@syntax-syllogism/warden-core 0.2.0

package/lib/access/output.d.ts

@@ -0,0 +1,12 @@
+import type { UserAccessRow } from './types.js';
+export declare const fieldCsvColumns: () => string[];
+export declare const enabledCsvColumns: () => string[];
+export declare const tabCsvColumns: () => string[];
+export declare const recordTypeCsvColumns: () => string[];
+export declare const objectCsvColumns: () => string[];
+export declare const flattenAccessRow: (row: UserAccessRow, columns: string[]) => Record<string, unknown>;
+export declare const renderFieldTable: (rows: UserAccessRow[], showTarget?: boolean) => string;
+export declare const renderObjectTable: (rows: UserAccessRow[]) => string;
+export declare const renderEnabledTable: (rows: UserAccessRow[]) => string;
+export declare const renderTabTable: (rows: UserAccessRow[]) => string;
+export declare const renderRecordTypeTable: (rows: UserAccessRow[]) => string;

package/lib/access/output.js

@@ -0,0 +1,108 @@
+const baseColumns = [
+    'userId',
+    'userName',
+    'username',
+    'assignmentType',
+    'sourceId',
+    'sourceName',
+    'viaPermissionSetId',
+    'viaPermissionSetName',
+    'targetType',
+    'targetName',
+    'sourceApiName',
+    'sourceLabel',
+];
+export const fieldCsvColumns = () => [...baseColumns, 'read', 'edit'];
+export const enabledCsvColumns = () => [...baseColumns, 'enabled'];
+export const tabCsvColumns = () => [...baseColumns, 'visibility'];
+export const recordTypeCsvColumns = () => [...baseColumns, 'visible', 'default'];
+export const objectCsvColumns = () => [
+    ...baseColumns,
+    'read',
+    'create',
+    'edit',
+    'delete',
+    'viewAll',
+    'modifyAll',
+];
+const csvValue = (row, column) => {
+    if (column in row.access)
+        return row.access[column];
+    return row[column] ?? '';
+};
+export const flattenAccessRow = (row, columns) => Object.fromEntries(columns.map((column) => [column, csvValue(row, column)]));
+const formatVia = (assignmentType, sourceName, viaName) => {
+    if (assignmentType === 'Profile')
+        return `Profile: ${sourceName}`;
+    if (assignmentType === 'PermissionSet')
+        return `Permission Set: ${sourceName}`;
+    return viaName ? `PSG: ${sourceName} / PS: ${viaName}` : `PSG: ${sourceName}`;
+};
+const paddedTable = (headers, rows) => {
+    const widths = headers.map((header, idx) => Math.max(header.length, ...rows.map((row) => (row[idx] ?? '').length)));
+    const render = (cells) => cells
+        .map((cell, idx) => cell.padEnd(widths[idx]))
+        .join('  ')
+        .trimEnd();
+    return [render(headers), ...rows.map(render)].join('\n');
+};
+export const renderFieldTable = (rows, showTarget = false) => paddedTable([...(showTarget ? ['Target'] : []), 'User Name', 'Username', 'Read', 'Edit', 'Via'], rows.map((row) => {
+    if (row.access.kind !== 'field')
+        throw new Error('Field table received non-field access');
+    return [
+        ...(showTarget ? [row.targetName] : []),
+        row.userName,
+        row.username,
+        row.access.read ? 'yes' : 'no',
+        row.access.edit ? 'yes' : 'no',
+        formatVia(row.assignmentType, row.sourceName, row.viaPermissionSetName),
+    ];
+}));
+export const renderObjectTable = (rows) => paddedTable(['User Name', 'Username', 'R', 'C', 'E', 'D', 'VA', 'MA', 'Via'], rows.map((row) => {
+    if (row.access.kind !== 'object')
+        throw new Error('Object table received non-object access');
+    const access = row.access;
+    return [
+        row.userName,
+        row.username,
+        access.read ? 'Y' : 'N',
+        access.create ? 'Y' : 'N',
+        access.edit ? 'Y' : 'N',
+        access.delete ? 'Y' : 'N',
+        access.viewAll ? 'Y' : 'N',
+        access.modifyAll ? 'Y' : 'N',
+        formatVia(row.assignmentType, row.sourceName, row.viaPermissionSetName),
+    ];
+}));
+export const renderEnabledTable = (rows) => paddedTable(['User Name', 'Username', 'Enabled', 'Via'], rows.map((row) => {
+    if (row.access.kind !== 'enabled')
+        throw new Error('Enabled table received non-enabled access');
+    return [
+        row.userName,
+        row.username,
+        row.access.enabled ? 'yes' : 'no',
+        formatVia(row.assignmentType, row.sourceName, row.viaPermissionSetName),
+    ];
+}));
+export const renderTabTable = (rows) => paddedTable(['User Name', 'Username', 'Visibility', 'Via'], rows.map((row) => {
+    if (row.access.kind !== 'tab')
+        throw new Error('Tab table received non-tab access');
+    return [
+        row.userName,
+        row.username,
+        row.access.visibility,
+        formatVia(row.assignmentType, row.sourceName, row.viaPermissionSetName),
+    ];
+}));
+export const renderRecordTypeTable = (rows) => paddedTable(['User Name', 'Username', 'Visible', 'Default', 'Via'], rows.map((row) => {
+    if (row.access.kind !== 'record-type')
+        throw new Error('Record type table received non-record-type access');
+    return [
+        row.userName,
+        row.username,
+        row.access.visible ? 'yes' : 'no',
+        row.access.default === null ? 'n/a' : row.access.default ? 'yes' : 'no',
+        formatVia(row.assignmentType, row.sourceName, row.viaPermissionSetName),
+    ];
+}));
+//# sourceMappingURL=output.js.map

package/lib/access/output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../../src/access/output.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,GAAG;IAClB,QAAQ;IACR,UAAU;IACV,UAAU;IACV,gBAAgB;IAChB,UAAU;IACV,YAAY;IACZ,oBAAoB;IACpB,sBAAsB;IACtB,YAAY;IACZ,YAAY;IACZ,eAAe;IACf,aAAa;CACL,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG,GAAa,EAAE,CAAC,CAAC,GAAG,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAChF,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAa,EAAE,CAAC,CAAC,GAAG,WAAW,EAAE,SAAS,CAAC,CAAC;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAG,GAAa,EAAE,CAAC,CAAC,GAAG,WAAW,EAAE,YAAY,CAAC,CAAC;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAa,EAAE,CAAC,CAAC,GAAG,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AAC3F,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAa,EAAE,CAAC;IAC9C,GAAG,WAAW;IACd,MAAM;IACN,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,SAAS;IACT,WAAW;CACZ,CAAC;AAEF,MAAM,QAAQ,GAAG,CAAC,GAAkB,EAAE,MAAc,EAAW,EAAE;IAC/D,IAAI,MAAM,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,MAAiC,CAAC,CAAC;IAC/E,OAAO,GAAG,CAAC,MAA6B,CAAC,IAAI,EAAE,CAAC;AAClD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAkB,EAAE,OAAiB,EAA2B,EAAE,CACjG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAE/E,MAAM,SAAS,GAAG,CAAC,cAA8B,EAAE,UAAkB,EAAE,OAAgB,EAAU,EAAE;IACjG,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO,YAAY,UAAU,EAAE,CAAC;IAClE,IAAI,cAAc,KAAK,eAAe;QAAE,OAAO,mBAAmB,UAAU,EAAE,CAAC;IAC/E,OAAO,OAAO,CAAC,CAAC,CAAC,QAAQ,UAAU,UAAU,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,UAAU,EAAE,CAAC;AAChF,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,OAAiB,EAAE,IAAgB,EAAU,EAAE;IAClE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpH,MAAM,MAAM,GAAG,CAAC,KAAe,EAAU,EAAE,CACzC,KAAK;SACF,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;SAC5C,IAAI,CAAC,IAAI,CAAC;SACV,OAAO,EAAE,CAAC;IACf,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3D,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAqB,EAAE,UAAU,GAAG,KAAK,EAAU,EAAE,CACpF,WAAW,CACT,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EACnF,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;IACf,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC1F,OAAO;QACL,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QAC9B,SAAS,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,oBAAoB,CAAC;KACxE,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAqB,EAAU,EAAE,CACjE,WAAW,CACT,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAChE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;IACf,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,OAAO;QACL,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;QACvB,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;QACzB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;QACvB,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;QACzB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;QAC1B,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;QAC5B,SAAS,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,oBAAoB,CAAC;KACxE,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,IAAqB,EAAU,EAAE,CAClE,WAAW,CACT,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,EAC3C,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;IACf,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAChG,OAAO;QACL,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QACjC,SAAS,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,oBAAoB,CAAC;KACxE,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAqB,EAAU,EAAE,CAC9D,WAAW,CACT,CAAC,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC,EAC9C,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;IACf,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACpF,OAAO;QACL,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,MAAM,CAAC,UAAU;QACrB,SAAS,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,oBAAoB,CAAC;KACxE,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,IAAqB,EAAU,EAAE,CACrE,WAAW,CACT,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,EACtD,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;IACf,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC5G,OAAO;QACL,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QACjC,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QACvE,SAAS,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,oBAAoB,CAAC;KACxE,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}

package/lib/access/resolvers/field.d.ts

@@ -0,0 +1,2 @@
+import type { AccessTargetResolver } from '../types.js';
+export declare const fieldResolver: AccessTargetResolver;

package/lib/access/resolvers/field.js

@@ -0,0 +1,93 @@
+import { resolveAssignees, resultFor } from '../assignees.js';
+import { queryAll, queryAllInChunks } from '../soql.js';
+import { combinePsgMuting, loadPsgMuting } from '../muting.js';
+import { validateFieldTarget } from '../targetValidation.js';
+import { fieldCsvColumns } from '../output.js';
+import { UserAccessError } from '../types.js';
+const truthy = (value) => value === true;
+const anyAccess = (access) => access.read || access.edit;
+export const fieldResolver = {
+    type: 'field',
+    validateTarget: validateFieldTarget,
+    async resolve(conn, target) {
+        if (!target.sobjectType || !target.fieldApiName)
+            throw new UserAccessError('errorInvalidTarget', [target.targetName]);
+        const qualifiedField = `${target.sobjectType}.${target.fieldApiName}`;
+        const warnings = [];
+        try {
+            const entitlementRows = await queryAll(conn, [
+                'SELECT ParentId, Parent.Id, Parent.Name, Parent.IsOwnedByProfile, Parent.ProfileId, Parent.Profile.Name, Parent.Type, PermissionsRead, PermissionsEdit',
+                'FROM FieldPermissions',
+                `WHERE SobjectType = '${target.sobjectType}'`,
+                `AND Field = '${qualifiedField}'`,
+                "AND Parent.Type != 'Muting'",
+            ].join(' '));
+            const grantByPermissionSetId = new Map();
+            const permissionSetById = new Map();
+            for (const row of entitlementRows) {
+                const access = {
+                    kind: 'field',
+                    read: truthy(row.PermissionsRead),
+                    edit: truthy(row.PermissionsEdit),
+                };
+                if (!anyAccess(access))
+                    continue;
+                grantByPermissionSetId.set(row.ParentId, access);
+                if (row.Parent)
+                    permissionSetById.set(row.ParentId, { ...row.Parent, Id: row.ParentId });
+            }
+            if (grantByPermissionSetId.size === 0) {
+                warnings.push(`No explicit FieldPermissions records were found for ${qualifiedField}. Standard fields may still be visible through base object/profile behavior. This command reports explicit field-level security grants only.`);
+                return resultFor('field', qualifiedField, [], warnings, {
+                    sobjectType: target.sobjectType,
+                    fieldApiName: target.fieldApiName,
+                });
+            }
+            let muting = {
+                permissionSetIdsByGroup: new Map(),
+                masksByPermissionSetId: new Map(),
+            };
+            const preparePsg = async (psgIds) => {
+                muting = await loadPsgMuting(conn, psgIds, async (mutingSetIds) => {
+                    const mutingRows = await queryAllInChunks(conn, mutingSetIds, (chunk) => [
+                        'SELECT ParentId, PermissionsRead, PermissionsEdit',
+                        'FROM FieldPermissions',
+                        'WHERE Parent.IsOwnedByProfile = false',
+                        `AND ParentId IN (${chunk.map((id) => `'${id}'`).join(',')})`,
+                        `AND SobjectType = '${target.sobjectType ?? ''}'`,
+                        `AND Field = '${qualifiedField}'`,
+                    ].join(' '));
+                    return new Map(mutingRows.map((row) => [
+                        row.ParentId,
+                        { read: truthy(row.PermissionsRead), edit: truthy(row.PermissionsEdit) },
+                    ]));
+                });
+            };
+            const rows = await resolveAssignees(conn, 'field', qualifiedField, grantByPermissionSetId, permissionSetById, (grant, context) => {
+                if (context.assignmentType === 'PermissionSet')
+                    return grant;
+                const muted = combinePsgMuting(context.psgId, muting, { read: false, edit: false }, (left, right) => ({
+                    read: left.read || right.read,
+                    edit: left.edit || right.edit,
+                }));
+                const effective = {
+                    kind: 'field',
+                    read: grant.read && !muted.read,
+                    edit: grant.edit && !muted.edit,
+                };
+                return anyAccess(effective) ? effective : undefined;
+            }, { preparePsg });
+            return resultFor('field', qualifiedField, rows, warnings, {
+                sobjectType: target.sobjectType,
+                fieldApiName: target.fieldApiName,
+            });
+        }
+        catch (error) {
+            if (error instanceof UserAccessError)
+                throw error;
+            throw new UserAccessError('errorAccessQueryFailed', [target.type, target.targetName], error);
+        }
+    },
+    csvColumns: fieldCsvColumns,
+};
+//# sourceMappingURL=field.js.map

package/lib/access/resolvers/field.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"field.js","sourceRoot":"","sources":["../../../src/access/resolvers/field.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAA4B,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAuB,MAAM,cAAc,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAiB9C,MAAM,MAAM,GAAG,CAAC,KAA0B,EAAW,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;AACvE,MAAM,SAAS,GAAG,CAAC,MAAmB,EAAW,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC;AAE/E,MAAM,CAAC,MAAM,aAAa,GAAyB;IACjD,IAAI,EAAE,OAAO;IACb,cAAc,EAAE,mBAAmB;IACnC,KAAK,CAAC,OAAO,CAAC,IAAgB,EAAE,MAA6B;QAC3D,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,YAAY;YAC7C,MAAM,IAAI,eAAe,CAAC,oBAAoB,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QACvE,MAAM,cAAc,GAAG,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACtE,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,MAAM,QAAQ,CACpC,IAAI,EACJ;gBACE,wJAAwJ;gBACxJ,uBAAuB;gBACvB,wBAAwB,MAAM,CAAC,WAAW,GAAG;gBAC7C,gBAAgB,cAAc,GAAG;gBACjC,6BAA6B;aAC9B,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;YACF,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAuB,CAAC;YAC9D,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA+B,CAAC;YACjE,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;gBAClC,MAAM,MAAM,GAAgB;oBAC1B,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC;oBACjC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC;iBAClC,CAAC;gBACF,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;oBAAE,SAAS;gBACjC,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACjD,IAAI,GAAG,CAAC,MAAM;oBAAE,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,IAAI,sBAAsB,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACtC,QAAQ,CAAC,IAAI,CACX,uDAAuD,cAAc,8IAA8I,CACpN,CAAC;gBACF,OAAO,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,QAAQ,EAAE;oBACtD,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;iBAClC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,MAAM,GAAwC;gBAChD,uBAAuB,EAAE,IAAI,GAAG,EAAE;gBAClC,sBAAsB,EAAE,IAAI,GAAG,EAAE;aAClC,CAAC;YACF,MAAM,UAAU,GAAG,KAAK,EAAE,MAAgB,EAAiB,EAAE;gBAC3D,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;oBAChE,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAsB,IAAI,EAAE,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAC3F;wBACE,mDAAmD;wBACnD,uBAAuB;wBACvB,uCAAuC;wBACvC,oBAAoB,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;wBAC7D,sBAAsB,MAAM,CAAC,WAAW,IAAI,EAAE,GAAG;wBACjD,gBAAgB,cAAc,GAAG;qBAClC,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;oBACF,OAAO,IAAI,GAAG,CACZ,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;wBACtB,GAAG,CAAC,QAAQ;wBACZ,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE;qBACzE,CAAC,CACH,CAAC;gBACJ,CAAC,CAAC,CAAC;YACL,CAAC,CAAC;YAEF,MAAM,IAAI,GAAG,MAAM,gBAAgB,CACjC,IAAI,EACJ,OAAO,EACP,cAAc,EACd,sBAAsB,EACtB,iBAAiB,EACjB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBACjB,IAAI,OAAO,CAAC,cAAc,KAAK,eAAe;oBAAE,OAAO,KAAK,CAAC;gBAC7D,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;oBACpG,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI;oBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI;iBAC9B,CAAC,CAAC,CAAC;gBACJ,MAAM,SAAS,GAAgB;oBAC7B,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI;oBAC/B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI;iBAChC,CAAC;gBACF,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACtD,CAAC,EACD,EAAE,UAAU,EAAE,CACf,CAAC;YACF,OAAO,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACxD,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,eAAe;gBAAE,MAAM,KAAK,CAAC;YAClD,MAAM,IAAI,eAAe,CAAC,wBAAwB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IACD,UAAU,EAAE,eAAe;CAC5B,CAAC"}

package/lib/access/resolvers/index.d.ts

@@ -0,0 +1,2 @@
+import type { AccessTargetResolver } from '../types.js';
+export declare const getResolver: (type: string) => AccessTargetResolver;

package/lib/access/resolvers/index.js

@@ -0,0 +1,22 @@
+import { UserAccessError } from '../types.js';
+import { fieldResolver } from './field.js';
+import { objectResolver } from './object.js';
+import { apexClassResolver, customPermissionResolver, vfPageResolver } from './setupEntity.js';
+import { tabResolver } from './tab.js';
+import { recordTypeResolver } from './recordType.js';
+const resolvers = {
+    field: fieldResolver,
+    object: objectResolver,
+    'apex-class': apexClassResolver,
+    'vf-page': vfPageResolver,
+    'custom-permission': customPermissionResolver,
+    tab: tabResolver,
+    'record-type': recordTypeResolver,
+};
+export const getResolver = (type) => {
+    const resolver = resolvers[type];
+    if (!resolver)
+        throw new UserAccessError('errorUnsupportedAccessType', [type]);
+    return resolver;
+};
+//# sourceMappingURL=index.js.map

package/lib/access/resolvers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/access/resolvers/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,MAAM,SAAS,GAAmD;IAChE,KAAK,EAAE,aAAa;IACpB,MAAM,EAAE,cAAc;IACtB,YAAY,EAAE,iBAAiB;IAC/B,SAAS,EAAE,cAAc;IACzB,mBAAmB,EAAE,wBAAwB;IAC7C,GAAG,EAAE,WAAW;IAChB,aAAa,EAAE,kBAAkB;CAClC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAwB,EAAE;IAChE,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAwB,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,eAAe,CAAC,4BAA4B,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/E,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC"}

package/lib/access/resolvers/object.d.ts

@@ -0,0 +1,2 @@
+import type { AccessTargetResolver } from '../types.js';
+export declare const objectResolver: AccessTargetResolver;

package/lib/access/resolvers/object.js

@@ -0,0 +1,101 @@
+import { resolveAssignees, resultFor } from '../assignees.js';
+import { queryAll, queryAllInChunks } from '../soql.js';
+import { combinePsgMuting, loadPsgMuting } from '../muting.js';
+import { objectCsvColumns } from '../output.js';
+import { validateObjectTarget } from '../targetValidation.js';
+import { UserAccessError } from '../types.js';
+const truthy = (value) => value === true;
+const toObjectAccess = (row) => ({
+    kind: 'object',
+    read: truthy(row.PermissionsRead),
+    create: truthy(row.PermissionsCreate),
+    edit: truthy(row.PermissionsEdit),
+    delete: truthy(row.PermissionsDelete),
+    viewAll: truthy(row.PermissionsViewAllRecords),
+    modifyAll: truthy(row.PermissionsModifyAllRecords),
+});
+const anyAccess = (access) => access.read || access.create || access.edit || access.delete || access.viewAll || access.modifyAll;
+export const objectResolver = {
+    type: 'object',
+    validateTarget: validateObjectTarget,
+    async resolve(conn, target) {
+        if (!target.sobjectType)
+            throw new UserAccessError('errorInvalidTarget', [target.targetName]);
+        const warnings = [];
+        try {
+            const entitlementRows = await queryAll(conn, [
+                'SELECT ParentId, Parent.Id, Parent.Name, Parent.IsOwnedByProfile, Parent.ProfileId, Parent.Profile.Name, Parent.Type, PermissionsRead, PermissionsCreate, PermissionsEdit, PermissionsDelete, PermissionsViewAllRecords, PermissionsModifyAllRecords',
+                'FROM ObjectPermissions',
+                `WHERE SobjectType = '${target.sobjectType}'`,
+                "AND Parent.Type != 'Muting'",
+            ].join(' '));
+            const grantByPermissionSetId = new Map();
+            const permissionSetById = new Map();
+            for (const row of entitlementRows) {
+                const access = toObjectAccess(row);
+                if (!anyAccess(access))
+                    continue;
+                grantByPermissionSetId.set(row.ParentId, access);
+                if (row.Parent)
+                    permissionSetById.set(row.ParentId, { ...row.Parent, Id: row.ParentId });
+            }
+            if (grantByPermissionSetId.size === 0)
+                return resultFor('object', target.sobjectType, [], warnings, { sobjectType: target.sobjectType });
+            let muting = {
+                permissionSetIdsByGroup: new Map(),
+                masksByPermissionSetId: new Map(),
+            };
+            const preparePsg = async (psgIds) => {
+                muting = await loadPsgMuting(conn, psgIds, async (mutingSetIds) => {
+                    const mutingRows = await queryAllInChunks(conn, mutingSetIds, (chunk) => [
+                        'SELECT ParentId, PermissionsRead, PermissionsCreate, PermissionsEdit, PermissionsDelete, PermissionsViewAllRecords, PermissionsModifyAllRecords',
+                        'FROM ObjectPermissions',
+                        'WHERE Parent.IsOwnedByProfile = false',
+                        `AND ParentId IN (${chunk.map((id) => `'${id}'`).join(',')})`,
+                        `AND SobjectType = '${target.sobjectType ?? ''}'`,
+                    ].join(' '));
+                    return new Map(mutingRows.map((row) => [row.ParentId, toObjectAccess(row)]));
+                });
+            };
+            const rows = await resolveAssignees(conn, 'object', target.sobjectType, grantByPermissionSetId, permissionSetById, (grant, context) => {
+                if (context.assignmentType === 'PermissionSet')
+                    return grant;
+                const muted = combinePsgMuting(context.psgId, muting, {
+                    kind: 'object',
+                    read: false,
+                    create: false,
+                    edit: false,
+                    delete: false,
+                    viewAll: false,
+                    modifyAll: false,
+                }, (left, right) => ({
+                    kind: 'object',
+                    read: left.read || right.read,
+                    create: left.create || right.create,
+                    edit: left.edit || right.edit,
+                    delete: left.delete || right.delete,
+                    viewAll: left.viewAll || right.viewAll,
+                    modifyAll: left.modifyAll || right.modifyAll,
+                }));
+                const effective = {
+                    kind: 'object',
+                    read: grant.read && !muted.read,
+                    create: grant.create && !muted.create,
+                    edit: grant.edit && !muted.edit,
+                    delete: grant.delete && !muted.delete,
+                    viewAll: grant.viewAll && !muted.viewAll,
+                    modifyAll: grant.modifyAll && !muted.modifyAll,
+                };
+                return anyAccess(effective) ? effective : undefined;
+            }, { preparePsg });
+            return resultFor('object', target.sobjectType, rows, warnings, { sobjectType: target.sobjectType });
+        }
+        catch (error) {
+            if (error instanceof UserAccessError)
+                throw error;
+            throw new UserAccessError('errorAccessQueryFailed', [target.type, target.targetName], error);
+        }
+    },
+    csvColumns: objectCsvColumns,
+};
+//# sourceMappingURL=object.js.map

package/lib/access/resolvers/object.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"object.js","sourceRoot":"","sources":["../../../src/access/resolvers/object.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAA4B,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAuB,MAAM,cAAc,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAe9C,MAAM,MAAM,GAAG,CAAC,KAA0B,EAAW,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;AACvE,MAAM,cAAc,GAAG,CAAC,GAA2B,EAAgB,EAAE,CAAC,CAAC;IACrE,IAAI,EAAE,QAAQ;IACd,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACrC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACrC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC;IAC9C,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,2BAA2B,CAAC;CACnD,CAAC,CAAC;AACH,MAAM,SAAS,GAAG,CAAC,MAAoB,EAAW,EAAE,CAClD,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,CAAC;AAErG,MAAM,CAAC,MAAM,cAAc,GAAyB;IAClD,IAAI,EAAE,QAAQ;IACd,cAAc,EAAE,oBAAoB;IACpC,KAAK,CAAC,OAAO,CAAC,IAAgB,EAAE,MAA6B;QAC3D,IAAI,CAAC,MAAM,CAAC,WAAW;YAAE,MAAM,IAAI,eAAe,CAAC,oBAAoB,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9F,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,MAAM,QAAQ,CACpC,IAAI,EACJ;gBACE,sPAAsP;gBACtP,wBAAwB;gBACxB,wBAAwB,MAAM,CAAC,WAAW,GAAG;gBAC7C,6BAA6B;aAC9B,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;YACF,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAwB,CAAC;YAC/D,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA+B,CAAC;YACjE,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;gBAClC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;gBACnC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;oBAAE,SAAS;gBACjC,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACjD,IAAI,GAAG,CAAC,MAAM;oBAAE,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,IAAI,sBAAsB,CAAC,IAAI,KAAK,CAAC;gBACnC,OAAO,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;YAEpG,IAAI,MAAM,GAAiC;gBACzC,uBAAuB,EAAE,IAAI,GAAG,EAAE;gBAClC,sBAAsB,EAAE,IAAI,GAAG,EAAE;aAClC,CAAC;YACF,MAAM,UAAU,GAAG,KAAK,EAAE,MAAgB,EAAiB,EAAE;gBAC3D,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;oBAChE,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAsB,IAAI,EAAE,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAC3F;wBACE,iJAAiJ;wBACjJ,wBAAwB;wBACxB,uCAAuC;wBACvC,oBAAoB,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;wBAC7D,sBAAsB,MAAM,CAAC,WAAW,IAAI,EAAE,GAAG;qBAClD,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;oBACF,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC/E,CAAC,CAAC,CAAC;YACL,CAAC,CAAC;YAEF,MAAM,IAAI,GAAG,MAAM,gBAAgB,CACjC,IAAI,EACJ,QAAQ,EACR,MAAM,CAAC,WAAW,EAClB,sBAAsB,EACtB,iBAAiB,EACjB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBACjB,IAAI,OAAO,CAAC,cAAc,KAAK,eAAe;oBAAE,OAAO,KAAK,CAAC;gBAC7D,MAAM,KAAK,GAAG,gBAAgB,CAC5B,OAAO,CAAC,KAAK,EACb,MAAM,EACN;oBACE,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,KAAK;oBACX,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,KAAK;oBACX,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,KAAK;oBACd,SAAS,EAAE,KAAK;iBACjB,EACD,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;oBAChB,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI;oBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM;oBACnC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI;oBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM;oBACnC,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO;oBACtC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS;iBAC7C,CAAC,CACH,CAAC;gBACF,MAAM,SAAS,GAAG;oBAChB,IAAI,EAAE,QAAiB;oBACvB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI;oBAC/B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM;oBACrC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI;oBAC/B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM;oBACrC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO;oBACxC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,SAAS;iBAC/C,CAAC;gBACF,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACtD,CAAC,EACD,EAAE,UAAU,EAAE,CACf,CAAC;YACF,OAAO,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QACtG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,eAAe;gBAAE,MAAM,KAAK,CAAC;YAClD,MAAM,IAAI,eAAe,CAAC,wBAAwB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IACD,UAAU,EAAE,gBAAgB;CAC7B,CAAC"}

package/lib/access/resolvers/recordType.d.ts

@@ -0,0 +1,2 @@
+import type { AccessTargetResolver } from '../types.js';
+export declare const recordTypeResolver: AccessTargetResolver;

package/lib/access/resolvers/recordType.js

@@ -0,0 +1,181 @@
+import { resolveAssignees, resultFor } from '../assignees.js';
+import { mutingPermissionSetMetadataNamesById, partialMetadataWarning, profileMetadataNamesById, readMetadataInBatches, recordTypeVisibilities, } from '../metadata.js';
+import { queryAll, queryAllInChunks, soqlIn } from '../soql.js';
+import { recordTypeCsvColumns } from '../output.js';
+import { validateRecordTypeTarget } from '../targetValidation.js';
+import { UserAccessError } from '../types.js';
+const metadataFailure = (type, name, cause) => new UserAccessError('errorRecordTypeMetadataReadFailed', [type, name], cause);
+const findVisibility = (metadata, type, targetName) => {
+    const matches = recordTypeVisibilities(metadata, type).filter((entry) => entry.recordType === targetName);
+    if (matches.length > 1) {
+        throw metadataFailure(type, metadata.fullName, new Error(`Duplicate visibility for ${targetName}.`));
+    }
+    return matches[0];
+};
+// eslint-disable-next-line complexity
+const discoverCandidateSources = async (conn) => {
+    const activeUsers = await queryAll(conn, 'SELECT ProfileId FROM User WHERE IsActive = true');
+    const profileIds = [...new Set(activeUsers.map((user) => user.ProfileId).filter((id) => Boolean(id)))];
+    const profileMetadataNames = await profileMetadataNamesById(conn);
+    const mutingMetadataNames = await mutingPermissionSetMetadataNamesById(conn);
+    const profiles = await queryAllInChunks(conn, profileIds, (chunk) => `SELECT Id, Name FROM Profile WHERE Id IN (${soqlIn(chunk)})`);
+    const profilesById = new Map(profiles.map((profile) => [profile.Id, profile]));
+    const profilePermissionSets = await queryAllInChunks(conn, profileIds, (chunk) => [
+        'SELECT Id, Name, Label, Type, IsOwnedByProfile, ProfileId, Profile.Name',
+        'FROM PermissionSet',
+        'WHERE IsOwnedByProfile = true',
+        `AND ProfileId IN (${soqlIn(chunk)})`,
+    ].join(' '));
+    const assignments = await queryAll(conn, [
+        'SELECT PermissionSetId, PermissionSet.Type, PermissionSet.IsOwnedByProfile, PermissionSetGroupId',
+        'FROM PermissionSetAssignment',
+        'WHERE Assignee.IsActive = true',
+    ].join(' '));
+    const permissionSetIds = new Set();
+    const mutingMetadataNameByPsgId = new Map();
+    const psgIds = [
+        ...new Set(assignments.flatMap((assignment) => (assignment.PermissionSetGroupId ? [assignment.PermissionSetGroupId] : []))),
+    ];
+    for (const assignment of assignments) {
+        if (assignment.PermissionSetId &&
+            assignment.PermissionSet?.Type === 'Regular' &&
+            assignment.PermissionSet?.IsOwnedByProfile !== true) {
+            permissionSetIds.add(assignment.PermissionSetId);
+        }
+    }
+    const components = await queryAllInChunks(conn, psgIds, (chunk) => [
+        'SELECT PermissionSetGroupId, PermissionSetId, PermissionSet.Name, PermissionSet.Type',
+        'FROM PermissionSetGroupComponent',
+        `WHERE PermissionSetGroupId IN (${soqlIn(chunk)})`,
+    ].join(' '));
+    for (const component of components) {
+        // Muting permission sets are a separate object: their component rows carry a
+        // null PermissionSet relationship and their Ids are not returned by a
+        // PermissionSet SOQL query, so resolve them through the metadata listing and
+        // never treat them as regular permission sets.
+        const mutingName = mutingMetadataNames.get(component.PermissionSetId.substring(0, 15)) ??
+            (component.PermissionSet?.Type === 'Muting' ? component.PermissionSet?.Name ?? undefined : undefined);
+        if (mutingName) {
+            mutingMetadataNameByPsgId.set(component.PermissionSetGroupId, mutingName);
+            continue;
+        }
+        if (component.PermissionSet?.Type !== 'Group')
+            permissionSetIds.add(component.PermissionSetId);
+    }
+    const permissionSetById = new Map();
+    const metadataNameByPermissionSetId = new Map();
+    const profilePermissionSetByProfileId = new Map();
+    for (const permissionSet of profilePermissionSets) {
+        if (permissionSet.ProfileId)
+            profilePermissionSetByProfileId.set(permissionSet.ProfileId, permissionSet);
+    }
+    for (const profileId of profileIds) {
+        const profile = profilesById.get(profileId);
+        const profilePermissionSet = profilePermissionSetByProfileId.get(profileId);
+        const metadataName = profileMetadataNames.get(profileId.substring(0, 15));
+        // Profiles the Metadata API does not expose (Automated Process and other
+        // system profiles) are not auditable for record-type visibility. Their
+        // record Ids are absent from the metadata listing and from the SOQL Profile
+        // query, so skip them rather than failing the whole audit.
+        if (!profile || !profilePermissionSet || !metadataName)
+            continue;
+        permissionSetById.set(profilePermissionSet.Id, {
+            ...profilePermissionSet,
+            Id: profilePermissionSet.Id,
+            IsOwnedByProfile: true,
+            ProfileId: profileId,
+            Profile: { Name: profile.Name },
+        });
+        metadataNameByPermissionSetId.set(profilePermissionSet.Id, { type: 'Profile', fullName: metadataName });
+    }
+    if (permissionSetIds.size > 0) {
+        const regularPermissionSets = await queryAllInChunks(conn, [...permissionSetIds], (chunk) => [
+            'SELECT Id, Name, Label, Type, IsOwnedByProfile, ProfileId, Profile.Name',
+            'FROM PermissionSet',
+            `WHERE Id IN (${soqlIn(chunk)})`,
+        ].join(' '));
+        const regularById = new Map(regularPermissionSets.map((permissionSet) => [permissionSet.Id, permissionSet]));
+        const missingIds = [...permissionSetIds].filter((id) => !regularById.has(id));
+        if (missingIds.length > 0) {
+            throw metadataFailure('PermissionSet', missingIds.join(', '), new Error('Permission Set source discovery was incomplete.'));
+        }
+        for (const permissionSet of regularPermissionSets) {
+            if (permissionSet.Type === 'Group' || permissionSet.IsOwnedByProfile === true)
+                continue;
+            const fullName = permissionSet.Name ?? permissionSet.DeveloperName;
+            if (!fullName)
+                throw metadataFailure('PermissionSet', permissionSet.Id, new Error('Permission Set has no metadata name.'));
+            permissionSetById.set(permissionSet.Id, permissionSet);
+            metadataNameByPermissionSetId.set(permissionSet.Id, { type: 'PermissionSet', fullName });
+        }
+    }
+    return { permissionSetById, metadataNameByPermissionSetId, mutingMetadataNameByPsgId };
+};
+const grantFor = (entry, type) => {
+    if (type === 'Profile' && typeof entry.default !== 'boolean') {
+        throw metadataFailure(type, entry.recordType, new Error('Profile record type visibility has no default value.'));
+    }
+    return {
+        kind: 'record-type',
+        visible: true,
+        default: type === 'Profile' ? entry.default === true : null,
+    };
+};
+export const recordTypeResolver = {
+    type: 'record-type',
+    validateTarget: validateRecordTypeTarget,
+    async resolve(conn, target) {
+        if (!target.sobjectType) {
+            throw new UserAccessError('errorInvalidTarget', [target.targetName]);
+        }
+        try {
+            const sources = await discoverCandidateSources(conn);
+            const metadataNamesByType = new Map();
+            for (const source of sources.metadataNameByPermissionSetId.values()) {
+                const names = metadataNamesByType.get(source.type) ?? [];
+                names.push(source.fullName);
+                metadataNamesByType.set(source.type, names);
+            }
+            const { metadata: profileMetadata, missing: missingProfileNames } = await readMetadataInBatches(conn, 'Profile', [...new Set(metadataNamesByType.get('Profile') ?? [])]);
+            const { metadata: permissionSetMetadata, missing: missingPermissionSetNames } = await readMetadataInBatches(conn, 'PermissionSet', [...new Set(metadataNamesByType.get('PermissionSet') ?? [])]);
+            const mutingNames = [...new Set(sources.mutingMetadataNameByPsgId.values())];
+            const { metadata: mutingMetadata, missing: missingMutingNames } = await readMetadataInBatches(conn, 'MutingPermissionSet', mutingNames);
+            const mutedPsgIds = new Set();
+            for (const [psgId, fullName] of sources.mutingMetadataNameByPsgId) {
+                const metadata = mutingMetadata.get(fullName);
+                // Muting metadata the running user cannot read is reported as a partial
+                // result below rather than aborting; leaving the PSG unmuted may
+                // over-report access, which the warning calls out.
+                if (!metadata)
+                    continue;
+                const entry = findVisibility(metadata, 'MutingPermissionSet', target.targetName);
+                if (entry?.visible === true)
+                    mutedPsgIds.add(psgId);
+            }
+            const grantByPermissionSetId = new Map();
+            for (const [permissionSetId, source] of sources.metadataNameByPermissionSetId) {
+                const metadata = (source.type === 'Profile' ? profileMetadata : permissionSetMetadata).get(source.fullName);
+                // Sources the running user cannot read are omitted from the audit and
+                // reported as a partial result below rather than aborting.
+                if (!metadata)
+                    continue;
+                const entry = findVisibility(metadata, source.type, target.targetName);
+                if (entry?.visible === true)
+                    grantByPermissionSetId.set(permissionSetId, grantFor(entry, source.type));
+            }
+            const rows = await resolveAssignees(conn, 'record-type', target.targetName, grantByPermissionSetId, sources.permissionSetById, (grant, context) => (context.psgId && mutedPsgIds.has(context.psgId) ? undefined : grant));
+            const warnings = [];
+            const missingNames = [...missingProfileNames, ...missingPermissionSetNames, ...missingMutingNames];
+            if (missingNames.length > 0)
+                warnings.push(partialMetadataWarning(missingNames));
+            return resultFor('record-type', target.targetName, rows, warnings, { sobjectType: target.sobjectType });
+        }
+        catch (error) {
+            if (error instanceof UserAccessError)
+                throw error;
+            throw new UserAccessError('errorAccessQueryFailed', [target.type, target.targetName], error);
+        }
+    },
+    csvColumns: recordTypeCsvColumns,
+};
+//# sourceMappingURL=recordType.js.map

package/lib/access/resolvers/recordType.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recordType.js","sourceRoot":"","sources":["../../../src/access/resolvers/recordType.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAA4B,MAAM,iBAAiB,CAAC;AACxF,OAAO,EACL,oCAAoC,EACpC,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,sBAAsB,GAGvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAElE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAsB9C,MAAM,eAAe,GAAG,CAAC,IAAkB,EAAE,IAAY,EAAE,KAAc,EAAmB,EAAE,CAC5F,IAAI,eAAe,CAAC,mCAAmC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;AAEhF,MAAM,cAAc,GAAG,CACrB,QAAwD,EACxD,IAAkB,EAClB,UAAkB,EACgB,EAAE;IACpC,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;IAC1G,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,KAAK,CAAC,4BAA4B,UAAU,GAAG,CAAC,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC,CAAC;AAEF,sCAAsC;AACtC,MAAM,wBAAwB,GAAG,KAAK,EAAE,IAAgB,EAA6B,EAAE;IACrF,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAuB,IAAI,EAAE,kDAAkD,CAAC,CAAC;IACnH,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrH,MAAM,oBAAoB,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,mBAAmB,GAAG,MAAM,oCAAoC,CAAC,IAAI,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,IAAI,EACJ,UAAU,EACV,CAAC,KAAK,EAAE,EAAE,CAAC,6CAA6C,MAAM,CAAC,KAAK,CAAC,GAAG,CACzE,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,qBAAqB,GAAG,MAAM,gBAAgB,CAAmB,IAAI,EAAE,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CACjG;QACE,yEAAyE;QACzE,oBAAoB;QACpB,+BAA+B;QAC/B,qBAAqB,MAAM,CAAC,KAAK,CAAC,GAAG;KACtC,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;IAEF,MAAM,WAAW,GAAG,MAAM,QAAQ,CAChC,IAAI,EACJ;QACE,kGAAkG;QAClG,8BAA8B;QAC9B,gCAAgC;KACjC,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5D,MAAM,MAAM,GAAG;QACb,GAAG,IAAI,GAAG,CACR,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAChH;KACF,CAAC;IACF,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IACE,UAAU,CAAC,eAAe;YAC1B,UAAU,CAAC,aAAa,EAAE,IAAI,KAAK,SAAS;YAC5C,UAAU,CAAC,aAAa,EAAE,gBAAgB,KAAK,IAAI,EACnD,CAAC;YACD,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAiC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAChG;QACE,sFAAsF;QACtF,kCAAkC;QAClC,kCAAkC,MAAM,CAAC,KAAK,CAAC,GAAG;KACnD,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,6EAA6E;QAC7E,sEAAsE;QACtE,6EAA6E;QAC7E,+CAA+C;QAC/C,MAAM,UAAU,GACd,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnE,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACxG,IAAI,UAAU,EAAE,CAAC;YACf,yBAAyB,CAAC,GAAG,CAAC,SAAS,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;YAC1E,SAAS;QACX,CAAC;QACD,IAAI,SAAS,CAAC,aAAa,EAAE,IAAI,KAAK,OAAO;YAAE,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA+B,CAAC;IACjE,MAAM,6BAA6B,GAAG,IAAI,GAAG,EAAmE,CAAC;IACjH,MAAM,+BAA+B,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC5E,KAAK,MAAM,aAAa,IAAI,qBAAqB,EAAE,CAAC;QAClD,IAAI,aAAa,CAAC,SAAS;YAAE,+BAA+B,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAC3G,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,oBAAoB,GAAG,+BAA+B,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5E,MAAM,YAAY,GAAG,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1E,yEAAyE;QACzE,uEAAuE;QACvE,4EAA4E;QAC5E,2DAA2D;QAC3D,IAAI,CAAC,OAAO,IAAI,CAAC,oBAAoB,IAAI,CAAC,YAAY;YAAE,SAAS;QACjE,iBAAiB,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,EAAE;YAC7C,GAAG,oBAAoB;YACvB,EAAE,EAAE,oBAAoB,CAAC,EAAE;YAC3B,gBAAgB,EAAE,IAAI;YACtB,SAAS,EAAE,SAAS;YACpB,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;SAChC,CAAC,CAAC;QACH,6BAA6B,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED,IAAI,gBAAgB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,qBAAqB,GAAG,MAAM,gBAAgB,CAAmB,IAAI,EAAE,CAAC,GAAG,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAC5G;YACE,yEAAyE;YACzE,oBAAoB;YACpB,gBAAgB,MAAM,CAAC,KAAK,CAAC,GAAG;SACjC,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;QACF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;QAC7G,MAAM,UAAU,GAAG,CAAC,GAAG,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9E,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,eAAe,CACnB,eAAe,EACf,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EACrB,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAC7D,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,aAAa,IAAI,qBAAqB,EAAE,CAAC;YAClD,IAAI,aAAa,CAAC,IAAI,KAAK,OAAO,IAAI,aAAa,CAAC,gBAAgB,KAAK,IAAI;gBAAE,SAAS;YACxF,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,IAAI,aAAa,CAAC,aAAa,CAAC;YACnE,IAAI,CAAC,QAAQ;gBACX,MAAM,eAAe,CAAC,eAAe,EAAE,aAAa,CAAC,EAAE,EAAE,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAC;YAC9G,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;YACvD,6BAA6B,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IACD,OAAO,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,yBAAyB,EAAE,CAAC;AACzF,CAAC,CAAC;AAEF,MAAM,QAAQ,GAAG,CAAC,KAA2B,EAAE,IAAiC,EAAoB,EAAE;IACpG,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC7D,MAAM,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC,CAAC;IACnH,CAAC;IACD,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI;KAC5D,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAyB;IACtD,IAAI,EAAE,aAAa;IACnB,cAAc,EAAE,wBAAwB;IACxC,KAAK,CAAC,OAAO,CAAC,IAAgB,EAAE,MAA6B;QAC3D,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,IAAI,eAAe,CAAC,oBAAoB,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;YACrD,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAyC,CAAC;YAC7E,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,6BAA6B,CAAC,MAAM,EAAE,EAAE,CAAC;gBACpE,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACzD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC5B,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;YACD,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,mBAAmB,EAAE,GAAG,MAAM,qBAAqB,CAE7F,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3E,MAAM,EAAE,QAAQ,EAAE,qBAAqB,EAAE,OAAO,EAAE,yBAAyB,EAAE,GAAG,MAAM,qBAAqB,CAEzG,IAAI,EAAE,eAAe,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACvF,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,yBAAyB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC7E,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,kBAAkB,EAAE,GAAG,MAAM,qBAAqB,CAE3F,IAAI,EAAE,qBAAqB,EAAE,WAAW,CAAC,CAAC;YAC5C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;YACtC,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC;gBAClE,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC9C,wEAAwE;gBACxE,iEAAiE;gBACjE,mDAAmD;gBACnD,IAAI,CAAC,QAAQ;oBAAE,SAAS;gBACxB,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,EAAE,qBAAqB,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;gBACjF,IAAI,KAAK,EAAE,OAAO,KAAK,IAAI;oBAAE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAA4B,CAAC;YACnE,KAAK,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,6BAA6B,EAAE,CAAC;gBAC9E,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC5G,sEAAsE;gBACtE,2DAA2D;gBAC3D,IAAI,CAAC,QAAQ;oBAAE,SAAS;gBACxB,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;gBACvE,IAAI,KAAK,EAAE,OAAO,KAAK,IAAI;oBAAE,sBAAsB,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACzG,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CACjC,IAAI,EACJ,aAAa,EACb,MAAM,CAAC,UAAU,EACjB,sBAAsB,EACtB,OAAO,CAAC,iBAAiB,EACzB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAC1F,CAAC;YACF,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,MAAM,YAAY,GAAG,CAAC,GAAG,mBAAmB,EAAE,GAAG,yBAAyB,EAAE,GAAG,kBAAkB,CAAC,CAAC;YACnG,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC,CAAC;YACjF,OAAO,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1G,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,eAAe;gBAAE,MAAM,KAAK,CAAC;YAClD,MAAM,IAAI,eAAe,CAAC,wBAAwB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IACD,UAAU,EAAE,oBAAoB;CACjC,CAAC"}

package/lib/access/resolvers/setupEntity.d.ts

@@ -0,0 +1,4 @@
+import type { AccessTargetResolver } from '../types.js';
+export declare const apexClassResolver: AccessTargetResolver;
+export declare const vfPageResolver: AccessTargetResolver;
+export declare const customPermissionResolver: AccessTargetResolver;