@vendure/admin-ui 1.5.0 → 1.5.1

package/bundles/vendure-admin-ui-core.umd.js

@@ -2467,6 +2467,31 @@
      * Permissions for administrators and customers. Used to control access to
      * GraphQL resolvers via the {@link Allow} decorator.
      *
+     * ## Understanding Permission.Owner
+     *
+     * `Permission.Owner` is a special permission which is used in some of the Vendure resolvers to indicate that that resolver should only
+     * be accessible to the "owner" of that resource.
+     *
+     * For example, the Shop API `activeCustomer` query resolver should only return the Customer object for the "owner" of that Customer, i.e.
+     * based on the activeUserId of the current session. As a result, the resolver code looks like this:
+     *
+     * @example
+     * ```TypeScript
+     * \@Query()
+     * \@Allow(Permission.Owner)
+     * async activeCustomer(\@Ctx() ctx: RequestContext): Promise<Customer | undefined> {
+     *   const userId = ctx.activeUserId;
+     *   if (userId) {
+     *     return this.customerService.findOneByUserId(ctx, userId);
+     *   }
+     * }
+     * ```
+     *
+     * Here we can see that the "ownership" must be enforced by custom logic inside the resolver. Since "ownership" cannot be defined generally
+     * nor statically encoded at build-time, any resolvers using `Permission.Owner` **must** include logic to enforce that only the owner
+     * of the resource has access. If not, then it is the equivalent of using `Permission.Public`.
+     *
+     *
      * @docsCategory common
      */
     exports.Permission = void 0;
@@ -14061,7 +14086,7 @@
     }
 
     // Auto-generated by the set-version.js script.
-    var ADMIN_UI_VERSION = '1.5.0';
+    var ADMIN_UI_VERSION = '1.5.1';
 
     /**
      * Responsible for registering dashboard widget components and querying for layouts.