@synchronized-console/shared 2.25.7 → 2.31.14

package/dist/commonjs/authz/fragments/savedViews.js

@@ -0,0 +1,122 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureCanAccessSavedViewGroupFragment = exports.ensureCanAccessSavedViewFragment = exports.WriteTypes = void 0;
+const result_1 = require("true-myth/result");
+const authErrors_js_1 = require("../domain/authErrors.js");
+const types_js_1 = require("../domain/savedViews/types.js");
+const projects_js_1 = require("./projects.js");
+const constants_js_1 = require("../../core/constants.js");
+const index_js_1 = require("../../workspaces/index.js");
+const index_js_2 = require("../../saved-views/index.js");
+const index_js_3 = require("../../core/index.js");
+exports.WriteTypes = (0, index_js_3.StringEnum)([
+    'UpdateGeneral',
+    'MoveView',
+    'EditTitle',
+    'EditDescription',
+    'SetHomeView'
+]);
+/**
+ * Ensure the user can access the view
+ */
+const ensureCanAccessSavedViewFragment = (loaders) => async ({ userId, projectId, savedViewId, access, allowNonExistent }) => {
+    const canUseSavedViews = await (0, projects_js_1.ensureCanUseProjectWorkspacePlanFeatureFragment)(loaders)({
+        projectId,
+        feature: index_js_1.WorkspacePlanFeatures.SavedViews
+    });
+    if (canUseSavedViews.isErr)
+        return (0, result_1.err)(canUseSavedViews.error);
+    const savedView = await loaders.getSavedView({ projectId, savedViewId });
+    if (!savedView) {
+        if (allowNonExistent)
+            return (0, result_1.ok)();
+        return (0, result_1.err)(new authErrors_js_1.SavedViewNotFoundError());
+    }
+    const isPublic = savedView.visibility === types_js_1.SavedViewVisibility.public;
+    const isAuthor = savedView.authorId === userId;
+    // Validate read access
+    if (access === 'read') {
+        if (isAuthor || isPublic) {
+            return (0, result_1.ok)();
+        }
+        else {
+            return (0, result_1.err)(new authErrors_js_1.SavedViewNoAccessError({
+                message: 'You do not have permission to read this saved view.'
+            }));
+        }
+    }
+    // Validate write access
+    // Check for write access to project first
+    const ensuredWriteAccess = await (0, projects_js_1.ensureImplicitProjectMemberWithWriteAccessFragment)(loaders)({
+        userId,
+        projectId
+    });
+    if (ensuredWriteAccess.isErr) {
+        if (ensuredWriteAccess.error.code === authErrors_js_1.ProjectNotEnoughPermissionsError.code)
+            return (0, result_1.err)(new authErrors_js_1.ProjectNotEnoughPermissionsError({
+                message: "Your role on this project doesn't give you permission to update views."
+            }));
+        return (0, result_1.err)(ensuredWriteAccess.error);
+    }
+    if (isAuthor) {
+        // authors can write whatever
+        return (0, result_1.ok)();
+    }
+    // Non-author project writers can make specific changes
+    switch (access) {
+        case exports.WriteTypes.MoveView:
+        case exports.WriteTypes.EditTitle:
+        case exports.WriteTypes.EditDescription:
+        case exports.WriteTypes.SetHomeView:
+            return (0, result_1.ok)();
+        case exports.WriteTypes.UpdateGeneral:
+            return (0, result_1.err)(new authErrors_js_1.SavedViewNoAccessError({
+                message: 'You do not have permission to edit the view in this way'
+            }));
+        default:
+            (0, index_js_3.throwUncoveredError)(access);
+    }
+};
+exports.ensureCanAccessSavedViewFragment = ensureCanAccessSavedViewFragment;
+/**
+ * Ensure the user can access the view group
+ */
+const ensureCanAccessSavedViewGroupFragment = (loaders) => async ({ userId, projectId, savedViewGroupId, access }) => {
+    const canUseSavedViews = await (0, projects_js_1.ensureCanUseProjectWorkspacePlanFeatureFragment)(loaders)({
+        projectId,
+        feature: index_js_1.WorkspacePlanFeatures.SavedViews
+    });
+    if (canUseSavedViews.isErr)
+        return (0, result_1.err)(canUseSavedViews.error);
+    const savedViewGroup = await loaders.getSavedViewGroup({
+        projectId,
+        groupId: savedViewGroupId
+    });
+    if (!savedViewGroup)
+        return (0, result_1.err)(new authErrors_js_1.SavedViewGroupNotFoundError());
+    if (access === 'read') {
+        return (0, result_1.ok)(); // read access available to everyone who has access to project
+    }
+    // Prevent default group updates (as it doesnt exist)
+    if ((0, index_js_2.isUngroupedGroup)(savedViewGroup.id)) {
+        return (0, result_1.err)(new authErrors_js_1.UngroupedSavedViewGroupLockError());
+    }
+    // groups have no visibility (yet), so authors AND project owners can mutate
+    const isAuthor = savedViewGroup.authorId === userId;
+    const expectedProjectRole = isAuthor ? constants_js_1.Roles.Stream.Contributor : constants_js_1.Roles.Stream.Owner;
+    const ensuredWriteAccess = await (0, projects_js_1.ensureImplicitProjectMemberWithWriteAccessFragment)(loaders)({
+        userId,
+        projectId,
+        role: expectedProjectRole
+    });
+    if (ensuredWriteAccess.isErr) {
+        if (ensuredWriteAccess.error.code === authErrors_js_1.ProjectNotEnoughPermissionsError.code)
+            return (0, result_1.err)(new authErrors_js_1.ProjectNotEnoughPermissionsError({
+                message: "Your role on this project doesn't give you permission to update view groups."
+            }));
+        return (0, result_1.err)(ensuredWriteAccess.error);
+    }
+    return (0, result_1.ok)();
+};
+exports.ensureCanAccessSavedViewGroupFragment = ensureCanAccessSavedViewGroupFragment;
+//# sourceMappingURL=savedViews.js.map

package/dist/commonjs/authz/fragments/savedViews.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"savedViews.js","sourceRoot":"","sources":["../../../../src/authz/fragments/savedViews.ts"],"names":[],"mappings":";;;AAAA,6CAA0C;AAC1C,2DAiBgC;AAShC,4DAAmE;AACnE,+CAGsB;AACtB,0DAA+C;AAC/C,wDAAiE;AACjE,yDAA6D;AAC7D,kDAAuF;AAE1E,QAAA,UAAU,GAAG,IAAA,qBAAU,EAAC;IACnC,eAAe;IACf,UAAU;IACV,WAAW;IACX,iBAAiB;IACjB,aAAa;CACd,CAAC,CAAA;AAGF;;GAEG;AACI,MAAM,gCAAgC,GAsC3C,CAAC,OAAO,EAAE,EAAE,CACZ,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,EAAE;IACrE,MAAM,gBAAgB,GAAG,MAAM,IAAA,6DAA+C,EAC5E,OAAO,CACR,CAAC;QACA,SAAS;QACT,OAAO,EAAE,gCAAqB,CAAC,UAAU;KAC1C,CAAC,CAAA;IACF,IAAI,gBAAgB,CAAC,KAAK;QAAE,OAAO,IAAA,YAAG,EAAC,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAE9D,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAA;IACxE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,gBAAgB;YAAE,OAAO,IAAA,WAAE,GAAE,CAAA;QACjC,OAAO,IAAA,YAAG,EAAC,IAAI,sCAAsB,EAAE,CAAC,CAAA;IAC1C,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,KAAK,8BAAmB,CAAC,MAAM,CAAA;IACpE,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,KAAK,MAAM,CAAA;IAE9C,uBAAuB;IACvB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,IAAI,QAAQ,IAAI,QAAQ,EAAE,CAAC;YACzB,OAAO,IAAA,WAAE,GAAE,CAAA;QACb,CAAC;aAAM,CAAC;YACN,OAAO,IAAA,YAAG,EACR,IAAI,sCAAsB,CAAC;gBACzB,OAAO,EAAE,qDAAqD;aAC/D,CAAC,CACH,CAAA;QACH,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,0CAA0C;IAC1C,MAAM,kBAAkB,GAAG,MAAM,IAAA,gEAAkD,EACjF,OAAO,CACR,CAAC;QACA,MAAM;QACN,SAAS;KACV,CAAC,CAAA;IACF,IAAI,kBAAkB,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,kBAAkB,CAAC,KAAK,CAAC,IAAI,KAAK,gDAAgC,CAAC,IAAI;YACzE,OAAO,IAAA,YAAG,EACR,IAAI,gDAAgC,CAAC;gBACnC,OAAO,EACL,wEAAwE;aAC3E,CAAC,CACH,CAAA;QACH,OAAO,IAAA,YAAG,EAAC,kBAAkB,CAAC,KAAK,CAAC,CAAA;IACtC,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,6BAA6B;QAC7B,OAAO,IAAA,WAAE,GAAE,CAAA;IACb,CAAC;IAED,uDAAuD;IACvD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,kBAAU,CAAC,QAAQ,CAAC;QACzB,KAAK,kBAAU,CAAC,SAAS,CAAC;QAC1B,KAAK,kBAAU,CAAC,eAAe,CAAC;QAChC,KAAK,kBAAU,CAAC,WAAW;YACzB,OAAO,IAAA,WAAE,GAAE,CAAA;QACb,KAAK,kBAAU,CAAC,aAAa;YAC3B,OAAO,IAAA,YAAG,EACR,IAAI,sCAAsB,CAAC;gBACzB,OAAO,EAAE,yDAAyD;aACnE,CAAC,CACH,CAAA;QACH;YACE,IAAA,8BAAmB,EAAC,MAAM,CAAC,CAAA;IAC/B,CAAC;AACH,CAAC,CAAA;AA7GU,QAAA,gCAAgC,oCA6G1C;AAEH;;GAEG;AACI,MAAM,qCAAqC,GAiChD,CAAC,OAAO,EAAE,EAAE,CACZ,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,EAAE;IACxD,MAAM,gBAAgB,GAAG,MAAM,IAAA,6DAA+C,EAC5E,OAAO,CACR,CAAC;QACA,SAAS;QACT,OAAO,EAAE,gCAAqB,CAAC,UAAU;KAC1C,CAAC,CAAA;IACF,IAAI,gBAAgB,CAAC,KAAK;QAAE,OAAO,IAAA,YAAG,EAAC,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAE9D,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC;QACrD,SAAS;QACT,OAAO,EAAE,gBAAgB;KAC1B,CAAC,CAAA;IACF,IAAI,CAAC,cAAc;QAAE,OAAO,IAAA,YAAG,EAAC,IAAI,2CAA2B,EAAE,CAAC,CAAA;IAElE,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,IAAA,WAAE,GAAE,CAAA,CAAC,8DAA8D;IAC5E,CAAC;IAED,qDAAqD;IACrD,IAAI,IAAA,2BAAgB,EAAC,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC;QACxC,OAAO,IAAA,YAAG,EAAC,IAAI,gDAAgC,EAAE,CAAC,CAAA;IACpD,CAAC;IAED,4EAA4E;IAC5E,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,KAAK,MAAM,CAAA;IACnD,MAAM,mBAAmB,GAAG,QAAQ,CAAC,CAAC,CAAC,oBAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,oBAAK,CAAC,MAAM,CAAC,KAAK,CAAA;IAEpF,MAAM,kBAAkB,GAAG,MAAM,IAAA,gEAAkD,EACjF,OAAO,CACR,CAAC;QACA,MAAM;QACN,SAAS;QACT,IAAI,EAAE,mBAAmB;KAC1B,CAAC,CAAA;IACF,IAAI,kBAAkB,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,kBAAkB,CAAC,KAAK,CAAC,IAAI,KAAK,gDAAgC,CAAC,IAAI;YACzE,OAAO,IAAA,YAAG,EACR,IAAI,gDAAgC,CAAC;gBACnC,OAAO,EACL,8EAA8E;aACjF,CAAC,CACH,CAAA;QACH,OAAO,IAAA,YAAG,EAAC,kBAAkB,CAAC,KAAK,CAAC,CAAA;IACtC,CAAC;IAED,OAAO,IAAA,WAAE,GAAE,CAAA;AACb,CAAC,CAAA;AAjFU,QAAA,qCAAqC,yCAiF/C"}

package/dist/commonjs/authz/fragments/workspaces.d.ts

@@ -1,8 +1,9 @@
 import { AuthPolicyEnsureFragment } from '../domain/policies.js';
-import { PersonalProjectsLimitedError, ProjectNotFoundError, WorkspaceLimitsReachedError, WorkspaceNoAccessError, WorkspaceNoEditorSeatError, WorkspaceNotEnoughPermissionsError, WorkspaceReadOnlyError, WorkspacesNotEnabledError, WorkspaceSsoSessionNoAccessError } from '../domain/authErrors.js';
+import { PersonalProjectsLimitedError, ProjectNotFoundError, ServerNoAccessError, ServerNoSessionError, ServerNotEnoughPermissionsError, WorkspaceLimitsReachedError, WorkspaceNoAccessError, WorkspaceNoEditorSeatError, WorkspaceNotEnoughPermissionsError, WorkspacePlanNoFeatureAccessError, WorkspaceReadOnlyError, WorkspacesNotEnabledError, WorkspaceSsoSessionNoAccessError } from '../domain/authErrors.js';
 import { Loaders } from '../domain/loaders.js';
 import { WorkspaceRoles } from '../../core/constants.js';
 import { MaybeUserContext, MaybeWorkspaceContext, ProjectContext, WorkspaceContext } from '../domain/context.js';
+import { WorkspacePlanFeatures } from '../../workspaces/helpers/features.js';
 /**
  * Ensure user has a workspace role, and a valid SSO session (if SSO is configured)
  */
@@ -34,4 +35,11 @@ export declare const ensureModelCanBeCreatedFragment: AuthPolicyEnsureFragment<t
      */
     addedModelCount?: number;
 }, InstanceType<typeof WorkspaceNoAccessError | typeof WorkspaceReadOnlyError | typeof WorkspaceLimitsReachedError | typeof ProjectNotFoundError | typeof PersonalProjectsLimitedError>>;
+export declare const ensureUserIsWorkspaceAdminFragment: AuthPolicyEnsureFragment<typeof Loaders.getEnv | typeof Loaders.getServerRole | typeof Loaders.getWorkspace | typeof Loaders.getWorkspaceRole | typeof Loaders.getWorkspaceSsoProvider | typeof Loaders.getWorkspaceSsoSession | typeof Loaders.getWorkspacePlan, WorkspaceContext & MaybeUserContext, InstanceType<typeof WorkspaceNoAccessError | typeof WorkspaceSsoSessionNoAccessError | typeof WorkspacesNotEnabledError | typeof ServerNoSessionError | typeof ServerNoAccessError | typeof ServerNotEnoughPermissionsError | typeof WorkspaceNotEnoughPermissionsError>>;
+/**
+ * Check if workspace has access to a specific feature
+ */
+export declare const ensureCanUseWorkspacePlanFeatureFragment: AuthPolicyEnsureFragment<typeof Loaders.getWorkspacePlan | typeof Loaders.getEnv, WorkspaceContext & {
+    feature: WorkspacePlanFeatures;
+}, InstanceType<typeof WorkspaceNoAccessError> | InstanceType<typeof WorkspaceReadOnlyError> | InstanceType<typeof WorkspacePlanNoFeatureAccessError> | InstanceType<typeof WorkspacesNotEnabledError>>;
 //# sourceMappingURL=workspaces.d.ts.map

package/dist/commonjs/authz/fragments/workspaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspaces.d.ts","sourceRoot":"","sources":["../../../../src/authz/fragments/workspaces.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAKhE,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,2BAA2B,EAC3B,sBAAsB,EACtB,0BAA0B,EAC1B,kCAAkC,EAClC,sBAAsB,EACtB,yBAAyB,EACzB,gCAAgC,EACjC,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAC9C,OAAO,EAAS,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAC/D,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EACjB,MAAM,sBAAsB,CAAA;AAI7B;;GAEG;AACH,eAAO,MAAM,qCAAqC,EAAE,wBAAwB,CACxE,kBAAkB,GAClB,yBAAyB,GACzB,wBAAwB,GACxB,cAAc,EAChB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,cAAc,CAAA;CAAE,EAC9D,YAAY,CACR,OAAO,gCAAgC,GACvC,OAAO,sBAAsB,GAC7B,OAAO,kCAAkC,CAC5C,CA2DA,CAAA;AAEH;;GAEG;AACH,eAAO,MAAM,+BAA+B,EAAE,wBAAwB,CACpE,OAAO,OAAO,CAAC,MAAM,EAErB,EAAE,EACF,YAAY,CAAC,OAAO,yBAAyB,CAAC,CAK/C,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,kCAAkC,EAAE,wBAAwB,CACvE,OAAO,OAAO,CAAC,gBAAgB,EAC/B,gBAAgB,EAChB,YAAY,CAAC,OAAO,sBAAsB,GAAG,OAAO,sBAAsB,CAAC,CAU1E,CAAA;AAEH;;;GAGG;AACH,eAAO,MAAM,0CAA0C,EAAE,wBAAwB,CAC7E,OAAO,OAAO,CAAC,gBAAgB,GAC/B,OAAO,OAAO,CAAC,gBAAgB,GAC/B,OAAO,OAAO,CAAC,gBAAgB,GAC/B,OAAO,OAAO,CAAC,kBAAkB,GACjC,OAAO,OAAO,CAAC,wBAAwB,EACzC,gBAAgB,GAAG,gBAAgB,EACnC,YAAY,CACR,OAAO,sBAAsB,GAC7B,OAAO,sBAAsB,GAC7B,OAAO,2BAA2B,GAClC,OAAO,0BAA0B,GACjC,OAAO,kCAAkC,CAC5C,CA2DA,CAAA;AAEH;;;GAGG;AACH,eAAO,MAAM,+BAA+B,EAAE,wBAAwB,CAClE,OAAO,OAAO,CAAC,MAAM,GACrB,OAAO,OAAO,CAAC,gBAAgB,GAC/B,OAAO,OAAO,CAAC,gBAAgB,GAC/B,OAAO,OAAO,CAAC,kBAAkB,GACjC,OAAO,OAAO,CAAC,UAAU,GACzB,OAAO,OAAO,CAAC,sBAAsB,EACvC,cAAc,GACZ,qBAAqB,GACrB,gBAAgB,GAAG;IACjB;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB,EACH,YAAY,CACR,OAAO,sBAAsB,GAC7B,OAAO,sBAAsB,GAC7B,OAAO,2BAA2B,GAClC,OAAO,oBAAoB,GAC3B,OAAO,4BAA4B,CACtC,CAmEA,CAAA"}
+{"version":3,"file":"workspaces.d.ts","sourceRoot":"","sources":["../../../../src/authz/fragments/workspaces.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAKhE,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,+BAA+B,EAC/B,2BAA2B,EAC3B,sBAAsB,EACtB,0BAA0B,EAC1B,kCAAkC,EAClC,iCAAiC,EACjC,sBAAsB,EACtB,yBAAyB,EACzB,gCAAgC,EACjC,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAC9C,OAAO,EAAS,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAC/D,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EACjB,MAAM,sBAAsB,CAAA;AAI7B,OAAO,EACL,qBAAqB,EAEtB,MAAM,sCAAsC,CAAA;AAE7C;;GAEG;AACH,eAAO,MAAM,qCAAqC,EAAE,wBAAwB,CACxE,kBAAkB,GAClB,yBAAyB,GACzB,wBAAwB,GACxB,cAAc,EAChB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,cAAc,CAAA;CAAE,EAC9D,YAAY,CACR,OAAO,gCAAgC,GACvC,OAAO,sBAAsB,GAC7B,OAAO,kCAAkC,CAC5C,CA2DA,CAAA;AAEH;;GAEG;AACH,eAAO,MAAM,+BAA+B,EAAE,wBAAwB,CACpE,OAAO,OAAO,CAAC,MAAM,EAErB,EAAE,EACF,YAAY,CAAC,OAAO,yBAAyB,CAAC,CAK/C,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,kCAAkC,EAAE,wBAAwB,CACvE,OAAO,OAAO,CAAC,gBAAgB,EAC/B,gBAAgB,EAChB,YAAY,CAAC,OAAO,sBAAsB,GAAG,OAAO,sBAAsB,CAAC,CAU1E,CAAA;AAEH;;;GAGG;AACH,eAAO,MAAM,0CAA0C,EAAE,wBAAwB,CAC7E,OAAO,OAAO,CAAC,gBAAgB,GAC/B,OAAO,OAAO,CAAC,gBAAgB,GAC/B,OAAO,OAAO,CAAC,gBAAgB,GAC/B,OAAO,OAAO,CAAC,kBAAkB,GACjC,OAAO,OAAO,CAAC,wBAAwB,EACzC,gBAAgB,GAAG,gBAAgB,EACnC,YAAY,CACR,OAAO,sBAAsB,GAC7B,OAAO,sBAAsB,GAC7B,OAAO,2BAA2B,GAClC,OAAO,0BAA0B,GACjC,OAAO,kCAAkC,CAC5C,CA2DA,CAAA;AAEH;;;GAGG;AACH,eAAO,MAAM,+BAA+B,EAAE,wBAAwB,CAClE,OAAO,OAAO,CAAC,MAAM,GACrB,OAAO,OAAO,CAAC,gBAAgB,GAC/B,OAAO,OAAO,CAAC,gBAAgB,GAC/B,OAAO,OAAO,CAAC,kBAAkB,GACjC,OAAO,OAAO,CAAC,UAAU,GACzB,OAAO,OAAO,CAAC,sBAAsB,EACvC,cAAc,GACZ,qBAAqB,GACrB,gBAAgB,GAAG;IACjB;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB,EACH,YAAY,CACR,OAAO,sBAAsB,GAC7B,OAAO,sBAAsB,GAC7B,OAAO,2BAA2B,GAClC,OAAO,oBAAoB,GAC3B,OAAO,4BAA4B,CACtC,CAmEA,CAAA;AAEH,eAAO,MAAM,kCAAkC,EAAE,wBAAwB,CACrE,OAAO,OAAO,CAAC,MAAM,GACrB,OAAO,OAAO,CAAC,aAAa,GAC5B,OAAO,OAAO,CAAC,YAAY,GAC3B,OAAO,OAAO,CAAC,gBAAgB,GAC/B,OAAO,OAAO,CAAC,uBAAuB,GACtC,OAAO,OAAO,CAAC,sBAAsB,GACrC,OAAO,OAAO,CAAC,gBAAgB,EACjC,gBAAgB,GAAG,gBAAgB,EACnC,YAAY,CACR,OAAO,sBAAsB,GAC7B,OAAO,gCAAgC,GACvC,OAAO,yBAAyB,GAChC,OAAO,oBAAoB,GAC3B,OAAO,mBAAmB,GAC1B,OAAO,+BAA+B,GACtC,OAAO,kCAAkC,CAC5C,CAuBA,CAAA;AAEH;;GAEG;AACH,eAAO,MAAM,wCAAwC,EAAE,wBAAwB,CAC7E,OAAO,OAAO,CAAC,gBAAgB,GAAG,OAAO,OAAO,CAAC,MAAM,EACvD,gBAAgB,GAAG;IAAE,OAAO,EAAE,qBAAqB,CAAA;CAAE,EACnD,YAAY,CAAC,OAAO,sBAAsB,CAAC,GAC3C,YAAY,CAAC,OAAO,sBAAsB,CAAC,GAC3C,YAAY,CAAC,OAAO,iCAAiC,CAAC,GACtD,YAAY,CAAC,OAAO,yBAAyB,CAAC,CAsB/C,CAAA"}

package/dist/commonjs/authz/fragments/workspaces.js

@@ -1,12 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ensureModelCanBeCreatedFragment = exports.ensureWorkspaceProjectCanBeCreatedFragment = exports.ensureWorkspaceNotReadOnlyFragment = exports.ensureWorkspacesEnabledFragment = exports.ensureWorkspaceRoleAndSessionFragment = void 0;
+exports.ensureCanUseWorkspacePlanFeatureFragment = exports.ensureUserIsWorkspaceAdminFragment = exports.ensureModelCanBeCreatedFragment = exports.ensureWorkspaceProjectCanBeCreatedFragment = exports.ensureWorkspaceNotReadOnlyFragment = exports.ensureWorkspacesEnabledFragment = exports.ensureWorkspaceRoleAndSessionFragment = void 0;
 const result_1 = require("true-myth/result");
 const workspaceRole_js_1 = require("../checks/workspaceRole.js");
 const authErrors_js_1 = require("../domain/authErrors.js");
 const constants_js_1 = require("../../core/constants.js");
 const plans_js_1 = require("../../workspaces/helpers/plans.js");
 const workspaceSeat_js_1 = require("../checks/workspaceSeat.js");
+const server_js_1 = require("./server.js");
+const features_js_1 = require("../../workspaces/helpers/features.js");
 /**
  * Ensure user has a workspace role, and a valid SSO session (if SSO is configured)
  */
@@ -190,4 +192,48 @@ const ensureModelCanBeCreatedFragment = (loaders) => async ({ projectId, userId,
     }
 };
 exports.ensureModelCanBeCreatedFragment = ensureModelCanBeCreatedFragment;
+const ensureUserIsWorkspaceAdminFragment = (loaders) => async ({ userId, workspaceId }) => {
+    const ensuredWorkspacesEnabled = await (0, exports.ensureWorkspacesEnabledFragment)(loaders)({});
+    if (ensuredWorkspacesEnabled.isErr)
+        return (0, result_1.err)(ensuredWorkspacesEnabled.error);
+    const ensuredServerRole = await (0, server_js_1.ensureMinimumServerRoleFragment)(loaders)({
+        userId,
+        role: constants_js_1.Roles.Server.User
+    });
+    if (ensuredServerRole.isErr)
+        return (0, result_1.err)(ensuredServerRole.error);
+    const ensuredWorkspaceAccess = await (0, exports.ensureWorkspaceRoleAndSessionFragment)(loaders)({
+        userId: userId,
+        workspaceId,
+        role: constants_js_1.Roles.Workspace.Admin
+    });
+    if (ensuredWorkspaceAccess.isErr)
+        return (0, result_1.err)(ensuredWorkspaceAccess.error);
+    return (0, result_1.ok)();
+};
+exports.ensureUserIsWorkspaceAdminFragment = ensureUserIsWorkspaceAdminFragment;
+/**
+ * Check if workspace has access to a specific feature
+ */
+const ensureCanUseWorkspacePlanFeatureFragment = (loaders) => async ({ workspaceId, feature }) => {
+    const ensuredWorkspacesEnabled = await (0, exports.ensureWorkspacesEnabledFragment)(loaders)({});
+    if (ensuredWorkspacesEnabled.isErr)
+        return (0, result_1.err)(ensuredWorkspacesEnabled.error);
+    const ensuredNotReadOnly = await (0, exports.ensureWorkspaceNotReadOnlyFragment)(loaders)({
+        workspaceId
+    });
+    if (ensuredNotReadOnly.isErr)
+        return (0, result_1.err)(ensuredNotReadOnly.error);
+    const workspacePlan = await loaders.getWorkspacePlan({ workspaceId });
+    if (!workspacePlan)
+        return (0, result_1.err)(new authErrors_js_1.WorkspaceNoAccessError());
+    const featureFlags = await loaders.getEnv();
+    const canUseFeature = (0, features_js_1.workspacePlanHasAccessToFeature)({
+        plan: workspacePlan.name,
+        feature,
+        featureFlags
+    });
+    return canUseFeature ? (0, result_1.ok)() : (0, result_1.err)(new authErrors_js_1.WorkspacePlanNoFeatureAccessError());
+};
+exports.ensureCanUseWorkspacePlanFeatureFragment = ensureCanUseWorkspacePlanFeatureFragment;
 //# sourceMappingURL=workspaces.js.map

package/dist/commonjs/authz/fragments/workspaces.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspaces.js","sourceRoot":"","sources":["../../../../src/authz/fragments/workspaces.ts"],"names":[],"mappings":";;;AAAA,6CAA0C;AAE1C,iEAGmC;AACnC,2DAUgC;AAEhC,0DAA+D;AAO/D,gEAAiF;AACjF,iEAA0D;AAE1D;;GAEG;AACI,MAAM,qCAAqC,GAYhD,CAAC,OAAO,EAAE,EAAE,CACZ,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE;IACtC,MAAM,UAAU,GAAG,IAAI,IAAI,oBAAK,CAAC,SAAS,CAAC,KAAK,CAAA;IAChD,MAAM,qBAAqB,GAAG,UAAU,KAAK,oBAAK,CAAC,SAAS,CAAC,KAAK,CAAA;IAElE,gEAAgE;IAChE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;IAC7D,oDAAoD;IACpD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAA,YAAG,EAAC,IAAI,sCAAsB,EAAE,CAAC,CAAA;IAExD,MAAM,cAAc,GAAG,MAAM,IAAA,0CAAuB,EAAC,OAAO,CAAC,CAAC;QAC5D,MAAM;QACN,WAAW;QACX,IAAI,EAAE,UAAU;KACjB,CAAC,CAAA;IACF,IAAI,CAAC,cAAc;QACjB,OAAO,IAAA,YAAG,EACR,qBAAqB;YACnB,CAAC,CAAC,IAAI,sCAAsB,EAAE;YAC9B,CAAC,CAAC,IAAI,kDAAkC,EAAE,CAC7C,CAAA;IAEH,MAAM,oBAAoB,GAAG,MAAM,IAAA,0CAAuB,EAAC,OAAO,CAAC,CAAC;QAClE,MAAM;QACN,WAAW;QACX,IAAI,EAAE,kBAAkB;KACzB,CAAC,CAAA;IACF,yCAAyC;IACzC,IAAI,CAAC,oBAAoB;QAAE,OAAO,IAAA,WAAE,GAAE,CAAA;IAEtC,MAAM,oBAAoB,GAAG,MAAM,OAAO,CAAC,uBAAuB,CAAC;QACjE,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,oBAAoB;QAAE,OAAO,IAAA,WAAE,GAAE,CAAA;IAEtC,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,sBAAsB,CAAC;QAC/D,MAAM;QACN,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,mBAAmB;QACtB,OAAO,IAAA,YAAG,EACR,IAAI,gDAAgC,CAAC;YACnC,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,CAAC,IAAI,EAAE;SAC3C,CAAC,CACH,CAAA;IAEH,MAAM,gBAAgB,GACpB,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,mBAAmB,CAAC,UAAU,CAAC,OAAO,EAAE,CAAA;IAEjE,IAAI,gBAAgB;QAClB,OAAO,IAAA,YAAG,EACR,IAAI,gDAAgC,CAAC;YACnC,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,CAAC,IAAI,EAAE;SAC3C,CAAC,CACH,CAAA;IAEH,OAAO,IAAA,WAAE,GAAE,CAAA;AACb,CAAC,CAAA;AArEU,QAAA,qCAAqC,yCAqE/C;AAEH;;GAEG;AACI,MAAM,+BAA+B,GAKxC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE;IAC1B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAA;IAClC,IAAI,CAAC,GAAG,CAAC,4BAA4B;QAAE,OAAO,IAAA,YAAG,EAAC,IAAI,yCAAyB,EAAE,CAAC,CAAA;IAClF,OAAO,IAAA,WAAE,GAAE,CAAA;AACb,CAAC,CAAA;AATY,QAAA,+BAA+B,mCAS3C;AAED;;GAEG;AACI,MAAM,kCAAkC,GAK7C,CAAC,OAAO,EAAE,EAAE,CACZ,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;IACxB,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;IACrE,IAAI,CAAC,aAAa;QAAE,OAAO,IAAA,YAAG,EAAC,IAAI,sCAAsB,EAAE,CAAC,CAAA;IAC5D,IAAI,IAAA,wCAA6B,EAAC,aAAa,CAAC,MAAM,CAAC;QACrD,OAAO,IAAA,YAAG,EAAC,IAAI,sCAAsB,EAAE,CAAC,CAAA;IAE1C,OAAO,IAAA,WAAE,GAAE,CAAA;AACb,CAAC,CAAA;AAbU,QAAA,kCAAkC,sCAa5C;AAEH;;;GAGG;AACI,MAAM,0CAA0C,GAerD,CAAC,OAAO,EAAE,EAAE,CACZ,KAAK,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE;IAChC,mCAAmC;IACnC,IAAI,MAAM,EAAE,CAAC;QACX,aAAa;QACb,MAAM,UAAU,GAAG,MAAM,IAAA,0CAAuB,EAAC,OAAO,CAAC,CAAC;YACxD,MAAM;YACN,WAAW;YACX,IAAI,EAAE,oBAAK,CAAC,SAAS,CAAC,MAAM;SAC7B,CAAC,CAAA;QACF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAA,YAAG,EACR,IAAI,kDAAkC,CACpC,gDAAgD,CACjD,CACF,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,kBAAkB,GAAG,MAAM,IAAA,0CAAkC,EAAC,OAAO,CAAC,CAAC;QAC3E,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,kBAAkB,CAAC,KAAK;QAAE,OAAO,IAAA,YAAG,EAAC,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAElE,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;IACrE,IAAI,CAAC,aAAa;QAAE,OAAO,IAAA,YAAG,EAAC,IAAI,sCAAsB,EAAE,CAAC,CAAA;IAE5D,wBAAwB;IACxB,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,MAAM,IAAA,gCAAa,EAAC,OAAO,CAAC,CAAC;YAC5C,MAAM;YACN,WAAW;SACZ,CAAC,CAAA;QACF,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAA,YAAG,EAAC,IAAI,0CAA0B,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;IACzE,IAAI,CAAC,eAAe;QAAE,OAAO,IAAA,YAAG,EAAC,IAAI,sCAAsB,EAAE,CAAC,CAAA;IAE9D,oBAAoB;IACpB,IAAI,eAAe,CAAC,YAAY,KAAK,IAAI;QAAE,OAAO,IAAA,WAAE,GAAE,CAAA;IACtD,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,wBAAwB,CAAC;QACjE,WAAW;KACZ,CAAC,CAAA;IAEF,mCAAmC;IACnC,IAAI,mBAAmB,KAAK,IAAI;QAAE,OAAO,IAAA,YAAG,EAAC,IAAI,sCAAsB,EAAE,CAAC,CAAA;IAE1E,OAAO,mBAAmB,GAAG,eAAe,CAAC,YAAY;QACvD,CAAC,CAAC,IAAA,WAAE,GAAE;QACN,CAAC,CAAC,IAAA,YAAG,EACD,IAAI,2CAA2B,CAAC;YAC9B,OAAO,EACL,wFAAwF;YAC1F,OAAO,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE;SACnC,CAAC,CACH,CAAA;AACP,CAAC,CAAA;AAxEU,QAAA,0CAA0C,8CAwEpD;AAEH;;;GAGG;AACI,MAAM,+BAA+B,GAuB1C,CAAC,OAAO,EAAE,EAAE,CACZ,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,EAAE,EAAE;IAC5D,eAAe,GAAG,eAAe,IAAI,CAAC,CAAA;IAEtC,MAAM,EAAE,4BAA4B,EAAE,mCAAmC,EAAE,GACzE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAA;IACxB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;IACvD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAA,YAAG,EAAC,IAAI,oCAAoB,EAAE,CAAC,CAAA;IAEpD,wFAAwF;IACxF,WAAW,GAAG,WAAW,IAAI,OAAO,CAAC,WAAW,IAAI,SAAS,CAAA;IAE7D,eAAe;IACf,IAAI,WAAW,IAAI,4BAA4B,EAAE,CAAC;QAChD,IAAI,MAAM,EAAE,CAAC;YACX,qBAAqB;YACrB,MAAM,aAAa,GAAG,MAAM,IAAA,sCAAmB,EAAC,OAAO,CAAC,CAAC;gBACvD,MAAM;gBACN,WAAW;aACZ,CAAC,CAAA;YACF,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,OAAO,IAAA,YAAG,EAAC,IAAI,sCAAsB,EAAE,CAAC,CAAA;YAC1C,CAAC;QACH,CAAC;QAED,MAAM,kBAAkB,GAAG,MAAM,IAAA,0CAAkC,EAAC,OAAO,CAAC,CAAC;YAC3E,WAAW;SACZ,CAAC,CAAA;QACF,IAAI,kBAAkB,CAAC,KAAK;YAAE,OAAO,IAAA,YAAG,EAAC,kBAAkB,CAAC,KAAK,CAAC,CAAA;QAElE,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;QACrE,IAAI,CAAC,aAAa;YAAE,OAAO,IAAA,YAAG,EAAC,IAAI,sCAAsB,EAAE,CAAC,CAAA;QAE5D,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;QACzE,IAAI,CAAC,eAAe;YAAE,OAAO,IAAA,YAAG,EAAC,IAAI,sCAAsB,EAAE,CAAC,CAAA;QAE9D,IAAI,eAAe,CAAC,UAAU,KAAK,IAAI;YAAE,OAAO,IAAA,WAAE,GAAE,CAAA;QAEpD,MAAM,iBAAiB,GAAG,MAAM,OAAO,CAAC,sBAAsB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;QAE/E,IAAI,iBAAiB,KAAK,IAAI;YAAE,OAAO,IAAA,YAAG,EAAC,IAAI,sCAAsB,EAAE,CAAC,CAAA;QAExE,OAAO,iBAAiB,GAAG,eAAe,IAAI,eAAe,CAAC,UAAU;YACtE,CAAC,CAAC,IAAA,WAAE,GAAE;YACN,CAAC,CAAC,IAAA,YAAG,EACD,IAAI,2CAA2B,CAAC;gBAC9B,OAAO,EACL,sFAAsF;gBACxF,OAAO,EAAE;oBACP,KAAK,EAAE,YAAY;iBACpB;aACF,CAAC,CACH,CAAA;IACP,CAAC;SAAM,CAAC;QACN,yCAAyC;QACzC,IAAI,mCAAmC,EAAE,CAAC;YACxC,OAAO,IAAA,YAAG,EACR,IAAI,4CAA4B,CAC9B,iDAAiD,CAClD,CACF,CAAA;QACH,CAAC;QAED,OAAO,IAAA,WAAE,GAAE,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAxFU,QAAA,+BAA+B,mCAwFzC"}
+{"version":3,"file":"workspaces.js","sourceRoot":"","sources":["../../../../src/authz/fragments/workspaces.ts"],"names":[],"mappings":";;;AAAA,6CAA0C;AAE1C,iEAGmC;AACnC,2DAcgC;AAEhC,0DAA+D;AAO/D,gEAAiF;AACjF,iEAA0D;AAC1D,2CAA6D;AAC7D,sEAG6C;AAE7C;;GAEG;AACI,MAAM,qCAAqC,GAYhD,CAAC,OAAO,EAAE,EAAE,CACZ,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE;IACtC,MAAM,UAAU,GAAG,IAAI,IAAI,oBAAK,CAAC,SAAS,CAAC,KAAK,CAAA;IAChD,MAAM,qBAAqB,GAAG,UAAU,KAAK,oBAAK,CAAC,SAAS,CAAC,KAAK,CAAA;IAElE,gEAAgE;IAChE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;IAC7D,oDAAoD;IACpD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAA,YAAG,EAAC,IAAI,sCAAsB,EAAE,CAAC,CAAA;IAExD,MAAM,cAAc,GAAG,MAAM,IAAA,0CAAuB,EAAC,OAAO,CAAC,CAAC;QAC5D,MAAM;QACN,WAAW;QACX,IAAI,EAAE,UAAU;KACjB,CAAC,CAAA;IACF,IAAI,CAAC,cAAc;QACjB,OAAO,IAAA,YAAG,EACR,qBAAqB;YACnB,CAAC,CAAC,IAAI,sCAAsB,EAAE;YAC9B,CAAC,CAAC,IAAI,kDAAkC,EAAE,CAC7C,CAAA;IAEH,MAAM,oBAAoB,GAAG,MAAM,IAAA,0CAAuB,EAAC,OAAO,CAAC,CAAC;QAClE,MAAM;QACN,WAAW;QACX,IAAI,EAAE,kBAAkB;KACzB,CAAC,CAAA;IACF,yCAAyC;IACzC,IAAI,CAAC,oBAAoB;QAAE,OAAO,IAAA,WAAE,GAAE,CAAA;IAEtC,MAAM,oBAAoB,GAAG,MAAM,OAAO,CAAC,uBAAuB,CAAC;QACjE,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,oBAAoB;QAAE,OAAO,IAAA,WAAE,GAAE,CAAA;IAEtC,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,sBAAsB,CAAC;QAC/D,MAAM;QACN,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,mBAAmB;QACtB,OAAO,IAAA,YAAG,EACR,IAAI,gDAAgC,CAAC;YACnC,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,CAAC,IAAI,EAAE;SAC3C,CAAC,CACH,CAAA;IAEH,MAAM,gBAAgB,GACpB,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,mBAAmB,CAAC,UAAU,CAAC,OAAO,EAAE,CAAA;IAEjE,IAAI,gBAAgB;QAClB,OAAO,IAAA,YAAG,EACR,IAAI,gDAAgC,CAAC;YACnC,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,CAAC,IAAI,EAAE;SAC3C,CAAC,CACH,CAAA;IAEH,OAAO,IAAA,WAAE,GAAE,CAAA;AACb,CAAC,CAAA;AArEU,QAAA,qCAAqC,yCAqE/C;AAEH;;GAEG;AACI,MAAM,+BAA+B,GAKxC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE;IAC1B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAA;IAClC,IAAI,CAAC,GAAG,CAAC,4BAA4B;QAAE,OAAO,IAAA,YAAG,EAAC,IAAI,yCAAyB,EAAE,CAAC,CAAA;IAClF,OAAO,IAAA,WAAE,GAAE,CAAA;AACb,CAAC,CAAA;AATY,QAAA,+BAA+B,mCAS3C;AAED;;GAEG;AACI,MAAM,kCAAkC,GAK7C,CAAC,OAAO,EAAE,EAAE,CACZ,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;IACxB,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;IACrE,IAAI,CAAC,aAAa;QAAE,OAAO,IAAA,YAAG,EAAC,IAAI,sCAAsB,EAAE,CAAC,CAAA;IAC5D,IAAI,IAAA,wCAA6B,EAAC,aAAa,CAAC,MAAM,CAAC;QACrD,OAAO,IAAA,YAAG,EAAC,IAAI,sCAAsB,EAAE,CAAC,CAAA;IAE1C,OAAO,IAAA,WAAE,GAAE,CAAA;AACb,CAAC,CAAA;AAbU,QAAA,kCAAkC,sCAa5C;AAEH;;;GAGG;AACI,MAAM,0CAA0C,GAerD,CAAC,OAAO,EAAE,EAAE,CACZ,KAAK,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE;IAChC,mCAAmC;IACnC,IAAI,MAAM,EAAE,CAAC;QACX,aAAa;QACb,MAAM,UAAU,GAAG,MAAM,IAAA,0CAAuB,EAAC,OAAO,CAAC,CAAC;YACxD,MAAM;YACN,WAAW;YACX,IAAI,EAAE,oBAAK,CAAC,SAAS,CAAC,MAAM;SAC7B,CAAC,CAAA;QACF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAA,YAAG,EACR,IAAI,kDAAkC,CACpC,gDAAgD,CACjD,CACF,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,kBAAkB,GAAG,MAAM,IAAA,0CAAkC,EAAC,OAAO,CAAC,CAAC;QAC3E,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,kBAAkB,CAAC,KAAK;QAAE,OAAO,IAAA,YAAG,EAAC,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAElE,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;IACrE,IAAI,CAAC,aAAa;QAAE,OAAO,IAAA,YAAG,EAAC,IAAI,sCAAsB,EAAE,CAAC,CAAA;IAE5D,wBAAwB;IACxB,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,MAAM,IAAA,gCAAa,EAAC,OAAO,CAAC,CAAC;YAC5C,MAAM;YACN,WAAW;SACZ,CAAC,CAAA;QACF,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAA,YAAG,EAAC,IAAI,0CAA0B,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;IACzE,IAAI,CAAC,eAAe;QAAE,OAAO,IAAA,YAAG,EAAC,IAAI,sCAAsB,EAAE,CAAC,CAAA;IAE9D,oBAAoB;IACpB,IAAI,eAAe,CAAC,YAAY,KAAK,IAAI;QAAE,OAAO,IAAA,WAAE,GAAE,CAAA;IACtD,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,wBAAwB,CAAC;QACjE,WAAW;KACZ,CAAC,CAAA;IAEF,mCAAmC;IACnC,IAAI,mBAAmB,KAAK,IAAI;QAAE,OAAO,IAAA,YAAG,EAAC,IAAI,sCAAsB,EAAE,CAAC,CAAA;IAE1E,OAAO,mBAAmB,GAAG,eAAe,CAAC,YAAY;QACvD,CAAC,CAAC,IAAA,WAAE,GAAE;QACN,CAAC,CAAC,IAAA,YAAG,EACD,IAAI,2CAA2B,CAAC;YAC9B,OAAO,EACL,wFAAwF;YAC1F,OAAO,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE;SACnC,CAAC,CACH,CAAA;AACP,CAAC,CAAA;AAxEU,QAAA,0CAA0C,8CAwEpD;AAEH;;;GAGG;AACI,MAAM,+BAA+B,GAuB1C,CAAC,OAAO,EAAE,EAAE,CACZ,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,EAAE,EAAE;IAC5D,eAAe,GAAG,eAAe,IAAI,CAAC,CAAA;IAEtC,MAAM,EAAE,4BAA4B,EAAE,mCAAmC,EAAE,GACzE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAA;IACxB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;IACvD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAA,YAAG,EAAC,IAAI,oCAAoB,EAAE,CAAC,CAAA;IAEpD,wFAAwF;IACxF,WAAW,GAAG,WAAW,IAAI,OAAO,CAAC,WAAW,IAAI,SAAS,CAAA;IAE7D,eAAe;IACf,IAAI,WAAW,IAAI,4BAA4B,EAAE,CAAC;QAChD,IAAI,MAAM,EAAE,CAAC;YACX,qBAAqB;YACrB,MAAM,aAAa,GAAG,MAAM,IAAA,sCAAmB,EAAC,OAAO,CAAC,CAAC;gBACvD,MAAM;gBACN,WAAW;aACZ,CAAC,CAAA;YACF,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,OAAO,IAAA,YAAG,EAAC,IAAI,sCAAsB,EAAE,CAAC,CAAA;YAC1C,CAAC;QACH,CAAC;QAED,MAAM,kBAAkB,GAAG,MAAM,IAAA,0CAAkC,EAAC,OAAO,CAAC,CAAC;YAC3E,WAAW;SACZ,CAAC,CAAA;QACF,IAAI,kBAAkB,CAAC,KAAK;YAAE,OAAO,IAAA,YAAG,EAAC,kBAAkB,CAAC,KAAK,CAAC,CAAA;QAElE,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;QACrE,IAAI,CAAC,aAAa;YAAE,OAAO,IAAA,YAAG,EAAC,IAAI,sCAAsB,EAAE,CAAC,CAAA;QAE5D,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;QACzE,IAAI,CAAC,eAAe;YAAE,OAAO,IAAA,YAAG,EAAC,IAAI,sCAAsB,EAAE,CAAC,CAAA;QAE9D,IAAI,eAAe,CAAC,UAAU,KAAK,IAAI;YAAE,OAAO,IAAA,WAAE,GAAE,CAAA;QAEpD,MAAM,iBAAiB,GAAG,MAAM,OAAO,CAAC,sBAAsB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;QAE/E,IAAI,iBAAiB,KAAK,IAAI;YAAE,OAAO,IAAA,YAAG,EAAC,IAAI,sCAAsB,EAAE,CAAC,CAAA;QAExE,OAAO,iBAAiB,GAAG,eAAe,IAAI,eAAe,CAAC,UAAU;YACtE,CAAC,CAAC,IAAA,WAAE,GAAE;YACN,CAAC,CAAC,IAAA,YAAG,EACD,IAAI,2CAA2B,CAAC;gBAC9B,OAAO,EACL,sFAAsF;gBACxF,OAAO,EAAE;oBACP,KAAK,EAAE,YAAY;iBACpB;aACF,CAAC,CACH,CAAA;IACP,CAAC;SAAM,CAAC;QACN,yCAAyC;QACzC,IAAI,mCAAmC,EAAE,CAAC;YACxC,OAAO,IAAA,YAAG,EACR,IAAI,4CAA4B,CAC9B,iDAAiD,CAClD,CACF,CAAA;QACH,CAAC;QAED,OAAO,IAAA,WAAE,GAAE,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAxFU,QAAA,+BAA+B,mCAwFzC;AAEI,MAAM,kCAAkC,GAmB7C,CAAC,OAAO,EAAE,EAAE,CACZ,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE;IAChC,MAAM,wBAAwB,GAAG,MAAM,IAAA,uCAA+B,EAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAA;IACnF,IAAI,wBAAwB,CAAC,KAAK;QAAE,OAAO,IAAA,YAAG,EAAC,wBAAwB,CAAC,KAAK,CAAC,CAAA;IAE9E,MAAM,iBAAiB,GAAG,MAAM,IAAA,2CAA+B,EAAC,OAAO,CAAC,CAAC;QACvE,MAAM;QACN,IAAI,EAAE,oBAAK,CAAC,MAAM,CAAC,IAAI;KACxB,CAAC,CAAA;IAEF,IAAI,iBAAiB,CAAC,KAAK;QAAE,OAAO,IAAA,YAAG,EAAC,iBAAiB,CAAC,KAAK,CAAC,CAAA;IAEhE,MAAM,sBAAsB,GAAG,MAAM,IAAA,6CAAqC,EAAC,OAAO,CAAC,CACjF;QACE,MAAM,EAAE,MAAO;QACf,WAAW;QACX,IAAI,EAAE,oBAAK,CAAC,SAAS,CAAC,KAAK;KAC5B,CACF,CAAA;IACD,IAAI,sBAAsB,CAAC,KAAK;QAAE,OAAO,IAAA,YAAG,EAAC,sBAAsB,CAAC,KAAK,CAAC,CAAA;IAC1E,OAAO,IAAA,WAAE,GAAE,CAAA;AACb,CAAC,CAAA;AAxCU,QAAA,kCAAkC,sCAwC5C;AAEH;;GAEG;AACI,MAAM,wCAAwC,GAQnD,CAAC,OAAO,EAAE,EAAE,CACZ,KAAK,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE;IACjC,MAAM,wBAAwB,GAAG,MAAM,IAAA,uCAA+B,EAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAA;IACnF,IAAI,wBAAwB,CAAC,KAAK;QAAE,OAAO,IAAA,YAAG,EAAC,wBAAwB,CAAC,KAAK,CAAC,CAAA;IAE9E,MAAM,kBAAkB,GAAG,MAAM,IAAA,0CAAkC,EAAC,OAAO,CAAC,CAAC;QAC3E,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,kBAAkB,CAAC,KAAK;QAAE,OAAO,IAAA,YAAG,EAAC,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAElE,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;IACrE,IAAI,CAAC,aAAa;QAAE,OAAO,IAAA,YAAG,EAAC,IAAI,sCAAsB,EAAE,CAAC,CAAA;IAE5D,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAA;IAC3C,MAAM,aAAa,GAAG,IAAA,6CAA+B,EAAC;QACpD,IAAI,EAAE,aAAa,CAAC,IAAI;QACxB,OAAO;QACP,YAAY;KACb,CAAC,CAAA;IACF,OAAO,aAAa,CAAC,CAAC,CAAC,IAAA,WAAE,GAAE,CAAC,CAAC,CAAC,IAAA,YAAG,EAAC,IAAI,iDAAiC,EAAE,CAAC,CAAA;AAC5E,CAAC,CAAA;AA5BU,QAAA,wCAAwC,4CA4BlD"}

package/dist/commonjs/authz/helpers/graphql.d.ts

@@ -4,7 +4,7 @@ export type GraphqlPermissionCheckResult = {
     authorized: boolean;
     code: string;
     message: string;
-    payload: unknown;
+    payload: Record<string, unknown> | null;
 };
 export declare const toGraphqlResult: (authResult: Result<unknown, AuthError<string, any>>) => GraphqlPermissionCheckResult;
 //# sourceMappingURL=graphql.d.ts.map

package/dist/commonjs/authz/helpers/graphql.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graphql.d.ts","sourceRoot":"","sources":["../../../../src/authz/helpers/graphql.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAEnD,MAAM,MAAM,4BAA4B,GAAG;IACzC,UAAU,EAAE,OAAO,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,eAAO,MAAM,eAAe,eACd,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,KAClD,4BAiBF,CAAA"}
+{"version":3,"file":"graphql.d.ts","sourceRoot":"","sources":["../../../../src/authz/helpers/graphql.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAEnD,MAAM,MAAM,4BAA4B,GAAG;IACzC,UAAU,EAAE,OAAO,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;CACxC,CAAA;AAED,eAAO,MAAM,eAAe,eACd,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,KAClD,4BAiBF,CAAA"}

package/dist/commonjs/authz/helpers/graphql.js

@@ -16,7 +16,7 @@ const toGraphqlResult = (authResult) => {
             authorized: false,
             code: error.code,
             message: error.message,
-            payload: error.payload || null
+            payload: (error.payload || null)
         };
     }
 };

package/dist/commonjs/authz/helpers/graphql.js.map

@@ -1 +1 @@
-{"version":3,"file":"graphql.js","sourceRoot":"","sources":["../../../../src/authz/helpers/graphql.ts"],"names":[],"mappings":";;;AAWO,MAAM,eAAe,GAAG,CAC7B,UAAmD,EACrB,EAAE;IAChC,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,IAAI;SACd,CAAA;IACH,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAA;QAC9B,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;SAC/B,CAAA;IACH,CAAC;AACH,CAAC,CAAA;AAnBY,QAAA,eAAe,mBAmB3B"}
+{"version":3,"file":"graphql.js","sourceRoot":"","sources":["../../../../src/authz/helpers/graphql.ts"],"names":[],"mappings":";;;AAWO,MAAM,eAAe,GAAG,CAC7B,UAAmD,EACrB,EAAE;IAChC,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,IAAI;SACd,CAAA;IACH,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAA;QAC9B,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAmC;SACnE,CAAA;IACH,CAAC;AACH,CAAC,CAAA;AAnBY,QAAA,eAAe,mBAmB3B"}

package/dist/commonjs/authz/index.d.ts

@@ -4,4 +4,5 @@ export * from './helpers/graphql.js';
 export * from './domain/authErrors.js';
 export { AuthPolicyResult } from './domain/policies.js';
 export { PersonalProjectsLimits } from './domain/projects/limits.js';
+export * from './domain/workspaces/operations.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/commonjs/authz/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/authz/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvE,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,0BAA0B,EAC3B,MAAM,qBAAqB,CAAA;AAC5B,cAAc,sBAAsB,CAAA;AACpC,cAAc,wBAAwB,CAAA;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/authz/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvE,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,0BAA0B,EAC3B,MAAM,qBAAqB,CAAA;AAC5B,cAAc,sBAAsB,CAAA;AACpC,cAAc,wBAAwB,CAAA;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACpE,cAAc,mCAAmC,CAAA"}

package/dist/commonjs/authz/index.js

@@ -23,4 +23,5 @@ __exportStar(require("./helpers/graphql.js"), exports);
 __exportStar(require("./domain/authErrors.js"), exports);
 var limits_js_1 = require("./domain/projects/limits.js");
 Object.defineProperty(exports, "PersonalProjectsLimits", { enumerable: true, get: function () { return limits_js_1.PersonalProjectsLimits; } });
+__exportStar(require("./domain/workspaces/operations.js"), exports);
 //# sourceMappingURL=index.js.map

package/dist/commonjs/authz/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/authz/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,gDAAuE;AAA9D,+GAAA,mBAAmB,OAAA;AAC5B,kDAI4B;AAD1B,wHAAA,0BAA0B,OAAA;AAE5B,uDAAoC;AACpC,yDAAsC;AAEtC,yDAAoE;AAA3D,mHAAA,sBAAsB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/authz/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,gDAAuE;AAA9D,+GAAA,mBAAmB,OAAA;AAC5B,kDAI4B;AAD1B,wHAAA,0BAA0B,OAAA;AAE5B,uDAAoC;AACpC,yDAAsC;AAEtC,yDAAoE;AAA3D,mHAAA,sBAAsB,OAAA;AAC/B,oEAAiD"}

package/dist/commonjs/authz/policies/automate/function/canEditFunction.d.ts

@@ -0,0 +1,10 @@
+import { AutomateFunctionNotCreatorError, AutomateFunctionNotFoundError, AutomateNotEnabledError } from '../../../domain/authErrors.js';
+import { AutomateFunctionContext, MaybeUserContext } from '../../../domain/context.js';
+import { AuthCheckContextLoaderKeys } from '../../../domain/loaders.js';
+import { AuthPolicy } from '../../../domain/policies.js';
+type PolicyLoaderKeys = typeof AuthCheckContextLoaderKeys.getEnv | typeof AuthCheckContextLoaderKeys.getAutomateFunction;
+type PolicyArgs = MaybeUserContext & AutomateFunctionContext;
+type PolicyErrors = InstanceType<typeof AutomateNotEnabledError | typeof AutomateFunctionNotFoundError | typeof AutomateFunctionNotCreatorError>;
+export declare const canEditFunctionPolicy: AuthPolicy<PolicyLoaderKeys, PolicyArgs, PolicyErrors>;
+export {};
+//# sourceMappingURL=canEditFunction.d.ts.map

package/dist/commonjs/authz/policies/automate/function/canEditFunction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canEditFunction.d.ts","sourceRoot":"","sources":["../../../../../../src/authz/policies/automate/function/canEditFunction.ts"],"names":[],"mappings":"AACA,OAAO,EACL,+BAA+B,EAC/B,6BAA6B,EAC7B,uBAAuB,EACxB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AACtF,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAA;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAA;AAMxD,KAAK,gBAAgB,GACjB,OAAO,0BAA0B,CAAC,MAAM,GACxC,OAAO,0BAA0B,CAAC,mBAAmB,CAAA;AAEzD,KAAK,UAAU,GAAG,gBAAgB,GAAG,uBAAuB,CAAA;AAE5D,KAAK,YAAY,GAAG,YAAY,CAC5B,OAAO,uBAAuB,GAC9B,OAAO,6BAA6B,GACpC,OAAO,+BAA+B,CACzC,CAAA;AAED,eAAO,MAAM,qBAAqB,EAAE,UAAU,CAC5C,gBAAgB,EAChB,UAAU,EACV,YAAY,CAgBX,CAAA"}

package/dist/commonjs/authz/policies/automate/function/canEditFunction.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canEditFunctionPolicy = void 0;
+const result_1 = require("true-myth/result");
+const automate_js_1 = require("../../../fragments/automate.js");
+const canEditFunctionPolicy = (loaders) => async ({ userId, functionId }) => {
+    const isAutomateEnabled = await (0, automate_js_1.ensureAutomateEnabledFragment)(loaders)({});
+    if (isAutomateEnabled.isErr)
+        return (0, result_1.err)(isAutomateEnabled.error);
+    const isAutomateFunctionCreator = await (0, automate_js_1.ensureAutomateFunctionCreatorFragment)(loaders)({
+        userId,
+        functionId
+    });
+    if (isAutomateFunctionCreator.isErr)
+        return (0, result_1.err)(isAutomateFunctionCreator.error);
+    return (0, result_1.ok)();
+};
+exports.canEditFunctionPolicy = canEditFunctionPolicy;
+//# sourceMappingURL=canEditFunction.js.map

package/dist/commonjs/authz/policies/automate/function/canEditFunction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canEditFunction.js","sourceRoot":"","sources":["../../../../../../src/authz/policies/automate/function/canEditFunction.ts"],"names":[],"mappings":";;;AAAA,6CAA0C;AAS1C,gEAGuC;AAchC,MAAM,qBAAqB,GAKhC,CAAC,OAAO,EAAE,EAAE,CACZ,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE;IAC/B,MAAM,iBAAiB,GAAG,MAAM,IAAA,2CAA6B,EAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAA;IAC1E,IAAI,iBAAiB,CAAC,KAAK;QAAE,OAAO,IAAA,YAAG,EAAC,iBAAiB,CAAC,KAAK,CAAC,CAAA;IAEhE,MAAM,yBAAyB,GAAG,MAAM,IAAA,mDAAqC,EAC3E,OAAO,CACR,CAAC;QACA,MAAM;QACN,UAAU;KACX,CAAC,CAAA;IACF,IAAI,yBAAyB,CAAC,KAAK;QAAE,OAAO,IAAA,YAAG,EAAC,yBAAyB,CAAC,KAAK,CAAC,CAAA;IAEhF,OAAO,IAAA,WAAE,GAAE,CAAA;AACb,CAAC,CAAA;AAnBU,QAAA,qBAAqB,yBAmB/B"}

package/dist/commonjs/authz/policies/dashboard/canCreateToken.d.ts

@@ -0,0 +1,10 @@
+import { AuthCheckContextLoaderKeys } from '../../domain/loaders.js';
+import { DashboardContext, MaybeUserContext } from '../../domain/context.js';
+import { DashboardNoProjectsError, DashboardNotFoundError, DashboardProjectsNotEnoughPermissionsError, DashboardsNotEnabledError, WorkspaceNoEditorSeatError, WorkspaceNotEnoughPermissionsError, WorkspacePlanNoFeatureAccessError } from '../../domain/authErrors.js';
+import { AuthPolicy } from '../../domain/policies.js';
+type PolicyLoaderKeys = typeof AuthCheckContextLoaderKeys.getEnv | typeof AuthCheckContextLoaderKeys.getDashboard | typeof AuthCheckContextLoaderKeys.getWorkspacePlan | typeof AuthCheckContextLoaderKeys.getWorkspaceRole | typeof AuthCheckContextLoaderKeys.getWorkspaceSeat | typeof AuthCheckContextLoaderKeys.getProjectRole | typeof AuthCheckContextLoaderKeys.getProject | typeof AuthCheckContextLoaderKeys.getServerRole | typeof AuthCheckContextLoaderKeys.getWorkspace | typeof AuthCheckContextLoaderKeys.getWorkspaceSsoProvider | typeof AuthCheckContextLoaderKeys.getWorkspaceSsoSession;
+type PolicyArgs = MaybeUserContext & DashboardContext;
+type PolicyErrors = InstanceType<typeof DashboardsNotEnabledError | typeof WorkspaceNotEnoughPermissionsError | typeof WorkspacePlanNoFeatureAccessError | typeof WorkspaceNoEditorSeatError | typeof DashboardNotFoundError | typeof DashboardNoProjectsError | typeof DashboardProjectsNotEnoughPermissionsError>;
+export declare const canCreateDashboardTokenPolicy: AuthPolicy<PolicyLoaderKeys, PolicyArgs, PolicyErrors>;
+export {};
+//# sourceMappingURL=canCreateToken.d.ts.map

package/dist/commonjs/authz/policies/dashboard/canCreateToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canCreateToken.d.ts","sourceRoot":"","sources":["../../../../../src/authz/policies/dashboard/canCreateToken.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC5E,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,0CAA0C,EAC1C,yBAAyB,EACzB,0BAA0B,EAC1B,kCAAkC,EAClC,iCAAiC,EAClC,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAUrD,KAAK,gBAAgB,GACjB,OAAO,0BAA0B,CAAC,MAAM,GACxC,OAAO,0BAA0B,CAAC,YAAY,GAC9C,OAAO,0BAA0B,CAAC,gBAAgB,GAClD,OAAO,0BAA0B,CAAC,gBAAgB,GAClD,OAAO,0BAA0B,CAAC,gBAAgB,GAClD,OAAO,0BAA0B,CAAC,cAAc,GAChD,OAAO,0BAA0B,CAAC,UAAU,GAC5C,OAAO,0BAA0B,CAAC,aAAa,GAC/C,OAAO,0BAA0B,CAAC,YAAY,GAC9C,OAAO,0BAA0B,CAAC,uBAAuB,GACzD,OAAO,0BAA0B,CAAC,sBAAsB,CAAA;AAE5D,KAAK,UAAU,GAAG,gBAAgB,GAAG,gBAAgB,CAAA;AAErD,KAAK,YAAY,GAAG,YAAY,CAC5B,OAAO,yBAAyB,GAChC,OAAO,kCAAkC,GACzC,OAAO,iCAAiC,GACxC,OAAO,0BAA0B,GACjC,OAAO,sBAAsB,GAC7B,OAAO,wBAAwB,GAC/B,OAAO,0CAA0C,CACpD,CAAA;AAED,eAAO,MAAM,6BAA6B,EAAE,UAAU,CACpD,gBAAgB,EAChB,UAAU,EACV,YAAY,CAsCX,CAAA"}

package/dist/commonjs/authz/policies/dashboard/canCreateToken.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canCreateDashboardTokenPolicy = void 0;
+const result_1 = require("true-myth/result");
+const authErrors_js_1 = require("../../domain/authErrors.js");
+const dashboards_js_1 = require("../../fragments/dashboards.js");
+const workspaceRole_js_1 = require("../../checks/workspaceRole.js");
+const constants_js_1 = require("../../../core/constants.js");
+const workspaceSeat_js_1 = require("../../checks/workspaceSeat.js");
+const canCreateDashboardTokenPolicy = (loaders) => async ({ userId, dashboardId }) => {
+    const isDashboardsEnabled = await (0, dashboards_js_1.ensureDashboardsEnabledFragment)(loaders)({});
+    if (isDashboardsEnabled.isErr)
+        return (0, result_1.err)(isDashboardsEnabled.error);
+    const dashboard = await loaders.getDashboard({ dashboardId });
+    if (!dashboard)
+        return (0, result_1.err)(new authErrors_js_1.DashboardNotFoundError());
+    const { workspaceId } = dashboard;
+    const ensuredFeatureAccess = await (0, dashboards_js_1.ensureWorkspaceDashboardsFeatureAccessFragment)(loaders)({ workspaceId });
+    if (ensuredFeatureAccess.isErr)
+        return (0, result_1.err)(ensuredFeatureAccess.error);
+    const isWorkspaceMember = await (0, workspaceRole_js_1.hasMinimumWorkspaceRole)(loaders)({
+        userId: userId,
+        workspaceId,
+        role: constants_js_1.Roles.Workspace.Member
+    });
+    if (!isWorkspaceMember)
+        return (0, result_1.err)(new authErrors_js_1.WorkspaceNotEnoughPermissionsError());
+    const isWorkspaceEditorSeat = await (0, workspaceSeat_js_1.hasEditorSeat)(loaders)({
+        userId: userId,
+        workspaceId
+    });
+    if (!isWorkspaceEditorSeat)
+        return (0, result_1.err)(new authErrors_js_1.WorkspaceNoEditorSeatError());
+    if (!dashboard.projectIds.length)
+        return (0, result_1.err)(new authErrors_js_1.DashboardNoProjectsError());
+    const ensuredProjectAccess = await (0, dashboards_js_1.ensureDashboardProjectsReadAccess)(loaders)({
+        userId: userId,
+        dashboardId
+    });
+    if (ensuredProjectAccess.isErr)
+        return (0, result_1.err)(ensuredProjectAccess.error);
+    return (0, result_1.ok)();
+};
+exports.canCreateDashboardTokenPolicy = canCreateDashboardTokenPolicy;
+//# sourceMappingURL=canCreateToken.js.map

package/dist/commonjs/authz/policies/dashboard/canCreateToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canCreateToken.js","sourceRoot":"","sources":["../../../../../src/authz/policies/dashboard/canCreateToken.ts"],"names":[],"mappings":";;;AAAA,6CAA0C;AAG1C,8DAQmC;AAEnC,iEAIsC;AACtC,oEAAuE;AACvE,6DAAkD;AAClD,oEAA6D;AA2BtD,MAAM,6BAA6B,GAKxC,CAAC,OAAO,EAAE,EAAE,CACZ,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE;IAChC,MAAM,mBAAmB,GAAG,MAAM,IAAA,+CAA+B,EAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAA;IAC9E,IAAI,mBAAmB,CAAC,KAAK;QAAE,OAAO,IAAA,YAAG,EAAC,mBAAmB,CAAC,KAAK,CAAC,CAAA;IAEpE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;IAC7D,IAAI,CAAC,SAAS;QAAE,OAAO,IAAA,YAAG,EAAC,IAAI,sCAAsB,EAAE,CAAC,CAAA;IAExD,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAA;IAEjC,MAAM,oBAAoB,GAAG,MAAM,IAAA,8DAA8C,EAC/E,OAAO,CACR,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;IAClB,IAAI,oBAAoB,CAAC,KAAK;QAAE,OAAO,IAAA,YAAG,EAAC,oBAAoB,CAAC,KAAK,CAAC,CAAA;IAEtE,MAAM,iBAAiB,GAAG,MAAM,IAAA,0CAAuB,EAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,EAAE,MAAO;QACf,WAAW;QACX,IAAI,EAAE,oBAAK,CAAC,SAAS,CAAC,MAAM;KAC7B,CAAC,CAAA;IACF,IAAI,CAAC,iBAAiB;QAAE,OAAO,IAAA,YAAG,EAAC,IAAI,kDAAkC,EAAE,CAAC,CAAA;IAE5E,MAAM,qBAAqB,GAAG,MAAM,IAAA,gCAAa,EAAC,OAAO,CAAC,CAAC;QACzD,MAAM,EAAE,MAAO;QACf,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,qBAAqB;QAAE,OAAO,IAAA,YAAG,EAAC,IAAI,0CAA0B,EAAE,CAAC,CAAA;IAExE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM;QAAE,OAAO,IAAA,YAAG,EAAC,IAAI,wCAAwB,EAAE,CAAC,CAAA;IAC5E,MAAM,oBAAoB,GAAG,MAAM,IAAA,iDAAiC,EAAC,OAAO,CAAC,CAAC;QAC5E,MAAM,EAAE,MAAO;QACf,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,oBAAoB,CAAC,KAAK;QAAE,OAAO,IAAA,YAAG,EAAC,oBAAoB,CAAC,KAAK,CAAC,CAAA;IAEtE,OAAO,IAAA,WAAE,GAAE,CAAA;AACb,CAAC,CAAA;AAzCU,QAAA,6BAA6B,iCAyCvC"}

package/dist/commonjs/authz/policies/dashboard/canDelete.d.ts

@@ -0,0 +1,10 @@
+import { AuthCheckContextLoaderKeys } from '../../domain/loaders.js';
+import { DashboardContext, MaybeUserContext } from '../../domain/context.js';
+import { DashboardNotFoundError, DashboardNotOwnerError, DashboardsNotEnabledError, WorkspaceNoEditorSeatError, WorkspaceNotEnoughPermissionsError, WorkspacePlanNoFeatureAccessError } from '../../domain/authErrors.js';
+import { AuthPolicy } from '../../domain/policies.js';
+type PolicyLoaderKeys = typeof AuthCheckContextLoaderKeys.getEnv | typeof AuthCheckContextLoaderKeys.getServerRole | typeof AuthCheckContextLoaderKeys.getAdminOverrideEnabled | typeof AuthCheckContextLoaderKeys.getDashboard | typeof AuthCheckContextLoaderKeys.getWorkspacePlan | typeof AuthCheckContextLoaderKeys.getWorkspaceRole | typeof AuthCheckContextLoaderKeys.getWorkspaceSeat;
+type PolicyArgs = MaybeUserContext & DashboardContext;
+type PolicyErrors = InstanceType<typeof DashboardsNotEnabledError | typeof DashboardNotOwnerError | typeof DashboardNotFoundError | typeof WorkspaceNotEnoughPermissionsError | typeof WorkspacePlanNoFeatureAccessError | typeof WorkspaceNoEditorSeatError>;
+export declare const canDeleteDashboardPolicy: AuthPolicy<PolicyLoaderKeys, PolicyArgs, PolicyErrors>;
+export {};
+//# sourceMappingURL=canDelete.d.ts.map

package/dist/commonjs/authz/policies/dashboard/canDelete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canDelete.d.ts","sourceRoot":"","sources":["../../../../../src/authz/policies/dashboard/canDelete.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC5E,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,EAC1B,kCAAkC,EAClC,iCAAiC,EAClC,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAWrD,KAAK,gBAAgB,GACjB,OAAO,0BAA0B,CAAC,MAAM,GACxC,OAAO,0BAA0B,CAAC,aAAa,GAC/C,OAAO,0BAA0B,CAAC,uBAAuB,GACzD,OAAO,0BAA0B,CAAC,YAAY,GAC9C,OAAO,0BAA0B,CAAC,gBAAgB,GAClD,OAAO,0BAA0B,CAAC,gBAAgB,GAClD,OAAO,0BAA0B,CAAC,gBAAgB,CAAA;AAEtD,KAAK,UAAU,GAAG,gBAAgB,GAAG,gBAAgB,CAAA;AAErD,KAAK,YAAY,GAAG,YAAY,CAC5B,OAAO,yBAAyB,GAChC,OAAO,sBAAsB,GAC7B,OAAO,sBAAsB,GAC7B,OAAO,kCAAkC,GACzC,OAAO,iCAAiC,GACxC,OAAO,0BAA0B,CACpC,CAAA;AAED,eAAO,MAAM,wBAAwB,EAAE,UAAU,CAC/C,gBAAgB,EAChB,UAAU,EACV,YAAY,CAsCX,CAAA"}

package/dist/commonjs/authz/policies/dashboard/canDelete.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canDeleteDashboardPolicy = void 0;
+const result_1 = require("true-myth/result");
+const authErrors_js_1 = require("../../domain/authErrors.js");
+const dashboards_js_1 = require("../../fragments/dashboards.js");
+const workspaceRole_js_1 = require("../../checks/workspaceRole.js");
+const constants_js_1 = require("../../../core/constants.js");
+const workspaceSeat_js_1 = require("../../checks/workspaceSeat.js");
+const dashboards_js_2 = require("../../checks/dashboards.js");
+const server_js_1 = require("../../fragments/server.js");
+const canDeleteDashboardPolicy = (loaders) => async ({ userId, dashboardId }) => {
+    const isDashboardsEnabled = await (0, dashboards_js_1.ensureDashboardsEnabledFragment)(loaders)({});
+    if (isDashboardsEnabled.isErr)
+        return (0, result_1.err)(isDashboardsEnabled.error);
+    const dashboard = await loaders.getDashboard({ dashboardId });
+    if (!dashboard)
+        return (0, result_1.err)(new authErrors_js_1.DashboardNotFoundError());
+    const { workspaceId } = dashboard;
+    const ensuredFeatureAccess = await (0, dashboards_js_1.ensureWorkspaceDashboardsFeatureAccessFragment)(loaders)({ workspaceId });
+    if (ensuredFeatureAccess.isErr)
+        return (0, result_1.err)(ensuredFeatureAccess.error);
+    const hasAdminAccess = await (0, server_js_1.checkIfAdminOverrideEnabledFragment)(loaders)({
+        userId
+    });
+    if (hasAdminAccess.isOk && hasAdminAccess.value)
+        return (0, result_1.ok)();
+    const isWorkspaceEditorSeat = await (0, workspaceSeat_js_1.hasEditorSeat)(loaders)({
+        userId: userId,
+        workspaceId
+    });
+    if (!isWorkspaceEditorSeat)
+        return (0, result_1.err)(new authErrors_js_1.WorkspaceNoEditorSeatError());
+    const isWorkspaceAdmin = await (0, workspaceRole_js_1.hasMinimumWorkspaceRole)(loaders)({
+        userId: userId,
+        workspaceId,
+        role: constants_js_1.Roles.Workspace.Admin
+    });
+    const isOwner = await (0, dashboards_js_2.isDashboardOwner)(loaders)({ userId: userId, dashboardId });
+    if (!isWorkspaceAdmin && !isOwner)
+        return (0, result_1.err)(new authErrors_js_1.DashboardNotOwnerError());
+    return (0, result_1.ok)();
+};
+exports.canDeleteDashboardPolicy = canDeleteDashboardPolicy;
+//# sourceMappingURL=canDelete.js.map

package/dist/commonjs/authz/policies/dashboard/canDelete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canDelete.js","sourceRoot":"","sources":["../../../../../src/authz/policies/dashboard/canDelete.ts"],"names":[],"mappings":";;;AAAA,6CAA0C;AAG1C,8DAOmC;AAEnC,iEAGsC;AACtC,oEAAuE;AACvE,6DAAkD;AAClD,oEAA6D;AAC7D,8DAA6D;AAC7D,yDAA+E;AAsBxE,MAAM,wBAAwB,GAKnC,CAAC,OAAO,EAAE,EAAE,CACZ,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE;IAChC,MAAM,mBAAmB,GAAG,MAAM,IAAA,+CAA+B,EAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAA;IAC9E,IAAI,mBAAmB,CAAC,KAAK;QAAE,OAAO,IAAA,YAAG,EAAC,mBAAmB,CAAC,KAAK,CAAC,CAAA;IAEpE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;IAC7D,IAAI,CAAC,SAAS;QAAE,OAAO,IAAA,YAAG,EAAC,IAAI,sCAAsB,EAAE,CAAC,CAAA;IAExD,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAA;IAEjC,MAAM,oBAAoB,GAAG,MAAM,IAAA,8DAA8C,EAC/E,OAAO,CACR,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;IAClB,IAAI,oBAAoB,CAAC,KAAK;QAAE,OAAO,IAAA,YAAG,EAAC,oBAAoB,CAAC,KAAK,CAAC,CAAA;IAEtE,MAAM,cAAc,GAAG,MAAM,IAAA,+CAAmC,EAAC,OAAO,CAAC,CAAC;QACxE,MAAM;KACP,CAAC,CAAA;IACF,IAAI,cAAc,CAAC,IAAI,IAAI,cAAc,CAAC,KAAK;QAAE,OAAO,IAAA,WAAE,GAAE,CAAA;IAE5D,MAAM,qBAAqB,GAAG,MAAM,IAAA,gCAAa,EAAC,OAAO,CAAC,CAAC;QACzD,MAAM,EAAE,MAAO;QACf,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,qBAAqB;QAAE,OAAO,IAAA,YAAG,EAAC,IAAI,0CAA0B,EAAE,CAAC,CAAA;IAExE,MAAM,gBAAgB,GAAG,MAAM,IAAA,0CAAuB,EAAC,OAAO,CAAC,CAAC;QAC9D,MAAM,EAAE,MAAO;QACf,WAAW;QACX,IAAI,EAAE,oBAAK,CAAC,SAAS,CAAC,KAAK;KAC5B,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,IAAA,gCAAgB,EAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,MAAO,EAAE,WAAW,EAAE,CAAC,CAAA;IAEjF,IAAI,CAAC,gBAAgB,IAAI,CAAC,OAAO;QAAE,OAAO,IAAA,YAAG,EAAC,IAAI,sCAAsB,EAAE,CAAC,CAAA;IAE3E,OAAO,IAAA,WAAE,GAAE,CAAA;AACb,CAAC,CAAA;AAzCU,QAAA,wBAAwB,4BAyClC"}

package/dist/commonjs/authz/policies/dashboard/canEdit.d.ts

@@ -0,0 +1,10 @@
+import { AuthCheckContextLoaderKeys } from '../../domain/loaders.js';
+import { MaybeUserContext, DashboardContext } from '../../domain/context.js';
+import { DashboardNotFoundError, DashboardsNotEnabledError, WorkspaceNoEditorSeatError, WorkspaceNotEnoughPermissionsError, WorkspacePlanNoFeatureAccessError } from '../../domain/authErrors.js';
+import { AuthPolicy } from '../../domain/policies.js';
+type PolicyLoaderKeys = typeof AuthCheckContextLoaderKeys.getEnv | typeof AuthCheckContextLoaderKeys.getServerRole | typeof AuthCheckContextLoaderKeys.getAdminOverrideEnabled | typeof AuthCheckContextLoaderKeys.getDashboard | typeof AuthCheckContextLoaderKeys.getWorkspacePlan | typeof AuthCheckContextLoaderKeys.getWorkspaceRole | typeof AuthCheckContextLoaderKeys.getWorkspaceSeat;
+type PolicyArgs = MaybeUserContext & DashboardContext;
+type PolicyErrors = InstanceType<typeof DashboardsNotEnabledError | typeof DashboardNotFoundError | typeof WorkspaceNotEnoughPermissionsError | typeof WorkspacePlanNoFeatureAccessError | typeof WorkspaceNoEditorSeatError>;
+export declare const canEditDashboardPolicy: AuthPolicy<PolicyLoaderKeys, PolicyArgs, PolicyErrors>;
+export {};
+//# sourceMappingURL=canEdit.d.ts.map

package/dist/commonjs/authz/policies/dashboard/canEdit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canEdit.d.ts","sourceRoot":"","sources":["../../../../../src/authz/policies/dashboard/canEdit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC5E,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,EAC1B,kCAAkC,EAClC,iCAAiC,EAClC,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAUrD,KAAK,gBAAgB,GACjB,OAAO,0BAA0B,CAAC,MAAM,GACxC,OAAO,0BAA0B,CAAC,aAAa,GAC/C,OAAO,0BAA0B,CAAC,uBAAuB,GACzD,OAAO,0BAA0B,CAAC,YAAY,GAC9C,OAAO,0BAA0B,CAAC,gBAAgB,GAClD,OAAO,0BAA0B,CAAC,gBAAgB,GAClD,OAAO,0BAA0B,CAAC,gBAAgB,CAAA;AAEtD,KAAK,UAAU,GAAG,gBAAgB,GAAG,gBAAgB,CAAA;AAErD,KAAK,YAAY,GAAG,YAAY,CAC5B,OAAO,yBAAyB,GAChC,OAAO,sBAAsB,GAC7B,OAAO,kCAAkC,GACzC,OAAO,iCAAiC,GACxC,OAAO,0BAA0B,CACpC,CAAA;AAED,eAAO,MAAM,sBAAsB,EAAE,UAAU,CAC7C,gBAAgB,EAChB,UAAU,EACV,YAAY,CAoCX,CAAA"}

package/dist/commonjs/authz/policies/dashboard/canEdit.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canEditDashboardPolicy = void 0;
+const result_1 = require("true-myth/result");
+const authErrors_js_1 = require("../../domain/authErrors.js");
+const dashboards_js_1 = require("../../fragments/dashboards.js");
+const workspaceRole_js_1 = require("../../checks/workspaceRole.js");
+const constants_js_1 = require("../../../core/constants.js");
+const workspaceSeat_js_1 = require("../../checks/workspaceSeat.js");
+const server_js_1 = require("../../fragments/server.js");
+const canEditDashboardPolicy = (loaders) => async ({ userId, dashboardId }) => {
+    const isDashboardsEnabled = await (0, dashboards_js_1.ensureDashboardsEnabledFragment)(loaders)({});
+    if (isDashboardsEnabled.isErr)
+        return (0, result_1.err)(isDashboardsEnabled.error);
+    const dashboard = await loaders.getDashboard({ dashboardId });
+    if (!dashboard)
+        return (0, result_1.err)(new authErrors_js_1.DashboardNotFoundError());
+    const { workspaceId } = dashboard;
+    const ensuredFeatureAccess = await (0, dashboards_js_1.ensureWorkspaceDashboardsFeatureAccessFragment)(loaders)({ workspaceId });
+    if (ensuredFeatureAccess.isErr)
+        return (0, result_1.err)(ensuredFeatureAccess.error);
+    const hasAdminAccess = await (0, server_js_1.checkIfAdminOverrideEnabledFragment)(loaders)({
+        userId
+    });
+    if (hasAdminAccess.isOk && hasAdminAccess.value)
+        return (0, result_1.ok)();
+    const isWorkspaceMember = await (0, workspaceRole_js_1.hasMinimumWorkspaceRole)(loaders)({
+        userId: userId,
+        workspaceId,
+        role: constants_js_1.Roles.Workspace.Member
+    });
+    if (!isWorkspaceMember)
+        return (0, result_1.err)(new authErrors_js_1.WorkspaceNotEnoughPermissionsError());
+    const isWorkspaceEditorSeat = await (0, workspaceSeat_js_1.hasEditorSeat)(loaders)({
+        userId: userId,
+        workspaceId
+    });
+    if (!isWorkspaceEditorSeat)
+        return (0, result_1.err)(new authErrors_js_1.WorkspaceNoEditorSeatError());
+    return (0, result_1.ok)();
+};
+exports.canEditDashboardPolicy = canEditDashboardPolicy;
+//# sourceMappingURL=canEdit.js.map

package/dist/commonjs/authz/policies/dashboard/canEdit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canEdit.js","sourceRoot":"","sources":["../../../../../src/authz/policies/dashboard/canEdit.ts"],"names":[],"mappings":";;;AAAA,6CAA0C;AAG1C,8DAMmC;AAEnC,iEAGsC;AACtC,oEAAuE;AACvE,6DAAkD;AAClD,oEAA6D;AAC7D,yDAA+E;AAqBxE,MAAM,sBAAsB,GAKjC,CAAC,OAAO,EAAE,EAAE,CACZ,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE;IAChC,MAAM,mBAAmB,GAAG,MAAM,IAAA,+CAA+B,EAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAA;IAC9E,IAAI,mBAAmB,CAAC,KAAK;QAAE,OAAO,IAAA,YAAG,EAAC,mBAAmB,CAAC,KAAK,CAAC,CAAA;IAEpE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;IAC7D,IAAI,CAAC,SAAS;QAAE,OAAO,IAAA,YAAG,EAAC,IAAI,sCAAsB,EAAE,CAAC,CAAA;IAExD,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAA;IAEjC,MAAM,oBAAoB,GAAG,MAAM,IAAA,8DAA8C,EAC/E,OAAO,CACR,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;IAClB,IAAI,oBAAoB,CAAC,KAAK;QAAE,OAAO,IAAA,YAAG,EAAC,oBAAoB,CAAC,KAAK,CAAC,CAAA;IAEtE,MAAM,cAAc,GAAG,MAAM,IAAA,+CAAmC,EAAC,OAAO,CAAC,CAAC;QACxE,MAAM;KACP,CAAC,CAAA;IACF,IAAI,cAAc,CAAC,IAAI,IAAI,cAAc,CAAC,KAAK;QAAE,OAAO,IAAA,WAAE,GAAE,CAAA;IAE5D,MAAM,iBAAiB,GAAG,MAAM,IAAA,0CAAuB,EAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,EAAE,MAAO;QACf,WAAW;QACX,IAAI,EAAE,oBAAK,CAAC,SAAS,CAAC,MAAM;KAC7B,CAAC,CAAA;IACF,IAAI,CAAC,iBAAiB;QAAE,OAAO,IAAA,YAAG,EAAC,IAAI,kDAAkC,EAAE,CAAC,CAAA;IAE5E,MAAM,qBAAqB,GAAG,MAAM,IAAA,gCAAa,EAAC,OAAO,CAAC,CAAC;QACzD,MAAM,EAAE,MAAO;QACf,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,qBAAqB;QAAE,OAAO,IAAA,YAAG,EAAC,IAAI,0CAA0B,EAAE,CAAC,CAAA;IAExE,OAAO,IAAA,WAAE,GAAE,CAAA;AACb,CAAC,CAAA;AAvCU,QAAA,sBAAsB,0BAuChC"}

package/dist/commonjs/authz/policies/dashboard/canRead.d.ts

@@ -0,0 +1,10 @@
+import { AuthCheckContextLoaderKeys } from '../../domain/loaders.js';
+import { DashboardContext, MaybeUserContext } from '../../domain/context.js';
+import { DashboardNotFoundError, DashboardsNotEnabledError, ServerNoAccessError, ServerNoSessionError, ServerNotEnoughPermissionsError, WorkspaceNotEnoughPermissionsError, WorkspacePlanNoFeatureAccessError } from '../../domain/authErrors.js';
+import { AuthPolicy } from '../../domain/policies.js';
+type PolicyLoaderKeys = typeof AuthCheckContextLoaderKeys.getEnv | typeof AuthCheckContextLoaderKeys.getServerRole | typeof AuthCheckContextLoaderKeys.getAdminOverrideEnabled | typeof AuthCheckContextLoaderKeys.getDashboard | typeof AuthCheckContextLoaderKeys.getWorkspaceRole | typeof AuthCheckContextLoaderKeys.getWorkspacePlan;
+type PolicyArgs = MaybeUserContext & DashboardContext;
+type PolicyErrors = InstanceType<typeof DashboardsNotEnabledError | typeof DashboardNotFoundError | typeof ServerNoSessionError | typeof ServerNoAccessError | typeof ServerNotEnoughPermissionsError | typeof WorkspaceNotEnoughPermissionsError | typeof WorkspacePlanNoFeatureAccessError>;
+export declare const canReadDashboardPolicy: AuthPolicy<PolicyLoaderKeys, PolicyArgs, PolicyErrors>;
+export {};
+//# sourceMappingURL=canRead.d.ts.map

package/dist/commonjs/authz/policies/dashboard/canRead.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canRead.d.ts","sourceRoot":"","sources":["../../../../../src/authz/policies/dashboard/canRead.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC5E,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,mBAAmB,EACnB,oBAAoB,EACpB,+BAA+B,EAC/B,kCAAkC,EAClC,iCAAiC,EAClC,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAYrD,KAAK,gBAAgB,GACjB,OAAO,0BAA0B,CAAC,MAAM,GACxC,OAAO,0BAA0B,CAAC,aAAa,GAC/C,OAAO,0BAA0B,CAAC,uBAAuB,GACzD,OAAO,0BAA0B,CAAC,YAAY,GAC9C,OAAO,0BAA0B,CAAC,gBAAgB,GAClD,OAAO,0BAA0B,CAAC,gBAAgB,CAAA;AAEtD,KAAK,UAAU,GAAG,gBAAgB,GAAG,gBAAgB,CAAA;AAErD,KAAK,YAAY,GAAG,YAAY,CAC5B,OAAO,yBAAyB,GAChC,OAAO,sBAAsB,GAC7B,OAAO,oBAAoB,GAC3B,OAAO,mBAAmB,GAC1B,OAAO,+BAA+B,GACtC,OAAO,kCAAkC,GACzC,OAAO,iCAAiC,CAC3C,CAAA;AAED,eAAO,MAAM,sBAAsB,EAAE,UAAU,CAC7C,gBAAgB,EAChB,UAAU,EACV,YAAY,CAmCX,CAAA"}