@webiny/api-aco 0.0.0-unstable.eb196ccd2f → 0.0.0-unstable.eb81deee7e

package/features/ai/NotifyFolderChange/abstractions.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Sent to the user's open admin tabs when an AI tool changes a folder. The admin keeps its own folder
+ * cache, and a change made on the server never passes through it, so without these the admin shows
+ * the old state until a reload. Each carries the folder id only; the admin reads the folder back.
+ */
+export declare const FOLDER_CREATED_WEBSOCKET_ACTION = "aco.folder.created";
+export declare const FOLDER_UPDATED_WEBSOCKET_ACTION = "aco.folder.updated";
+export declare const FOLDER_DELETED_WEBSOCKET_ACTION = "aco.folder.deleted";
+export interface NotifyFolderChangeParams {
+    id: string;
+    change: "created" | "updated" | "deleted";
+}
+export interface INotifyFolderChangeUseCase {
+    execute(params: NotifyFolderChangeParams): Promise<void>;
+}
+export declare const NotifyFolderChangeUseCase: import("@webiny/di").Abstraction<INotifyFolderChangeUseCase>;
+export declare namespace NotifyFolderChangeUseCase {
+    type Interface = INotifyFolderChangeUseCase;
+    type Params = NotifyFolderChangeParams;
+}

package/features/ai/NotifyFolderChange/abstractions.js

@@ -0,0 +1,8 @@
+import { createAbstraction } from "@webiny/feature/api";
+const FOLDER_CREATED_WEBSOCKET_ACTION = "aco.folder.created";
+const FOLDER_UPDATED_WEBSOCKET_ACTION = "aco.folder.updated";
+const FOLDER_DELETED_WEBSOCKET_ACTION = "aco.folder.deleted";
+const NotifyFolderChangeUseCase = createAbstraction("Aco/NotifyFolderChangeUseCase");
+export { FOLDER_CREATED_WEBSOCKET_ACTION, FOLDER_DELETED_WEBSOCKET_ACTION, FOLDER_UPDATED_WEBSOCKET_ACTION, NotifyFolderChangeUseCase };
+
+//# sourceMappingURL=abstractions.js.map

package/features/ai/NotifyFolderChange/abstractions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/ai/NotifyFolderChange/abstractions.js","sources":["../../../../src/features/ai/NotifyFolderChange/abstractions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\n\n/**\n * Sent to the user's open admin tabs when an AI tool changes a folder. The admin keeps its own folder\n * cache, and a change made on the server never passes through it, so without these the admin shows\n * the old state until a reload. Each carries the folder id only; the admin reads the folder back.\n */\nexport const FOLDER_CREATED_WEBSOCKET_ACTION = \"aco.folder.created\";\nexport const FOLDER_UPDATED_WEBSOCKET_ACTION = \"aco.folder.updated\";\nexport const FOLDER_DELETED_WEBSOCKET_ACTION = \"aco.folder.deleted\";\n\nexport interface NotifyFolderChangeParams {\n    id: string;\n    change: \"created\" | \"updated\" | \"deleted\";\n}\n\nexport interface INotifyFolderChangeUseCase {\n    execute(params: NotifyFolderChangeParams): Promise<void>;\n}\n\nexport const NotifyFolderChangeUseCase = createAbstraction<INotifyFolderChangeUseCase>(\n    \"Aco/NotifyFolderChangeUseCase\"\n);\n\nexport namespace NotifyFolderChangeUseCase {\n    export type Interface = INotifyFolderChangeUseCase;\n    export type Params = NotifyFolderChangeParams;\n}\n"],"names":["FOLDER_CREATED_WEBSOCKET_ACTION","FOLDER_UPDATED_WEBSOCKET_ACTION","FOLDER_DELETED_WEBSOCKET_ACTION","NotifyFolderChangeUseCase","createAbstraction"],"mappings":";AAOO,MAAMA,kCAAkC;AACxC,MAAMC,kCAAkC;AACxC,MAAMC,kCAAkC;AAWxC,MAAMC,4BAA4BC,kBACrC"}

package/features/ai/NotifyFolderChange/index.d.ts

@@ -0,0 +1 @@
+export { NotifyFolderChangeUseCase, FOLDER_CREATED_WEBSOCKET_ACTION, FOLDER_UPDATED_WEBSOCKET_ACTION, FOLDER_DELETED_WEBSOCKET_ACTION } from "./abstractions.js";

package/features/ai/NotifyFolderChange/index.js

@@ -0,0 +1 @@
+export { FOLDER_CREATED_WEBSOCKET_ACTION, FOLDER_DELETED_WEBSOCKET_ACTION, FOLDER_UPDATED_WEBSOCKET_ACTION, NotifyFolderChangeUseCase } from "./abstractions.js";

package/features/ai/RevokeFolderAccessTool.d.ts

@@ -0,0 +1,65 @@
+import { z } from "zod";
+import { AiSdkToolDefinition, AiSdkToolHandler } from "@webiny/api-core/features/ai/index.js";
+import { GetFolderUseCase } from "../../features/folder/GetFolder/index.js";
+import { UpdateFolderUseCase } from "../../features/folder/UpdateFolder/index.js";
+import { NotifyFolderChangeUseCase } from "./NotifyFolderChange/index.js";
+declare const inputSchema: z.ZodObject<{
+    folderId: z.ZodString;
+    target: z.ZodString;
+}, z.core.$strip>;
+type Input = z.infer<typeof inputSchema>;
+interface RevokeResult {
+    folderId: string;
+    title: string;
+    path: string;
+    removed: {
+        target: string;
+        level: string;
+    };
+    /**
+     * Every direct rule remaining afterwards.
+     *
+     * This is the set the update was asked to store, not an independent read of it:
+     * `UpdateFolderWithFolderLevelPermissions` returns the permissions it derived from the input
+     * rather than the ones the repository wrote. Treating it as a verification would let the tool
+     * confirm its own request back to itself.
+     */
+    permissions: {
+        target: string;
+        level: string;
+    }[];
+}
+declare class RevokeFolderAccessToolHandlerImpl implements AiSdkToolHandler.Interface<Input> {
+    private getFolder;
+    private updateFolder;
+    private notifyFolderChange;
+    constructor(getFolder: GetFolderUseCase.Interface, updateFolder: UpdateFolderUseCase.Interface, notifyFolderChange: NotifyFolderChangeUseCase.Interface);
+    execute(input: Input): Promise<RevokeResult>;
+}
+/**
+ * Removes one target's direct access to one folder.
+ *
+ * Destructive: somebody loses access, and there is no undo. Refuses when the target has no DIRECT rule
+ * rather than reporting a removal that changed nothing — an inherited grant cannot be revoked here,
+ * only where it is defined, and saying otherwise would leave the user believing access was withdrawn.
+ */
+declare class RevokeFolderAccessToolImpl implements AiSdkToolDefinition.Interface<Input> {
+    readonly name = "revokeFolderAccess";
+    readonly title = "Revoke folder access";
+    readonly description = "Removes one team's or user's direct access to one folder, leaving all other permissions untouched. Cannot remove inherited access. Requires user approval.";
+    readonly inputSchema: z.ZodObject<{
+        folderId: z.ZodString;
+        target: z.ZodString;
+    }, z.core.$strip>;
+    readonly annotations: {
+        readOnlyHint: boolean;
+        destructiveHint: boolean;
+    };
+    readonly handler: typeof RevokeFolderAccessToolHandlerImpl & {
+        __abstraction: import("@webiny/di").Abstraction<import("@webiny/api-core/features/ai/abstractions.js").IAiSdkToolHandler<any>>;
+    };
+}
+export declare const RevokeFolderAccessTool: typeof RevokeFolderAccessToolImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/api-core/features/ai/abstractions.js").IAiSdkToolDefinition<any>>;
+};
+export {};

package/features/ai/RevokeFolderAccessTool.js

@@ -0,0 +1,76 @@
+import { z } from "zod";
+import { AiSdkToolDefinition, AiSdkToolHandler } from "@webiny/api-core/features/ai/index.js";
+import { GetFolderUseCase } from "../folder/GetFolder/index.js";
+import { UpdateFolderUseCase } from "../folder/UpdateFolder/index.js";
+import { loadFolderPermissions } from "./loadFolderPermissions.js";
+import { NotifyFolderChangeUseCase } from "./NotifyFolderChange/index.js";
+const inputSchema = z.object({
+    folderId: z.string().describe("Folder id as returned by listFolders."),
+    target: z.string().describe("Whose access to remove: 'team:<slug>' or 'admin:<userId>', exactly as listFolders reports it.")
+});
+class RevokeFolderAccessToolHandlerImpl {
+    constructor(getFolder, updateFolder, notifyFolderChange){
+        this.getFolder = getFolder;
+        this.updateFolder = updateFolder;
+        this.notifyFolderChange = notifyFolderChange;
+    }
+    async execute(input) {
+        const loaded = await loadFolderPermissions(this.getFolder, input.folderId);
+        const existing = loaded.direct.find((permission)=>String(permission.target) === input.target);
+        if (!existing) {
+            if (loaded.inheritedTargets.has(input.target)) throw new Error(`"${input.target}" has inherited access to this folder, not a direct rule, so it cannot be revoked here. Change it where it is defined.`);
+            throw new Error(`"${input.target}" has no direct access to this folder, so there is nothing to revoke.`);
+        }
+        const permissions = loaded.direct.filter((permission)=>String(permission.target) !== input.target);
+        const result = await this.updateFolder.execute(input.folderId, {
+            permissions
+        });
+        if (result.isFail()) throw new Error(`Could not revoke access: ${result.error.message}`);
+        const folder = result.value;
+        await this.notifyFolderChange.execute({
+            id: folder.id,
+            change: "updated"
+        });
+        return {
+            folderId: folder.id,
+            title: folder.title,
+            path: folder.path,
+            removed: {
+                target: input.target,
+                level: existing.level
+            },
+            permissions: (folder.permissions ?? []).filter((permission)=>!permission.inheritedFrom).map((permission)=>({
+                    target: String(permission.target),
+                    level: permission.level
+                }))
+        };
+    }
+}
+const RevokeFolderAccessToolHandler = AiSdkToolHandler.createImplementation({
+    implementation: RevokeFolderAccessToolHandlerImpl,
+    dependencies: [
+        GetFolderUseCase,
+        UpdateFolderUseCase,
+        NotifyFolderChangeUseCase
+    ]
+});
+class RevokeFolderAccessToolImpl {
+    constructor(){
+        this.name = "revokeFolderAccess";
+        this.title = "Revoke folder access";
+        this.description = "Removes one team's or user's direct access to one folder, leaving all other permissions untouched. Cannot remove inherited access. Requires user approval.";
+        this.inputSchema = inputSchema;
+        this.annotations = {
+            readOnlyHint: false,
+            destructiveHint: true
+        };
+        this.handler = RevokeFolderAccessToolHandler;
+    }
+}
+const RevokeFolderAccessTool = AiSdkToolDefinition.createImplementation({
+    implementation: RevokeFolderAccessToolImpl,
+    dependencies: []
+});
+export { RevokeFolderAccessTool };
+
+//# sourceMappingURL=RevokeFolderAccessTool.js.map

package/features/ai/RevokeFolderAccessTool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/ai/RevokeFolderAccessTool.js","sources":["../../../src/features/ai/RevokeFolderAccessTool.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { AiSdkToolDefinition, AiSdkToolHandler } from \"@webiny/api-core/features/ai/index.js\";\nimport { GetFolderUseCase } from \"~/features/folder/GetFolder/index.js\";\nimport { UpdateFolderUseCase } from \"~/features/folder/UpdateFolder/index.js\";\nimport { loadFolderPermissions } from \"./loadFolderPermissions.js\";\nimport { NotifyFolderChangeUseCase } from \"./NotifyFolderChange/index.js\";\n\nconst inputSchema = z.object({\n    folderId: z.string().describe(\"Folder id as returned by listFolders.\"),\n    target: z\n        .string()\n        .describe(\n            \"Whose access to remove: 'team:<slug>' or 'admin:<userId>', exactly as listFolders reports it.\"\n        )\n});\n\ntype Input = z.infer<typeof inputSchema>;\n\ninterface RevokeResult {\n    folderId: string;\n    title: string;\n    path: string;\n    removed: { target: string; level: string };\n    /**\n     * Every direct rule remaining afterwards.\n     *\n     * This is the set the update was asked to store, not an independent read of it:\n     * `UpdateFolderWithFolderLevelPermissions` returns the permissions it derived from the input\n     * rather than the ones the repository wrote. Treating it as a verification would let the tool\n     * confirm its own request back to itself.\n     */\n    permissions: { target: string; level: string }[];\n}\n\nclass RevokeFolderAccessToolHandlerImpl implements AiSdkToolHandler.Interface<Input> {\n    constructor(\n        private getFolder: GetFolderUseCase.Interface,\n        private updateFolder: UpdateFolderUseCase.Interface,\n        private notifyFolderChange: NotifyFolderChangeUseCase.Interface\n    ) {}\n\n    async execute(input: Input): Promise<RevokeResult> {\n        const loaded = await loadFolderPermissions(this.getFolder, input.folderId);\n\n        const existing = loaded.direct.find(\n            permission => String(permission.target) === input.target\n        );\n\n        if (!existing) {\n            if (loaded.inheritedTargets.has(input.target)) {\n                throw new Error(\n                    `\"${input.target}\" has inherited access to this folder, not a direct rule, so it cannot be revoked here. Change it where it is defined.`\n                );\n            }\n\n            throw new Error(\n                `\"${input.target}\" has no direct access to this folder, so there is nothing to revoke.`\n            );\n        }\n\n        const permissions = loaded.direct.filter(\n            permission => String(permission.target) !== input.target\n        );\n\n        const result = await this.updateFolder.execute(input.folderId, { permissions });\n\n        if (result.isFail()) {\n            throw new Error(`Could not revoke access: ${result.error.message}`);\n        }\n\n        const folder = result.value;\n\n        await this.notifyFolderChange.execute({ id: folder.id, change: \"updated\" });\n\n        return {\n            folderId: folder.id,\n            title: folder.title,\n            path: folder.path,\n            removed: { target: input.target, level: existing.level },\n            permissions: (folder.permissions ?? [])\n                .filter(permission => !permission.inheritedFrom)\n                .map(permission => ({ target: String(permission.target), level: permission.level }))\n        };\n    }\n}\n\nconst RevokeFolderAccessToolHandler = AiSdkToolHandler.createImplementation({\n    implementation: RevokeFolderAccessToolHandlerImpl,\n    dependencies: [GetFolderUseCase, UpdateFolderUseCase, NotifyFolderChangeUseCase]\n});\n\n/**\n * Removes one target's direct access to one folder.\n *\n * Destructive: somebody loses access, and there is no undo. Refuses when the target has no DIRECT rule\n * rather than reporting a removal that changed nothing — an inherited grant cannot be revoked here,\n * only where it is defined, and saying otherwise would leave the user believing access was withdrawn.\n */\nclass RevokeFolderAccessToolImpl implements AiSdkToolDefinition.Interface<Input> {\n    readonly name = \"revokeFolderAccess\";\n    readonly title = \"Revoke folder access\";\n    readonly description =\n        \"Removes one team's or user's direct access to one folder, leaving all other permissions untouched. Cannot remove inherited access. Requires user approval.\";\n    readonly inputSchema = inputSchema;\n    readonly annotations = { readOnlyHint: false, destructiveHint: true };\n    readonly handler = RevokeFolderAccessToolHandler;\n}\n\nexport const RevokeFolderAccessTool = AiSdkToolDefinition.createImplementation({\n    implementation: RevokeFolderAccessToolImpl,\n    dependencies: []\n});\n"],"names":["inputSchema","z","RevokeFolderAccessToolHandlerImpl","getFolder","updateFolder","notifyFolderChange","input","loaded","loadFolderPermissions","existing","permission","String","Error","permissions","result","folder","RevokeFolderAccessToolHandler","AiSdkToolHandler","GetFolderUseCase","UpdateFolderUseCase","NotifyFolderChangeUseCase","RevokeFolderAccessToolImpl","RevokeFolderAccessTool","AiSdkToolDefinition"],"mappings":";;;;;;AAOA,MAAMA,cAAcC,EAAE,MAAM,CAAC;IACzB,UAAUA,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC9B,QAAQA,EAAAA,MACG,GACN,QAAQ,CACL;AAEZ;AAoBA,MAAMC;IACF,YACYC,SAAqC,EACrCC,YAA2C,EAC3CC,kBAAuD,CACjE;aAHUF,SAAS,GAATA;aACAC,YAAY,GAAZA;aACAC,kBAAkB,GAAlBA;IACT;IAEH,MAAM,QAAQC,KAAY,EAAyB;QAC/C,MAAMC,SAAS,MAAMC,sBAAsB,IAAI,CAAC,SAAS,EAAEF,MAAM,QAAQ;QAEzE,MAAMG,WAAWF,OAAO,MAAM,CAAC,IAAI,CAC/BG,CAAAA,aAAcC,OAAOD,WAAW,MAAM,MAAMJ,MAAM,MAAM;QAG5D,IAAI,CAACG,UAAU;YACX,IAAIF,OAAO,gBAAgB,CAAC,GAAG,CAACD,MAAM,MAAM,GACxC,MAAM,IAAIM,MACN,CAAC,CAAC,EAAEN,MAAM,MAAM,CAAC,sHAAsH,CAAC;YAIhJ,MAAM,IAAIM,MACN,CAAC,CAAC,EAAEN,MAAM,MAAM,CAAC,qEAAqE,CAAC;QAE/F;QAEA,MAAMO,cAAcN,OAAO,MAAM,CAAC,MAAM,CACpCG,CAAAA,aAAcC,OAAOD,WAAW,MAAM,MAAMJ,MAAM,MAAM;QAG5D,MAAMQ,SAAS,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAACR,MAAM,QAAQ,EAAE;YAAEO;QAAY;QAE7E,IAAIC,OAAO,MAAM,IACb,MAAM,IAAIF,MAAM,CAAC,yBAAyB,EAAEE,OAAO,KAAK,CAAC,OAAO,EAAE;QAGtE,MAAMC,SAASD,OAAO,KAAK;QAE3B,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;YAAE,IAAIC,OAAO,EAAE;YAAE,QAAQ;QAAU;QAEzE,OAAO;YACH,UAAUA,OAAO,EAAE;YACnB,OAAOA,OAAO,KAAK;YACnB,MAAMA,OAAO,IAAI;YACjB,SAAS;gBAAE,QAAQT,MAAM,MAAM;gBAAE,OAAOG,SAAS,KAAK;YAAC;YACvD,aAAcM,AAAAA,CAAAA,OAAO,WAAW,IAAI,EAAC,EAChC,MAAM,CAACL,CAAAA,aAAc,CAACA,WAAW,aAAa,EAC9C,GAAG,CAACA,CAAAA,aAAe;oBAAE,QAAQC,OAAOD,WAAW,MAAM;oBAAG,OAAOA,WAAW,KAAK;gBAAC;QACzF;IACJ;AACJ;AAEA,MAAMM,gCAAgCC,iBAAiB,oBAAoB,CAAC;IACxE,gBAAgBf;IAChB,cAAc;QAACgB;QAAkBC;QAAqBC;KAA0B;AACpF;AASA,MAAMC;;aACO,IAAI,GAAG;aACP,KAAK,GAAG;aACR,WAAW,GAChB;aACK,WAAW,GAAGrB;aACd,WAAW,GAAG;YAAE,cAAc;YAAO,iBAAiB;QAAK;aAC3D,OAAO,GAAGgB;;AACvB;AAEO,MAAMM,yBAAyBC,oBAAoB,oBAAoB,CAAC;IAC3E,gBAAgBF;IAChB,cAAc,EAAE;AACpB"}

package/features/ai/assertTargetIsUsable.d.ts

@@ -0,0 +1,10 @@
+import type { ListTeamsUseCase } from "@webiny/api-core/features/security/teams/ListTeams/index.js";
+/**
+ * Rejects a permission target that would be stored happily and then match nobody.
+ *
+ * A folder rule identifies a team by SLUG (`team:<slug>`) and a user by id (`admin:<userId>`) — see
+ * ListFolderLevelPermissionsTargets. The field is only typed as a template string, so a team id where
+ * a slug belongs is accepted and silently grants nothing. Also refuses a target the folder inherits,
+ * since rewriting it as a direct rule detaches the folder from where the grant came from.
+ */
+export declare const assertTargetIsUsable: (listTeams: ListTeamsUseCase.Interface, target: string, inheritedTargets: Set<string>) => Promise<void>;

package/features/ai/assertTargetIsUsable.js

@@ -0,0 +1,14 @@
+const assertTargetIsUsable = async (listTeams, target, inheritedTargets)=>{
+    if (inheritedTargets.has(target)) throw new Error(`"${target}" is inherited from an ancestor folder or a role, so it cannot be changed on this folder. Change it where it is defined.`);
+    if (!target.startsWith("team:")) return;
+    const result = await listTeams.execute();
+    if (result.isFail()) throw new Error(`Could not verify the teams: ${result.error.message}`);
+    const value = target.slice(5);
+    if (result.value.some((team)=>team.slug === value)) return;
+    const byId = result.value.find((team)=>team.id === value);
+    if (byId) throw new Error(`"${target}" uses a team id. Use the slug instead: "team:${byId.slug}".`);
+    throw new Error(`"${target}" is not a known team. Call listTeams first.`);
+};
+export { assertTargetIsUsable };
+
+//# sourceMappingURL=assertTargetIsUsable.js.map

package/features/ai/assertTargetIsUsable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/ai/assertTargetIsUsable.js","sources":["../../../src/features/ai/assertTargetIsUsable.ts"],"sourcesContent":["import type { ListTeamsUseCase } from \"@webiny/api-core/features/security/teams/ListTeams/index.js\";\n\n/**\n * Rejects a permission target that would be stored happily and then match nobody.\n *\n * A folder rule identifies a team by SLUG (`team:<slug>`) and a user by id (`admin:<userId>`) — see\n * ListFolderLevelPermissionsTargets. The field is only typed as a template string, so a team id where\n * a slug belongs is accepted and silently grants nothing. Also refuses a target the folder inherits,\n * since rewriting it as a direct rule detaches the folder from where the grant came from.\n */\nexport const assertTargetIsUsable = async (\n    listTeams: ListTeamsUseCase.Interface,\n    target: string,\n    inheritedTargets: Set<string>\n): Promise<void> => {\n    if (inheritedTargets.has(target)) {\n        throw new Error(\n            `\"${target}\" is inherited from an ancestor folder or a role, so it cannot be changed on this folder. Change it where it is defined.`\n        );\n    }\n\n    if (!target.startsWith(\"team:\")) {\n        return;\n    }\n\n    const result = await listTeams.execute();\n\n    if (result.isFail()) {\n        throw new Error(`Could not verify the teams: ${result.error.message}`);\n    }\n\n    const value = target.slice(\"team:\".length);\n\n    if (result.value.some(team => team.slug === value)) {\n        return;\n    }\n\n    const byId = result.value.find(team => team.id === value);\n\n    if (byId) {\n        throw new Error(`\"${target}\" uses a team id. Use the slug instead: \"team:${byId.slug}\".`);\n    }\n\n    throw new Error(`\"${target}\" is not a known team. Call listTeams first.`);\n};\n"],"names":["assertTargetIsUsable","listTeams","target","inheritedTargets","Error","result","value","team","byId"],"mappings":"AAUO,MAAMA,uBAAuB,OAChCC,WACAC,QACAC;IAEA,IAAIA,iBAAiB,GAAG,CAACD,SACrB,MAAM,IAAIE,MACN,CAAC,CAAC,EAAEF,OAAO,wHAAwH,CAAC;IAI5I,IAAI,CAACA,OAAO,UAAU,CAAC,UACnB;IAGJ,MAAMG,SAAS,MAAMJ,UAAU,OAAO;IAEtC,IAAII,OAAO,MAAM,IACb,MAAM,IAAID,MAAM,CAAC,4BAA4B,EAAEC,OAAO,KAAK,CAAC,OAAO,EAAE;IAGzE,MAAMC,QAAQJ,OAAO,KAAK,CAAC;IAE3B,IAAIG,OAAO,KAAK,CAAC,IAAI,CAACE,CAAAA,OAAQA,KAAK,IAAI,KAAKD,QACxC;IAGJ,MAAME,OAAOH,OAAO,KAAK,CAAC,IAAI,CAACE,CAAAA,OAAQA,KAAK,EAAE,KAAKD;IAEnD,IAAIE,MACA,MAAM,IAAIJ,MAAM,CAAC,CAAC,EAAEF,OAAO,8CAA8C,EAAEM,KAAK,IAAI,CAAC,EAAE,CAAC;IAG5F,MAAM,IAAIJ,MAAM,CAAC,CAAC,EAAEF,OAAO,4CAA4C,CAAC;AAC5E"}

package/features/ai/feature.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Folder and team tools for AI callers.
+ *
+ * The list tools are read-only and run unattended. Anything that creates, deletes or changes access is a write,
+ * so it pauses for the user to approve the exact arguments. Access changes are deliberately one target
+ * per call — granting and revoking separately means the approval block shows the entire change, rather
+ * than a desired end state whose omissions quietly remove somebody's access.
+ */
+export declare const AcoAiToolsFeature: {
+    name: string;
+    register(container: import("@webiny/di").Container): void;
+};

package/features/ai/feature.js

@@ -0,0 +1,27 @@
+import { createFeature } from "@webiny/feature/api";
+import { ListTeamsTool } from "./ListTeamsTool.js";
+import { ListFoldersTool } from "./ListFoldersTool.js";
+import { GrantFolderAccessTool } from "./GrantFolderAccessTool.js";
+import { RevokeFolderAccessTool } from "./RevokeFolderAccessTool.js";
+import { CreateFolderTool } from "./CreateFolderTool.js";
+import { DeleteFolderTool } from "./DeleteFolderTool.js";
+import { CreateTeamTool } from "./CreateTeamTool.js";
+import { ListRolesTool } from "./ListRolesTool.js";
+import { NotifyFolderChangeUseCase } from "./NotifyFolderChange/NotifyFolderChangeUseCase.js";
+const AcoAiToolsFeature = createFeature({
+    name: "Aco/AiTools",
+    register (container) {
+        container.register(NotifyFolderChangeUseCase);
+        container.register(ListTeamsTool);
+        container.register(ListFoldersTool);
+        container.register(GrantFolderAccessTool);
+        container.register(RevokeFolderAccessTool);
+        container.register(CreateFolderTool);
+        container.register(DeleteFolderTool);
+        container.register(CreateTeamTool);
+        container.register(ListRolesTool);
+    }
+});
+export { AcoAiToolsFeature };
+
+//# sourceMappingURL=feature.js.map

package/features/ai/feature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/ai/feature.js","sources":["../../../src/features/ai/feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { ListTeamsTool } from \"./ListTeamsTool.js\";\nimport { ListFoldersTool } from \"./ListFoldersTool.js\";\nimport { GrantFolderAccessTool } from \"./GrantFolderAccessTool.js\";\nimport { RevokeFolderAccessTool } from \"./RevokeFolderAccessTool.js\";\nimport { CreateFolderTool } from \"./CreateFolderTool.js\";\nimport { DeleteFolderTool } from \"./DeleteFolderTool.js\";\nimport { CreateTeamTool } from \"./CreateTeamTool.js\";\nimport { ListRolesTool } from \"./ListRolesTool.js\";\nimport { NotifyFolderChangeUseCase } from \"./NotifyFolderChange/NotifyFolderChangeUseCase.js\";\n\n/**\n * Folder and team tools for AI callers.\n *\n * The list tools are read-only and run unattended. Anything that creates, deletes or changes access is a write,\n * so it pauses for the user to approve the exact arguments. Access changes are deliberately one target\n * per call — granting and revoking separately means the approval block shows the entire change, rather\n * than a desired end state whose omissions quietly remove somebody's access.\n */\nexport const AcoAiToolsFeature = createFeature({\n    name: \"Aco/AiTools\",\n    register(container) {\n        container.register(NotifyFolderChangeUseCase);\n\n        container.register(ListTeamsTool);\n        container.register(ListFoldersTool);\n        container.register(GrantFolderAccessTool);\n        container.register(RevokeFolderAccessTool);\n        container.register(CreateFolderTool);\n        container.register(DeleteFolderTool);\n        container.register(CreateTeamTool);\n        container.register(ListRolesTool);\n    }\n});\n"],"names":["AcoAiToolsFeature","createFeature","container","NotifyFolderChangeUseCase","ListTeamsTool","ListFoldersTool","GrantFolderAccessTool","RevokeFolderAccessTool","CreateFolderTool","DeleteFolderTool","CreateTeamTool","ListRolesTool"],"mappings":";;;;;;;;;;AAmBO,MAAMA,oBAAoBC,cAAc;IAC3C,MAAM;IACN,UAASC,SAAS;QACdA,UAAU,QAAQ,CAACC;QAEnBD,UAAU,QAAQ,CAACE;QACnBF,UAAU,QAAQ,CAACG;QACnBH,UAAU,QAAQ,CAACI;QACnBJ,UAAU,QAAQ,CAACK;QACnBL,UAAU,QAAQ,CAACM;QACnBN,UAAU,QAAQ,CAACO;QACnBP,UAAU,QAAQ,CAACQ;QACnBR,UAAU,QAAQ,CAACS;IACvB;AACJ"}

package/features/ai/index.d.ts

@@ -0,0 +1,9 @@
+export { AcoAiToolsFeature } from "./feature.js";
+export { ListTeamsTool } from "./ListTeamsTool.js";
+export { ListFoldersTool } from "./ListFoldersTool.js";
+export { ListRolesTool } from "./ListRolesTool.js";
+export { GrantFolderAccessTool } from "./GrantFolderAccessTool.js";
+export { RevokeFolderAccessTool } from "./RevokeFolderAccessTool.js";
+export { CreateFolderTool } from "./CreateFolderTool.js";
+export { DeleteFolderTool } from "./DeleteFolderTool.js";
+export { CreateTeamTool } from "./CreateTeamTool.js";

package/features/ai/index.js

@@ -0,0 +1,9 @@
+export { AcoAiToolsFeature } from "./feature.js";
+export { ListTeamsTool } from "./ListTeamsTool.js";
+export { ListFoldersTool } from "./ListFoldersTool.js";
+export { ListRolesTool } from "./ListRolesTool.js";
+export { GrantFolderAccessTool } from "./GrantFolderAccessTool.js";
+export { RevokeFolderAccessTool } from "./RevokeFolderAccessTool.js";
+export { CreateFolderTool } from "./CreateFolderTool.js";
+export { DeleteFolderTool } from "./DeleteFolderTool.js";
+export { CreateTeamTool } from "./CreateTeamTool.js";

package/features/ai/loadFolderPermissions.d.ts

@@ -0,0 +1,16 @@
+import type { GetFolderUseCase } from "../../features/folder/GetFolder/index.js";
+import type { Folder, FolderPermission } from "../../types.js";
+export interface LoadedFolderPermissions {
+    folder: Folder;
+    /** Rules set on this folder. The only ones it may change. */
+    direct: FolderPermission[];
+    /** Targets granted by an ancestor or a role. Writing these back would detach the inheritance. */
+    inheritedTargets: Set<string>;
+}
+/**
+ * Reads a folder and separates the rules it owns from the ones it merely inherits.
+ *
+ * Every permission write starts here, because the field holds both kinds and a change has to preserve
+ * the direct rules while leaving the inherited ones alone.
+ */
+export declare const loadFolderPermissions: (getFolder: GetFolderUseCase.Interface, folderId: string) => Promise<LoadedFolderPermissions>;

package/features/ai/loadFolderPermissions.js

@@ -0,0 +1,14 @@
+const loadFolderPermissions = async (getFolder, folderId)=>{
+    const result = await getFolder.execute(folderId);
+    if (result.isFail()) throw new Error(`Folder "${folderId}" not found: ${result.error.message}. Call listFolders for valid ids.`);
+    const folder = result.value;
+    const permissions = folder.permissions ?? [];
+    return {
+        folder,
+        direct: permissions.filter((permission)=>!permission.inheritedFrom),
+        inheritedTargets: new Set(permissions.filter((permission)=>permission.inheritedFrom).map((p)=>String(p.target)))
+    };
+};
+export { loadFolderPermissions };
+
+//# sourceMappingURL=loadFolderPermissions.js.map

package/features/ai/loadFolderPermissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/ai/loadFolderPermissions.js","sources":["../../../src/features/ai/loadFolderPermissions.ts"],"sourcesContent":["import type { GetFolderUseCase } from \"~/features/folder/GetFolder/index.js\";\nimport type { Folder, FolderPermission } from \"~/types.js\";\n\nexport interface LoadedFolderPermissions {\n    folder: Folder;\n    /** Rules set on this folder. The only ones it may change. */\n    direct: FolderPermission[];\n    /** Targets granted by an ancestor or a role. Writing these back would detach the inheritance. */\n    inheritedTargets: Set<string>;\n}\n\n/**\n * Reads a folder and separates the rules it owns from the ones it merely inherits.\n *\n * Every permission write starts here, because the field holds both kinds and a change has to preserve\n * the direct rules while leaving the inherited ones alone.\n */\nexport const loadFolderPermissions = async (\n    getFolder: GetFolderUseCase.Interface,\n    folderId: string\n): Promise<LoadedFolderPermissions> => {\n    const result = await getFolder.execute(folderId);\n\n    if (result.isFail()) {\n        throw new Error(\n            `Folder \"${folderId}\" not found: ${result.error.message}. Call listFolders for valid ids.`\n        );\n    }\n\n    const folder = result.value;\n    const permissions = folder.permissions ?? [];\n\n    return {\n        folder,\n        direct: permissions.filter(permission => !permission.inheritedFrom),\n        inheritedTargets: new Set(\n            permissions.filter(permission => permission.inheritedFrom).map(p => String(p.target))\n        )\n    };\n};\n"],"names":["loadFolderPermissions","getFolder","folderId","result","Error","folder","permissions","permission","Set","p","String"],"mappings":"AAiBO,MAAMA,wBAAwB,OACjCC,WACAC;IAEA,MAAMC,SAAS,MAAMF,UAAU,OAAO,CAACC;IAEvC,IAAIC,OAAO,MAAM,IACb,MAAM,IAAIC,MACN,CAAC,QAAQ,EAAEF,SAAS,aAAa,EAAEC,OAAO,KAAK,CAAC,OAAO,CAAC,iCAAiC,CAAC;IAIlG,MAAME,SAASF,OAAO,KAAK;IAC3B,MAAMG,cAAcD,OAAO,WAAW,IAAI,EAAE;IAE5C,OAAO;QACHA;QACA,QAAQC,YAAY,MAAM,CAACC,CAAAA,aAAc,CAACA,WAAW,aAAa;QAClE,kBAAkB,IAAIC,IAClBF,YAAY,MAAM,CAACC,CAAAA,aAAcA,WAAW,aAAa,EAAE,GAAG,CAACE,CAAAA,IAAKC,OAAOD,EAAE,MAAM;IAE3F;AACJ"}

package/features/cms/decorators/CreateEntryRevisionFromWithFlpDecorator.d.ts

@@ -0,0 +1,13 @@
+import { CreateEntryRevisionFromUseCase } from "@webiny/api-headless-cms/features/contentEntry/CreateEntryRevisionFrom/abstractions.js";
+import { GetRevisionByIdUseCase } from "@webiny/api-headless-cms/features/contentEntry/GetRevisionById/abstractions.js";
+import type { CmsEntryValues, CmsModel, CreateCmsEntryInput, CreateCmsEntryOptionsInput } from "@webiny/api-headless-cms/types/index.js";
+import { FolderLevelPermissions } from "../../../features/flp/FolderLevelPermissions/index.js";
+declare class CreateEntryRevisionFromWithFlpDecoratorImpl implements CreateEntryRevisionFromUseCase.Interface {
+    private folderLevelPermissions;
+    private getRevisionById;
+    private decoratee;
+    constructor(folderLevelPermissions: FolderLevelPermissions.Interface, getRevisionById: GetRevisionByIdUseCase.Interface, decoratee: CreateEntryRevisionFromUseCase.Interface);
+    execute<T extends CmsEntryValues = CmsEntryValues>(model: CmsModel, sourceId: string, input: CreateCmsEntryInput<T>, options?: CreateCmsEntryOptionsInput): CreateEntryRevisionFromUseCase.Return<T>;
+}
+export declare const CreateEntryRevisionFromWithFlpDecorator: typeof CreateEntryRevisionFromWithFlpDecoratorImpl;
+export {};

package/features/cms/decorators/CreateEntryRevisionFromWithFlpDecorator.js

@@ -0,0 +1,39 @@
+import { Result, createDecorator } from "@webiny/feature/api";
+import { CreateEntryRevisionFromUseCase } from "@webiny/api-headless-cms/features/contentEntry/CreateEntryRevisionFrom/abstractions.js";
+import { GetRevisionByIdUseCase } from "@webiny/api-headless-cms/features/contentEntry/GetRevisionById/abstractions.js";
+import { FolderLevelPermissions } from "../../flp/FolderLevelPermissions/index.js";
+import { ROOT_FOLDER } from "../../../constants.js";
+import { EntryNotAuthorizedError } from "@webiny/api-headless-cms/domain/contentEntry/errors.js";
+class CreateEntryRevisionFromWithFlpDecoratorImpl {
+    constructor(folderLevelPermissions, getRevisionById, decoratee){
+        this.folderLevelPermissions = folderLevelPermissions;
+        this.getRevisionById = getRevisionById;
+        this.decoratee = decoratee;
+    }
+    async execute(model, sourceId, input, options) {
+        if (!this.folderLevelPermissions.canUseFolderLevelPermissions()) return this.decoratee.execute(model, sourceId, input, options);
+        const entryResult = await this.getRevisionById.execute(model, sourceId);
+        if (entryResult.isFail()) return this.decoratee.execute(model, sourceId, input, options);
+        const entry = entryResult.value;
+        const folderId = entry?.location?.folderId;
+        if (!folderId || folderId === ROOT_FOLDER) return this.decoratee.execute(model, sourceId, input, options);
+        const permissions = await this.folderLevelPermissions.getFolderLevelPermissions(folderId);
+        const canAccessFolderContent = await this.folderLevelPermissions.canAccessFolderContent({
+            permissions,
+            rwd: "w"
+        });
+        if (!canAccessFolderContent) return Result.fail(new EntryNotAuthorizedError());
+        return this.decoratee.execute(model, sourceId, input, options);
+    }
+}
+const CreateEntryRevisionFromWithFlpDecorator = createDecorator({
+    abstraction: CreateEntryRevisionFromUseCase,
+    decorator: CreateEntryRevisionFromWithFlpDecoratorImpl,
+    dependencies: [
+        FolderLevelPermissions,
+        GetRevisionByIdUseCase
+    ]
+});
+export { CreateEntryRevisionFromWithFlpDecorator };
+
+//# sourceMappingURL=CreateEntryRevisionFromWithFlpDecorator.js.map

package/features/cms/decorators/CreateEntryRevisionFromWithFlpDecorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/cms/decorators/CreateEntryRevisionFromWithFlpDecorator.js","sources":["../../../../src/features/cms/decorators/CreateEntryRevisionFromWithFlpDecorator.ts"],"sourcesContent":["import { createDecorator, Result } from \"@webiny/feature/api\";\nimport { CreateEntryRevisionFromUseCase } from \"@webiny/api-headless-cms/features/contentEntry/CreateEntryRevisionFrom/abstractions.js\";\nimport { GetRevisionByIdUseCase } from \"@webiny/api-headless-cms/features/contentEntry/GetRevisionById/abstractions.js\";\nimport type {\n    CmsEntryValues,\n    CmsModel,\n    CreateCmsEntryInput,\n    CreateCmsEntryOptionsInput\n} from \"@webiny/api-headless-cms/types/index.js\";\nimport { FolderLevelPermissions } from \"~/features/flp/FolderLevelPermissions/index.js\";\nimport { ROOT_FOLDER } from \"~/constants.js\";\nimport { EntryNotAuthorizedError } from \"@webiny/api-headless-cms/domain/contentEntry/errors.js\";\n\nclass CreateEntryRevisionFromWithFlpDecoratorImpl\n    implements CreateEntryRevisionFromUseCase.Interface\n{\n    constructor(\n        private folderLevelPermissions: FolderLevelPermissions.Interface,\n        private getRevisionById: GetRevisionByIdUseCase.Interface,\n        private decoratee: CreateEntryRevisionFromUseCase.Interface\n    ) {}\n\n    async execute<T extends CmsEntryValues = CmsEntryValues>(\n        model: CmsModel,\n        sourceId: string,\n        input: CreateCmsEntryInput<T>,\n        options?: CreateCmsEntryOptionsInput\n    ): CreateEntryRevisionFromUseCase.Return<T> {\n        if (!this.folderLevelPermissions.canUseFolderLevelPermissions()) {\n            return this.decoratee.execute(model, sourceId, input, options);\n        }\n\n        const entryResult = await this.getRevisionById.execute(model, sourceId);\n        if (entryResult.isFail()) {\n            return this.decoratee.execute(model, sourceId, input, options);\n        }\n\n        const entry = entryResult.value;\n        const folderId = entry?.location?.folderId;\n\n        if (!folderId || folderId === ROOT_FOLDER) {\n            return this.decoratee.execute(model, sourceId, input, options);\n        }\n\n        const permissions = await this.folderLevelPermissions.getFolderLevelPermissions(folderId);\n        const canAccessFolderContent = await this.folderLevelPermissions.canAccessFolderContent({\n            permissions,\n            rwd: \"w\"\n        });\n\n        if (!canAccessFolderContent) {\n            return Result.fail(new EntryNotAuthorizedError());\n        }\n\n        return this.decoratee.execute(model, sourceId, input, options);\n    }\n}\n\nexport const CreateEntryRevisionFromWithFlpDecorator = createDecorator({\n    abstraction: CreateEntryRevisionFromUseCase,\n    decorator: CreateEntryRevisionFromWithFlpDecoratorImpl,\n    dependencies: [FolderLevelPermissions, GetRevisionByIdUseCase]\n});\n"],"names":["CreateEntryRevisionFromWithFlpDecoratorImpl","folderLevelPermissions","getRevisionById","decoratee","model","sourceId","input","options","entryResult","entry","folderId","ROOT_FOLDER","permissions","canAccessFolderContent","Result","EntryNotAuthorizedError","CreateEntryRevisionFromWithFlpDecorator","createDecorator","CreateEntryRevisionFromUseCase","FolderLevelPermissions","GetRevisionByIdUseCase"],"mappings":";;;;;;AAaA,MAAMA;IAGF,YACYC,sBAAwD,EACxDC,eAAiD,EACjDC,SAAmD,CAC7D;aAHUF,sBAAsB,GAAtBA;aACAC,eAAe,GAAfA;aACAC,SAAS,GAATA;IACT;IAEH,MAAM,QACFC,KAAe,EACfC,QAAgB,EAChBC,KAA6B,EAC7BC,OAAoC,EACI;QACxC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,4BAA4B,IACzD,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAACH,OAAOC,UAAUC,OAAOC;QAG1D,MAAMC,cAAc,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAACJ,OAAOC;QAC9D,IAAIG,YAAY,MAAM,IAClB,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAACJ,OAAOC,UAAUC,OAAOC;QAG1D,MAAME,QAAQD,YAAY,KAAK;QAC/B,MAAME,WAAWD,OAAO,UAAU;QAElC,IAAI,CAACC,YAAYA,aAAaC,aAC1B,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAACP,OAAOC,UAAUC,OAAOC;QAG1D,MAAMK,cAAc,MAAM,IAAI,CAAC,sBAAsB,CAAC,yBAAyB,CAACF;QAChF,MAAMG,yBAAyB,MAAM,IAAI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;YACpFD;YACA,KAAK;QACT;QAEA,IAAI,CAACC,wBACD,OAAOC,OAAO,IAAI,CAAC,IAAIC;QAG3B,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAACX,OAAOC,UAAUC,OAAOC;IAC1D;AACJ;AAEO,MAAMS,0CAA0CC,gBAAgB;IACnE,aAAaC;IACb,WAAWlB;IACX,cAAc;QAACmB;QAAwBC;KAAuB;AAClE"}

package/features/cms/decorators/CreateEntryWithFlpDecorator.d.ts

@@ -0,0 +1,12 @@
+import { Result } from "@webiny/feature/api";
+import { CreateEntryUseCase } from "@webiny/api-headless-cms/features/contentEntry/CreateEntry/abstractions.js";
+import type { CmsEntry, CmsEntryValues, CmsModel, CreateCmsEntryInput, CreateCmsEntryOptionsInput } from "@webiny/api-headless-cms/types/index.js";
+import { FolderLevelPermissions } from "../../../features/flp/FolderLevelPermissions/index.js";
+declare class CreateEntryWithFlpDecoratorImpl implements CreateEntryUseCase.Interface {
+    private folderLevelPermissions;
+    private decoratee;
+    constructor(folderLevelPermissions: FolderLevelPermissions.Interface, decoratee: CreateEntryUseCase.Interface);
+    execute<T extends CmsEntryValues = CmsEntryValues>(model: CmsModel, input: CreateCmsEntryInput<T>, options?: CreateCmsEntryOptionsInput): Promise<Result<CmsEntry<T>, CreateEntryUseCase.Error>>;
+}
+export declare const CreateEntryWithFlpDecorator: typeof CreateEntryWithFlpDecoratorImpl;
+export {};

package/features/cms/decorators/CreateEntryWithFlpDecorator.js

@@ -0,0 +1,33 @@
+import { Result, createDecorator } from "@webiny/feature/api";
+import { CreateEntryUseCase } from "@webiny/api-headless-cms/features/contentEntry/CreateEntry/abstractions.js";
+import { FolderLevelPermissions } from "../../flp/FolderLevelPermissions/index.js";
+import { ROOT_FOLDER } from "../../../constants.js";
+import { EntryNotAuthorizedError } from "@webiny/api-headless-cms/domain/contentEntry/errors.js";
+class CreateEntryWithFlpDecoratorImpl {
+    constructor(folderLevelPermissions, decoratee){
+        this.folderLevelPermissions = folderLevelPermissions;
+        this.decoratee = decoratee;
+    }
+    async execute(model, input, options) {
+        if (!this.folderLevelPermissions.canUseFolderLevelPermissions()) return this.decoratee.execute(model, input, options);
+        const folderId = input.wbyAco_location?.folderId || input.location?.folderId;
+        if (!folderId || folderId === ROOT_FOLDER) return this.decoratee.execute(model, input, options);
+        const permissions = await this.folderLevelPermissions.getFolderLevelPermissions(folderId);
+        const canAccessFolder = await this.folderLevelPermissions.canAccessFolderContent({
+            permissions,
+            rwd: "w"
+        });
+        if (!canAccessFolder) return Result.fail(new EntryNotAuthorizedError());
+        return this.decoratee.execute(model, input, options);
+    }
+}
+const CreateEntryWithFlpDecorator = createDecorator({
+    abstraction: CreateEntryUseCase,
+    decorator: CreateEntryWithFlpDecoratorImpl,
+    dependencies: [
+        FolderLevelPermissions
+    ]
+});
+export { CreateEntryWithFlpDecorator };
+
+//# sourceMappingURL=CreateEntryWithFlpDecorator.js.map

package/features/cms/decorators/CreateEntryWithFlpDecorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/cms/decorators/CreateEntryWithFlpDecorator.js","sources":["../../../../src/features/cms/decorators/CreateEntryWithFlpDecorator.ts"],"sourcesContent":["import { createDecorator, Result } from \"@webiny/feature/api\";\nimport { CreateEntryUseCase } from \"@webiny/api-headless-cms/features/contentEntry/CreateEntry/abstractions.js\";\nimport type {\n    CmsEntry,\n    CmsEntryValues,\n    CmsModel,\n    CreateCmsEntryInput,\n    CreateCmsEntryOptionsInput\n} from \"@webiny/api-headless-cms/types/index.js\";\nimport { FolderLevelPermissions } from \"~/features/flp/FolderLevelPermissions/index.js\";\nimport { ROOT_FOLDER } from \"~/constants.js\";\nimport { EntryNotAuthorizedError } from \"@webiny/api-headless-cms/domain/contentEntry/errors.js\";\n\nclass CreateEntryWithFlpDecoratorImpl implements CreateEntryUseCase.Interface {\n    constructor(\n        private folderLevelPermissions: FolderLevelPermissions.Interface,\n        private decoratee: CreateEntryUseCase.Interface\n    ) {}\n\n    async execute<T extends CmsEntryValues = CmsEntryValues>(\n        model: CmsModel,\n        input: CreateCmsEntryInput<T>,\n        options?: CreateCmsEntryOptionsInput\n    ): Promise<Result<CmsEntry<T>, CreateEntryUseCase.Error>> {\n        if (!this.folderLevelPermissions.canUseFolderLevelPermissions()) {\n            return this.decoratee.execute(model, input, options);\n        }\n\n        const folderId = input.wbyAco_location?.folderId || input.location?.folderId;\n\n        if (!folderId || folderId === ROOT_FOLDER) {\n            return this.decoratee.execute(model, input, options);\n        }\n\n        const permissions = await this.folderLevelPermissions.getFolderLevelPermissions(folderId);\n        const canAccessFolder = await this.folderLevelPermissions.canAccessFolderContent({\n            permissions,\n            rwd: \"w\"\n        });\n\n        if (!canAccessFolder) {\n            return Result.fail(new EntryNotAuthorizedError());\n        }\n\n        return this.decoratee.execute(model, input, options);\n    }\n}\n\nexport const CreateEntryWithFlpDecorator = createDecorator({\n    abstraction: CreateEntryUseCase,\n    decorator: CreateEntryWithFlpDecoratorImpl,\n    dependencies: [FolderLevelPermissions]\n});\n"],"names":["CreateEntryWithFlpDecoratorImpl","folderLevelPermissions","decoratee","model","input","options","folderId","ROOT_FOLDER","permissions","canAccessFolder","Result","EntryNotAuthorizedError","CreateEntryWithFlpDecorator","createDecorator","CreateEntryUseCase","FolderLevelPermissions"],"mappings":";;;;;AAaA,MAAMA;IACF,YACYC,sBAAwD,EACxDC,SAAuC,CACjD;aAFUD,sBAAsB,GAAtBA;aACAC,SAAS,GAATA;IACT;IAEH,MAAM,QACFC,KAAe,EACfC,KAA6B,EAC7BC,OAAoC,EACkB;QACtD,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,4BAA4B,IACzD,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAACF,OAAOC,OAAOC;QAGhD,MAAMC,WAAWF,MAAM,eAAe,EAAE,YAAYA,MAAM,QAAQ,EAAE;QAEpE,IAAI,CAACE,YAAYA,aAAaC,aAC1B,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAACJ,OAAOC,OAAOC;QAGhD,MAAMG,cAAc,MAAM,IAAI,CAAC,sBAAsB,CAAC,yBAAyB,CAACF;QAChF,MAAMG,kBAAkB,MAAM,IAAI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;YAC7ED;YACA,KAAK;QACT;QAEA,IAAI,CAACC,iBACD,OAAOC,OAAO,IAAI,CAAC,IAAIC;QAG3B,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAACR,OAAOC,OAAOC;IAChD;AACJ;AAEO,MAAMO,8BAA8BC,gBAAgB;IACvD,aAAaC;IACb,WAAWd;IACX,cAAc;QAACe;KAAuB;AAC1C"}

package/features/cms/decorators/DeleteEntryRevisionWithFlpDecorator.d.ts

@@ -0,0 +1,13 @@
+import { DeleteEntryRevisionUseCase } from "@webiny/api-headless-cms/features/contentEntry/DeleteEntryRevision/abstractions.js";
+import { GetRevisionByIdUseCase } from "@webiny/api-headless-cms/features/contentEntry/GetRevisionById/abstractions.js";
+import type { CmsModel } from "@webiny/api-headless-cms/types/index.js";
+import { FolderLevelPermissions } from "../../../features/flp/FolderLevelPermissions/index.js";
+declare class DeleteEntryRevisionWithFlpDecoratorImpl implements DeleteEntryRevisionUseCase.Interface {
+    private folderLevelPermissions;
+    private getRevisionById;
+    private decoratee;
+    constructor(folderLevelPermissions: FolderLevelPermissions.Interface, getRevisionById: GetRevisionByIdUseCase.Interface, decoratee: DeleteEntryRevisionUseCase.Interface);
+    execute(model: CmsModel, revisionId: string): ReturnType<DeleteEntryRevisionUseCase.Interface["execute"]>;
+}
+export declare const DeleteEntryRevisionWithFlpDecorator: typeof DeleteEntryRevisionWithFlpDecoratorImpl;
+export {};

package/features/cms/decorators/DeleteEntryRevisionWithFlpDecorator.js

@@ -0,0 +1,39 @@
+import { Result, createDecorator } from "@webiny/feature/api";
+import { DeleteEntryRevisionUseCase } from "@webiny/api-headless-cms/features/contentEntry/DeleteEntryRevision/abstractions.js";
+import { GetRevisionByIdUseCase } from "@webiny/api-headless-cms/features/contentEntry/GetRevisionById/abstractions.js";
+import { FolderLevelPermissions } from "../../flp/FolderLevelPermissions/index.js";
+import { ROOT_FOLDER } from "../../../constants.js";
+import { EntryNotAuthorizedError } from "@webiny/api-headless-cms/domain/contentEntry/errors.js";
+class DeleteEntryRevisionWithFlpDecoratorImpl {
+    constructor(folderLevelPermissions, getRevisionById, decoratee){
+        this.folderLevelPermissions = folderLevelPermissions;
+        this.getRevisionById = getRevisionById;
+        this.decoratee = decoratee;
+    }
+    async execute(model, revisionId) {
+        if (!this.folderLevelPermissions.canUseFolderLevelPermissions()) return this.decoratee.execute(model, revisionId);
+        const entryResult = await this.getRevisionById.execute(model, revisionId);
+        if (entryResult.isFail()) return this.decoratee.execute(model, revisionId);
+        const entry = entryResult.value;
+        const folderId = entry?.location?.folderId;
+        if (!folderId || folderId === ROOT_FOLDER) return this.decoratee.execute(model, revisionId);
+        const permissions = await this.folderLevelPermissions.getFolderLevelPermissions(folderId);
+        const canAccessFolder = await this.folderLevelPermissions.canAccessFolderContent({
+            permissions,
+            rwd: "d"
+        });
+        if (!canAccessFolder) return Result.fail(new EntryNotAuthorizedError());
+        return this.decoratee.execute(model, revisionId);
+    }
+}
+const DeleteEntryRevisionWithFlpDecorator = createDecorator({
+    abstraction: DeleteEntryRevisionUseCase,
+    decorator: DeleteEntryRevisionWithFlpDecoratorImpl,
+    dependencies: [
+        FolderLevelPermissions,
+        GetRevisionByIdUseCase
+    ]
+});
+export { DeleteEntryRevisionWithFlpDecorator };
+
+//# sourceMappingURL=DeleteEntryRevisionWithFlpDecorator.js.map

package/features/cms/decorators/DeleteEntryRevisionWithFlpDecorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/cms/decorators/DeleteEntryRevisionWithFlpDecorator.js","sources":["../../../../src/features/cms/decorators/DeleteEntryRevisionWithFlpDecorator.ts"],"sourcesContent":["import { createDecorator, Result } from \"@webiny/feature/api\";\nimport { DeleteEntryRevisionUseCase } from \"@webiny/api-headless-cms/features/contentEntry/DeleteEntryRevision/abstractions.js\";\nimport { GetRevisionByIdUseCase } from \"@webiny/api-headless-cms/features/contentEntry/GetRevisionById/abstractions.js\";\nimport type { CmsModel } from \"@webiny/api-headless-cms/types/index.js\";\nimport { FolderLevelPermissions } from \"~/features/flp/FolderLevelPermissions/index.js\";\nimport { ROOT_FOLDER } from \"~/constants.js\";\nimport { EntryNotAuthorizedError } from \"@webiny/api-headless-cms/domain/contentEntry/errors.js\";\n\nclass DeleteEntryRevisionWithFlpDecoratorImpl implements DeleteEntryRevisionUseCase.Interface {\n    constructor(\n        private folderLevelPermissions: FolderLevelPermissions.Interface,\n        private getRevisionById: GetRevisionByIdUseCase.Interface,\n        private decoratee: DeleteEntryRevisionUseCase.Interface\n    ) {}\n\n    async execute(\n        model: CmsModel,\n        revisionId: string\n    ): ReturnType<DeleteEntryRevisionUseCase.Interface[\"execute\"]> {\n        if (!this.folderLevelPermissions.canUseFolderLevelPermissions()) {\n            return this.decoratee.execute(model, revisionId);\n        }\n\n        const entryResult = await this.getRevisionById.execute(model, revisionId);\n        if (entryResult.isFail()) {\n            return this.decoratee.execute(model, revisionId);\n        }\n\n        const entry = entryResult.value;\n        const folderId = entry?.location?.folderId;\n\n        if (!folderId || folderId === ROOT_FOLDER) {\n            return this.decoratee.execute(model, revisionId);\n        }\n\n        const permissions = await this.folderLevelPermissions.getFolderLevelPermissions(folderId);\n        const canAccessFolder = await this.folderLevelPermissions.canAccessFolderContent({\n            permissions,\n            rwd: \"d\"\n        });\n\n        if (!canAccessFolder) {\n            return Result.fail(new EntryNotAuthorizedError());\n        }\n\n        return this.decoratee.execute(model, revisionId);\n    }\n}\n\nexport const DeleteEntryRevisionWithFlpDecorator = createDecorator({\n    abstraction: DeleteEntryRevisionUseCase,\n    decorator: DeleteEntryRevisionWithFlpDecoratorImpl,\n    dependencies: [FolderLevelPermissions, GetRevisionByIdUseCase]\n});\n"],"names":["DeleteEntryRevisionWithFlpDecoratorImpl","folderLevelPermissions","getRevisionById","decoratee","model","revisionId","entryResult","entry","folderId","ROOT_FOLDER","permissions","canAccessFolder","Result","EntryNotAuthorizedError","DeleteEntryRevisionWithFlpDecorator","createDecorator","DeleteEntryRevisionUseCase","FolderLevelPermissions","GetRevisionByIdUseCase"],"mappings":";;;;;;AAQA,MAAMA;IACF,YACYC,sBAAwD,EACxDC,eAAiD,EACjDC,SAA+C,CACzD;aAHUF,sBAAsB,GAAtBA;aACAC,eAAe,GAAfA;aACAC,SAAS,GAATA;IACT;IAEH,MAAM,QACFC,KAAe,EACfC,UAAkB,EACyC;QAC3D,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,4BAA4B,IACzD,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAACD,OAAOC;QAGzC,MAAMC,cAAc,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAACF,OAAOC;QAC9D,IAAIC,YAAY,MAAM,IAClB,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAACF,OAAOC;QAGzC,MAAME,QAAQD,YAAY,KAAK;QAC/B,MAAME,WAAWD,OAAO,UAAU;QAElC,IAAI,CAACC,YAAYA,aAAaC,aAC1B,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAACL,OAAOC;QAGzC,MAAMK,cAAc,MAAM,IAAI,CAAC,sBAAsB,CAAC,yBAAyB,CAACF;QAChF,MAAMG,kBAAkB,MAAM,IAAI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;YAC7ED;YACA,KAAK;QACT;QAEA,IAAI,CAACC,iBACD,OAAOC,OAAO,IAAI,CAAC,IAAIC;QAG3B,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAACT,OAAOC;IACzC;AACJ;AAEO,MAAMS,sCAAsCC,gBAAgB;IAC/D,aAAaC;IACb,WAAWhB;IACX,cAAc;QAACiB;QAAwBC;KAAuB;AAClE"}

package/features/cms/decorators/DeleteEntryWithFlpDecorator.d.ts

@@ -0,0 +1,13 @@
+import { DeleteEntryUseCase } from "@webiny/api-headless-cms/features/contentEntry/DeleteEntry/abstractions.js";
+import { GetLatestRevisionByEntryIdBaseUseCase } from "@webiny/api-headless-cms/features/contentEntry/GetLatestRevisionByEntryId/abstractions.js";
+import type { CmsModel, CmsDeleteEntryOptions } from "@webiny/api-headless-cms/types/index.js";
+import { FolderLevelPermissions } from "../../../features/flp/FolderLevelPermissions/index.js";
+declare class DeleteEntryWithFlpDecoratorImpl implements DeleteEntryUseCase.Interface {
+    private folderLevelPermissions;
+    private getLatestRevisionByEntryId;
+    private decoratee;
+    constructor(folderLevelPermissions: FolderLevelPermissions.Interface, getLatestRevisionByEntryId: GetLatestRevisionByEntryIdBaseUseCase.Interface, decoratee: DeleteEntryUseCase.Interface);
+    execute(model: CmsModel, id: string, options?: CmsDeleteEntryOptions): ReturnType<DeleteEntryUseCase.Interface["execute"]>;
+}
+export declare const DeleteEntryWithFlpDecorator: typeof DeleteEntryWithFlpDecoratorImpl;
+export {};

package/features/cms/decorators/DeleteEntryWithFlpDecorator.js

@@ -0,0 +1,41 @@
+import { Result, createDecorator } from "@webiny/feature/api";
+import { DeleteEntryUseCase } from "@webiny/api-headless-cms/features/contentEntry/DeleteEntry/abstractions.js";
+import { GetLatestRevisionByEntryIdBaseUseCase } from "@webiny/api-headless-cms/features/contentEntry/GetLatestRevisionByEntryId/abstractions.js";
+import { FolderLevelPermissions } from "../../flp/FolderLevelPermissions/index.js";
+import { ROOT_FOLDER } from "../../../constants.js";
+import { EntryNotAuthorizedError } from "@webiny/api-headless-cms/domain/contentEntry/errors.js";
+class DeleteEntryWithFlpDecoratorImpl {
+    constructor(folderLevelPermissions, getLatestRevisionByEntryId, decoratee){
+        this.folderLevelPermissions = folderLevelPermissions;
+        this.getLatestRevisionByEntryId = getLatestRevisionByEntryId;
+        this.decoratee = decoratee;
+    }
+    async execute(model, id, options) {
+        if (!this.folderLevelPermissions.canUseFolderLevelPermissions()) return this.decoratee.execute(model, id, options);
+        const entryResult = await this.getLatestRevisionByEntryId.execute(model, {
+            id
+        });
+        if (entryResult.isFail()) return this.decoratee.execute(model, id, options);
+        const entry = entryResult.value;
+        const folderId = entry?.location?.folderId;
+        if (!folderId || folderId === ROOT_FOLDER) return this.decoratee.execute(model, id, options);
+        const permissions = await this.folderLevelPermissions.getFolderLevelPermissions(folderId);
+        const canAccessFolder = await this.folderLevelPermissions.canAccessFolderContent({
+            permissions,
+            rwd: "d"
+        });
+        if (!canAccessFolder) return Result.fail(new EntryNotAuthorizedError());
+        return this.decoratee.execute(model, id, options);
+    }
+}
+const DeleteEntryWithFlpDecorator = createDecorator({
+    abstraction: DeleteEntryUseCase,
+    decorator: DeleteEntryWithFlpDecoratorImpl,
+    dependencies: [
+        FolderLevelPermissions,
+        GetLatestRevisionByEntryIdBaseUseCase
+    ]
+});
+export { DeleteEntryWithFlpDecorator };
+
+//# sourceMappingURL=DeleteEntryWithFlpDecorator.js.map

package/features/cms/decorators/DeleteEntryWithFlpDecorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/cms/decorators/DeleteEntryWithFlpDecorator.js","sources":["../../../../src/features/cms/decorators/DeleteEntryWithFlpDecorator.ts"],"sourcesContent":["import { createDecorator, Result } from \"@webiny/feature/api\";\nimport { DeleteEntryUseCase } from \"@webiny/api-headless-cms/features/contentEntry/DeleteEntry/abstractions.js\";\nimport { GetLatestRevisionByEntryIdBaseUseCase } from \"@webiny/api-headless-cms/features/contentEntry/GetLatestRevisionByEntryId/abstractions.js\";\nimport type { CmsModel, CmsDeleteEntryOptions } from \"@webiny/api-headless-cms/types/index.js\";\nimport { FolderLevelPermissions } from \"~/features/flp/FolderLevelPermissions/index.js\";\nimport { ROOT_FOLDER } from \"~/constants.js\";\nimport { EntryNotAuthorizedError } from \"@webiny/api-headless-cms/domain/contentEntry/errors.js\";\n\nclass DeleteEntryWithFlpDecoratorImpl implements DeleteEntryUseCase.Interface {\n    constructor(\n        private folderLevelPermissions: FolderLevelPermissions.Interface,\n        private getLatestRevisionByEntryId: GetLatestRevisionByEntryIdBaseUseCase.Interface,\n        private decoratee: DeleteEntryUseCase.Interface\n    ) {}\n\n    async execute(\n        model: CmsModel,\n        id: string,\n        options?: CmsDeleteEntryOptions\n    ): ReturnType<DeleteEntryUseCase.Interface[\"execute\"]> {\n        if (!this.folderLevelPermissions.canUseFolderLevelPermissions()) {\n            return this.decoratee.execute(model, id, options);\n        }\n\n        const entryResult = await this.getLatestRevisionByEntryId.execute(model, { id });\n        if (entryResult.isFail()) {\n            return this.decoratee.execute(model, id, options);\n        }\n\n        const entry = entryResult.value;\n        const folderId = entry?.location?.folderId;\n\n        if (!folderId || folderId === ROOT_FOLDER) {\n            return this.decoratee.execute(model, id, options);\n        }\n\n        const permissions = await this.folderLevelPermissions.getFolderLevelPermissions(folderId);\n        const canAccessFolder = await this.folderLevelPermissions.canAccessFolderContent({\n            permissions,\n            rwd: \"d\"\n        });\n\n        if (!canAccessFolder) {\n            return Result.fail(new EntryNotAuthorizedError());\n        }\n\n        return this.decoratee.execute(model, id, options);\n    }\n}\n\nexport const DeleteEntryWithFlpDecorator = createDecorator({\n    abstraction: DeleteEntryUseCase,\n    decorator: DeleteEntryWithFlpDecoratorImpl,\n    dependencies: [FolderLevelPermissions, GetLatestRevisionByEntryIdBaseUseCase]\n});\n"],"names":["DeleteEntryWithFlpDecoratorImpl","folderLevelPermissions","getLatestRevisionByEntryId","decoratee","model","id","options","entryResult","entry","folderId","ROOT_FOLDER","permissions","canAccessFolder","Result","EntryNotAuthorizedError","DeleteEntryWithFlpDecorator","createDecorator","DeleteEntryUseCase","FolderLevelPermissions","GetLatestRevisionByEntryIdBaseUseCase"],"mappings":";;;;;;AAQA,MAAMA;IACF,YACYC,sBAAwD,EACxDC,0BAA2E,EAC3EC,SAAuC,CACjD;aAHUF,sBAAsB,GAAtBA;aACAC,0BAA0B,GAA1BA;aACAC,SAAS,GAATA;IACT;IAEH,MAAM,QACFC,KAAe,EACfC,EAAU,EACVC,OAA+B,EACoB;QACnD,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,4BAA4B,IACzD,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAACF,OAAOC,IAAIC;QAG7C,MAAMC,cAAc,MAAM,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAACH,OAAO;YAAEC;QAAG;QAC9E,IAAIE,YAAY,MAAM,IAClB,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAACH,OAAOC,IAAIC;QAG7C,MAAME,QAAQD,YAAY,KAAK;QAC/B,MAAME,WAAWD,OAAO,UAAU;QAElC,IAAI,CAACC,YAAYA,aAAaC,aAC1B,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAACN,OAAOC,IAAIC;QAG7C,MAAMK,cAAc,MAAM,IAAI,CAAC,sBAAsB,CAAC,yBAAyB,CAACF;QAChF,MAAMG,kBAAkB,MAAM,IAAI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;YAC7ED;YACA,KAAK;QACT;QAEA,IAAI,CAACC,iBACD,OAAOC,OAAO,IAAI,CAAC,IAAIC;QAG3B,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAACV,OAAOC,IAAIC;IAC7C;AACJ;AAEO,MAAMS,8BAA8BC,gBAAgB;IACvD,aAAaC;IACb,WAAWjB;IACX,cAAc;QAACkB;QAAwBC;KAAsC;AACjF"}