@webiny/api-aco 0.0.0-unstable.9e825fd5fb → 0.0.0-unstable.a9593f74dd

package/folder/folder.crud.js

@@ -1,12 +1,21 @@
 "use strict";
 
+var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault").default;
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.createFolderCrudMethods = void 0;
 var _pubsub = require("@webiny/pubsub");
+var _validation = require("@webiny/validation");
+var _getFolderAndItsAncestors = require("../utils/getFolderAndItsAncestors");
+var _NotAuthorizedError = _interopRequireDefault(require("@webiny/api-security/NotAuthorizedError"));
+var _error = _interopRequireDefault(require("@webiny/error"));
+const FIXED_FOLDER_LISTING_LIMIT = 10_000;
 const createFolderCrudMethods = ({
-  storageOperations
+  storageOperations,
+  folderLevelPermissions,
+  listAdminUsers,
+  listTeams
 }) => {
   // create
   const onFolderBeforeCreate = (0, _pubsub.createTopic)("aco.onFolderBeforeCreate");
@@ -28,20 +37,81 @@ const createFolderCrudMethods = ({
     onFolderBeforeDelete,
     onFolderAfterDelete,
     async get(id) {
-      return storageOperations.getFolder({
+      const folder = await storageOperations.getFolder({
         id
       });
+      await folderLevelPermissions.ensureCanAccessFolder({
+        folder,
+        rwd: "r"
+      });
+      await folderLevelPermissions.assignFolderPermissions(folder);
+      return folder;
     },
     async list(params) {
-      return storageOperations.listFolders(params);
+      // No matter what was the limit set in the params, initially, we always retrieve
+      // all folders. The limit is then applied with the filtered folders list below.
+      const filteredFolders = await folderLevelPermissions.listAllFoldersWithPermissions(params.where.type).then(filteredFolders => {
+        // If `parentId` was included in the `where` clause, we need to filter the folders.
+        // TODO: we might want to incorporate this into the `listAllFoldersWithPermissions` method.
+        if (params.where.parentId) {
+          // Filter by parent ID.
+          return filteredFolders.filter(folder => folder.parentId === params.where.parentId);
+        }
+        return filteredFolders;
+      });
+      const totalCount = filteredFolders.length;
+      let hasMoreItems = false;
+      let cursor = null;
+
+      // Apply cursor/limit params.
+      if (params.after) {
+        const afterListItemIndex = filteredFolders.findIndex(folder => folder.id === params.after);
+        if (afterListItemIndex >= 0) {
+          // Remove all items below the "after" item.
+          filteredFolders.splice(0, afterListItemIndex + 1);
+        }
+      }
+      hasMoreItems = !!params.limit && filteredFolders.length > params.limit;
+      if (hasMoreItems) {
+        cursor = filteredFolders[params.limit - 1]?.id || null;
+        filteredFolders.splice(params.limit);
+      }
+      return [filteredFolders, {
+        totalCount,
+        hasMoreItems,
+        cursor
+      }];
+    },
+    async listAll(params) {
+      return this.list({
+        ...params,
+        limit: FIXED_FOLDER_LISTING_LIMIT
+      });
     },
     async create(data) {
+      let canCreateFolder = false;
+      if (data.parentId) {
+        const parentFolder = await storageOperations.getFolder({
+          id: data.parentId
+        });
+        canCreateFolder = await folderLevelPermissions.canAccessFolder({
+          folder: parentFolder,
+          rwd: "w"
+        });
+      } else {
+        canCreateFolder = await folderLevelPermissions.canCreateFolderInRoot();
+      }
+      if (!canCreateFolder) {
+        throw new _NotAuthorizedError.default();
+      }
       await onFolderBeforeCreate.publish({
         input: data
       });
       const folder = await storageOperations.createFolder({
         data
       });
+      folderLevelPermissions.invalidateCache();
+      await folderLevelPermissions.assignFolderPermissions(folder);
       await onFolderAfterCreate.publish({
         folder
       });
@@ -51,6 +121,63 @@ const createFolderCrudMethods = ({
       const original = await storageOperations.getFolder({
         id
       });
+      const canUpdateFolder = await folderLevelPermissions.canAccessFolder({
+        folder: original,
+        rwd: "w"
+      });
+      if (!canUpdateFolder) {
+        throw new _NotAuthorizedError.default();
+      }
+
+      // Validate data.
+      if (Array.isArray(data.permissions)) {
+        data.permissions.forEach(permission => {
+          const targetIsValid = permission.target.startsWith("admin:") || permission.target.startsWith("team:");
+          if (!targetIsValid) {
+            throw new Error(`Permission target "${permission.target}" is not valid.`);
+          }
+          if (permission.inheritedFrom) {
+            throw new Error(`Permission "inheritedFrom" cannot be set manually.`);
+          }
+        });
+      }
+
+      // Parent change is not allowed if the user doesn't have access to the new parent.
+      if (data.parentId && data.parentId !== original.parentId) {
+        try {
+          // Getting the parent folder will throw an error if the user doesn't have access.
+          await this.get(data.parentId);
+        } catch (e) {
+          if (e instanceof _NotAuthorizedError.default) {
+            throw new _error.default(`Cannot move folder to a new parent because you don't have access to the new parent.`, "CANNOT_MOVE_FOLDER_TO_NEW_PARENT");
+          }
+
+          // If we didn't receive the expected error, we still want to throw it.
+          throw e;
+        }
+      }
+
+      // Let's prepare a custom folder permissions list, where the folder contains the updated data.
+      const customFoldersList = await folderLevelPermissions.listAllFolders(original.type).then(folders => {
+        const foldersClone = structuredClone(folders);
+        return foldersClone.map(folder => {
+          if (folder.id === id) {
+            Object.assign(folder, data);
+          }
+          return folder;
+        });
+      });
+      const stillHasAccess = await folderLevelPermissions.canAccessFolder({
+        folder: {
+          id,
+          type: original.type
+        },
+        rwd: "w",
+        foldersList: customFoldersList
+      });
+      if (!stillHasAccess) {
+        throw new _error.default(`Cannot continue because you would loose access to this folder.`, "CANNOT_LOOSE_FOLDER_ACCESS");
+      }
       await onFolderBeforeUpdate.publish({
         original,
         input: {
@@ -70,12 +197,18 @@ const createFolderCrudMethods = ({
         },
         folder
       });
+      folderLevelPermissions.invalidateCache();
+      await folderLevelPermissions.assignFolderPermissions(folder);
       return folder;
     },
     async delete(id) {
       const folder = await storageOperations.getFolder({
         id
       });
+      await folderLevelPermissions.ensureCanAccessFolder({
+        folder,
+        rwd: "d"
+      });
       await onFolderBeforeDelete.publish({
         folder
       });
@@ -86,7 +219,71 @@ const createFolderCrudMethods = ({
         folder
       });
       return true;
+    },
+    async getAncestors(folder) {
+      const [folders] = await this.listAll({
+        where: {
+          type: folder.type
+        }
+      });
+      return (0, _getFolderAndItsAncestors.getFolderAndItsAncestors)({
+        folder,
+        folders
+      });
+    },
+    /**
+     * @deprecated use `getAncestors` instead
+     */
+    async getFolderWithAncestors(id) {
+      const folder = await this.get(id);
+      return this.getAncestors(folder);
+    },
+    async listFolderLevelPermissionsTargets() {
+      const adminUsers = await listAdminUsers();
+      const teams = await listTeams();
+      const teamTargets = teams.map(team => ({
+        id: team.id,
+        type: "team",
+        target: `team:${team.id}`,
+        name: team.name || "",
+        meta: {}
+      }));
+      const adminUserTargets = adminUsers.map(user => {
+        let name = user.displayName;
+        if (!name) {
+          // For backwards compatibility, we also want to try concatenating first and last name.
+          name = [user.firstName, user.lastName].filter(Boolean).join(" ");
+        }
+
+        // We're doing the validation because, with non-Cognito IdPs (Okta, Auth0), the email
+        // field might actually contain a non-email value: `id:${IdP_Identity_ID}`. In that case,
+        // let's not assign anything to the `email` field.
+        let email = user.email;
+        try {
+          _validation.validation.validateSync(email, "email");
+        } catch {
+          email = null;
+        }
+        const image = user.avatar?.src || null;
+        return {
+          id: user.id,
+          type: "admin",
+          target: `admin:${user.id}`,
+          name,
+          meta: {
+            email,
+            image
+          }
+        };
+      });
+      const results = [...teamTargets, ...adminUserTargets];
+      const meta = {
+        totalCount: results.length
+      };
+      return [results, meta];
     }
   };
 };
-exports.createFolderCrudMethods = createFolderCrudMethods;
+exports.createFolderCrudMethods = createFolderCrudMethods;
+
+//# sourceMappingURL=folder.crud.js.map

package/folder/folder.crud.js.map

@@ -1 +1 @@
-{"version":3,"names":["createFolderCrudMethods","storageOperations","onFolderBeforeCreate","createTopic","onFolderAfterCreate","onFolderBeforeUpdate","onFolderAfterUpdate","onFolderBeforeDelete","onFolderAfterDelete","get","id","getFolder","list","params","listFolders","create","data","publish","input","folder","createFolder","update","original","updateFolder","delete","deleteFolder"],"sources":["folder.crud.ts"],"sourcesContent":["import { createTopic } from \"@webiny/pubsub\";\n\nimport { CreateAcoParams } from \"~/types\";\nimport {\n    AcoFolderCrud,\n    OnFolderAfterCreateTopicParams,\n    OnFolderAfterDeleteTopicParams,\n    OnFolderAfterUpdateTopicParams,\n    OnFolderBeforeCreateTopicParams,\n    OnFolderBeforeDeleteTopicParams,\n    OnFolderBeforeUpdateTopicParams\n} from \"./folder.types\";\n\nexport const createFolderCrudMethods = ({ storageOperations }: CreateAcoParams): AcoFolderCrud => {\n    // create\n    const onFolderBeforeCreate = createTopic<OnFolderBeforeCreateTopicParams>(\n        \"aco.onFolderBeforeCreate\"\n    );\n    const onFolderAfterCreate =\n        createTopic<OnFolderAfterCreateTopicParams>(\"aco.onFolderAfterCreate\");\n    // update\n    const onFolderBeforeUpdate = createTopic<OnFolderBeforeUpdateTopicParams>(\n        \"aco.onFolderBeforeUpdate\"\n    );\n    const onFolderAfterUpdate =\n        createTopic<OnFolderAfterUpdateTopicParams>(\"aco.onFolderAfterUpdate\");\n    // delete\n    const onFolderBeforeDelete = createTopic<OnFolderBeforeDeleteTopicParams>(\n        \"aco.onFolderBeforeDelete\"\n    );\n    const onFolderAfterDelete =\n        createTopic<OnFolderAfterDeleteTopicParams>(\"aco.onFolderAfterDelete\");\n\n    return {\n        /**\n         * Lifecycle events\n         */\n        onFolderBeforeCreate,\n        onFolderAfterCreate,\n        onFolderBeforeUpdate,\n        onFolderAfterUpdate,\n        onFolderBeforeDelete,\n        onFolderAfterDelete,\n        async get(id) {\n            return storageOperations.getFolder({ id });\n        },\n        async list(params) {\n            return storageOperations.listFolders(params);\n        },\n        async create(data) {\n            await onFolderBeforeCreate.publish({ input: data });\n            const folder = await storageOperations.createFolder({ data });\n            await onFolderAfterCreate.publish({ folder });\n            return folder;\n        },\n        async update(id, data) {\n            const original = await storageOperations.getFolder({ id });\n            await onFolderBeforeUpdate.publish({ original, input: { id, data } });\n            const folder = await storageOperations.updateFolder({ id, data });\n            await onFolderAfterUpdate.publish({ original, input: { id, data }, folder });\n            return folder;\n        },\n        async delete(id: string) {\n            const folder = await storageOperations.getFolder({ id });\n            await onFolderBeforeDelete.publish({ folder });\n            await storageOperations.deleteFolder({ id });\n            await onFolderAfterDelete.publish({ folder });\n            return true;\n        }\n    };\n};\n"],"mappings":";;;;;;AAAA;AAaO,MAAMA,uBAAuB,GAAG,CAAC;EAAEC;AAAmC,CAAC,KAAoB;EAC9F;EACA,MAAMC,oBAAoB,GAAG,IAAAC,mBAAW,EACpC,0BAA0B,CAC7B;EACD,MAAMC,mBAAmB,GACrB,IAAAD,mBAAW,EAAiC,yBAAyB,CAAC;EAC1E;EACA,MAAME,oBAAoB,GAAG,IAAAF,mBAAW,EACpC,0BAA0B,CAC7B;EACD,MAAMG,mBAAmB,GACrB,IAAAH,mBAAW,EAAiC,yBAAyB,CAAC;EAC1E;EACA,MAAMI,oBAAoB,GAAG,IAAAJ,mBAAW,EACpC,0BAA0B,CAC7B;EACD,MAAMK,mBAAmB,GACrB,IAAAL,mBAAW,EAAiC,yBAAyB,CAAC;EAE1E,OAAO;IACH;AACR;AACA;IACQD,oBAAoB;IACpBE,mBAAmB;IACnBC,oBAAoB;IACpBC,mBAAmB;IACnBC,oBAAoB;IACpBC,mBAAmB;IACnB,MAAMC,GAAG,CAACC,EAAE,EAAE;MACV,OAAOT,iBAAiB,CAACU,SAAS,CAAC;QAAED;MAAG,CAAC,CAAC;IAC9C,CAAC;IACD,MAAME,IAAI,CAACC,MAAM,EAAE;MACf,OAAOZ,iBAAiB,CAACa,WAAW,CAACD,MAAM,CAAC;IAChD,CAAC;IACD,MAAME,MAAM,CAACC,IAAI,EAAE;MACf,MAAMd,oBAAoB,CAACe,OAAO,CAAC;QAAEC,KAAK,EAAEF;MAAK,CAAC,CAAC;MACnD,MAAMG,MAAM,GAAG,MAAMlB,iBAAiB,CAACmB,YAAY,CAAC;QAAEJ;MAAK,CAAC,CAAC;MAC7D,MAAMZ,mBAAmB,CAACa,OAAO,CAAC;QAAEE;MAAO,CAAC,CAAC;MAC7C,OAAOA,MAAM;IACjB,CAAC;IACD,MAAME,MAAM,CAACX,EAAE,EAAEM,IAAI,EAAE;MACnB,MAAMM,QAAQ,GAAG,MAAMrB,iBAAiB,CAACU,SAAS,CAAC;QAAED;MAAG,CAAC,CAAC;MAC1D,MAAML,oBAAoB,CAACY,OAAO,CAAC;QAAEK,QAAQ;QAAEJ,KAAK,EAAE;UAAER,EAAE;UAAEM;QAAK;MAAE,CAAC,CAAC;MACrE,MAAMG,MAAM,GAAG,MAAMlB,iBAAiB,CAACsB,YAAY,CAAC;QAAEb,EAAE;QAAEM;MAAK,CAAC,CAAC;MACjE,MAAMV,mBAAmB,CAACW,OAAO,CAAC;QAAEK,QAAQ;QAAEJ,KAAK,EAAE;UAAER,EAAE;UAAEM;QAAK,CAAC;QAAEG;MAAO,CAAC,CAAC;MAC5E,OAAOA,MAAM;IACjB,CAAC;IACD,MAAMK,MAAM,CAACd,EAAU,EAAE;MACrB,MAAMS,MAAM,GAAG,MAAMlB,iBAAiB,CAACU,SAAS,CAAC;QAAED;MAAG,CAAC,CAAC;MACxD,MAAMH,oBAAoB,CAACU,OAAO,CAAC;QAAEE;MAAO,CAAC,CAAC;MAC9C,MAAMlB,iBAAiB,CAACwB,YAAY,CAAC;QAAEf;MAAG,CAAC,CAAC;MAC5C,MAAMF,mBAAmB,CAACS,OAAO,CAAC;QAAEE;MAAO,CAAC,CAAC;MAC7C,OAAO,IAAI;IACf;EACJ,CAAC;AACL,CAAC;AAAC"}
+{"version":3,"names":["_pubsub","require","_validation","_getFolderAndItsAncestors","_NotAuthorizedError","_interopRequireDefault","_error","FIXED_FOLDER_LISTING_LIMIT","createFolderCrudMethods","storageOperations","folderLevelPermissions","listAdminUsers","listTeams","onFolderBeforeCreate","createTopic","onFolderAfterCreate","onFolderBeforeUpdate","onFolderAfterUpdate","onFolderBeforeDelete","onFolderAfterDelete","get","id","folder","getFolder","ensureCanAccessFolder","rwd","assignFolderPermissions","list","params","filteredFolders","listAllFoldersWithPermissions","where","type","then","parentId","filter","totalCount","length","hasMoreItems","cursor","after","afterListItemIndex","findIndex","splice","limit","listAll","create","data","canCreateFolder","parentFolder","canAccessFolder","canCreateFolderInRoot","NotAuthorizedError","publish","input","createFolder","invalidateCache","update","original","canUpdateFolder","Array","isArray","permissions","forEach","permission","targetIsValid","target","startsWith","Error","inheritedFrom","e","WError","customFoldersList","listAllFolders","folders","foldersClone","structuredClone","map","Object","assign","stillHasAccess","foldersList","updateFolder","delete","deleteFolder","getAncestors","getFolderAndItsAncestors","getFolderWithAncestors","listFolderLevelPermissionsTargets","adminUsers","teams","teamTargets","team","name","meta","adminUserTargets","user","displayName","firstName","lastName","Boolean","join","email","validation","validateSync","image","avatar","src","results","exports"],"sources":["folder.crud.ts"],"sourcesContent":["import { createTopic } from \"@webiny/pubsub\";\nimport { validation } from \"@webiny/validation\";\nimport { CreateAcoParams, Folder } from \"~/types\";\nimport {\n    AcoFolderCrud,\n    OnFolderAfterCreateTopicParams,\n    OnFolderAfterDeleteTopicParams,\n    OnFolderAfterUpdateTopicParams,\n    OnFolderBeforeCreateTopicParams,\n    OnFolderBeforeDeleteTopicParams,\n    OnFolderBeforeUpdateTopicParams\n} from \"./folder.types\";\n\nimport { getFolderAndItsAncestors } from \"~/utils/getFolderAndItsAncestors\";\nimport NotAuthorizedError from \"@webiny/api-security/NotAuthorizedError\";\nimport { AdminUser } from \"@webiny/api-admin-users/types\";\nimport { Team } from \"@webiny/api-security/types\";\nimport WError from \"@webiny/error\";\n\nconst FIXED_FOLDER_LISTING_LIMIT = 10_000;\n\ninterface CreateFolderCrudMethodsParams extends CreateAcoParams {\n    listAdminUsers: () => Promise<AdminUser[]>;\n    listTeams: () => Promise<Team[]>;\n}\n\nexport const createFolderCrudMethods = ({\n    storageOperations,\n    folderLevelPermissions,\n    listAdminUsers,\n    listTeams\n}: CreateFolderCrudMethodsParams): AcoFolderCrud => {\n    // create\n    const onFolderBeforeCreate = createTopic<OnFolderBeforeCreateTopicParams>(\n        \"aco.onFolderBeforeCreate\"\n    );\n    const onFolderAfterCreate =\n        createTopic<OnFolderAfterCreateTopicParams>(\"aco.onFolderAfterCreate\");\n    // update\n    const onFolderBeforeUpdate = createTopic<OnFolderBeforeUpdateTopicParams>(\n        \"aco.onFolderBeforeUpdate\"\n    );\n    const onFolderAfterUpdate =\n        createTopic<OnFolderAfterUpdateTopicParams>(\"aco.onFolderAfterUpdate\");\n    // delete\n    const onFolderBeforeDelete = createTopic<OnFolderBeforeDeleteTopicParams>(\n        \"aco.onFolderBeforeDelete\"\n    );\n    const onFolderAfterDelete =\n        createTopic<OnFolderAfterDeleteTopicParams>(\"aco.onFolderAfterDelete\");\n\n    return {\n        /**\n         * Lifecycle events\n         */\n        onFolderBeforeCreate,\n        onFolderAfterCreate,\n        onFolderBeforeUpdate,\n        onFolderAfterUpdate,\n        onFolderBeforeDelete,\n        onFolderAfterDelete,\n\n        async get(id) {\n            const folder = await storageOperations.getFolder({ id });\n\n            await folderLevelPermissions.ensureCanAccessFolder({\n                folder,\n                rwd: \"r\"\n            });\n\n            await folderLevelPermissions.assignFolderPermissions(folder);\n            return folder;\n        },\n        async list(params) {\n            // No matter what was the limit set in the params, initially, we always retrieve\n            // all folders. The limit is then applied with the filtered folders list below.\n            const filteredFolders = await folderLevelPermissions\n                .listAllFoldersWithPermissions(params.where.type)\n                .then(filteredFolders => {\n                    // If `parentId` was included in the `where` clause, we need to filter the folders.\n                    // TODO: we might want to incorporate this into the `listAllFoldersWithPermissions` method.\n                    if (params.where.parentId) {\n                        // Filter by parent ID.\n                        return filteredFolders.filter(\n                            folder => folder.parentId === params.where.parentId\n                        );\n                    }\n                    return filteredFolders;\n                });\n\n            const totalCount = filteredFolders.length;\n            let hasMoreItems = false;\n            let cursor: string | null = null;\n\n            // Apply cursor/limit params.\n            if (params.after) {\n                const afterListItemIndex = filteredFolders.findIndex(\n                    folder => folder.id === params.after\n                );\n                if (afterListItemIndex >= 0) {\n                    // Remove all items below the \"after\" item.\n                    filteredFolders.splice(0, afterListItemIndex + 1);\n                }\n            }\n\n            hasMoreItems = !!params.limit && filteredFolders.length > params.limit;\n\n            if (hasMoreItems) {\n                cursor = filteredFolders[params.limit! - 1]?.id || null;\n                filteredFolders.splice(params.limit!);\n            }\n\n            return [filteredFolders, { totalCount, hasMoreItems, cursor }];\n        },\n\n        async listAll(params) {\n            return this.list({ ...params, limit: FIXED_FOLDER_LISTING_LIMIT });\n        },\n\n        async create(data) {\n            let canCreateFolder = false;\n            if (data.parentId) {\n                const parentFolder = await storageOperations.getFolder({ id: data.parentId });\n                canCreateFolder = await folderLevelPermissions.canAccessFolder({\n                    folder: parentFolder,\n                    rwd: \"w\"\n                });\n            } else {\n                canCreateFolder = await folderLevelPermissions.canCreateFolderInRoot();\n            }\n\n            if (!canCreateFolder) {\n                throw new NotAuthorizedError();\n            }\n\n            await onFolderBeforeCreate.publish({ input: data });\n            const folder = await storageOperations.createFolder({ data });\n\n            folderLevelPermissions.invalidateCache();\n            await folderLevelPermissions.assignFolderPermissions(folder);\n\n            await onFolderAfterCreate.publish({ folder });\n\n            return folder;\n        },\n\n        async update(id, data) {\n            const original = await storageOperations.getFolder({ id });\n\n            const canUpdateFolder = await folderLevelPermissions.canAccessFolder({\n                folder: original,\n                rwd: \"w\"\n            });\n\n            if (!canUpdateFolder) {\n                throw new NotAuthorizedError();\n            }\n\n            // Validate data.\n            if (Array.isArray(data.permissions)) {\n                data.permissions.forEach(permission => {\n                    const targetIsValid =\n                        permission.target.startsWith(\"admin:\") ||\n                        permission.target.startsWith(\"team:\");\n                    if (!targetIsValid) {\n                        throw new Error(`Permission target \"${permission.target}\" is not valid.`);\n                    }\n\n                    if (permission.inheritedFrom) {\n                        throw new Error(`Permission \"inheritedFrom\" cannot be set manually.`);\n                    }\n                });\n            }\n\n            // Parent change is not allowed if the user doesn't have access to the new parent.\n            if (data.parentId && data.parentId !== original.parentId) {\n                try {\n                    // Getting the parent folder will throw an error if the user doesn't have access.\n                    await this.get(data.parentId);\n                } catch (e) {\n                    if (e instanceof NotAuthorizedError) {\n                        throw new WError(\n                            `Cannot move folder to a new parent because you don't have access to the new parent.`,\n                            \"CANNOT_MOVE_FOLDER_TO_NEW_PARENT\"\n                        );\n                    }\n\n                    // If we didn't receive the expected error, we still want to throw it.\n                    throw e;\n                }\n            }\n\n            // Let's prepare a custom folder permissions list, where the folder contains the updated data.\n            const customFoldersList = await folderLevelPermissions\n                .listAllFolders(original.type)\n                .then(folders => {\n                    const foldersClone = structuredClone<Folder[]>(folders);\n                    return foldersClone.map(folder => {\n                        if (folder.id === id) {\n                            Object.assign(folder, data);\n                        }\n                        return folder;\n                    });\n                });\n\n            const stillHasAccess = await folderLevelPermissions.canAccessFolder({\n                folder: { id, type: original.type },\n                rwd: \"w\",\n                foldersList: customFoldersList\n            });\n\n            if (!stillHasAccess) {\n                throw new WError(\n                    `Cannot continue because you would loose access to this folder.`,\n                    \"CANNOT_LOOSE_FOLDER_ACCESS\"\n                );\n            }\n\n            await onFolderBeforeUpdate.publish({ original, input: { id, data } });\n            const folder = await storageOperations.updateFolder({ id, data });\n            await onFolderAfterUpdate.publish({ original, input: { id, data }, folder });\n\n            folderLevelPermissions.invalidateCache();\n            await folderLevelPermissions.assignFolderPermissions(folder);\n            return folder;\n        },\n\n        async delete(id: string) {\n            const folder = await storageOperations.getFolder({ id });\n\n            await folderLevelPermissions.ensureCanAccessFolder({\n                folder,\n                rwd: \"d\"\n            });\n\n            await onFolderBeforeDelete.publish({ folder });\n            await storageOperations.deleteFolder({ id });\n            await onFolderAfterDelete.publish({ folder });\n            return true;\n        },\n\n        async getAncestors(folder: Folder) {\n            const [folders] = await this.listAll({ where: { type: folder.type } });\n            return getFolderAndItsAncestors({ folder, folders });\n        },\n\n        /**\n         * @deprecated use `getAncestors` instead\n         */\n        async getFolderWithAncestors(id: string) {\n            const folder = await this.get(id);\n            return this.getAncestors(folder);\n        },\n\n        async listFolderLevelPermissionsTargets() {\n            const adminUsers = await listAdminUsers();\n            const teams = await listTeams();\n\n            const teamTargets = teams.map(team => ({\n                id: team.id,\n                type: \"team\",\n                target: `team:${team.id}`,\n                name: team.name || \"\",\n                meta: {}\n            }));\n\n            const adminUserTargets = adminUsers.map(user => {\n                let name = user.displayName;\n                if (!name) {\n                    // For backwards compatibility, we also want to try concatenating first and last name.\n                    name = [user.firstName, user.lastName].filter(Boolean).join(\" \");\n                }\n\n                // We're doing the validation because, with non-Cognito IdPs (Okta, Auth0), the email\n                // field might actually contain a non-email value: `id:${IdP_Identity_ID}`. In that case,\n                // let's not assign anything to the `email` field.\n                let email: string | null = user.email;\n                try {\n                    validation.validateSync(email, \"email\");\n                } catch {\n                    email = null;\n                }\n\n                const image = user.avatar?.src || null;\n\n                return {\n                    id: user.id,\n                    type: \"admin\",\n                    target: `admin:${user.id}`,\n                    name,\n                    meta: {\n                        email,\n                        image\n                    }\n                };\n            });\n\n            const results = [...teamTargets, ...adminUserTargets];\n            const meta = { totalCount: results.length };\n\n            return [results, meta];\n        }\n    };\n};\n"],"mappings":";;;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AACA,IAAAC,WAAA,GAAAD,OAAA;AAYA,IAAAE,yBAAA,GAAAF,OAAA;AACA,IAAAG,mBAAA,GAAAC,sBAAA,CAAAJ,OAAA;AAGA,IAAAK,MAAA,GAAAD,sBAAA,CAAAJ,OAAA;AAEA,MAAMM,0BAA0B,GAAG,MAAM;AAOlC,MAAMC,uBAAuB,GAAGA,CAAC;EACpCC,iBAAiB;EACjBC,sBAAsB;EACtBC,cAAc;EACdC;AAC2B,CAAC,KAAoB;EAChD;EACA,MAAMC,oBAAoB,GAAG,IAAAC,mBAAW,EACpC,0BACJ,CAAC;EACD,MAAMC,mBAAmB,GACrB,IAAAD,mBAAW,EAAiC,yBAAyB,CAAC;EAC1E;EACA,MAAME,oBAAoB,GAAG,IAAAF,mBAAW,EACpC,0BACJ,CAAC;EACD,MAAMG,mBAAmB,GACrB,IAAAH,mBAAW,EAAiC,yBAAyB,CAAC;EAC1E;EACA,MAAMI,oBAAoB,GAAG,IAAAJ,mBAAW,EACpC,0BACJ,CAAC;EACD,MAAMK,mBAAmB,GACrB,IAAAL,mBAAW,EAAiC,yBAAyB,CAAC;EAE1E,OAAO;IACH;AACR;AACA;IACQD,oBAAoB;IACpBE,mBAAmB;IACnBC,oBAAoB;IACpBC,mBAAmB;IACnBC,oBAAoB;IACpBC,mBAAmB;IAEnB,MAAMC,GAAGA,CAACC,EAAE,EAAE;MACV,MAAMC,MAAM,GAAG,MAAMb,iBAAiB,CAACc,SAAS,CAAC;QAAEF;MAAG,CAAC,CAAC;MAExD,MAAMX,sBAAsB,CAACc,qBAAqB,CAAC;QAC/CF,MAAM;QACNG,GAAG,EAAE;MACT,CAAC,CAAC;MAEF,MAAMf,sBAAsB,CAACgB,uBAAuB,CAACJ,MAAM,CAAC;MAC5D,OAAOA,MAAM;IACjB,CAAC;IACD,MAAMK,IAAIA,CAACC,MAAM,EAAE;MACf;MACA;MACA,MAAMC,eAAe,GAAG,MAAMnB,sBAAsB,CAC/CoB,6BAA6B,CAACF,MAAM,CAACG,KAAK,CAACC,IAAI,CAAC,CAChDC,IAAI,CAACJ,eAAe,IAAI;QACrB;QACA;QACA,IAAID,MAAM,CAACG,KAAK,CAACG,QAAQ,EAAE;UACvB;UACA,OAAOL,eAAe,CAACM,MAAM,CACzBb,MAAM,IAAIA,MAAM,CAACY,QAAQ,KAAKN,MAAM,CAACG,KAAK,CAACG,QAC/C,CAAC;QACL;QACA,OAAOL,eAAe;MAC1B,CAAC,CAAC;MAEN,MAAMO,UAAU,GAAGP,eAAe,CAACQ,MAAM;MACzC,IAAIC,YAAY,GAAG,KAAK;MACxB,IAAIC,MAAqB,GAAG,IAAI;;MAEhC;MACA,IAAIX,MAAM,CAACY,KAAK,EAAE;QACd,MAAMC,kBAAkB,GAAGZ,eAAe,CAACa,SAAS,CAChDpB,MAAM,IAAIA,MAAM,CAACD,EAAE,KAAKO,MAAM,CAACY,KACnC,CAAC;QACD,IAAIC,kBAAkB,IAAI,CAAC,EAAE;UACzB;UACAZ,eAAe,CAACc,MAAM,CAAC,CAAC,EAAEF,kBAAkB,GAAG,CAAC,CAAC;QACrD;MACJ;MAEAH,YAAY,GAAG,CAAC,CAACV,MAAM,CAACgB,KAAK,IAAIf,eAAe,CAACQ,MAAM,GAAGT,MAAM,CAACgB,KAAK;MAEtE,IAAIN,YAAY,EAAE;QACdC,MAAM,GAAGV,eAAe,CAACD,MAAM,CAACgB,KAAK,GAAI,CAAC,CAAC,EAAEvB,EAAE,IAAI,IAAI;QACvDQ,eAAe,CAACc,MAAM,CAACf,MAAM,CAACgB,KAAM,CAAC;MACzC;MAEA,OAAO,CAACf,eAAe,EAAE;QAAEO,UAAU;QAAEE,YAAY;QAAEC;MAAO,CAAC,CAAC;IAClE,CAAC;IAED,MAAMM,OAAOA,CAACjB,MAAM,EAAE;MAClB,OAAO,IAAI,CAACD,IAAI,CAAC;QAAE,GAAGC,MAAM;QAAEgB,KAAK,EAAErC;MAA2B,CAAC,CAAC;IACtE,CAAC;IAED,MAAMuC,MAAMA,CAACC,IAAI,EAAE;MACf,IAAIC,eAAe,GAAG,KAAK;MAC3B,IAAID,IAAI,CAACb,QAAQ,EAAE;QACf,MAAMe,YAAY,GAAG,MAAMxC,iBAAiB,CAACc,SAAS,CAAC;UAAEF,EAAE,EAAE0B,IAAI,CAACb;QAAS,CAAC,CAAC;QAC7Ec,eAAe,GAAG,MAAMtC,sBAAsB,CAACwC,eAAe,CAAC;UAC3D5B,MAAM,EAAE2B,YAAY;UACpBxB,GAAG,EAAE;QACT,CAAC,CAAC;MACN,CAAC,MAAM;QACHuB,eAAe,GAAG,MAAMtC,sBAAsB,CAACyC,qBAAqB,CAAC,CAAC;MAC1E;MAEA,IAAI,CAACH,eAAe,EAAE;QAClB,MAAM,IAAII,2BAAkB,CAAC,CAAC;MAClC;MAEA,MAAMvC,oBAAoB,CAACwC,OAAO,CAAC;QAAEC,KAAK,EAAEP;MAAK,CAAC,CAAC;MACnD,MAAMzB,MAAM,GAAG,MAAMb,iBAAiB,CAAC8C,YAAY,CAAC;QAAER;MAAK,CAAC,CAAC;MAE7DrC,sBAAsB,CAAC8C,eAAe,CAAC,CAAC;MACxC,MAAM9C,sBAAsB,CAACgB,uBAAuB,CAACJ,MAAM,CAAC;MAE5D,MAAMP,mBAAmB,CAACsC,OAAO,CAAC;QAAE/B;MAAO,CAAC,CAAC;MAE7C,OAAOA,MAAM;IACjB,CAAC;IAED,MAAMmC,MAAMA,CAACpC,EAAE,EAAE0B,IAAI,EAAE;MACnB,MAAMW,QAAQ,GAAG,MAAMjD,iBAAiB,CAACc,SAAS,CAAC;QAAEF;MAAG,CAAC,CAAC;MAE1D,MAAMsC,eAAe,GAAG,MAAMjD,sBAAsB,CAACwC,eAAe,CAAC;QACjE5B,MAAM,EAAEoC,QAAQ;QAChBjC,GAAG,EAAE;MACT,CAAC,CAAC;MAEF,IAAI,CAACkC,eAAe,EAAE;QAClB,MAAM,IAAIP,2BAAkB,CAAC,CAAC;MAClC;;MAEA;MACA,IAAIQ,KAAK,CAACC,OAAO,CAACd,IAAI,CAACe,WAAW,CAAC,EAAE;QACjCf,IAAI,CAACe,WAAW,CAACC,OAAO,CAACC,UAAU,IAAI;UACnC,MAAMC,aAAa,GACfD,UAAU,CAACE,MAAM,CAACC,UAAU,CAAC,QAAQ,CAAC,IACtCH,UAAU,CAACE,MAAM,CAACC,UAAU,CAAC,OAAO,CAAC;UACzC,IAAI,CAACF,aAAa,EAAE;YAChB,MAAM,IAAIG,KAAK,CAAE,sBAAqBJ,UAAU,CAACE,MAAO,iBAAgB,CAAC;UAC7E;UAEA,IAAIF,UAAU,CAACK,aAAa,EAAE;YAC1B,MAAM,IAAID,KAAK,CAAE,oDAAmD,CAAC;UACzE;QACJ,CAAC,CAAC;MACN;;MAEA;MACA,IAAIrB,IAAI,CAACb,QAAQ,IAAIa,IAAI,CAACb,QAAQ,KAAKwB,QAAQ,CAACxB,QAAQ,EAAE;QACtD,IAAI;UACA;UACA,MAAM,IAAI,CAACd,GAAG,CAAC2B,IAAI,CAACb,QAAQ,CAAC;QACjC,CAAC,CAAC,OAAOoC,CAAC,EAAE;UACR,IAAIA,CAAC,YAAYlB,2BAAkB,EAAE;YACjC,MAAM,IAAImB,cAAM,CACX,qFAAoF,EACrF,kCACJ,CAAC;UACL;;UAEA;UACA,MAAMD,CAAC;QACX;MACJ;;MAEA;MACA,MAAME,iBAAiB,GAAG,MAAM9D,sBAAsB,CACjD+D,cAAc,CAACf,QAAQ,CAAC1B,IAAI,CAAC,CAC7BC,IAAI,CAACyC,OAAO,IAAI;QACb,MAAMC,YAAY,GAAGC,eAAe,CAAWF,OAAO,CAAC;QACvD,OAAOC,YAAY,CAACE,GAAG,CAACvD,MAAM,IAAI;UAC9B,IAAIA,MAAM,CAACD,EAAE,KAAKA,EAAE,EAAE;YAClByD,MAAM,CAACC,MAAM,CAACzD,MAAM,EAAEyB,IAAI,CAAC;UAC/B;UACA,OAAOzB,MAAM;QACjB,CAAC,CAAC;MACN,CAAC,CAAC;MAEN,MAAM0D,cAAc,GAAG,MAAMtE,sBAAsB,CAACwC,eAAe,CAAC;QAChE5B,MAAM,EAAE;UAAED,EAAE;UAAEW,IAAI,EAAE0B,QAAQ,CAAC1B;QAAK,CAAC;QACnCP,GAAG,EAAE,GAAG;QACRwD,WAAW,EAAET;MACjB,CAAC,CAAC;MAEF,IAAI,CAACQ,cAAc,EAAE;QACjB,MAAM,IAAIT,cAAM,CACX,gEAA+D,EAChE,4BACJ,CAAC;MACL;MAEA,MAAMvD,oBAAoB,CAACqC,OAAO,CAAC;QAAEK,QAAQ;QAAEJ,KAAK,EAAE;UAAEjC,EAAE;UAAE0B;QAAK;MAAE,CAAC,CAAC;MACrE,MAAMzB,MAAM,GAAG,MAAMb,iBAAiB,CAACyE,YAAY,CAAC;QAAE7D,EAAE;QAAE0B;MAAK,CAAC,CAAC;MACjE,MAAM9B,mBAAmB,CAACoC,OAAO,CAAC;QAAEK,QAAQ;QAAEJ,KAAK,EAAE;UAAEjC,EAAE;UAAE0B;QAAK,CAAC;QAAEzB;MAAO,CAAC,CAAC;MAE5EZ,sBAAsB,CAAC8C,eAAe,CAAC,CAAC;MACxC,MAAM9C,sBAAsB,CAACgB,uBAAuB,CAACJ,MAAM,CAAC;MAC5D,OAAOA,MAAM;IACjB,CAAC;IAED,MAAM6D,MAAMA,CAAC9D,EAAU,EAAE;MACrB,MAAMC,MAAM,GAAG,MAAMb,iBAAiB,CAACc,SAAS,CAAC;QAAEF;MAAG,CAAC,CAAC;MAExD,MAAMX,sBAAsB,CAACc,qBAAqB,CAAC;QAC/CF,MAAM;QACNG,GAAG,EAAE;MACT,CAAC,CAAC;MAEF,MAAMP,oBAAoB,CAACmC,OAAO,CAAC;QAAE/B;MAAO,CAAC,CAAC;MAC9C,MAAMb,iBAAiB,CAAC2E,YAAY,CAAC;QAAE/D;MAAG,CAAC,CAAC;MAC5C,MAAMF,mBAAmB,CAACkC,OAAO,CAAC;QAAE/B;MAAO,CAAC,CAAC;MAC7C,OAAO,IAAI;IACf,CAAC;IAED,MAAM+D,YAAYA,CAAC/D,MAAc,EAAE;MAC/B,MAAM,CAACoD,OAAO,CAAC,GAAG,MAAM,IAAI,CAAC7B,OAAO,CAAC;QAAEd,KAAK,EAAE;UAAEC,IAAI,EAAEV,MAAM,CAACU;QAAK;MAAE,CAAC,CAAC;MACtE,OAAO,IAAAsD,kDAAwB,EAAC;QAAEhE,MAAM;QAAEoD;MAAQ,CAAC,CAAC;IACxD,CAAC;IAED;AACR;AACA;IACQ,MAAMa,sBAAsBA,CAAClE,EAAU,EAAE;MACrC,MAAMC,MAAM,GAAG,MAAM,IAAI,CAACF,GAAG,CAACC,EAAE,CAAC;MACjC,OAAO,IAAI,CAACgE,YAAY,CAAC/D,MAAM,CAAC;IACpC,CAAC;IAED,MAAMkE,iCAAiCA,CAAA,EAAG;MACtC,MAAMC,UAAU,GAAG,MAAM9E,cAAc,CAAC,CAAC;MACzC,MAAM+E,KAAK,GAAG,MAAM9E,SAAS,CAAC,CAAC;MAE/B,MAAM+E,WAAW,GAAGD,KAAK,CAACb,GAAG,CAACe,IAAI,KAAK;QACnCvE,EAAE,EAAEuE,IAAI,CAACvE,EAAE;QACXW,IAAI,EAAE,MAAM;QACZkC,MAAM,EAAG,QAAO0B,IAAI,CAACvE,EAAG,EAAC;QACzBwE,IAAI,EAAED,IAAI,CAACC,IAAI,IAAI,EAAE;QACrBC,IAAI,EAAE,CAAC;MACX,CAAC,CAAC,CAAC;MAEH,MAAMC,gBAAgB,GAAGN,UAAU,CAACZ,GAAG,CAACmB,IAAI,IAAI;QAC5C,IAAIH,IAAI,GAAGG,IAAI,CAACC,WAAW;QAC3B,IAAI,CAACJ,IAAI,EAAE;UACP;UACAA,IAAI,GAAG,CAACG,IAAI,CAACE,SAAS,EAAEF,IAAI,CAACG,QAAQ,CAAC,CAAChE,MAAM,CAACiE,OAAO,CAAC,CAACC,IAAI,CAAC,GAAG,CAAC;QACpE;;QAEA;QACA;QACA;QACA,IAAIC,KAAoB,GAAGN,IAAI,CAACM,KAAK;QACrC,IAAI;UACAC,sBAAU,CAACC,YAAY,CAACF,KAAK,EAAE,OAAO,CAAC;QAC3C,CAAC,CAAC,MAAM;UACJA,KAAK,GAAG,IAAI;QAChB;QAEA,MAAMG,KAAK,GAAGT,IAAI,CAACU,MAAM,EAAEC,GAAG,IAAI,IAAI;QAEtC,OAAO;UACHtF,EAAE,EAAE2E,IAAI,CAAC3E,EAAE;UACXW,IAAI,EAAE,OAAO;UACbkC,MAAM,EAAG,SAAQ8B,IAAI,CAAC3E,EAAG,EAAC;UAC1BwE,IAAI;UACJC,IAAI,EAAE;YACFQ,KAAK;YACLG;UACJ;QACJ,CAAC;MACL,CAAC,CAAC;MAEF,MAAMG,OAAO,GAAG,CAAC,GAAGjB,WAAW,EAAE,GAAGI,gBAAgB,CAAC;MACrD,MAAMD,IAAI,GAAG;QAAE1D,UAAU,EAAEwE,OAAO,CAACvE;MAAO,CAAC;MAE3C,OAAO,CAACuE,OAAO,EAAEd,IAAI,CAAC;IAC1B;EACJ,CAAC;AACL,CAAC;AAACe,OAAA,CAAArG,uBAAA,GAAAA,uBAAA"}

package/folder/folder.gql.js

@@ -6,23 +6,54 @@ Object.defineProperty(exports, "__esModule", {
 exports.folderSchema = void 0;
 var _responses = require("@webiny/handler-graphql/responses");
 var _GraphQLSchemaPlugin = require("@webiny/handler-graphql/plugins/GraphQLSchemaPlugin");
+var _ensureAuthentication = require("../utils/ensureAuthentication");
 var _resolve = require("../utils/resolve");
 const folderSchema = new _GraphQLSchemaPlugin.GraphQLSchemaPlugin({
   typeDefs: /* GraphQL */`
+        type FolderPermission {
+            target: String!
+            level: String!
+            inheritedFrom: ID
+        }
+
+        input FolderPermissionInput {
+            target: String!
+            level: String!
+            inheritedFrom: ID
+        }
+
         type Folder {
             id: ID!
             title: String!
             slug: String!
+            permissions: [FolderPermission]
+
+            # Tells us if the current user can manage folder structure.
+            canManageStructure: Boolean
+
+            # Tells us if the current user can manage folder permissions.
+            canManagePermissions: Boolean
+
+            # Tells us if the current user can manage folder content.
+            canManageContent: Boolean
+
+            # Tells us if the folder contains non-inherited permissions.
+            hasNonInheritedPermissions: Boolean
+
             type: String!
             parentId: ID
-            savedOn: DateTime
             createdOn: DateTime
+            modifiedOn: DateTime
+            savedOn: DateTime
             createdBy: AcoUser
+            modifiedBy: AcoUser
+            savedBy: AcoUser
         }
 
         input FolderCreateInput {
             title: String!
             slug: String!
+            permissions: [FolderPermissionInput]
             type: String!
             parentId: ID
         }
@@ -30,12 +61,14 @@ const folderSchema = new _GraphQLSchemaPlugin.GraphQLSchemaPlugin({
         input FolderUpdateInput {
             title: String
             slug: String
+            permissions: [FolderPermissionInput]
             parentId: ID
         }
 
         input FoldersListWhereInput {
             type: String!
             parentId: String
+            createdBy: ID
         }
 
         type FolderResponse {
@@ -46,6 +79,25 @@ const folderSchema = new _GraphQLSchemaPlugin.GraphQLSchemaPlugin({
         type FoldersListResponse {
             data: [Folder]
             error: AcoError
+            meta: AcoMeta
+        }
+
+        type FolderLevelPermissionsTarget {
+            id: ID!
+            type: String!
+            target: ID!
+            name: String!
+            meta: JSON
+        }
+
+        type FolderLevelPermissionsTargetsListMeta {
+            totalCount: Int!
+        }
+
+        type FolderLevelPermissionsTargetsListResponse {
+            data: [FolderLevelPermissionsTarget]
+            meta: FolderLevelPermissionsTargetsListMeta
+            error: AcoError
         }
 
         extend type AcoQuery {
@@ -56,6 +108,8 @@ const folderSchema = new _GraphQLSchemaPlugin.GraphQLSchemaPlugin({
                 after: String
                 sort: AcoSort
             ): FoldersListResponse
+
+            listFolderLevelPermissionsTargets: FolderLevelPermissionsTargetsListResponse
         }
 
         extend type AcoMutation {
@@ -65,39 +119,77 @@ const folderSchema = new _GraphQLSchemaPlugin.GraphQLSchemaPlugin({
         }
     `,
   resolvers: {
+    Folder: {
+      hasNonInheritedPermissions: (folder, _, context) => {
+        return context.aco.folderLevelPermissions.permissionsIncludeNonInheritedPermissions(folder.permissions);
+      },
+      canManageStructure: (folder, _, context) => {
+        return context.aco.folderLevelPermissions.canManageFolderStructure(folder);
+      },
+      canManagePermissions: (folder, _, context) => {
+        return context.aco.folderLevelPermissions.canManageFolderPermissions(folder);
+      },
+      canManageContent: (folder, _, context) => {
+        return context.aco.folderLevelPermissions.canManageFolderContent(folder);
+      }
+    },
     AcoQuery: {
       getFolder: async (_, {
         id
       }, context) => {
-        return (0, _resolve.resolve)(() => context.aco.folder.get(id));
+        return (0, _resolve.resolve)(() => {
+          (0, _ensureAuthentication.ensureAuthentication)(context);
+          return context.aco.folder.get(id);
+        });
       },
       listFolders: async (_, args, context) => {
         try {
+          (0, _ensureAuthentication.ensureAuthentication)(context);
           const [entries, meta] = await context.aco.folder.list(args);
           return new _responses.ListResponse(entries, meta);
         } catch (e) {
           return new _responses.ErrorResponse(e);
         }
+      },
+      listFolderLevelPermissionsTargets: async (_, args, context) => {
+        try {
+          (0, _ensureAuthentication.ensureAuthentication)(context);
+          const [entries, meta] = await context.aco.folder.listFolderLevelPermissionsTargets();
+          return new _responses.ListResponse(entries, meta);
+        } catch (e) {
+          return new _responses.ErrorResponse(e);
+        }
       }
     },
     AcoMutation: {
       createFolder: async (_, {
         data
       }, context) => {
-        return (0, _resolve.resolve)(() => context.aco.folder.create(data));
+        return (0, _resolve.resolve)(() => {
+          (0, _ensureAuthentication.ensureAuthentication)(context);
+          return context.aco.folder.create(data);
+        });
       },
       updateFolder: async (_, {
         id,
         data
       }, context) => {
-        return (0, _resolve.resolve)(() => context.aco.folder.update(id, data));
+        return (0, _resolve.resolve)(() => {
+          (0, _ensureAuthentication.ensureAuthentication)(context);
+          return context.aco.folder.update(id, data);
+        });
       },
       deleteFolder: async (_, {
         id
       }, context) => {
-        return (0, _resolve.resolve)(() => context.aco.folder.delete(id));
+        return (0, _resolve.resolve)(() => {
+          (0, _ensureAuthentication.ensureAuthentication)(context);
+          return context.aco.folder.delete(id);
+        });
       }
     }
   }
 });
-exports.folderSchema = folderSchema;
+exports.folderSchema = folderSchema;
+
+//# sourceMappingURL=folder.gql.js.map

package/folder/folder.gql.js.map

@@ -1 +1 @@
-{"version":3,"names":["folderSchema","GraphQLSchemaPlugin","typeDefs","resolvers","AcoQuery","getFolder","_","id","context","resolve","aco","folder","get","listFolders","args","entries","meta","list","ListResponse","e","ErrorResponse","AcoMutation","createFolder","data","create","updateFolder","update","deleteFolder","delete"],"sources":["folder.gql.ts"],"sourcesContent":["import { ErrorResponse, ListResponse } from \"@webiny/handler-graphql/responses\";\nimport { GraphQLSchemaPlugin } from \"@webiny/handler-graphql/plugins/GraphQLSchemaPlugin\";\n\nimport { resolve } from \"~/utils/resolve\";\n\nimport { AcoContext } from \"~/types\";\n\nexport const folderSchema = new GraphQLSchemaPlugin<AcoContext>({\n    typeDefs: /* GraphQL */ `\n        type Folder {\n            id: ID!\n            title: String!\n            slug: String!\n            type: String!\n            parentId: ID\n            savedOn: DateTime\n            createdOn: DateTime\n            createdBy: AcoUser\n        }\n\n        input FolderCreateInput {\n            title: String!\n            slug: String!\n            type: String!\n            parentId: ID\n        }\n\n        input FolderUpdateInput {\n            title: String\n            slug: String\n            parentId: ID\n        }\n\n        input FoldersListWhereInput {\n            type: String!\n            parentId: String\n        }\n\n        type FolderResponse {\n            data: Folder\n            error: AcoError\n        }\n\n        type FoldersListResponse {\n            data: [Folder]\n            error: AcoError\n        }\n\n        extend type AcoQuery {\n            getFolder(id: ID!): FolderResponse\n            listFolders(\n                where: FoldersListWhereInput!\n                limit: Int\n                after: String\n                sort: AcoSort\n            ): FoldersListResponse\n        }\n\n        extend type AcoMutation {\n            createFolder(data: FolderCreateInput!): FolderResponse\n            updateFolder(id: ID!, data: FolderUpdateInput!): FolderResponse\n            deleteFolder(id: ID!): AcoBooleanResponse\n        }\n    `,\n    resolvers: {\n        AcoQuery: {\n            getFolder: async (_, { id }, context) => {\n                return resolve(() => context.aco.folder.get(id));\n            },\n            listFolders: async (_, args: any, context) => {\n                try {\n                    const [entries, meta] = await context.aco.folder.list(args);\n                    return new ListResponse(entries, meta);\n                } catch (e) {\n                    return new ErrorResponse(e);\n                }\n            }\n        },\n        AcoMutation: {\n            createFolder: async (_, { data }, context) => {\n                return resolve(() => context.aco.folder.create(data));\n            },\n            updateFolder: async (_, { id, data }, context) => {\n                return resolve(() => context.aco.folder.update(id, data));\n            },\n            deleteFolder: async (_, { id }, context) => {\n                return resolve(() => context.aco.folder.delete(id));\n            }\n        }\n    }\n});\n"],"mappings":";;;;;;AAAA;AACA;AAEA;AAIO,MAAMA,YAAY,GAAG,IAAIC,wCAAmB,CAAa;EAC5DC,QAAQ,EAAE,aAAe;AAC7B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,KAAK;EACDC,SAAS,EAAE;IACPC,QAAQ,EAAE;MACNC,SAAS,EAAE,OAAOC,CAAC,EAAE;QAAEC;MAAG,CAAC,EAAEC,OAAO,KAAK;QACrC,OAAO,IAAAC,gBAAO,EAAC,MAAMD,OAAO,CAACE,GAAG,CAACC,MAAM,CAACC,GAAG,CAACL,EAAE,CAAC,CAAC;MACpD,CAAC;MACDM,WAAW,EAAE,OAAOP,CAAC,EAAEQ,IAAS,EAAEN,OAAO,KAAK;QAC1C,IAAI;UACA,MAAM,CAACO,OAAO,EAAEC,IAAI,CAAC,GAAG,MAAMR,OAAO,CAACE,GAAG,CAACC,MAAM,CAACM,IAAI,CAACH,IAAI,CAAC;UAC3D,OAAO,IAAII,uBAAY,CAACH,OAAO,EAAEC,IAAI,CAAC;QAC1C,CAAC,CAAC,OAAOG,CAAC,EAAE;UACR,OAAO,IAAIC,wBAAa,CAACD,CAAC,CAAC;QAC/B;MACJ;IACJ,CAAC;IACDE,WAAW,EAAE;MACTC,YAAY,EAAE,OAAOhB,CAAC,EAAE;QAAEiB;MAAK,CAAC,EAAEf,OAAO,KAAK;QAC1C,OAAO,IAAAC,gBAAO,EAAC,MAAMD,OAAO,CAACE,GAAG,CAACC,MAAM,CAACa,MAAM,CAACD,IAAI,CAAC,CAAC;MACzD,CAAC;MACDE,YAAY,EAAE,OAAOnB,CAAC,EAAE;QAAEC,EAAE;QAAEgB;MAAK,CAAC,EAAEf,OAAO,KAAK;QAC9C,OAAO,IAAAC,gBAAO,EAAC,MAAMD,OAAO,CAACE,GAAG,CAACC,MAAM,CAACe,MAAM,CAACnB,EAAE,EAAEgB,IAAI,CAAC,CAAC;MAC7D,CAAC;MACDI,YAAY,EAAE,OAAOrB,CAAC,EAAE;QAAEC;MAAG,CAAC,EAAEC,OAAO,KAAK;QACxC,OAAO,IAAAC,gBAAO,EAAC,MAAMD,OAAO,CAACE,GAAG,CAACC,MAAM,CAACiB,MAAM,CAACrB,EAAE,CAAC,CAAC;MACvD;IACJ;EACJ;AACJ,CAAC,CAAC;AAAC"}
+{"version":3,"names":["_responses","require","_GraphQLSchemaPlugin","_ensureAuthentication","_resolve","folderSchema","GraphQLSchemaPlugin","typeDefs","resolvers","Folder","hasNonInheritedPermissions","folder","_","context","aco","folderLevelPermissions","permissionsIncludeNonInheritedPermissions","permissions","canManageStructure","canManageFolderStructure","canManagePermissions","canManageFolderPermissions","canManageContent","canManageFolderContent","AcoQuery","getFolder","id","resolve","ensureAuthentication","get","listFolders","args","entries","meta","list","ListResponse","e","ErrorResponse","listFolderLevelPermissionsTargets","AcoMutation","createFolder","data","create","updateFolder","update","deleteFolder","delete","exports"],"sources":["folder.gql.ts"],"sourcesContent":["import { ErrorResponse, ListResponse } from \"@webiny/handler-graphql/responses\";\nimport { GraphQLSchemaPlugin } from \"@webiny/handler-graphql/plugins/GraphQLSchemaPlugin\";\n\nimport { ensureAuthentication } from \"~/utils/ensureAuthentication\";\nimport { resolve } from \"~/utils/resolve\";\n\nimport { AcoContext, Folder } from \"~/types\";\n\nexport const folderSchema = new GraphQLSchemaPlugin<AcoContext>({\n    typeDefs: /* GraphQL */ `\n        type FolderPermission {\n            target: String!\n            level: String!\n            inheritedFrom: ID\n        }\n\n        input FolderPermissionInput {\n            target: String!\n            level: String!\n            inheritedFrom: ID\n        }\n\n        type Folder {\n            id: ID!\n            title: String!\n            slug: String!\n            permissions: [FolderPermission]\n\n            # Tells us if the current user can manage folder structure.\n            canManageStructure: Boolean\n\n            # Tells us if the current user can manage folder permissions.\n            canManagePermissions: Boolean\n\n            # Tells us if the current user can manage folder content.\n            canManageContent: Boolean\n\n            # Tells us if the folder contains non-inherited permissions.\n            hasNonInheritedPermissions: Boolean\n\n            type: String!\n            parentId: ID\n            createdOn: DateTime\n            modifiedOn: DateTime\n            savedOn: DateTime\n            createdBy: AcoUser\n            modifiedBy: AcoUser\n            savedBy: AcoUser\n        }\n\n        input FolderCreateInput {\n            title: String!\n            slug: String!\n            permissions: [FolderPermissionInput]\n            type: String!\n            parentId: ID\n        }\n\n        input FolderUpdateInput {\n            title: String\n            slug: String\n            permissions: [FolderPermissionInput]\n            parentId: ID\n        }\n\n        input FoldersListWhereInput {\n            type: String!\n            parentId: String\n            createdBy: ID\n        }\n\n        type FolderResponse {\n            data: Folder\n            error: AcoError\n        }\n\n        type FoldersListResponse {\n            data: [Folder]\n            error: AcoError\n            meta: AcoMeta\n        }\n\n        type FolderLevelPermissionsTarget {\n            id: ID!\n            type: String!\n            target: ID!\n            name: String!\n            meta: JSON\n        }\n\n        type FolderLevelPermissionsTargetsListMeta {\n            totalCount: Int!\n        }\n\n        type FolderLevelPermissionsTargetsListResponse {\n            data: [FolderLevelPermissionsTarget]\n            meta: FolderLevelPermissionsTargetsListMeta\n            error: AcoError\n        }\n\n        extend type AcoQuery {\n            getFolder(id: ID!): FolderResponse\n            listFolders(\n                where: FoldersListWhereInput!\n                limit: Int\n                after: String\n                sort: AcoSort\n            ): FoldersListResponse\n\n            listFolderLevelPermissionsTargets: FolderLevelPermissionsTargetsListResponse\n        }\n\n        extend type AcoMutation {\n            createFolder(data: FolderCreateInput!): FolderResponse\n            updateFolder(id: ID!, data: FolderUpdateInput!): FolderResponse\n            deleteFolder(id: ID!): AcoBooleanResponse\n        }\n    `,\n    resolvers: {\n        Folder: {\n            hasNonInheritedPermissions: (folder: Folder, _, context) => {\n                return context.aco.folderLevelPermissions.permissionsIncludeNonInheritedPermissions(\n                    folder.permissions\n                );\n            },\n            canManageStructure: (folder, _, context) => {\n                return context.aco.folderLevelPermissions.canManageFolderStructure(folder);\n            },\n            canManagePermissions: (folder, _, context) => {\n                return context.aco.folderLevelPermissions.canManageFolderPermissions(folder);\n            },\n            canManageContent: (folder, _, context) => {\n                return context.aco.folderLevelPermissions.canManageFolderContent(folder);\n            }\n        },\n        AcoQuery: {\n            getFolder: async (_, { id }, context) => {\n                return resolve(() => {\n                    ensureAuthentication(context);\n                    return context.aco.folder.get(id);\n                });\n            },\n            listFolders: async (_, args: any, context) => {\n                try {\n                    ensureAuthentication(context);\n                    const [entries, meta] = await context.aco.folder.list(args);\n                    return new ListResponse(entries, meta);\n                } catch (e) {\n                    return new ErrorResponse(e);\n                }\n            },\n            listFolderLevelPermissionsTargets: async (_, args: any, context) => {\n                try {\n                    ensureAuthentication(context);\n                    const [entries, meta] =\n                        await context.aco.folder.listFolderLevelPermissionsTargets();\n                    return new ListResponse(entries, meta);\n                } catch (e) {\n                    return new ErrorResponse(e);\n                }\n            }\n        },\n        AcoMutation: {\n            createFolder: async (_, { data }, context) => {\n                return resolve(() => {\n                    ensureAuthentication(context);\n                    return context.aco.folder.create(data);\n                });\n            },\n            updateFolder: async (_, { id, data }, context) => {\n                return resolve(() => {\n                    ensureAuthentication(context);\n                    return context.aco.folder.update(id, data);\n                });\n            },\n            deleteFolder: async (_, { id }, context) => {\n                return resolve(() => {\n                    ensureAuthentication(context);\n                    return context.aco.folder.delete(id);\n                });\n            }\n        }\n    }\n});\n"],"mappings":";;;;;;AAAA,IAAAA,UAAA,GAAAC,OAAA;AACA,IAAAC,oBAAA,GAAAD,OAAA;AAEA,IAAAE,qBAAA,GAAAF,OAAA;AACA,IAAAG,QAAA,GAAAH,OAAA;AAIO,MAAMI,YAAY,GAAG,IAAIC,wCAAmB,CAAa;EAC5DC,QAAQ,EAAE,aAAe;AAC7B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,KAAK;EACDC,SAAS,EAAE;IACPC,MAAM,EAAE;MACJC,0BAA0B,EAAEA,CAACC,MAAc,EAAEC,CAAC,EAAEC,OAAO,KAAK;QACxD,OAAOA,OAAO,CAACC,GAAG,CAACC,sBAAsB,CAACC,yCAAyC,CAC/EL,MAAM,CAACM,WACX,CAAC;MACL,CAAC;MACDC,kBAAkB,EAAEA,CAACP,MAAM,EAAEC,CAAC,EAAEC,OAAO,KAAK;QACxC,OAAOA,OAAO,CAACC,GAAG,CAACC,sBAAsB,CAACI,wBAAwB,CAACR,MAAM,CAAC;MAC9E,CAAC;MACDS,oBAAoB,EAAEA,CAACT,MAAM,EAAEC,CAAC,EAAEC,OAAO,KAAK;QAC1C,OAAOA,OAAO,CAACC,GAAG,CAACC,sBAAsB,CAACM,0BAA0B,CAACV,MAAM,CAAC;MAChF,CAAC;MACDW,gBAAgB,EAAEA,CAACX,MAAM,EAAEC,CAAC,EAAEC,OAAO,KAAK;QACtC,OAAOA,OAAO,CAACC,GAAG,CAACC,sBAAsB,CAACQ,sBAAsB,CAACZ,MAAM,CAAC;MAC5E;IACJ,CAAC;IACDa,QAAQ,EAAE;MACNC,SAAS,EAAE,MAAAA,CAAOb,CAAC,EAAE;QAAEc;MAAG,CAAC,EAAEb,OAAO,KAAK;QACrC,OAAO,IAAAc,gBAAO,EAAC,MAAM;UACjB,IAAAC,0CAAoB,EAACf,OAAO,CAAC;UAC7B,OAAOA,OAAO,CAACC,GAAG,CAACH,MAAM,CAACkB,GAAG,CAACH,EAAE,CAAC;QACrC,CAAC,CAAC;MACN,CAAC;MACDI,WAAW,EAAE,MAAAA,CAAOlB,CAAC,EAAEmB,IAAS,EAAElB,OAAO,KAAK;QAC1C,IAAI;UACA,IAAAe,0CAAoB,EAACf,OAAO,CAAC;UAC7B,MAAM,CAACmB,OAAO,EAAEC,IAAI,CAAC,GAAG,MAAMpB,OAAO,CAACC,GAAG,CAACH,MAAM,CAACuB,IAAI,CAACH,IAAI,CAAC;UAC3D,OAAO,IAAII,uBAAY,CAACH,OAAO,EAAEC,IAAI,CAAC;QAC1C,CAAC,CAAC,OAAOG,CAAC,EAAE;UACR,OAAO,IAAIC,wBAAa,CAACD,CAAC,CAAC;QAC/B;MACJ,CAAC;MACDE,iCAAiC,EAAE,MAAAA,CAAO1B,CAAC,EAAEmB,IAAS,EAAElB,OAAO,KAAK;QAChE,IAAI;UACA,IAAAe,0CAAoB,EAACf,OAAO,CAAC;UAC7B,MAAM,CAACmB,OAAO,EAAEC,IAAI,CAAC,GACjB,MAAMpB,OAAO,CAACC,GAAG,CAACH,MAAM,CAAC2B,iCAAiC,CAAC,CAAC;UAChE,OAAO,IAAIH,uBAAY,CAACH,OAAO,EAAEC,IAAI,CAAC;QAC1C,CAAC,CAAC,OAAOG,CAAC,EAAE;UACR,OAAO,IAAIC,wBAAa,CAACD,CAAC,CAAC;QAC/B;MACJ;IACJ,CAAC;IACDG,WAAW,EAAE;MACTC,YAAY,EAAE,MAAAA,CAAO5B,CAAC,EAAE;QAAE6B;MAAK,CAAC,EAAE5B,OAAO,KAAK;QAC1C,OAAO,IAAAc,gBAAO,EAAC,MAAM;UACjB,IAAAC,0CAAoB,EAACf,OAAO,CAAC;UAC7B,OAAOA,OAAO,CAACC,GAAG,CAACH,MAAM,CAAC+B,MAAM,CAACD,IAAI,CAAC;QAC1C,CAAC,CAAC;MACN,CAAC;MACDE,YAAY,EAAE,MAAAA,CAAO/B,CAAC,EAAE;QAAEc,EAAE;QAAEe;MAAK,CAAC,EAAE5B,OAAO,KAAK;QAC9C,OAAO,IAAAc,gBAAO,EAAC,MAAM;UACjB,IAAAC,0CAAoB,EAACf,OAAO,CAAC;UAC7B,OAAOA,OAAO,CAACC,GAAG,CAACH,MAAM,CAACiC,MAAM,CAAClB,EAAE,EAAEe,IAAI,CAAC;QAC9C,CAAC,CAAC;MACN,CAAC;MACDI,YAAY,EAAE,MAAAA,CAAOjC,CAAC,EAAE;QAAEc;MAAG,CAAC,EAAEb,OAAO,KAAK;QACxC,OAAO,IAAAc,gBAAO,EAAC,MAAM;UACjB,IAAAC,0CAAoB,EAACf,OAAO,CAAC;UAC7B,OAAOA,OAAO,CAACC,GAAG,CAACH,MAAM,CAACmC,MAAM,CAACpB,EAAE,CAAC;QACxC,CAAC,CAAC;MACN;IACJ;EACJ;AACJ,CAAC,CAAC;AAACqB,OAAA,CAAA1C,YAAA,GAAAA,YAAA"}

package/folder/folder.model.d.ts

@@ -1,4 +1,2 @@
-import { CmsPrivateModelFull } from "@webiny/api-headless-cms";
-export declare type FolderModelDefinition = Omit<CmsPrivateModelFull, "noValidate" | "group">;
 export declare const FOLDER_MODEL_ID = "acoFolder";
-export declare const createFolderModelDefinition: () => FolderModelDefinition;
+export declare const createFolderModelDefinition: () => import("@webiny/api-headless-cms").CmsPrivateModelFull;

package/folder/folder.model.js

@@ -5,18 +5,13 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.createFolderModelDefinition = exports.FOLDER_MODEL_ID = void 0;
 var _createModelField = require("../utils/createModelField");
+var _apiHeadlessCms = require("@webiny/api-headless-cms");
 const titleField = () => (0, _createModelField.createModelField)({
   label: "Title",
   type: "text",
   validation: [{
     name: "required",
     message: "Value is required."
-  }, {
-    name: "minLength",
-    settings: {
-      value: "3"
-    },
-    message: "Value is too short."
   }]
 });
 const slugField = () => (0, _createModelField.createModelField)({
@@ -25,18 +20,6 @@ const slugField = () => (0, _createModelField.createModelField)({
   validation: [{
     name: "required",
     message: "Value is required."
-  }, {
-    name: "minLength",
-    settings: {
-      value: "3"
-    },
-    message: "Value is too short."
-  }, {
-    name: "maxLength",
-    settings: {
-      value: "100"
-    },
-    message: "Value is too long."
   }, {
     name: "pattern",
     settings: {
@@ -59,17 +42,63 @@ const parentIdField = () => (0, _createModelField.createModelField)({
   label: "Parent Id",
   type: "text"
 });
+const permissionsField = () => (0, _createModelField.createModelField)({
+  label: "Permissions",
+  fieldId: "permissions",
+  type: "object",
+  multipleValues: true,
+  listValidation: [],
+  settings: {
+    fields: [{
+      id: "target",
+      type: "text",
+      storageId: "text@target",
+      fieldId: "target",
+      label: "Target",
+      validation: [{
+        name: "required",
+        message: "Value is required."
+      }]
+    }, {
+      id: "level",
+      type: "text",
+      storageId: "text@level",
+      fieldId: "level",
+      label: "Level",
+      validation: [{
+        name: "required",
+        message: "Value is required."
+      }],
+      predefinedValues: {
+        enabled: true,
+        values: [{
+          label: "Viewer",
+          value: "viewer"
+        }, {
+          label: "Editor",
+          value: "editor"
+        }, {
+          label: "Owner",
+          value: "owner"
+        }, {
+          label: "Public",
+          value: "public"
+        }]
+      }
+    }],
+    layout: [["target"], ["level"]]
+  }
+});
 const FOLDER_MODEL_ID = "acoFolder";
 exports.FOLDER_MODEL_ID = FOLDER_MODEL_ID;
 const createFolderModelDefinition = () => {
-  return {
+  return (0, _apiHeadlessCms.createPrivateModelDefinition)({
     name: "ACO - Folder",
     modelId: FOLDER_MODEL_ID,
     titleFieldId: "title",
-    layout: [["title"], ["slug"], ["type"], ["parentId"]],
-    fields: [titleField(), slugField(), typeField(), parentIdField()],
-    description: "ACO - Folder content model",
-    isPrivate: true
-  };
+    fields: [titleField(), slugField(), typeField(), parentIdField(), permissionsField()]
+  });
 };
-exports.createFolderModelDefinition = createFolderModelDefinition;
+exports.createFolderModelDefinition = createFolderModelDefinition;
+
+//# sourceMappingURL=folder.model.js.map