,MAAM,YAAY;IAEtB,YACa,qBAA4C,EAC5C,kBAAsC,EACtC,iBAAoC;QAFpC,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,sBAAiB,GAAjB,iBAAiB,CAAmB;IAC9C,CAAC;IAEJ,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,WAAmB,EAAE,SAAkB;QACrE,MAAM,MAAM,GAAG,MAAM,IAAI;aACrB,qBAAqB;aACrB,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QAE9C,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC1C,MAAM,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC;gBACvC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;aACtB,CAAC,CAAA;QACL,CAAC,CAAC,CAAC,CAAA;QAEH,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;YACnC,WAAW,EAAE,WAAW;YACxB,SAAS,EAAE,SAAS;YACpB,MAAM,EAAE,MAAM;SAChB,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC;YACpC,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,SAAS;YACpB,WAAW,EAAE,WAAW;SAC1B,CAAC,CAAA;IACL,CAAC;CACH,CAAA;AAhCY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,2BAAU,GAAE;qCAI0B,gDAAqB;QACxB,yCAAkB;QACnB,uCAAiB;GALvC,YAAY,CAgCxB"}

package/command/functions/execute-post.js

@@ -1,12 +1,9 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.executePost = void 0;
 const use_repository_1 = require("../../database/functions/use-repository");
 const common_1 = require("@rockster/common");
-const generate_id_1 = __importDefault(require("../../database/functions/generate-id"));
+const generate_entity_id_1 = require("../../database/functions/generate-entity-id");
 const deep_merge_keep_undefined_1 = require("../utils/deep-merge-keep-undefined");
 const transaction_context_1 = require("../../database/contexts/transaction-context");
 const executePost = async (content) => {
@@ -17,11 +14,12 @@ const executePost = async (content) => {
     const properties = core
         .storage
         .getProperties(content.target)
-        .filter((property) => !isNullOrEmpty(property.columnType)
-        || property.isRelation);
+        .filter((property) => (!isNullOrEmpty(property.columnType)
+        || property.isRelation)
+        && !property.isExternal);
     if (content.type === 'create') {
         if (!content.data[content.idProperty])
-            (0, generate_id_1.default)(repository.target, content.data);
+            content.data[content.idProperty] = (0, generate_entity_id_1.generateEntityId)(repository.target);
         return repository.save(content.data);
     }
     else {

package/command/functions/execute-post.js.map

@@ -1 +1 @@
-{"version":3,"file":"execute-post.js","sourceRoot":"./","sources":["command/functions/execute-post.ts"],"names":[],"mappings":";;;;;;AACA,4EAAwE;AACxE,6CAAmD;AACnD,uFAA8D;AAG9D,kFAA4E;AAC5E,qFAAsF;AAE/E,MAAM,WAAW,GAAG,KAAK,EAC7B,OAA6B,EAC9B,EAAE;IACD,MAAM,kBAAkB,GAAG,6CAAuB,CAAC,QAAQ,EAAE,CAAC;IAC9D,MAAM,UAAU,GAAG,kBAAkB,EAAE,aAAa;QACjD,CAAC,CAAC,kBAAkB,CAAC,aAAa,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC;QAChE,CAAC,CAAC,IAAA,8BAAa,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnC,MAAM,UAAU,GAAG,IAAI;SACnB,OAAO;SACP,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC;SAC7B,MAAM,CAAC,CAAC,QAAuC,EAAE,EAAE,CACjD,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC;WAChC,QAAQ,CAAC,UAAU,CACW,CAAC;IAExC,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;YAAE,IAAA,qBAAU,EAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACnF,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QAEL,MAAM,MAAM,GAAG,MAAM,UAAU;aAC3B,OAAO,CAAC;YACN,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,OAAO,EAAE;YAChD,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;SAC5D,CAAC,CAAC;QAEN,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO,UAAU,CAAC,IAAI,CAAC;gBACpB,GAAG,OAAO,CAAC,IAAI;gBACf,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,OAAO;aACvC,CAAC,CAAC;QACN,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,wBAAe,CAAC;gBACvB,OAAO,EAAE,kBAAkB,OAAO,CAAC,OAAO,YAAY;aACxD,CAAC,CAAC;QACN,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,kDAAsB,EAAS,MAAgB,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAE9E,MAAM,UAAU,CAAC,MAAM,CAAC;YACrB,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,OAAO;SACvC,EAAE,MAAM,CAAC,CAAC;QAEX,OAAO,MAAM,CAAC;IACjB,CAAC;AACJ,CAAC,CAAA;AAhDY,QAAA,WAAW,eAgDvB"}
+{"version":3,"file":"execute-post.js","sourceRoot":"./","sources":["command/functions/execute-post.ts"],"names":[],"mappings":";;;AACA,4EAAwE;AACxE,6CAAmD;AACnD,oFAA+E;AAG/E,kFAA4E;AAC5E,qFAAsF;AAE/E,MAAM,WAAW,GAAG,KAAK,EAC7B,OAA6B,EAC9B,EAAE;IACD,MAAM,kBAAkB,GAAG,6CAAuB,CAAC,QAAQ,EAAE,CAAC;IAC9D,MAAM,UAAU,GAAG,kBAAkB,EAAE,aAAa;QACjD,CAAC,CAAC,kBAAkB,CAAC,aAAa,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC;QAChE,CAAC,CAAC,IAAA,8BAAa,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnC,MAAM,UAAU,GAAG,IAAI;SACnB,OAAO;SACP,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC;SAC7B,MAAM,CAAC,CAAC,QAAuC,EAAE,EAAE,CACjD,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC;WACjC,QAAQ,CAAC,UAAU,CAAC;WACpB,CAAC,QAAQ,CAAC,UAAU,CACU,CAAC;IAExC,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAE7B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,IAAA,qCAAgB,EAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAE1E,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAExC,CAAC;SAAM,CAAC;QAEL,MAAM,MAAM,GAAG,MAAM,UAAU;aAC3B,OAAO,CAAC;YACN,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,OAAO,EAAE;YAChD,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;SAC5D,CAAC,CAAC;QAEN,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO,UAAU,CAAC,IAAI,CAAC;gBACpB,GAAG,OAAO,CAAC,IAAI;gBACf,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,OAAO;aACvC,CAAC,CAAC;QACN,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,wBAAe,CAAC;gBACvB,OAAO,EAAE,kBAAkB,OAAO,CAAC,OAAO,YAAY;aACxD,CAAC,CAAC;QACN,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,kDAAsB,EAAS,MAAgB,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAE9E,MAAM,UAAU,CAAC,MAAM,CAAC;YACrB,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,OAAO;SACvC,EAAE,MAAM,CAAC,CAAC;QAEX,OAAO,MAAM,CAAC;IACjB,CAAC;AACJ,CAAC,CAAA;AArDY,QAAA,WAAW,eAqDvB"}

package/command/services/post-action-builder.js

@@ -11,10 +11,13 @@ const class_injector_1 = require("@rockster/class-injector");
 const core_1 = require("../../core");
 const class_pipe_1 = require("@rockster/class-pipe");
 const interfaces_1 = require("../../controllers/interfaces");
+const resolve_action_transactional_1 = require("../../core/functions/resolve-action-transactional");
 const constants_1 = require("../constants");
 const constants_2 = require("../../controllers/constants");
 const database_1 = require("../../database");
-const use_protector_1 = require("../../database/functions/use-protector");
+const assert_scope_action_access_1 = require("../../access/functions/assert-scope-action-access");
+const warn_if_public_1 = require("../../access/functions/warn-if-public");
+const describe_action_scope_1 = require("../../access/functions/describe-action-scope");
 const constants_3 = require("../../web-socket/constants");
 const global_1 = require("../../global");
 const docs_1 = require("@rockster/common/docs");
@@ -39,6 +42,7 @@ let PostActionBuilder = class PostActionBuilder {
             const isSecure = !property.public;
             const name = property.name || property.propertyKey;
             const path = (0, core_1.getActionPath)(object.alias, name);
+            (0, warn_if_public_1.warnIfPublic)(path, property);
             this.beforeInterceptors[path] =
                 (0, core_1.createExecuteInterceptors)([core_1.commonInterceptor.onBeforeExecute], object, property);
             this.afterInterceptors[path] =
@@ -51,6 +55,7 @@ let PostActionBuilder = class PostActionBuilder {
                 path: path,
                 name: name,
                 secure: isSecure,
+                transactional: (0, resolve_action_transactional_1.resolveActionTransactional)(object, property),
                 execute: async (action, context) => {
                     return this
                         .execute(action, context, data.executors[name], property);
@@ -120,6 +125,8 @@ let PostActionBuilder = class PostActionBuilder {
             path: path,
             description: property.description,
             isSecure: isSecure,
+            authenticated: property.authenticated,
+            keys: (0, describe_action_scope_1.describeActionScopeKeys)(property),
             payload: property.data,
             response: property.data,
             hasResponse: true,
@@ -154,6 +161,19 @@ let PostActionBuilder = class PostActionBuilder {
         // End After Interceptor
     }
     async onBefore(pending, context, property) {
+        const groups = property.exposeGroups ?? [];
+        const payload = context.request[pending.requestRef];
+        const idProperty = (0, database_1.getIdProperty)(property.data);
+        const idValue = payload?.[idProperty.propertyKey];
+        const postType = !idValue ? 'create' : 'modify';
+        await (0, assert_scope_action_access_1.assertScopeActionAccess)({
+            property,
+            slot: postType === "create" ? "create" : "modify",
+            pending,
+            context,
+            postType,
+            entityId: idValue != null ? String(idValue) : undefined,
+        });
         // Before Validation Interceptor
         await this
             .beforeValidationInterceptors[pending.path]({
@@ -162,13 +182,7 @@ let PostActionBuilder = class PostActionBuilder {
             property: property
         });
         // End Before Validation Interceptor
-        const groups = property.exposeGroups ?? [];
-        const payload = context.request[pending.requestRef];
-        const idProperty = (0, database_1.getIdProperty)(property.data);
-        const idValue = payload[idProperty.propertyKey];
-        const postType = !idValue ? 'create' : 'modify';
         const sanitized = {};
-        const protector = (0, use_protector_1.useProtector)(property.data);
         const errors = await (0, class_pipe_1.validate)(property.data, payload, sanitized, {
             groups: postType === 'modify'
                 ? [global_1.actionGroups.modify, ...groups]
@@ -196,16 +210,6 @@ let PostActionBuilder = class PostActionBuilder {
             errors.target = pending.requestRef;
             throw errors;
         }
-        if (context.isAuthenticated && protector) {
-            if (postType === 'modify') {
-                await protector
-                    .canModify(context.session?.userId, payload, context.entityManager);
-            }
-            else {
-                await protector
-                    .canCreate(context.session?.userId, payload, context.entityManager);
-            }
-        }
         const postContent = {
             idProperty: idProperty.propertyKey,
             data: property.content?.strict