@synchronized-console/shared 2.25.7 → 2.31.14

package/dist/esm/authz/policies/project/savedViews/canUpdate.d.ts

@@ -0,0 +1,6 @@
+import { ProjectNoAccessError, ProjectNotEnoughPermissionsError, ProjectNotFoundError, SavedViewNoAccessError, SavedViewNotFoundError, ServerNoAccessError, ServerNoSessionError, ServerNotEnoughPermissionsError, WorkspaceNoAccessError, WorkspaceNotEnoughPermissionsError, WorkspacePlanNoFeatureAccessError, WorkspaceReadOnlyError, WorkspacesNotEnabledError, WorkspaceSsoSessionNoAccessError } from '../../../domain/authErrors.js';
+import { MaybeUserContext, ProjectContext, SavedViewContext } from '../../../domain/context.js';
+import { Loaders } from '../../../domain/loaders.js';
+import { AuthPolicy } from '../../../domain/policies.js';
+export declare const canUpdateSavedViewPolicy: AuthPolicy<typeof Loaders.getSavedView | typeof Loaders.getProject | typeof Loaders.getEnv | typeof Loaders.getServerRole | typeof Loaders.getWorkspaceRole | typeof Loaders.getWorkspace | typeof Loaders.getWorkspacePlan | typeof Loaders.getWorkspaceSsoProvider | typeof Loaders.getWorkspaceSsoSession | typeof Loaders.getAdminOverrideEnabled | typeof Loaders.getProjectRole, MaybeUserContext & ProjectContext & SavedViewContext, InstanceType<typeof SavedViewNotFoundError | typeof SavedViewNoAccessError | typeof ProjectNotFoundError | typeof ServerNoAccessError | typeof ServerNoSessionError | typeof ProjectNoAccessError | typeof WorkspaceNoAccessError | typeof WorkspaceSsoSessionNoAccessError | typeof ServerNotEnoughPermissionsError | typeof ProjectNotEnoughPermissionsError | typeof WorkspaceNotEnoughPermissionsError | typeof WorkspacesNotEnabledError | typeof WorkspaceReadOnlyError | typeof WorkspacePlanNoFeatureAccessError>>;
+//# sourceMappingURL=canUpdate.d.ts.map

package/dist/esm/authz/policies/project/savedViews/canUpdate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canUpdate.d.ts","sourceRoot":"","sources":["../../../../../../src/authz/policies/project/savedViews/canUpdate.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,gCAAgC,EAChC,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,+BAA+B,EAC/B,sBAAsB,EACtB,kCAAkC,EAClC,iCAAiC,EACjC,sBAAsB,EACtB,yBAAyB,EACzB,gCAAgC,EACjC,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EACjB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAA;AAMxD,eAAO,MAAM,wBAAwB,EAAE,UAAU,CAC7C,OAAO,OAAO,CAAC,YAAY,GAC3B,OAAO,OAAO,CAAC,UAAU,GACzB,OAAO,OAAO,CAAC,MAAM,GACrB,OAAO,OAAO,CAAC,aAAa,GAC5B,OAAO,OAAO,CAAC,gBAAgB,GAC/B,OAAO,OAAO,CAAC,YAAY,GAC3B,OAAO,OAAO,CAAC,gBAAgB,GAC/B,OAAO,OAAO,CAAC,uBAAuB,GACtC,OAAO,OAAO,CAAC,sBAAsB,GACrC,OAAO,OAAO,CAAC,uBAAuB,GACtC,OAAO,OAAO,CAAC,cAAc,EAC/B,gBAAgB,GAAG,cAAc,GAAG,gBAAgB,EACpD,YAAY,CACR,OAAO,sBAAsB,GAC7B,OAAO,sBAAsB,GAC7B,OAAO,oBAAoB,GAC3B,OAAO,mBAAmB,GAC1B,OAAO,oBAAoB,GAC3B,OAAO,oBAAoB,GAC3B,OAAO,sBAAsB,GAC7B,OAAO,gCAAgC,GACvC,OAAO,+BAA+B,GACtC,OAAO,gCAAgC,GACvC,OAAO,kCAAkC,GACzC,OAAO,yBAAyB,GAChC,OAAO,sBAAsB,GAC7B,OAAO,iCAAiC,CAC3C,CAUA,CAAA"}

package/dist/esm/authz/policies/project/savedViews/canUpdate.js

@@ -0,0 +1,10 @@
+import { ensureCanAccessSavedViewFragment, WriteTypes } from '../../../fragments/savedViews.js';
+export const canUpdateSavedViewPolicy = (loaders) => async ({ userId, projectId, savedViewId }) => {
+    return await ensureCanAccessSavedViewFragment(loaders)({
+        userId,
+        projectId,
+        savedViewId,
+        access: WriteTypes.UpdateGeneral
+    });
+};
+//# sourceMappingURL=canUpdate.js.map

package/dist/esm/authz/policies/project/savedViews/canUpdate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canUpdate.js","sourceRoot":"","sources":["../../../../../../src/authz/policies/project/savedViews/canUpdate.ts"],"names":[],"mappings":"AAuBA,OAAO,EACL,gCAAgC,EAChC,UAAU,EACX,MAAM,kCAAkC,CAAA;AAEzC,MAAM,CAAC,MAAM,wBAAwB,GA8BnC,CAAC,OAAO,EAAE,EAAE,CACZ,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE;IAC3C,OAAO,MAAM,gCAAgC,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM;QACN,SAAS;QACT,WAAW;QACX,MAAM,EAAE,UAAU,CAAC,aAAa;KACjC,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/esm/authz/policies/project/savedViews/canUpdateGroup.d.ts

@@ -0,0 +1,6 @@
+import { ProjectNoAccessError, ProjectNotEnoughPermissionsError, ProjectNotFoundError, SavedViewGroupNotFoundError, ServerNoAccessError, ServerNoSessionError, ServerNotEnoughPermissionsError, UngroupedSavedViewGroupLockError, WorkspaceNoAccessError, WorkspaceNotEnoughPermissionsError, WorkspacePlanNoFeatureAccessError, WorkspaceReadOnlyError, WorkspacesNotEnabledError, WorkspaceSsoSessionNoAccessError } from '../../../domain/authErrors.js';
+import { MaybeUserContext, ProjectContext, SavedViewGroupContext } from '../../../domain/context.js';
+import { Loaders } from '../../../domain/loaders.js';
+import { AuthPolicy } from '../../../domain/policies.js';
+export declare const canUpdateSavedViewGroupPolicy: AuthPolicy<typeof Loaders.getSavedViewGroup | typeof Loaders.getProject | typeof Loaders.getEnv | typeof Loaders.getServerRole | typeof Loaders.getWorkspaceRole | typeof Loaders.getWorkspace | typeof Loaders.getWorkspacePlan | typeof Loaders.getWorkspaceSsoProvider | typeof Loaders.getWorkspaceSsoSession | typeof Loaders.getProjectRole, MaybeUserContext & ProjectContext & SavedViewGroupContext, InstanceType<typeof SavedViewGroupNotFoundError | typeof ProjectNotFoundError | typeof ServerNoAccessError | typeof ServerNoSessionError | typeof ProjectNoAccessError | typeof WorkspaceNoAccessError | typeof WorkspaceSsoSessionNoAccessError | typeof ServerNotEnoughPermissionsError | typeof ProjectNotEnoughPermissionsError | typeof WorkspaceNotEnoughPermissionsError | typeof WorkspacesNotEnabledError | typeof WorkspaceReadOnlyError | typeof WorkspacePlanNoFeatureAccessError | typeof UngroupedSavedViewGroupLockError>>;
+//# sourceMappingURL=canUpdateGroup.d.ts.map

package/dist/esm/authz/policies/project/savedViews/canUpdateGroup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canUpdateGroup.d.ts","sourceRoot":"","sources":["../../../../../../src/authz/policies/project/savedViews/canUpdateGroup.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,gCAAgC,EAChC,oBAAoB,EACpB,2BAA2B,EAC3B,mBAAmB,EACnB,oBAAoB,EACpB,+BAA+B,EAC/B,gCAAgC,EAChC,sBAAsB,EACtB,kCAAkC,EAClC,iCAAiC,EACjC,sBAAsB,EACtB,yBAAyB,EACzB,gCAAgC,EACjC,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACtB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAA;AAGxD,eAAO,MAAM,6BAA6B,EAAE,UAAU,CAClD,OAAO,OAAO,CAAC,iBAAiB,GAChC,OAAO,OAAO,CAAC,UAAU,GACzB,OAAO,OAAO,CAAC,MAAM,GACrB,OAAO,OAAO,CAAC,aAAa,GAC5B,OAAO,OAAO,CAAC,gBAAgB,GAC/B,OAAO,OAAO,CAAC,YAAY,GAC3B,OAAO,OAAO,CAAC,gBAAgB,GAC/B,OAAO,OAAO,CAAC,uBAAuB,GACtC,OAAO,OAAO,CAAC,sBAAsB,GACrC,OAAO,OAAO,CAAC,cAAc,EAC/B,gBAAgB,GAAG,cAAc,GAAG,qBAAqB,EACzD,YAAY,CACR,OAAO,2BAA2B,GAClC,OAAO,oBAAoB,GAC3B,OAAO,mBAAmB,GAC1B,OAAO,oBAAoB,GAC3B,OAAO,oBAAoB,GAC3B,OAAO,sBAAsB,GAC7B,OAAO,gCAAgC,GACvC,OAAO,+BAA+B,GACtC,OAAO,gCAAgC,GACvC,OAAO,kCAAkC,GACzC,OAAO,yBAAyB,GAChC,OAAO,sBAAsB,GAC7B,OAAO,iCAAiC,GACxC,OAAO,gCAAgC,CAC1C,CAUA,CAAA"}

package/dist/esm/authz/policies/project/savedViews/canUpdateGroup.js

@@ -0,0 +1,10 @@
+import { ensureCanAccessSavedViewGroupFragment } from '../../../fragments/savedViews.js';
+export const canUpdateSavedViewGroupPolicy = (loaders) => async ({ userId, projectId, savedViewGroupId }) => {
+    return await ensureCanAccessSavedViewGroupFragment(loaders)({
+        userId,
+        projectId,
+        savedViewGroupId,
+        access: 'write'
+    });
+};
+//# sourceMappingURL=canUpdateGroup.js.map

package/dist/esm/authz/policies/project/savedViews/canUpdateGroup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canUpdateGroup.js","sourceRoot":"","sources":["../../../../../../src/authz/policies/project/savedViews/canUpdateGroup.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,qCAAqC,EAAE,MAAM,kCAAkC,CAAA;AAExF,MAAM,CAAC,MAAM,6BAA6B,GA6BxC,CAAC,OAAO,EAAE,EAAE,CACZ,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,EAAE,EAAE;IAChD,OAAO,MAAM,qCAAqC,CAAC,OAAO,CAAC,CAAC;QAC1D,MAAM;QACN,SAAS;QACT,gBAAgB;QAChB,MAAM,EAAE,OAAO;KAChB,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/esm/authz/policies/workspace/canCreateDashboards.d.ts

@@ -0,0 +1,10 @@
+import { AuthCheckContextLoaderKeys } from '../../domain/loaders.js';
+import { MaybeUserContext, WorkspaceContext } from '../../domain/context.js';
+import { DashboardsNotEnabledError, WorkspaceNoEditorSeatError, WorkspaceNotEnoughPermissionsError, WorkspacePlanNoFeatureAccessError } from '../../domain/authErrors.js';
+import { AuthPolicy } from '../../domain/policies.js';
+type PolicyLoaderKeys = typeof AuthCheckContextLoaderKeys.getEnv | typeof AuthCheckContextLoaderKeys.getServerRole | typeof AuthCheckContextLoaderKeys.getAdminOverrideEnabled | typeof AuthCheckContextLoaderKeys.getWorkspacePlan | typeof AuthCheckContextLoaderKeys.getWorkspaceRole | typeof AuthCheckContextLoaderKeys.getWorkspaceSeat;
+type PolicyArgs = MaybeUserContext & WorkspaceContext;
+type PolicyErrors = InstanceType<typeof DashboardsNotEnabledError | typeof WorkspaceNotEnoughPermissionsError | typeof WorkspacePlanNoFeatureAccessError | typeof WorkspaceNoEditorSeatError>;
+export declare const canCreateDashboardsPolicy: AuthPolicy<PolicyLoaderKeys, PolicyArgs, PolicyErrors>;
+export {};
+//# sourceMappingURL=canCreateDashboards.d.ts.map

package/dist/esm/authz/policies/workspace/canCreateDashboards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canCreateDashboards.d.ts","sourceRoot":"","sources":["../../../../../src/authz/policies/workspace/canCreateDashboards.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC5E,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,kCAAkC,EAClC,iCAAiC,EAClC,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAUrD,KAAK,gBAAgB,GACjB,OAAO,0BAA0B,CAAC,MAAM,GACxC,OAAO,0BAA0B,CAAC,aAAa,GAC/C,OAAO,0BAA0B,CAAC,uBAAuB,GACzD,OAAO,0BAA0B,CAAC,gBAAgB,GAClD,OAAO,0BAA0B,CAAC,gBAAgB,GAClD,OAAO,0BAA0B,CAAC,gBAAgB,CAAA;AAEtD,KAAK,UAAU,GAAG,gBAAgB,GAAG,gBAAgB,CAAA;AAErD,KAAK,YAAY,GAAG,YAAY,CAC5B,OAAO,yBAAyB,GAChC,OAAO,kCAAkC,GACzC,OAAO,iCAAiC,GACxC,OAAO,0BAA0B,CACpC,CAAA;AAED,eAAO,MAAM,yBAAyB,EAAE,UAAU,CAChD,gBAAgB,EAChB,UAAU,EACV,YAAY,CA+BX,CAAA"}

package/dist/esm/authz/policies/workspace/canCreateDashboards.js

@@ -0,0 +1,35 @@
+import { err, ok } from 'true-myth/result';
+import { WorkspaceNoEditorSeatError, WorkspaceNotEnoughPermissionsError } from '../../domain/authErrors.js';
+import { ensureDashboardsEnabledFragment, ensureWorkspaceDashboardsFeatureAccessFragment } from '../../fragments/dashboards.js';
+import { hasMinimumWorkspaceRole } from '../../checks/workspaceRole.js';
+import { Roles } from '../../../core/constants.js';
+import { hasEditorSeat } from '../../checks/workspaceSeat.js';
+import { checkIfAdminOverrideEnabledFragment } from '../../fragments/server.js';
+export const canCreateDashboardsPolicy = (loaders) => async ({ userId, workspaceId }) => {
+    const isDashboardsEnabled = await ensureDashboardsEnabledFragment(loaders)({});
+    if (isDashboardsEnabled.isErr)
+        return err(isDashboardsEnabled.error);
+    const ensuredFeatureAccess = await ensureWorkspaceDashboardsFeatureAccessFragment(loaders)({ workspaceId });
+    if (ensuredFeatureAccess.isErr)
+        return err(ensuredFeatureAccess.error);
+    const hasAdminAccess = await checkIfAdminOverrideEnabledFragment(loaders)({
+        userId
+    });
+    if (hasAdminAccess.isOk && hasAdminAccess.value)
+        return ok();
+    const isWorkspaceMember = await hasMinimumWorkspaceRole(loaders)({
+        userId: userId,
+        workspaceId,
+        role: Roles.Workspace.Member
+    });
+    if (!isWorkspaceMember)
+        return err(new WorkspaceNotEnoughPermissionsError());
+    const isWorkspaceEditorSeat = await hasEditorSeat(loaders)({
+        userId: userId,
+        workspaceId
+    });
+    if (!isWorkspaceEditorSeat)
+        return err(new WorkspaceNoEditorSeatError());
+    return ok();
+};
+//# sourceMappingURL=canCreateDashboards.js.map

package/dist/esm/authz/policies/workspace/canCreateDashboards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canCreateDashboards.js","sourceRoot":"","sources":["../../../../../src/authz/policies/workspace/canCreateDashboards.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AAG1C,OAAO,EAEL,0BAA0B,EAC1B,kCAAkC,EAEnC,MAAM,4BAA4B,CAAA;AAEnC,OAAO,EACL,+BAA+B,EAC/B,8CAA8C,EAC/C,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAA;AACvE,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAA;AAC7D,OAAO,EAAE,mCAAmC,EAAE,MAAM,2BAA2B,CAAA;AAmB/E,MAAM,CAAC,MAAM,yBAAyB,GAKpC,CAAC,OAAO,EAAE,EAAE,CACZ,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE;IAChC,MAAM,mBAAmB,GAAG,MAAM,+BAA+B,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAA;IAC9E,IAAI,mBAAmB,CAAC,KAAK;QAAE,OAAO,GAAG,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAA;IAEpE,MAAM,oBAAoB,GAAG,MAAM,8CAA8C,CAC/E,OAAO,CACR,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;IAClB,IAAI,oBAAoB,CAAC,KAAK;QAAE,OAAO,GAAG,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAA;IAEtE,MAAM,cAAc,GAAG,MAAM,mCAAmC,CAAC,OAAO,CAAC,CAAC;QACxE,MAAM;KACP,CAAC,CAAA;IACF,IAAI,cAAc,CAAC,IAAI,IAAI,cAAc,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,CAAA;IAE5D,MAAM,iBAAiB,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,EAAE,MAAO;QACf,WAAW;QACX,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM;KAC7B,CAAC,CAAA;IACF,IAAI,CAAC,iBAAiB;QAAE,OAAO,GAAG,CAAC,IAAI,kCAAkC,EAAE,CAAC,CAAA;IAE5E,MAAM,qBAAqB,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,EAAE,MAAO;QACf,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,qBAAqB;QAAE,OAAO,GAAG,CAAC,IAAI,0BAA0B,EAAE,CAAC,CAAA;IAExE,OAAO,EAAE,EAAE,CAAA;AACb,CAAC,CAAA"}

package/dist/esm/authz/policies/workspace/canCreateWorkspace.d.ts

@@ -0,0 +1,10 @@
+import { EligibleForExclusiveWorkspaceError, ServerNoAccessError, ServerNoSessionError, ServerNotEnoughPermissionsError, WorkspacesNotEnabledError } from '../../domain/authErrors.js';
+import { MaybeUserContext } from '../../domain/context.js';
+import { AuthCheckContextLoaderKeys } from '../../domain/loaders.js';
+import { AuthPolicy } from '../../domain/policies.js';
+type PolicyArgs = MaybeUserContext;
+type PolicyLoaderKeys = typeof AuthCheckContextLoaderKeys.getEnv | typeof AuthCheckContextLoaderKeys.getUsersCurrentAndEligibleToBecomeAMemberWorkspaces | typeof AuthCheckContextLoaderKeys.getServerRole;
+type PolicyErrors = InstanceType<typeof WorkspacesNotEnabledError | typeof ServerNoSessionError | typeof ServerNoAccessError | typeof ServerNotEnoughPermissionsError | typeof EligibleForExclusiveWorkspaceError>;
+export declare const canCreateWorkspacePolicy: AuthPolicy<PolicyLoaderKeys, PolicyArgs, PolicyErrors>;
+export {};
+//# sourceMappingURL=canCreateWorkspace.d.ts.map

package/dist/esm/authz/policies/workspace/canCreateWorkspace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canCreateWorkspace.d.ts","sourceRoot":"","sources":["../../../../../src/authz/policies/workspace/canCreateWorkspace.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kCAAkC,EAClC,mBAAmB,EACnB,oBAAoB,EACpB,+BAA+B,EAC/B,yBAAyB,EAC1B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAMrD,KAAK,UAAU,GAAG,gBAAgB,CAAA;AAClC,KAAK,gBAAgB,GACjB,OAAO,0BAA0B,CAAC,MAAM,GACxC,OAAO,0BAA0B,CAAC,mDAAmD,GACrF,OAAO,0BAA0B,CAAC,aAAa,CAAA;AAEnD,KAAK,YAAY,GAAG,YAAY,CAC5B,OAAO,yBAAyB,GAChC,OAAO,oBAAoB,GAC3B,OAAO,mBAAmB,GAC1B,OAAO,+BAA+B,GACtC,OAAO,kCAAkC,CAC5C,CAAA;AAED,eAAO,MAAM,wBAAwB,EAAE,UAAU,CAC/C,gBAAgB,EAChB,UAAU,EACV,YAAY,CA2CX,CAAA"}

package/dist/esm/authz/policies/workspace/canCreateWorkspace.js

@@ -0,0 +1,47 @@
+import { err, ok } from 'true-myth/result';
+import { EligibleForExclusiveWorkspaceError } from '../../domain/authErrors.js';
+import { ensureWorkspacesEnabledFragment } from '../../fragments/workspaces.js';
+import { ensureMinimumServerRoleFragment } from '../../fragments/server.js';
+import { Roles } from '../../../core/constants.js';
+import { throwUncoveredError } from '../../../core/index.js';
+export const canCreateWorkspacePolicy = (loaders) => async ({ userId }) => {
+    const ensuredWorkspacesEnabled = await ensureWorkspacesEnabledFragment(loaders)({});
+    if (ensuredWorkspacesEnabled.isErr)
+        return err(ensuredWorkspacesEnabled.error);
+    const ensuredServerRole = await ensureMinimumServerRoleFragment(loaders)({
+        userId,
+        role: Roles.Server.User
+    });
+    if (ensuredServerRole.isErr)
+        return err(ensuredServerRole.error);
+    // userId is not null here, ensured by the serverRoleFragment
+    const workspaces = await loaders.getUsersCurrentAndEligibleToBecomeAMemberWorkspaces({
+        userId: userId
+    });
+    const isUserEligibleForExclusiveWorkspaces = workspaces.some((w) => {
+        if (w.isExclusive) {
+            // if the user has no role in the workspace, means they are eligible
+            // to join it via an invite or discovery
+            if (!w.role)
+                return true;
+            // for exclusive workspaces, if the user has a role, some of them are not affected by this policy
+            // ie.: Workspace admins of exclusive workspaces should be able to create new ones
+            //      also guests should not be bound by this rule
+            switch (w.role) {
+                case Roles.Workspace.Admin:
+                case Roles.Workspace.Guest:
+                    return false;
+                case Roles.Workspace.Member:
+                    return true;
+                default:
+                    throwUncoveredError(w.role);
+            }
+        }
+        return false;
+    });
+    if (isUserEligibleForExclusiveWorkspaces) {
+        return err(new EligibleForExclusiveWorkspaceError());
+    }
+    return ok();
+};
+//# sourceMappingURL=canCreateWorkspace.js.map

package/dist/esm/authz/policies/workspace/canCreateWorkspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canCreateWorkspace.js","sourceRoot":"","sources":["../../../../../src/authz/policies/workspace/canCreateWorkspace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EACL,kCAAkC,EAKnC,MAAM,4BAA4B,CAAA;AAInC,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAA;AAC/E,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAA;AAC3E,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAA;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AAgB5D,MAAM,CAAC,MAAM,wBAAwB,GAKnC,CAAC,OAAO,EAAE,EAAE,CACZ,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;IACnB,MAAM,wBAAwB,GAAG,MAAM,+BAA+B,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAA;IACnF,IAAI,wBAAwB,CAAC,KAAK;QAAE,OAAO,GAAG,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAA;IAE9E,MAAM,iBAAiB,GAAG,MAAM,+BAA+B,CAAC,OAAO,CAAC,CAAC;QACvE,MAAM;QACN,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;KACxB,CAAC,CAAA;IACF,IAAI,iBAAiB,CAAC,KAAK;QAAE,OAAO,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAA;IAEhE,6DAA6D;IAC7D,MAAM,UAAU,GACd,MAAM,OAAO,CAAC,mDAAmD,CAAC;QAChE,MAAM,EAAE,MAAO;KAChB,CAAC,CAAA;IACJ,MAAM,oCAAoC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACjE,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAClB,oEAAoE;YACpE,wCAAwC;YACxC,IAAI,CAAC,CAAC,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAA;YACxB,iGAAiG;YACjG,kFAAkF;YAClF,oDAAoD;YACpD,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;gBACf,KAAK,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC;gBAC3B,KAAK,KAAK,CAAC,SAAS,CAAC,KAAK;oBACxB,OAAO,KAAK,CAAA;gBACd,KAAK,KAAK,CAAC,SAAS,CAAC,MAAM;oBACzB,OAAO,IAAI,CAAA;gBACb;oBACE,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YAC/B,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;IAEF,IAAI,oCAAoC,EAAE,CAAC;QACzC,OAAO,GAAG,CAAC,IAAI,kCAAkC,EAAE,CAAC,CAAA;IACtD,CAAC;IACD,OAAO,EAAE,EAAE,CAAA;AACb,CAAC,CAAA"}

package/dist/esm/authz/policies/workspace/canListDashboards.d.ts

@@ -0,0 +1,10 @@
+import { AuthCheckContextLoaderKeys } from '../../domain/loaders.js';
+import { MaybeUserContext, WorkspaceContext } from '../../domain/context.js';
+import { DashboardsNotEnabledError, WorkspaceNotEnoughPermissionsError, WorkspacePlanNoFeatureAccessError } from '../../domain/authErrors.js';
+import { AuthPolicy } from '../../domain/policies.js';
+type PolicyLoaderKeys = typeof AuthCheckContextLoaderKeys.getEnv | typeof AuthCheckContextLoaderKeys.getWorkspaceRole | typeof AuthCheckContextLoaderKeys.getWorkspacePlan;
+type PolicyArgs = MaybeUserContext & WorkspaceContext;
+type PolicyErrors = InstanceType<typeof DashboardsNotEnabledError | typeof WorkspaceNotEnoughPermissionsError | typeof WorkspacePlanNoFeatureAccessError>;
+export declare const canListDashboardsPolicy: AuthPolicy<PolicyLoaderKeys, PolicyArgs, PolicyErrors>;
+export {};
+//# sourceMappingURL=canListDashboards.d.ts.map

package/dist/esm/authz/policies/workspace/canListDashboards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canListDashboards.d.ts","sourceRoot":"","sources":["../../../../../src/authz/policies/workspace/canListDashboards.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC5E,OAAO,EACL,yBAAyB,EACzB,kCAAkC,EAClC,iCAAiC,EAClC,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAQrD,KAAK,gBAAgB,GACjB,OAAO,0BAA0B,CAAC,MAAM,GACxC,OAAO,0BAA0B,CAAC,gBAAgB,GAClD,OAAO,0BAA0B,CAAC,gBAAgB,CAAA;AAEtD,KAAK,UAAU,GAAG,gBAAgB,GAAG,gBAAgB,CAAA;AAErD,KAAK,YAAY,GAAG,YAAY,CAC5B,OAAO,yBAAyB,GAChC,OAAO,kCAAkC,GACzC,OAAO,iCAAiC,CAC3C,CAAA;AAED,eAAO,MAAM,uBAAuB,EAAE,UAAU,CAC9C,gBAAgB,EAChB,UAAU,EACV,YAAY,CAoBX,CAAA"}

package/dist/esm/authz/policies/workspace/canListDashboards.js

@@ -0,0 +1,22 @@
+import { err, ok } from 'true-myth/result';
+import { WorkspaceNotEnoughPermissionsError } from '../../domain/authErrors.js';
+import { ensureDashboardsEnabledFragment, ensureWorkspaceDashboardsFeatureAccessFragment } from '../../fragments/dashboards.js';
+import { hasMinimumWorkspaceRole } from '../../checks/workspaceRole.js';
+import { Roles } from '../../../core/constants.js';
+export const canListDashboardsPolicy = (loaders) => async ({ userId, workspaceId }) => {
+    const isDashboardsEnabled = await ensureDashboardsEnabledFragment(loaders)({});
+    if (isDashboardsEnabled.isErr)
+        return err(isDashboardsEnabled.error);
+    const ensuredFeatureAccess = await ensureWorkspaceDashboardsFeatureAccessFragment(loaders)({ workspaceId });
+    if (ensuredFeatureAccess.isErr)
+        return err(ensuredFeatureAccess.error);
+    const isWorkspaceMember = await hasMinimumWorkspaceRole(loaders)({
+        userId: userId,
+        workspaceId,
+        role: Roles.Workspace.Member
+    });
+    if (!isWorkspaceMember)
+        return err(new WorkspaceNotEnoughPermissionsError());
+    return ok();
+};
+//# sourceMappingURL=canListDashboards.js.map

package/dist/esm/authz/policies/workspace/canListDashboards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canListDashboards.js","sourceRoot":"","sources":["../../../../../src/authz/policies/workspace/canListDashboards.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AAG1C,OAAO,EAEL,kCAAkC,EAEnC,MAAM,4BAA4B,CAAA;AAEnC,OAAO,EACL,+BAA+B,EAC/B,8CAA8C,EAC/C,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAA;AACvE,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAA;AAelD,MAAM,CAAC,MAAM,uBAAuB,GAKlC,CAAC,OAAO,EAAE,EAAE,CACZ,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE;IAChC,MAAM,mBAAmB,GAAG,MAAM,+BAA+B,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAA;IAC9E,IAAI,mBAAmB,CAAC,KAAK;QAAE,OAAO,GAAG,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAA;IAEpE,MAAM,oBAAoB,GAAG,MAAM,8CAA8C,CAC/E,OAAO,CACR,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;IAClB,IAAI,oBAAoB,CAAC,KAAK;QAAE,OAAO,GAAG,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAA;IAEtE,MAAM,iBAAiB,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,EAAE,MAAO;QACf,WAAW;QACX,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM;KAC7B,CAAC,CAAA;IACF,IAAI,CAAC,iBAAiB;QAAE,OAAO,GAAG,CAAC,IAAI,kCAAkC,EAAE,CAAC,CAAA;IAE5E,OAAO,EAAE,EAAE,CAAA;AACb,CAAC,CAAA"}

package/dist/esm/authz/policies/workspace/canReadMemberEmail.d.ts

@@ -4,7 +4,7 @@ import { AuthPolicy } from '../../domain/policies.js';
 import { ServerNoAccessError, ServerNoSessionError, ServerNotEnoughPermissionsError, WorkspaceNoAccessError, WorkspaceNotEnoughPermissionsError, WorkspacesNotEnabledError, WorkspaceSsoSessionNoAccessError } from '../../domain/authErrors.js';
 type PolicyArgs = MaybeUserContext & WorkspaceContext;
 type PolicyLoaderKeys = typeof AuthCheckContextLoaderKeys.getEnv | typeof AuthCheckContextLoaderKeys.getServerRole | typeof AuthCheckContextLoaderKeys.getWorkspace | typeof AuthCheckContextLoaderKeys.getWorkspaceRole | typeof AuthCheckContextLoaderKeys.getWorkspaceSsoProvider | typeof AuthCheckContextLoaderKeys.getWorkspaceSsoSession | typeof AuthCheckContextLoaderKeys.getWorkspacePlan;
-type PolicyErrors = InstanceType<typeof WorkspaceNoAccessError> | InstanceType<typeof WorkspaceSsoSessionNoAccessError> | InstanceType<typeof WorkspacesNotEnabledError> | InstanceType<typeof ServerNoSessionError> | InstanceType<typeof ServerNoAccessError> | InstanceType<typeof ServerNotEnoughPermissionsError> | InstanceType<typeof WorkspaceNotEnoughPermissionsError>;
+type PolicyErrors = InstanceType<typeof WorkspaceNoAccessError | typeof WorkspaceSsoSessionNoAccessError | typeof WorkspacesNotEnabledError | typeof ServerNoSessionError | typeof ServerNoAccessError | typeof ServerNotEnoughPermissionsError | typeof WorkspaceNotEnoughPermissionsError>;
 export declare const canReadMemberEmailPolicy: AuthPolicy<PolicyLoaderKeys, PolicyArgs, PolicyErrors>;
 export {};
 //# sourceMappingURL=canReadMemberEmail.d.ts.map

package/dist/esm/authz/policies/workspace/canReadMemberEmail.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"canReadMemberEmail.d.ts","sourceRoot":"","sources":["../../../../../src/authz/policies/workspace/canReadMemberEmail.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAKrD,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,+BAA+B,EAC/B,sBAAsB,EACtB,kCAAkC,EAClC,yBAAyB,EACzB,gCAAgC,EACjC,MAAM,4BAA4B,CAAA;AAInC,KAAK,UAAU,GAAG,gBAAgB,GAAG,gBAAgB,CAAA;AAErD,KAAK,gBAAgB,GACjB,OAAO,0BAA0B,CAAC,MAAM,GACxC,OAAO,0BAA0B,CAAC,aAAa,GAC/C,OAAO,0BAA0B,CAAC,YAAY,GAC9C,OAAO,0BAA0B,CAAC,gBAAgB,GAClD,OAAO,0BAA0B,CAAC,uBAAuB,GACzD,OAAO,0BAA0B,CAAC,sBAAsB,GACxD,OAAO,0BAA0B,CAAC,gBAAgB,CAAA;AAEtD,KAAK,YAAY,GACb,YAAY,CAAC,OAAO,sBAAsB,CAAC,GAC3C,YAAY,CAAC,OAAO,gCAAgC,CAAC,GACrD,YAAY,CAAC,OAAO,yBAAyB,CAAC,GAC9C,YAAY,CAAC,OAAO,oBAAoB,CAAC,GACzC,YAAY,CAAC,OAAO,mBAAmB,CAAC,GACxC,YAAY,CAAC,OAAO,+BAA+B,CAAC,GACpD,YAAY,CAAC,OAAO,kCAAkC,CAAC,CAAA;AAE3D,eAAO,MAAM,wBAAwB,EAAE,UAAU,CAC/C,gBAAgB,EAChB,UAAU,EACV,YAAY,CAuBX,CAAA"}
+{"version":3,"file":"canReadMemberEmail.d.ts","sourceRoot":"","sources":["../../../../../src/authz/policies/workspace/canReadMemberEmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAErD,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,+BAA+B,EAC/B,sBAAsB,EACtB,kCAAkC,EAClC,yBAAyB,EACzB,gCAAgC,EACjC,MAAM,4BAA4B,CAAA;AAEnC,KAAK,UAAU,GAAG,gBAAgB,GAAG,gBAAgB,CAAA;AAErD,KAAK,gBAAgB,GACjB,OAAO,0BAA0B,CAAC,MAAM,GACxC,OAAO,0BAA0B,CAAC,aAAa,GAC/C,OAAO,0BAA0B,CAAC,YAAY,GAC9C,OAAO,0BAA0B,CAAC,gBAAgB,GAClD,OAAO,0BAA0B,CAAC,uBAAuB,GACzD,OAAO,0BAA0B,CAAC,sBAAsB,GACxD,OAAO,0BAA0B,CAAC,gBAAgB,CAAA;AAEtD,KAAK,YAAY,GAAG,YAAY,CAC5B,OAAO,sBAAsB,GAC7B,OAAO,gCAAgC,GACvC,OAAO,yBAAyB,GAChC,OAAO,oBAAoB,GAC3B,OAAO,mBAAmB,GAC1B,OAAO,+BAA+B,GACtC,OAAO,kCAAkC,CAC5C,CAAA;AAED,eAAO,MAAM,wBAAwB,EAAE,UAAU,CAC/C,gBAAgB,EAChB,UAAU,EACV,YAAY,CAKX,CAAA"}

package/dist/esm/authz/policies/workspace/canReadMemberEmail.js

@@ -1,24 +1,5 @@
-import { err, ok } from 'true-myth/result';
-import { ensureWorkspaceRoleAndSessionFragment, ensureWorkspacesEnabledFragment } from '../../fragments/workspaces.js';
-import { ensureMinimumServerRoleFragment } from '../../fragments/server.js';
-import { Roles } from '../../../core/constants.js';
+import { ensureUserIsWorkspaceAdminFragment } from '../../fragments/workspaces.js';
 export const canReadMemberEmailPolicy = (loaders) => async ({ userId, workspaceId }) => {
-    const ensuredWorkspacesEnabled = await ensureWorkspacesEnabledFragment(loaders)({});
-    if (ensuredWorkspacesEnabled.isErr)
-        return err(ensuredWorkspacesEnabled.error);
-    const ensuredServerRole = await ensureMinimumServerRoleFragment(loaders)({
-        userId,
-        role: Roles.Server.User
-    });
-    if (ensuredServerRole.isErr)
-        return err(ensuredServerRole.error);
-    const ensuredWorkspaceAccess = await ensureWorkspaceRoleAndSessionFragment(loaders)({
-        userId: userId,
-        workspaceId,
-        role: Roles.Workspace.Admin
-    });
-    if (ensuredWorkspaceAccess.isErr)
-        return err(ensuredWorkspaceAccess.error);
-    return ok();
+    return ensureUserIsWorkspaceAdminFragment(loaders)({ userId, workspaceId });
 };
 //# sourceMappingURL=canReadMemberEmail.js.map

package/dist/esm/authz/policies/workspace/canReadMemberEmail.js.map

@@ -1 +1 @@
-{"version":3,"file":"canReadMemberEmail.js","sourceRoot":"","sources":["../../../../../src/authz/policies/workspace/canReadMemberEmail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AAI1C,OAAO,EACL,qCAAqC,EACrC,+BAA+B,EAChC,MAAM,+BAA+B,CAAA;AAUtC,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAA;AAC3E,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAA;AAsBlD,MAAM,CAAC,MAAM,wBAAwB,GAKnC,CAAC,OAAO,EAAE,EAAE,CACZ,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE;IAChC,MAAM,wBAAwB,GAAG,MAAM,+BAA+B,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAA;IACnF,IAAI,wBAAwB,CAAC,KAAK;QAAE,OAAO,GAAG,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAA;IAE9E,MAAM,iBAAiB,GAAG,MAAM,+BAA+B,CAAC,OAAO,CAAC,CAAC;QACvE,MAAM;QACN,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;KACxB,CAAC,CAAA;IAEF,IAAI,iBAAiB,CAAC,KAAK;QAAE,OAAO,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAA;IAEhE,MAAM,sBAAsB,GAAG,MAAM,qCAAqC,CAAC,OAAO,CAAC,CACjF;QACE,MAAM,EAAE,MAAO;QACf,WAAW;QACX,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK;KAC5B,CACF,CAAA;IACD,IAAI,sBAAsB,CAAC,KAAK;QAAE,OAAO,GAAG,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAA;IAC1E,OAAO,EAAE,EAAE,CAAA;AACb,CAAC,CAAA"}
+{"version":3,"file":"canReadMemberEmail.js","sourceRoot":"","sources":["../../../../../src/authz/policies/workspace/canReadMemberEmail.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAA;AAgClF,MAAM,CAAC,MAAM,wBAAwB,GAKnC,CAAC,OAAO,EAAE,EAAE,CACZ,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE;IAChC,OAAO,kCAAkC,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;AAC7E,CAAC,CAAA"}

package/dist/esm/authz/policies/workspace/{canUpdateEmbedOptions.d.ts → canUseWorkspacePlanFeature.d.ts}

@@ -1,10 +1,18 @@
-import { ServerNoAccessError, ServerNoSessionError, ServerNotEnoughPermissionsError, WorkspaceNoAccessError, WorkspaceNoFeatureAccessError, WorkspaceNotEnoughPermissionsError, WorkspaceReadOnlyError, WorkspacesNotEnabledError, WorkspaceSsoSessionNoAccessError } from '../../domain/authErrors.js';
+import { ServerNoAccessError, ServerNoSessionError, ServerNotEnoughPermissionsError, WorkspaceNoAccessError, WorkspacePlanNoFeatureAccessError, WorkspaceNotEnoughPermissionsError, WorkspaceReadOnlyError, WorkspacesNotEnabledError, WorkspaceSsoSessionNoAccessError } from '../../domain/authErrors.js';
 import { MaybeUserContext, WorkspaceContext } from '../../domain/context.js';
 import { AuthCheckContextLoaderKeys } from '../../domain/loaders.js';
 import { AuthPolicy } from '../../domain/policies.js';
+import { WorkspacePlanFeatures } from '../../../workspaces/index.js';
 type PolicyLoaderKeys = typeof AuthCheckContextLoaderKeys.getEnv | typeof AuthCheckContextLoaderKeys.getServerRole | typeof AuthCheckContextLoaderKeys.getWorkspace | typeof AuthCheckContextLoaderKeys.getWorkspaceRole | typeof AuthCheckContextLoaderKeys.getWorkspaceSsoProvider | typeof AuthCheckContextLoaderKeys.getWorkspaceSsoSession | typeof AuthCheckContextLoaderKeys.getWorkspacePlan;
-type PolicyArgs = MaybeUserContext & WorkspaceContext;
-type PolicyErrors = InstanceType<typeof WorkspaceNoAccessError> | InstanceType<typeof WorkspaceSsoSessionNoAccessError> | InstanceType<typeof WorkspaceReadOnlyError> | InstanceType<typeof WorkspacesNotEnabledError> | InstanceType<typeof ServerNoSessionError> | InstanceType<typeof ServerNoAccessError> | InstanceType<typeof ServerNotEnoughPermissionsError> | InstanceType<typeof WorkspaceNotEnoughPermissionsError> | InstanceType<typeof WorkspaceNoFeatureAccessError>;
-export declare const canUpdateEmbedOptionsPolicy: AuthPolicy<PolicyLoaderKeys, PolicyArgs, PolicyErrors>;
+type PolicyArgs = MaybeUserContext & WorkspaceContext & {
+    feature: WorkspacePlanFeatures;
+};
+type PolicyErrors = InstanceType<typeof WorkspaceNoAccessError> | InstanceType<typeof WorkspaceSsoSessionNoAccessError> | InstanceType<typeof WorkspaceReadOnlyError> | InstanceType<typeof WorkspacesNotEnabledError> | InstanceType<typeof ServerNoSessionError> | InstanceType<typeof ServerNoAccessError> | InstanceType<typeof ServerNotEnoughPermissionsError> | InstanceType<typeof WorkspaceNotEnoughPermissionsError> | InstanceType<typeof WorkspacePlanNoFeatureAccessError>;
+/**
+ * TODO: Refactor. Just use the fragment if you want to check if a workspace has access to a feature,
+ * and create more specific policies for the actual use cases, cause policies shouldn't be reusable
+ * building blocks like this.
+ */
+export declare const canUseWorkspacePlanFeature: AuthPolicy<PolicyLoaderKeys, PolicyArgs, PolicyErrors>;
 export {};
-//# sourceMappingURL=canUpdateEmbedOptions.d.ts.map
+//# sourceMappingURL=canUseWorkspacePlanFeature.d.ts.map

package/dist/esm/authz/policies/workspace/canUseWorkspacePlanFeature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canUseWorkspacePlanFeature.d.ts","sourceRoot":"","sources":["../../../../../src/authz/policies/workspace/canUseWorkspacePlanFeature.ts"],"names":[],"mappings":"AACA,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,+BAA+B,EAC/B,sBAAsB,EACtB,iCAAiC,EACjC,kCAAkC,EAClC,sBAAsB,EACtB,yBAAyB,EACzB,gCAAgC,EACjC,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAKrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAEpE,KAAK,gBAAgB,GACjB,OAAO,0BAA0B,CAAC,MAAM,GACxC,OAAO,0BAA0B,CAAC,aAAa,GAC/C,OAAO,0BAA0B,CAAC,YAAY,GAC9C,OAAO,0BAA0B,CAAC,gBAAgB,GAClD,OAAO,0BAA0B,CAAC,uBAAuB,GACzD,OAAO,0BAA0B,CAAC,sBAAsB,GACxD,OAAO,0BAA0B,CAAC,gBAAgB,CAAA;AAEtD,KAAK,UAAU,GAAG,gBAAgB,GAChC,gBAAgB,GAAG;IAAE,OAAO,EAAE,qBAAqB,CAAA;CAAE,CAAA;AAEvD,KAAK,YAAY,GACb,YAAY,CAAC,OAAO,sBAAsB,CAAC,GAC3C,YAAY,CAAC,OAAO,gCAAgC,CAAC,GACrD,YAAY,CAAC,OAAO,sBAAsB,CAAC,GAC3C,YAAY,CAAC,OAAO,yBAAyB,CAAC,GAC9C,YAAY,CAAC,OAAO,oBAAoB,CAAC,GACzC,YAAY,CAAC,OAAO,mBAAmB,CAAC,GACxC,YAAY,CAAC,OAAO,+BAA+B,CAAC,GACpD,YAAY,CAAC,OAAO,kCAAkC,CAAC,GACvD,YAAY,CAAC,OAAO,iCAAiC,CAAC,CAAA;AAE1D;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,EAAE,UAAU,CACjD,gBAAgB,EAChB,UAAU,EACV,YAAY,CAgBX,CAAA"}

package/dist/esm/authz/policies/workspace/canUseWorkspacePlanFeature.js

@@ -0,0 +1,23 @@
+import { err, ok } from 'true-myth/result';
+import { ensureCanUseWorkspacePlanFeatureFragment, ensureUserIsWorkspaceAdminFragment } from '../../fragments/workspaces.js';
+/**
+ * TODO: Refactor. Just use the fragment if you want to check if a workspace has access to a feature,
+ * and create more specific policies for the actual use cases, cause policies shouldn't be reusable
+ * building blocks like this.
+ */
+export const canUseWorkspacePlanFeature = (loaders) => async ({ userId, workspaceId, feature }) => {
+    const isWorkspaceAdmin = await ensureUserIsWorkspaceAdminFragment(loaders)({
+        userId,
+        workspaceId
+    });
+    if (isWorkspaceAdmin.isErr)
+        return err(isWorkspaceAdmin.error);
+    const canUseFeature = await ensureCanUseWorkspacePlanFeatureFragment(loaders)({
+        workspaceId,
+        feature
+    });
+    if (canUseFeature.isErr)
+        return err(canUseFeature.error);
+    return ok();
+};
+//# sourceMappingURL=canUseWorkspacePlanFeature.js.map

package/dist/esm/authz/policies/workspace/canUseWorkspacePlanFeature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canUseWorkspacePlanFeature.js","sourceRoot":"","sources":["../../../../../src/authz/policies/workspace/canUseWorkspacePlanFeature.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AAe1C,OAAO,EACL,wCAAwC,EACxC,kCAAkC,EACnC,MAAM,+BAA+B,CAAA;AA0BtC;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAKrC,CAAC,OAAO,EAAE,EAAE,CACZ,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE;IACzC,MAAM,gBAAgB,GAAG,MAAM,kCAAkC,CAAC,OAAO,CAAC,CAAC;QACzE,MAAM;QACN,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,gBAAgB,CAAC,KAAK;QAAE,OAAO,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAE9D,MAAM,aAAa,GAAG,MAAM,wCAAwC,CAAC,OAAO,CAAC,CAAC;QAC5E,WAAW;QACX,OAAO;KACR,CAAC,CAAA;IACF,IAAI,aAAa,CAAC,KAAK;QAAE,OAAO,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;IACxD,OAAO,EAAE,EAAE,CAAA;AACb,CAAC,CAAA"}