@rockster/core 0.0.4 → 0.1.1

package/access/controllers/scope-owner.controller.js

@@ -16,13 +16,20 @@ exports.ScopeOwnerController = void 0;
 const action_content_decorator_1 = require("../../controllers/decorators/actions/action-content.decorator");
 const action_decorator_1 = require("../../controllers/decorators/actions/action.decorator");
 const controller_decorator_1 = require("../../controllers/decorators/controller.decorator");
+const request_context_decorator_1 = require("../../controllers/decorators/request-context.decorator");
 const scope_owner_1 = require("../models/scope-owner");
 const scope_owner_service_1 = require("../services/scope-owner.service");
+const assert_context_admin_access_1 = require("../functions/assert-context-admin-access");
 let ScopeOwnerController = class ScopeOwnerController {
     constructor(scopeOwnerService) {
         this.scopeOwnerService = scopeOwnerService;
     }
-    async add(content) {
+    async add(content, requestContext) {
+        await (0, assert_context_admin_access_1.assertContextAdminAccess)({
+            contextName: content.contextName,
+            contextId: content.contextId,
+            userId: requestContext.session?.userId,
+        });
         const owner = await this.scopeOwnerService.getOneBy({
             contextName: content.contextName,
             contextId: content.contextId,
@@ -36,7 +43,12 @@ let ScopeOwnerController = class ScopeOwnerController {
             contextId: content.contextId
         });
     }
-    async remove(content) {
+    async remove(content, requestContext) {
+        await (0, assert_context_admin_access_1.assertContextAdminAccess)({
+            contextName: content.contextName,
+            contextId: content.contextId,
+            userId: requestContext.session?.userId,
+        });
         await this.scopeOwnerService.removeBy({
             contextId: content.contextId,
             contextName: content.contextName,
@@ -48,15 +60,17 @@ exports.ScopeOwnerController = ScopeOwnerController;
 __decorate([
     (0, action_decorator_1.Action)(),
     __param(0, (0, action_content_decorator_1.ActionContent)()),
+    __param(1, (0, request_context_decorator_1.RequestContext)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [scope_owner_1.ScopeOwner]),
+    __metadata("design:paramtypes", [scope_owner_1.ScopeOwner, Object]),
     __metadata("design:returntype", Promise)
 ], ScopeOwnerController.prototype, "add", null);
 __decorate([
     (0, action_decorator_1.Action)(),
     __param(0, (0, action_content_decorator_1.ActionContent)()),
+    __param(1, (0, request_context_decorator_1.RequestContext)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [scope_owner_1.ScopeOwner]),
+    __metadata("design:paramtypes", [scope_owner_1.ScopeOwner, Object]),
     __metadata("design:returntype", Promise)
 ], ScopeOwnerController.prototype, "remove", null);
 exports.ScopeOwnerController = ScopeOwnerController = __decorate([

package/access/controllers/scope-owner.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-owner.controller.js","sourceRoot":"./","sources":["access/controllers/scope-owner.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,4GAA8F;AAC9F,4FAA+E;AAC/E,4FAA+E;AAC/E,uDAAmD;AACnD,yEAAoE;AAG7D,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAE9B,YAA+B,iBAAoC;QAApC,sBAAiB,GAAjB,iBAAiB,CAAmB;IAAG,CAAC;IAGjE,AAAN,KAAK,CAAC,GAAG,CAAkB,OAAmB;QAC3C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;YACjD,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;SACxB,CAAC,CAAC;QAEH,IAAI,KAAK;YAAE,OAAO;QAElB,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;YAC/B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,OAAO,CAAC,SAAS;SAC9B,CAAC,CAAC;IACN,CAAC;IAGK,AAAN,KAAK,CAAC,MAAM,CAAkB,OAAmB;QAC9C,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;YACnC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM;SACxB,CAAC,CAAC;IACN,CAAC;CACH,CAAA;AA7BY,oDAAoB;AAKxB;IADL,IAAA,yBAAM,GAAE;IACE,WAAA,IAAA,wCAAa,GAAE,CAAA;;qCAAU,wBAAU;;+CAc7C;AAGK;IADL,IAAA,yBAAM,GAAE;IACK,WAAA,IAAA,wCAAa,GAAE,CAAA;;qCAAU,wBAAU;;kDAMhD;+BA5BS,oBAAoB;IADhC,IAAA,iCAAU,GAAE;qCAGwC,uCAAiB;GAFzD,oBAAoB,CA6BhC"}
+{"version":3,"file":"scope-owner.controller.js","sourceRoot":"./","sources":["access/controllers/scope-owner.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,4GAA8F;AAC9F,4FAA+E;AAC/E,4FAA+E;AAC/E,sGAAwF;AAExF,uDAAmD;AACnD,yEAAoE;AACpE,0FAAoF;AAG7E,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAE9B,YAA+B,iBAAoC;QAApC,sBAAiB,GAAjB,iBAAiB,CAAmB;IAAG,CAAC;IAGjE,AAAN,KAAK,CAAC,GAAG,CACW,OAAmB,EAClB,cAA+B;QAEjD,MAAM,IAAA,sDAAwB,EAAC;YAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,cAAc,CAAC,OAAO,EAAE,MAAM;SACxC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;YACjD,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;SACxB,CAAC,CAAC;QAEH,IAAI,KAAK;YAAE,OAAO;QAElB,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;YAC/B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,OAAO,CAAC,SAAS;SAC9B,CAAC,CAAC;IACN,CAAC;IAGK,AAAN,KAAK,CAAC,MAAM,CACQ,OAAmB,EAClB,cAA+B;QAEjD,MAAM,IAAA,sDAAwB,EAAC;YAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,cAAc,CAAC,OAAO,EAAE,MAAM;SACxC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;YACnC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM;SACxB,CAAC,CAAC;IACN,CAAC;CACH,CAAA;AA/CY,oDAAoB;AAKxB;IADL,IAAA,yBAAM,GAAE;IAEL,WAAA,IAAA,wCAAa,GAAE,CAAA;IACf,WAAA,IAAA,0CAAc,GAAE,CAAA;;qCADS,wBAAU;;+CAsBtC;AAGK;IADL,IAAA,yBAAM,GAAE;IAEL,WAAA,IAAA,wCAAa,GAAE,CAAA;IACf,WAAA,IAAA,0CAAc,GAAE,CAAA;;qCADS,wBAAU;;kDActC;+BA9CS,oBAAoB;IADhC,IAAA,iCAAU,GAAE;qCAGwC,uCAAiB;GAFzD,oBAAoB,CA+ChC"}

package/access/controllers/scope-user.controller.d.ts

@@ -1,4 +1,4 @@
-import { IRequestContext } from "../../core/interfaces/request-context";
+import { CurrentSession, IRequestContext } from "../../core/interfaces/request-context";
 import { ScopeKeysUpdate } from "../models/scope-keys-update";
 import { ScopeUser } from "../models/scope-user";
 import { ScopeAccessService } from "../services/scope-access.service";
@@ -10,5 +10,5 @@ export declare class ScopeUserController {
     protected readonly scopeGroupService: ScopeGroupService;
     constructor(scopeOwnerService: ScopeOwnerService, scopeAccessService: ScopeAccessService, scopeGroupService: ScopeGroupService);
     updateKeys(content: ScopeKeysUpdate, requestContext: IRequestContext): Promise<void>;
-    get(userId: string, contextName: string, contextId: string): Promise<ScopeUser>;
+    get(userId: string, contextName: string, contextId: string, session: CurrentSession): Promise<ScopeUser>;
 }

package/access/controllers/scope-user.controller.js

@@ -22,11 +22,14 @@ const from_query_decorator_1 = require("../../controllers/decorators/http-method
 const get_decorator_1 = require("../../controllers/decorators/http-methods/get.decorator");
 const response_type_decorator_1 = require("../../controllers/decorators/http-methods/response-type.decorator");
 const request_context_decorator_1 = require("../../controllers/decorators/request-context.decorator");
+const session_decorator_1 = require("../../controllers/decorators/session.decorator");
 const scope_keys_update_1 = require("../models/scope-keys-update");
 const scope_user_1 = require("../models/scope-user");
 const scope_access_service_1 = require("../services/scope-access.service");
 const scope_owner_service_1 = require("../services/scope-owner.service");
 const scope_group_service_1 = require("../services/scope-group.service");
+const normalize_scope_keys_1 = require("../functions/normalize-scope-keys");
+const assert_context_admin_access_1 = require("../functions/assert-context-admin-access");
 let ScopeUserController = class ScopeUserController {
     constructor(scopeOwnerService, scopeAccessService, scopeGroupService) {
         this.scopeOwnerService = scopeOwnerService;
@@ -39,12 +42,22 @@ let ScopeUserController = class ScopeUserController {
                 message: 'A user cannot edit their own permissions'
             });
         }
-        return this.scopeAccessService.updateKeys('user', content.contextName, content.contextId, content.targetId, content.keys);
+        await (0, assert_context_admin_access_1.assertContextAdminAccess)({
+            contextName: content.contextName,
+            contextId: content.contextId,
+            userId: requestContext.session?.userId,
+        });
+        return this.scopeAccessService.updateKeys('user', content.contextName, content.contextId, content.targetId, (0, normalize_scope_keys_1.normalizeScopeKeys)(content.keys));
     }
-    async get(userId, contextName, contextId) {
+    async get(userId, contextName, contextId, session) {
+        await (0, assert_context_admin_access_1.assertContextAdminAccess)({
+            contextName,
+            contextId,
+            userId: session?.userId,
+        });
         const isOwner = await this
             .scopeOwnerService
-            .getIsOwner(contextName, userId, !contextId ? null : contextId);
+            .getIsOwner(contextName, userId, contextId);
         const groups = await this
             .scopeGroupService
             .getUserGroups(userId, contextName, contextId);
@@ -62,7 +75,7 @@ let ScopeUserController = class ScopeUserController {
             userId: userId,
             contextId: contextId,
             groups: groups,
-            keys: keys,
+            keys: (0, normalize_scope_keys_1.filterScopeAccessRows)(keys),
             isOwner
         };
     }
@@ -82,8 +95,9 @@ __decorate([
     __param(0, (0, from_params_decorator_1.FromParams)('userId')),
     __param(1, (0, from_params_decorator_1.FromParams)('contextName')),
     __param(2, (0, from_query_decorator_1.FromQuery)('contextId')),
+    __param(3, (0, session_decorator_1.Session)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, String, String]),
+    __metadata("design:paramtypes", [String, String, String, Object]),
     __metadata("design:returntype", Promise)
 ], ScopeUserController.prototype, "get", null);
 exports.ScopeUserController = ScopeUserController = __decorate([

package/access/controllers/scope-user.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-user.controller.js","sourceRoot":"./","sources":["access/controllers/scope-user.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,6CAAkD;AAClD,4GAA8F;AAC9F,4FAA+E;AAC/E,4FAA+E;AAC/E,2GAA6F;AAC7F,yGAA2F;AAC3F,2FAA8E;AAC9E,+GAAiG;AACjG,sGAAwF;AAExF,mEAA8D;AAC9D,qDAAiD;AACjD,2EAAsE;AACtE,yEAAoE;AACpE,yEAAoE;AAG7D,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAE7B,YACsB,iBAAoC,EACpC,kBAAsC,EACtC,iBAAoC;QAFpC,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,sBAAiB,GAAjB,iBAAiB,CAAmB;IACvD,CAAC;IAGE,AAAN,KAAK,CAAC,UAAU,CACI,OAAwB,EACvB,cAA+B;QAEjD,IAAI,cAAc,CAAC,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,uBAAc,CAAC;gBACtB,OAAO,EAAE,0CAA0C;aACrD,CAAC,CAAC;QACN,CAAC;QAED,OAAO,IAAI,CAAC,kBAAkB,CAAC,UAAU,CACtC,MAAM,EACN,OAAO,CAAC,WAAW,EACnB,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,IAAI,CACd,CAAC;IACL,CAAC;IAIK,AAAN,KAAK,CAAC,GAAG,CACgB,MAAc,EACT,WAAmB,EACtB,SAAiB;QAEzC,MAAM,OAAO,GAAG,MAAM,IAAI;aACtB,iBAAiB;aACjB,UAAU,CACR,WAAW,EACX,MAAM,EACN,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAC/B,CAAC;QAEL,MAAM,MAAM,GAAG,MAAM,IAAI;aACrB,iBAAiB;aACjB,aAAa,CACX,MAAM,EACN,WAAW,EACX,SAAS,CACX,CAAC;QAEL,MAAM,IAAI,GAAG,MAAM,IAAI;aACnB,kBAAkB;aAClB,OAAO,CAAC;YACN,KAAK,EAAE;gBACJ,SAAS,EAAE,SAAS;gBACpB,WAAW,EAAE,WAAW;gBACxB,MAAM,EAAE,MAAM;aAChB;SACH,CAAC,CAAC;QAEN,OAAO;YACJ,WAAW,EAAE,WAAW;YACxB,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,SAAS;YACpB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI;YACV,OAAO;SACI,CAAC;IAClB,CAAC;CACH,CAAA;AAtEY,kDAAmB;AASvB;IADL,IAAA,yBAAM,GAAE;IAEL,WAAA,IAAA,wCAAa,GAAE,CAAA;IACf,WAAA,IAAA,0CAAc,GAAE,CAAA;;qCADS,mCAAe;;qDAgB3C;AAIK;IAFL,IAAA,sCAAY,EAAC,GAAG,EAAE,CAAC,sBAAS,CAAC;IAC7B,IAAA,mBAAG,EAAC,8BAA8B,CAAC;IAEhC,WAAA,IAAA,kCAAU,EAAC,QAAQ,CAAC,CAAA;IACpB,WAAA,IAAA,kCAAU,EAAC,aAAa,CAAC,CAAA;IACzB,WAAA,IAAA,gCAAS,EAAC,WAAW,CAAC,CAAA;;;;8CAoCzB;8BArES,mBAAmB;IAD/B,IAAA,iCAAU,GAAE;qCAI+B,uCAAiB;QAChB,yCAAkB;QACnB,uCAAiB;GALhD,mBAAmB,CAsE/B"}
+{"version":3,"file":"scope-user.controller.js","sourceRoot":"./","sources":["access/controllers/scope-user.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,6CAAkD;AAClD,4GAA8F;AAC9F,4FAA+E;AAC/E,4FAA+E;AAC/E,2GAA6F;AAC7F,yGAA2F;AAC3F,2FAA8E;AAC9E,+GAAiG;AACjG,sGAAwF;AACxF,sFAAyE;AAEzE,mEAA8D;AAC9D,qDAAiD;AACjD,2EAAsE;AACtE,yEAAoE;AACpE,yEAAoE;AACpE,4EAG2C;AAC3C,0FAAoF;AAG7E,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAE7B,YACsB,iBAAoC,EACpC,kBAAsC,EACtC,iBAAoC;QAFpC,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,sBAAiB,GAAjB,iBAAiB,CAAmB;IACvD,CAAC;IAGE,AAAN,KAAK,CAAC,UAAU,CACI,OAAwB,EACvB,cAA+B;QAEjD,IAAI,cAAc,CAAC,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,uBAAc,CAAC;gBACtB,OAAO,EAAE,0CAA0C;aACrD,CAAC,CAAC;QACN,CAAC;QAED,MAAM,IAAA,sDAAwB,EAAC;YAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,cAAc,CAAC,OAAO,EAAE,MAAM;SACxC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,kBAAkB,CAAC,UAAU,CACtC,MAAM,EACN,OAAO,CAAC,WAAW,EACnB,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,QAAQ,EAChB,IAAA,yCAAkB,EAAC,OAAO,CAAC,IAAI,CAAC,CAClC,CAAC;IACL,CAAC;IAIK,AAAN,KAAK,CAAC,GAAG,CACgB,MAAc,EACT,WAAmB,EACtB,SAAiB,EAC9B,OAAuB;QAElC,MAAM,IAAA,sDAAwB,EAAC;YAC5B,WAAW;YACX,SAAS;YACT,MAAM,EAAE,OAAO,EAAE,MAAM;SACzB,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,IAAI;aACtB,iBAAiB;aACjB,UAAU,CACR,WAAW,EACX,MAAM,EACN,SAAS,CACX,CAAC;QAEL,MAAM,MAAM,GAAG,MAAM,IAAI;aACrB,iBAAiB;aACjB,aAAa,CACX,MAAM,EACN,WAAW,EACX,SAAS,CACX,CAAC;QAEL,MAAM,IAAI,GAAG,MAAM,IAAI;aACnB,kBAAkB;aAClB,OAAO,CAAC;YACN,KAAK,EAAE;gBACJ,SAAS,EAAE,SAAS;gBACpB,WAAW,EAAE,WAAW;gBACxB,MAAM,EAAE,MAAM;aAChB;SACH,CAAC,CAAC;QAEN,OAAO;YACJ,WAAW,EAAE,WAAW;YACxB,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,SAAS;YACpB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAA,4CAAqB,EAAC,IAAI,CAAC;YACjC,OAAO;SACI,CAAC;IAClB,CAAC;CACH,CAAA;AAnFY,kDAAmB;AASvB;IADL,IAAA,yBAAM,GAAE;IAEL,WAAA,IAAA,wCAAa,GAAE,CAAA;IACf,WAAA,IAAA,0CAAc,GAAE,CAAA;;qCADS,mCAAe;;qDAsB3C;AAIK;IAFL,IAAA,sCAAY,EAAC,GAAG,EAAE,CAAC,sBAAS,CAAC;IAC7B,IAAA,mBAAG,EAAC,8BAA8B,CAAC;IAEhC,WAAA,IAAA,kCAAU,EAAC,QAAQ,CAAC,CAAA;IACpB,WAAA,IAAA,kCAAU,EAAC,aAAa,CAAC,CAAA;IACzB,WAAA,IAAA,gCAAS,EAAC,WAAW,CAAC,CAAA;IACtB,WAAA,IAAA,2BAAO,GAAE,CAAA;;;;8CA0CZ;8BAlFS,mBAAmB;IAD/B,IAAA,iCAAU,GAAE;qCAI+B,uCAAiB;QAChB,yCAAkB;QACnB,uCAAiB;GALhD,mBAAmB,CAmF/B"}

package/access/decorators/context-params.decorator.d.ts

@@ -0,0 +1,2 @@
+/** Injects scope context resolve params for the current action. */
+export declare const ContextParams: () => (target: any, propertyKey: string, index: number) => void;

package/access/decorators/context-params.decorator.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ContextParams = void 0;
+const class_injector_1 = require("@rockster/class-injector");
+const constants_1 = require("../constants");
+/** Injects scope context resolve params for the current action. */
+const ContextParams = () => {
+    return (target, propertyKey, index) => {
+        (0, class_injector_1.Inject)(constants_1.SCOPE_CONTEXT_PARAMS_KEY)(target, propertyKey, index);
+    };
+};
+exports.ContextParams = ContextParams;
+//# sourceMappingURL=context-params.decorator.js.map

package/access/decorators/context-params.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-params.decorator.js","sourceRoot":"./","sources":["access/decorators/context-params.decorator.ts"],"names":[],"mappings":";;;AAAA,6DAAkD;AAClD,4CAAwD;AAExD,mEAAmE;AAC5D,MAAM,aAAa,GAAG,GAAG,EAAE;IAC/B,OAAO,CAAC,MAAM,EAAE,WAAmB,EAAE,KAAa,EAAE,EAAE;QACnD,IAAA,uBAAM,EAAC,oCAAwB,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC,CAAC;AACL,CAAC,CAAC;AAJW,QAAA,aAAa,iBAIxB"}

package/access/decorators/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./context-params.decorator";
+export * from "./scope-context-id-resolver.decorator";

package/access/decorators/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./context-params.decorator"), exports);
+__exportStar(require("./scope-context-id-resolver.decorator"), exports);
+//# sourceMappingURL=index.js.map

package/access/decorators/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"./","sources":["access/decorators/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6DAA2C;AAC3C,wEAAsD"}

package/access/decorators/scope-context-id-resolver.decorator.d.ts

@@ -0,0 +1,10 @@
+export type ScopeContextIdResolverOptions = {
+    /** Marks this method as the default resolver (resolveContextId). */
+    default?: boolean;
+};
+/**
+ * Marks a scope service method as a context id resolver.
+ * Executor name is always the method name (propertyKey).
+ * Use with @ContextParams() and optional action decorators (@QueryContent, @PostContent, …).
+ */
+export declare function ScopeContextIdResolver(options?: ScopeContextIdResolverOptions): (target: any, propertyKey: string) => void;

package/access/decorators/scope-context-id-resolver.decorator.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScopeContextIdResolver = ScopeContextIdResolver;
+const class_injector_1 = require("@rockster/class-injector");
+/**
+ * Marks a scope service method as a context id resolver.
+ * Executor name is always the method name (propertyKey).
+ * Use with @ContextParams() and optional action decorators (@QueryContent, @PostContent, …).
+ */
+function ScopeContextIdResolver(options) {
+    return (target, propertyKey) => {
+        (0, class_injector_1.markExecutable)(target, propertyKey);
+        const property = classInjector
+            .storage
+            .createProperty(target, propertyKey);
+        property.scopeContextIdResolver = true;
+        if (options?.default === true) {
+            property.defaultScopeContextIdResolver = true;
+        }
+    };
+}
+//# sourceMappingURL=scope-context-id-resolver.decorator.js.map

package/access/decorators/scope-context-id-resolver.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-context-id-resolver.decorator.js","sourceRoot":"./","sources":["access/decorators/scope-context-id-resolver.decorator.ts"],"names":[],"mappings":";;AAYA,wDAeC;AA3BD,6DAA0D;AAO1D;;;;GAIG;AACH,SAAgB,sBAAsB,CACnC,OAAuC;IAEvC,OAAO,CAAC,MAAM,EAAE,WAAmB,EAAE,EAAE;QACpC,IAAA,+BAAc,EAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,aAAa;aAC1B,OAAO;aACP,cAAc,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAExC,QAAQ,CAAC,sBAAsB,GAAG,IAAI,CAAC;QAEvC,IAAI,OAAO,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAC7B,QAAQ,CAAC,6BAA6B,GAAG,IAAI,CAAC;QACjD,CAAC;IACJ,CAAC,CAAC;AACL,CAAC"}

package/access/entities/entities.d.ts

@@ -1,6 +1,8 @@
 import { ScopeUserMapped } from "../models/scope-user-mapped";
 import { ScopeAccess } from "./scope-access";
+import { ScopeAccessProfile } from "./scope-access-profile";
+import { ScopeAccessProfileKey } from "./scope-access-profile-key";
 import { ScopeGroupUser } from "./scope-group-user";
 import { ScopeKey } from "./scope-key";
 import { ScopeOwner } from "./scope-owner";
-export declare const entities: (typeof ScopeKey | typeof ScopeAccess | typeof ScopeOwner | typeof ScopeUserMapped | typeof ScopeGroupUser)[];
+export declare const entities: (typeof ScopeKey | typeof ScopeAccessProfileKey | typeof ScopeAccessProfile | typeof ScopeAccess | typeof ScopeOwner | typeof ScopeUserMapped | typeof ScopeGroupUser)[];

package/access/entities/entities.js

@@ -3,12 +3,16 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.entities = void 0;
 const scope_user_mapped_1 = require("../models/scope-user-mapped");
 const scope_access_1 = require("./scope-access");
+const scope_access_profile_1 = require("./scope-access-profile");
+const scope_access_profile_key_1 = require("./scope-access-profile-key");
 const scope_group_1 = require("./scope-group");
 const scope_group_user_1 = require("./scope-group-user");
 const scope_key_1 = require("./scope-key");
 const scope_owner_1 = require("./scope-owner");
 exports.entities = [
     scope_access_1.ScopeAccess,
+    scope_access_profile_1.ScopeAccessProfile,
+    scope_access_profile_key_1.ScopeAccessProfileKey,
     scope_group_user_1.ScopeGroupUser,
     scope_group_1.ScopeGroup,
     scope_key_1.ScopeKey,

package/access/entities/entities.js.map

@@ -1 +1 @@
-{"version":3,"file":"entities.js","sourceRoot":"./","sources":["access/entities/entities.ts"],"names":[],"mappings":";;;AAAA,mEAA8D;AAC9D,iDAA6C;AAC7C,+CAA2C;AAC3C,yDAAoD;AACpD,2CAAuC;AACvC,+CAA2C;AAE9B,QAAA,QAAQ,GAAG;IACrB,0BAAW;IACX,iCAAc;IACd,wBAAU;IACV,oBAAQ;IACR,wBAAU;IACV,mCAAe;CACjB,CAAC"}
+{"version":3,"file":"entities.js","sourceRoot":"./","sources":["access/entities/entities.ts"],"names":[],"mappings":";;;AAAA,mEAA8D;AAC9D,iDAA6C;AAC7C,iEAA4D;AAC5D,yEAAmE;AACnE,+CAA2C;AAC3C,yDAAoD;AACpD,2CAAuC;AACvC,+CAA2C;AAE9B,QAAA,QAAQ,GAAG;IACrB,0BAAW;IACX,yCAAkB;IAClB,gDAAqB;IACrB,iCAAc;IACd,wBAAU;IACV,oBAAQ;IACR,wBAAU;IACV,mCAAe;CACjB,CAAC"}

package/access/entities/index.d.ts

@@ -1,4 +1,6 @@
 export * from './scope-access';
+export * from './scope-access-profile';
+export * from './scope-access-profile-key';
 export * from './scope-group-user';
 export * from './scope-group';
 export * from './scope-key';

package/access/entities/index.js

@@ -15,6 +15,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./scope-access"), exports);
+__exportStar(require("./scope-access-profile"), exports);
+__exportStar(require("./scope-access-profile-key"), exports);
 __exportStar(require("./scope-group-user"), exports);
 __exportStar(require("./scope-group"), exports);
 __exportStar(require("./scope-key"), exports);

package/access/entities/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"./","sources":["access/entities/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,qDAAmC;AACnC,gDAA8B;AAC9B,8CAA4B;AAC5B,gDAA8B"}
+{"version":3,"file":"index.js","sourceRoot":"./","sources":["access/entities/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,yDAAuC;AACvC,6DAA2C;AAC3C,qDAAmC;AACnC,gDAA8B;AAC9B,8CAA4B;AAC5B,gDAA8B"}

package/access/entities/scope-access-profile-key.d.ts

@@ -0,0 +1,6 @@
+import { IScopeAccessProfileKey } from "@rockster/common/access";
+import { BaseEntity } from "../../common/entities/base-entity";
+export declare class ScopeAccessProfileKey extends BaseEntity implements IScopeAccessProfileKey {
+    scopeAccessProfileId: string;
+    key?: string;
+}

package/access/entities/scope-access-profile-key.js

@@ -0,0 +1,40 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScopeAccessProfileKey = void 0;
+const base_entity_1 = require("../../common/entities/base-entity");
+const entity_decorator_1 = require("../../database/decorators/entity.decorator");
+const class_pipe_1 = require("@rockster/class-pipe");
+const relation_decorator_1 = require("../../database/decorators/relation.decorator");
+const scope_key_1 = require("./scope-key");
+const scope_access_profile_1 = require("./scope-access-profile");
+const typeorm_1 = require("typeorm");
+let ScopeAccessProfileKey = class ScopeAccessProfileKey extends base_entity_1.BaseEntity {
+};
+exports.ScopeAccessProfileKey = ScopeAccessProfileKey;
+__decorate([
+    (0, class_pipe_1.Expose)(),
+    (0, class_pipe_1.IsRequired)(),
+    (0, class_pipe_1.IsString)(),
+    (0, typeorm_1.Index)(),
+    (0, relation_decorator_1.Relation)(() => scope_access_profile_1.ScopeAccessProfile),
+    __metadata("design:type", String)
+], ScopeAccessProfileKey.prototype, "scopeAccessProfileId", void 0);
+__decorate([
+    (0, class_pipe_1.Expose)(),
+    (0, class_pipe_1.IsString)(),
+    (0, relation_decorator_1.Relation)(() => scope_key_1.ScopeKey, { nullable: true }),
+    __metadata("design:type", String)
+], ScopeAccessProfileKey.prototype, "key", void 0);
+exports.ScopeAccessProfileKey = ScopeAccessProfileKey = __decorate([
+    (0, entity_decorator_1.Entity)()
+], ScopeAccessProfileKey);
+//# sourceMappingURL=scope-access-profile-key.js.map

package/access/entities/scope-access-profile-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-access-profile-key.js","sourceRoot":"./","sources":["access/entities/scope-access-profile-key.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,mEAA+D;AAC/D,iFAAoE;AACpE,qDAAoE;AAEpE,qFAAwE;AACxE,2CAAuC;AACvC,iEAA4D;AAC5D,qCAAgC;AAGzB,IAAM,qBAAqB,GAA3B,MAAM,qBACV,SAAQ,wBAAU;CAepB,CAAA;AAhBY,sDAAqB;AAU/B;IALC,IAAA,mBAAM,GAAE;IACR,IAAA,uBAAU,GAAE;IACZ,IAAA,qBAAQ,GAAE;IACV,IAAA,eAAK,GAAE;IACP,IAAA,6BAAQ,EAAC,GAAG,EAAE,CAAC,yCAAkB,CAAC;;mEACN;AAK7B;IAHC,IAAA,mBAAM,GAAE;IACR,IAAA,qBAAQ,GAAE;IACV,IAAA,6BAAQ,EAAC,GAAG,EAAE,CAAC,oBAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;kDAChC;gCAfH,qBAAqB;IADjC,IAAA,yBAAM,GAAE;GACI,qBAAqB,CAgBjC"}

package/access/entities/scope-access-profile.d.ts

@@ -0,0 +1,6 @@
+import { IScopeAccessProfile, IScopeAccessProfileKey } from "@rockster/common/access";
+import { BaseEntity } from "../../common/entities/base-entity";
+export declare class ScopeAccessProfile extends BaseEntity implements IScopeAccessProfile {
+    name: string;
+    keys?: IScopeAccessProfileKey[];
+}

package/access/entities/scope-access-profile.js

@@ -0,0 +1,37 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScopeAccessProfile = void 0;
+const base_entity_1 = require("../../common/entities/base-entity");
+const entity_decorator_1 = require("../../database/decorators/entity.decorator");
+const column_decorator_1 = require("../../database/decorators/column.decorator");
+const class_pipe_1 = require("@rockster/class-pipe");
+const scope_access_profile_key_1 = require("./scope-access-profile-key");
+let ScopeAccessProfile = class ScopeAccessProfile extends base_entity_1.BaseEntity {
+};
+exports.ScopeAccessProfile = ScopeAccessProfile;
+__decorate([
+    (0, class_pipe_1.Expose)(),
+    (0, class_pipe_1.IsRequired)(),
+    (0, class_pipe_1.IsString)(),
+    (0, column_decorator_1.Column)(),
+    __metadata("design:type", String)
+], ScopeAccessProfile.prototype, "name", void 0);
+__decorate([
+    (0, class_pipe_1.Expose)(),
+    (0, class_pipe_1.IsArray)(),
+    (0, class_pipe_1.IsType)(() => scope_access_profile_key_1.ScopeAccessProfileKey),
+    __metadata("design:type", Array)
+], ScopeAccessProfile.prototype, "keys", void 0);
+exports.ScopeAccessProfile = ScopeAccessProfile = __decorate([
+    (0, entity_decorator_1.Entity)()
+], ScopeAccessProfile);
+//# sourceMappingURL=scope-access-profile.js.map

package/access/entities/scope-access-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-access-profile.js","sourceRoot":"./","sources":["access/entities/scope-access-profile.ts"],"names":[],"mappings":";;;;;;;;;;;;AAIA,mEAA+D;AAC/D,iFAAoE;AACpE,iFAAoE;AACpE,qDAM8B;AAC9B,yEAAmE;AAG5D,IAAM,kBAAkB,GAAxB,MAAM,kBACV,SAAQ,wBAAU;CAepB,CAAA;AAhBY,gDAAkB;AAS5B;IAJC,IAAA,mBAAM,GAAE;IACR,IAAA,uBAAU,GAAE;IACZ,IAAA,qBAAQ,GAAE;IACV,IAAA,yBAAM,GAAE;;gDACI;AAMb;IAHC,IAAA,mBAAM,GAAE;IACR,IAAA,oBAAO,GAAE;IACT,IAAA,mBAAM,EAAC,GAAG,EAAE,CAAC,gDAAqB,CAAC;;gDACJ;6BAftB,kBAAkB;IAD9B,IAAA,yBAAM,GAAE;GACI,kBAAkB,CAgB9B"}

package/access/entities/scope-group.d.ts

@@ -1,9 +1,12 @@
 import { IScopeAccess, IScopeGroup } from "@rockster/common/access";
 import { BaseEntity } from "../../common/entities/base-entity";
+import { ScopeAccessProfile } from "./scope-access-profile";
 export declare class ScopeGroup extends BaseEntity implements IScopeGroup {
     contextName: string;
     contextId?: string;
     isReadOnly?: boolean;
     name: string;
+    scopeAccessProfileId?: string;
     keys?: IScopeAccess[];
+    scopeAccessProfile?: ScopeAccessProfile;
 }

package/access/entities/scope-group.js

@@ -14,7 +14,9 @@ const base_entity_1 = require("../../common/entities/base-entity");
 const entity_decorator_1 = require("../../database/decorators/entity.decorator");
 const column_decorator_1 = require("../../database/decorators/column.decorator");
 const class_pipe_1 = require("@rockster/class-pipe");
+const relation_decorator_1 = require("../../database/decorators/relation.decorator");
 const scope_access_1 = require("./scope-access");
+const scope_access_profile_1 = require("./scope-access-profile");
 let ScopeGroup = class ScopeGroup extends base_entity_1.BaseEntity {
 };
 exports.ScopeGroup = ScopeGroup;
@@ -47,9 +49,23 @@ __decorate([
 ], ScopeGroup.prototype, "name", void 0);
 __decorate([
     (0, class_pipe_1.Expose)(),
+    (0, class_pipe_1.IsOptional)(),
+    (0, class_pipe_1.IsString)(),
+    (0, relation_decorator_1.Relation)(() => scope_access_profile_1.ScopeAccessProfile, { nullable: true }),
+    __metadata("design:type", String)
+], ScopeGroup.prototype, "scopeAccessProfileId", void 0);
+__decorate([
+    (0, class_pipe_1.Expose)(),
+    (0, class_pipe_1.IsArray)(),
     (0, class_pipe_1.IsType)(() => scope_access_1.ScopeAccess),
     __metadata("design:type", Array)
 ], ScopeGroup.prototype, "keys", void 0);
+__decorate([
+    (0, class_pipe_1.Expose)(),
+    (0, class_pipe_1.IsOptional)(),
+    (0, class_pipe_1.IsType)(() => scope_access_profile_1.ScopeAccessProfile),
+    __metadata("design:type", scope_access_profile_1.ScopeAccessProfile)
+], ScopeGroup.prototype, "scopeAccessProfile", void 0);
 exports.ScopeGroup = ScopeGroup = __decorate([
     (0, entity_decorator_1.Entity)()
 ], ScopeGroup);

package/access/entities/scope-group.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-group.js","sourceRoot":"./","sources":["access/entities/scope-group.ts"],"names":[],"mappings":";;;;;;;;;;;;AAIA,mEAA+D;AAC/D,iFAAoE;AACpE,iFAAoE;AACpE,qDAO8B;AAC9B,iDAA6C;AAGtC,IAAM,UAAU,GAAhB,MAAM,UACV,SAAQ,wBAAU;CA+BpB,CAAA;AAhCY,gCAAU;AASpB;IAJC,IAAA,mBAAM,GAAE;IACR,IAAA,uBAAU,GAAE;IACZ,IAAA,qBAAQ,GAAE;IACV,IAAA,yBAAM,GAAE;;+CACW;AAMpB;IAJC,IAAA,mBAAM,GAAE;IACR,IAAA,uBAAU,GAAE;IACZ,IAAA,qBAAQ,GAAE;IACV,IAAA,yBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;6CACR;AAKnB;IAHC,IAAA,mBAAM,GAAE;IACR,IAAA,sBAAS,GAAE;IACX,IAAA,yBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;8CACN;AAMrB;IAJC,IAAA,mBAAM,GAAE;IACR,IAAA,uBAAU,GAAE;IACZ,IAAA,qBAAQ,GAAE;IACV,IAAA,yBAAM,GAAE;;wCACI;AAKb;IAFC,IAAA,mBAAM,GAAE;IACR,IAAA,mBAAM,EAAC,GAAG,EAAE,CAAC,0BAAW,CAAC;;wCACJ;qBA/BZ,UAAU;IADtB,IAAA,yBAAM,GAAE;GACI,UAAU,CAgCtB"}
+{"version":3,"file":"scope-group.js","sourceRoot":"./","sources":["access/entities/scope-group.ts"],"names":[],"mappings":";;;;;;;;;;;;AAIA,mEAA+D;AAC/D,iFAAoE;AACpE,iFAAoE;AACpE,qDAQ8B;AAC9B,qFAAwE;AACxE,iDAA6C;AAC7C,iEAA4D;AAGrD,IAAM,UAAU,GAAhB,MAAM,UACV,SAAQ,wBAAU;CA2CpB,CAAA;AA5CY,gCAAU;AASpB;IAJC,IAAA,mBAAM,GAAE;IACR,IAAA,uBAAU,GAAE;IACZ,IAAA,qBAAQ,GAAE;IACV,IAAA,yBAAM,GAAE;;+CACW;AAMpB;IAJC,IAAA,mBAAM,GAAE;IACR,IAAA,uBAAU,GAAE;IACZ,IAAA,qBAAQ,GAAE;IACV,IAAA,yBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;6CACR;AAKnB;IAHC,IAAA,mBAAM,GAAE;IACR,IAAA,sBAAS,GAAE;IACX,IAAA,yBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;8CACN;AAMrB;IAJC,IAAA,mBAAM,GAAE;IACR,IAAA,uBAAU,GAAE;IACZ,IAAA,qBAAQ,GAAE;IACV,IAAA,yBAAM,GAAE;;wCACI;AAMb;IAJC,IAAA,mBAAM,GAAE;IACR,IAAA,uBAAU,GAAE;IACZ,IAAA,qBAAQ,GAAE;IACV,IAAA,6BAAQ,EAAC,GAAG,EAAE,CAAC,yCAAkB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;wDACzB;AAM9B;IAHC,IAAA,mBAAM,GAAE;IACR,IAAA,oBAAO,GAAE;IACT,IAAA,mBAAM,EAAC,GAAG,EAAE,CAAC,0BAAW,CAAC;;wCACJ;AAKtB;IAHC,IAAA,mBAAM,GAAE;IACR,IAAA,uBAAU,GAAE;IACZ,IAAA,mBAAM,EAAC,GAAG,EAAE,CAAC,yCAAkB,CAAC;8BACZ,yCAAkB;sDAAC;qBA3C9B,UAAU;IADtB,IAAA,yBAAM,GAAE;GACI,UAAU,CA4CtB"}

package/access/functions/assert-context-admin-access.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Gate for IAM-management actions (the access controllers: scope keys, groups,
+ * owners, access profiles). For the given context it requires the caller to be
+ * the **owner**, hold the context **admin** key, or hold the platform **master**
+ * key at the hierarchy root.
+ *
+ * Back-compat: a context that was NOT registered with an admin hierarchy
+ * (no `root` / `rootScope` / `adminKey` via `registerScope`) is left ungated, so
+ * apps that don't use this hierarchy keep their previous behavior.
+ */
+export declare function assertContextAdminAccess(options: {
+    contextName: string;
+    contextId?: string;
+    userId?: string;
+}): Promise<void>;

package/access/functions/assert-context-admin-access.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertContextAdminAccess = assertContextAdminAccess;
+const common_1 = require("@rockster/common");
+const env_1 = require("../env");
+const get_is_owner_1 = require("./get-is-owner");
+const get_user_keys_1 = require("./get-user-keys");
+/**
+ * Gate for IAM-management actions (the access controllers: scope keys, groups,
+ * owners, access profiles). For the given context it requires the caller to be
+ * the **owner**, hold the context **admin** key, or hold the platform **master**
+ * key at the hierarchy root.
+ *
+ * Back-compat: a context that was NOT registered with an admin hierarchy
+ * (no `root` / `rootScope` / `adminKey` via `registerScope`) is left ungated, so
+ * apps that don't use this hierarchy keep their previous behavior.
+ */
+async function assertContextAdminAccess(options) {
+    const { contextName, contextId, userId } = options;
+    const registry = env_1.env.scopeServiceRegistry.get(contextName);
+    const hasHierarchy = !!(registry?.adminKey || registry?.root || registry?.rootScope);
+    if (!hasHierarchy) {
+        return;
+    }
+    if (!userId) {
+        throw new common_1.UnauthorizedError();
+    }
+    // Owner of the context.
+    if (await (0, get_is_owner_1.getIsOwner)(contextName, userId, contextId)) {
+        return;
+    }
+    const userKeys = contextId
+        ? await (0, get_user_keys_1.getUserKeys)(userId, contextId)
+        : await (0, get_user_keys_1.getUserKeys)(userId);
+    // Context admin.
+    if (registry?.adminKey && userKeys.includes(registry.adminKey)) {
+        return;
+    }
+    // Platform master at the hierarchy root.
+    let rootContextId;
+    let masterKey;
+    if (registry?.root) {
+        rootContextId = contextId;
+        masterKey = registry.masterKey;
+    }
+    else if (registry?.rootScope) {
+        masterKey = env_1.env.scopeServiceRegistry.get(registry.rootScope)?.masterKey;
+        rootContextId = contextId
+            ? await registry.instance?.resolveRootContextId?.(contextId)
+            : undefined;
+    }
+    if (masterKey && rootContextId) {
+        const rootKeys = await (0, get_user_keys_1.getUserKeys)(userId, rootContextId);
+        if (rootKeys.includes(masterKey)) {
+            return;
+        }
+    }
+    throw new common_1.ForbiddenError({
+        message: "Requires owner, admin or master access for this context",
+    });
+}
+//# sourceMappingURL=assert-context-admin-access.js.map

package/access/functions/assert-context-admin-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assert-context-admin-access.js","sourceRoot":"./","sources":["access/functions/assert-context-admin-access.ts"],"names":[],"mappings":";;AAeA,4DAwDC;AAvED,6CAAqE;AACrE,gCAA6B;AAC7B,iDAA4C;AAC5C,mDAA8C;AAE9C;;;;;;;;;GASG;AACI,KAAK,UAAU,wBAAwB,CAAC,OAI9C;IACE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACnD,MAAM,QAAQ,GAAG,SAAG,CAAC,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAE3D,MAAM,YAAY,GAAG,CAAC,CAAC,CACpB,QAAQ,EAAE,QAAQ,IAAI,QAAQ,EAAE,IAAI,IAAI,QAAQ,EAAE,SAAS,CAC7D,CAAC;IACF,IAAI,CAAC,YAAY,EAAE,CAAC;QACjB,OAAO;IACV,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,0BAAiB,EAAE,CAAC;IACjC,CAAC;IAED,wBAAwB;IACxB,IAAI,MAAM,IAAA,yBAAU,EAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;QACpD,OAAO;IACV,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS;QACvB,CAAC,CAAC,MAAM,IAAA,2BAAW,EAAC,MAAM,EAAE,SAAS,CAAC;QACtC,CAAC,CAAC,MAAM,IAAA,2BAAW,EAAC,MAAM,CAAC,CAAC;IAE/B,iBAAiB;IACjB,IAAI,QAAQ,EAAE,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,OAAO;IACV,CAAC;IAED,yCAAyC;IACzC,IAAI,aAAiC,CAAC;IACtC,IAAI,SAA6B,CAAC;IAClC,IAAI,QAAQ,EAAE,IAAI,EAAE,CAAC;QAClB,aAAa,GAAG,SAAS,CAAC;QAC1B,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IAClC,CAAC;SAAM,IAAI,QAAQ,EAAE,SAAS,EAAE,CAAC;QAC9B,SAAS,GAAG,SAAG,CAAC,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;QACxE,aAAa,GAAG,SAAS;YACtB,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,EAAE,CAAC,SAAS,CAAC;YAC5D,CAAC,CAAC,SAAS,CAAC;IAClB,CAAC;IAED,IAAI,SAAS,IAAI,aAAa,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,IAAA,2BAAW,EAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAC1D,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,OAAO;QACV,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,uBAAc,CAAC;QACtB,OAAO,EAAE,yDAAyD;KACpE,CAAC,CAAC;AACN,CAAC"}

package/access/functions/assert-master-or-owner.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Gate for GLOBAL IAM resources that have no context (e.g. access profiles).
+ * Allows the platform **master** (holds any registered master key, granted at
+ * any context) or any **owner**. Context admins do NOT pass.
+ *
+ * Back-compat: if no scope registered a master key, the master branch is simply
+ * skipped — only owners pass.
+ */
+export declare function assertMasterOrOwner(userId?: string): Promise<void>;

package/access/functions/assert-master-or-owner.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertMasterOrOwner = assertMasterOrOwner;
+const common_1 = require("@rockster/common");
+const env_1 = require("../env");
+const get_user_keys_1 = require("./get-user-keys");
+/**
+ * Gate for GLOBAL IAM resources that have no context (e.g. access profiles).
+ * Allows the platform **master** (holds any registered master key, granted at
+ * any context) or any **owner**. Context admins do NOT pass.
+ *
+ * Back-compat: if no scope registered a master key, the master branch is simply
+ * skipped — only owners pass.
+ */
+async function assertMasterOrOwner(userId) {
+    if (!userId) {
+        throw new common_1.UnauthorizedError();
+    }
+    // Master: holds any registered master key.
+    const masterKeys = new Set();
+    for (const registry of env_1.env.scopeServiceRegistry.values()) {
+        if (registry.masterKey) {
+            masterKeys.add(registry.masterKey);
+        }
+    }
+    if (masterKeys.size > 0) {
+        const userKeys = await (0, get_user_keys_1.getUserKeys)(userId);
+        if (userKeys.some((key) => masterKeys.has(key))) {
+            return;
+        }
+    }
+    // Owner of any context.
+    if (await env_1.env.scopeOwnerService.getHasAnyOwnership(userId)) {
+        return;
+    }
+    throw new common_1.ForbiddenError({
+        message: "Requires master or owner access",
+    });
+}
+//# sourceMappingURL=assert-master-or-owner.js.map

package/access/functions/assert-master-or-owner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assert-master-or-owner.js","sourceRoot":"./","sources":["access/functions/assert-master-or-owner.ts"],"names":[],"mappings":";;AAYA,kDA2BC;AAvCD,6CAAqE;AACrE,gCAA6B;AAC7B,mDAA8C;AAE9C;;;;;;;GAOG;AACI,KAAK,UAAU,mBAAmB,CAAC,MAAe;IACtD,IAAI,CAAC,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,0BAAiB,EAAE,CAAC;IACjC,CAAC;IAED,2CAA2C;IAC3C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,QAAQ,IAAI,SAAG,CAAC,oBAAoB,CAAC,MAAM,EAAE,EAAE,CAAC;QACxD,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YACtB,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACtC,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,MAAM,IAAA,2BAAW,EAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC/C,OAAO;QACV,CAAC;IACJ,CAAC;IAED,wBAAwB;IACxB,IAAI,MAAM,SAAG,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1D,OAAO;IACV,CAAC;IAED,MAAM,IAAI,uBAAc,CAAC;QACtB,OAAO,EAAE,iCAAiC;KAC5C,CAAC,CAAC;AACN,CAAC"}