@webiny/api-core 0.0.0-unstable.0d717d18dd

package/features/security/login/index.js

@@ -0,0 +1 @@
+export * from "./abstractions.js";

package/features/security/permissions/createPermissionSchema.d.ts

@@ -0,0 +1,2 @@
+import type { PermissionSchemaConfig } from "./types.js";
+export declare function createPermissionSchema<const T extends PermissionSchemaConfig>(config: T): T;

package/features/security/permissions/createPermissionSchema.js

@@ -0,0 +1,9 @@
+function createPermissionSchema(config) {
+    return {
+        ...config,
+        entities: config.entities ?? []
+    };
+}
+export { createPermissionSchema };
+
+//# sourceMappingURL=createPermissionSchema.js.map

package/features/security/permissions/createPermissionSchema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/permissions/createPermissionSchema.js","sources":["../../../../src/features/security/permissions/createPermissionSchema.ts"],"sourcesContent":["import type { PermissionSchemaConfig } from \"./types.js\";\n\nexport function createPermissionSchema<const T extends PermissionSchemaConfig>(config: T): T {\n    return {\n        ...config,\n        entities: config.entities ?? []\n    };\n}\n"],"names":["createPermissionSchema","config"],"mappings":"AAEO,SAASA,uBAA+DC,MAAS;IACpF,OAAO;QACH,GAAGA,MAAM;QACT,UAAUA,OAAO,QAAQ,IAAI,EAAE;IACnC;AACJ"}

package/features/security/permissions/createPermissions.d.ts

@@ -0,0 +1,8 @@
+import type { Abstraction } from "@webiny/di";
+import type { PermissionSchemaConfig } from "./types.js";
+import type { Permissions } from "./types.js";
+export declare function createPermissionsAbstraction<const S extends PermissionSchemaConfig>(schema: S): Abstraction<Permissions<S>>;
+export declare function createPermissionsFeature<const S extends PermissionSchemaConfig>(schema: S, abstraction: Abstraction<Permissions<S>>): {
+    name: string;
+    register(container: import("@webiny/di").Container): void;
+};

package/features/security/permissions/createPermissions.js

@@ -0,0 +1,162 @@
+import { createAbstraction, createFeature } from "@webiny/feature/api";
+import { IdentityContext } from "../IdentityContext/index.js";
+function buildEntityMap(schema) {
+    const map = new Map();
+    for (const entity of schema.entities ?? []){
+        const actions = new Set();
+        for (const action of entity.actions ?? [])actions.add(action.name);
+        map.set(entity.id, {
+            permission: entity.permission,
+            actions,
+            hasOwn: entity.scopes.includes("own")
+        });
+    }
+    return map;
+}
+function getEntity(entityMap, entityId) {
+    const entity = entityMap.get(entityId);
+    if (!entity) throw new Error(`Unknown entity "${entityId}" in permission schema.`);
+    return entity;
+}
+class SchemaPermissions {
+    constructor(schema, identityContext){
+        this.entityMap = buildEntityMap(schema);
+        this.fullAccessName = `${schema.prefix}.*`;
+        this.identityContext = identityContext;
+    }
+    async canAccess(entityId, item) {
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        if (void 0 === item) return true;
+        const ownOnly = !permissions.some((p)=>!p.own);
+        if (!ownOnly) return true;
+        const identity = this.identityContext.getIdentity();
+        return item.createdBy?.id === identity.id;
+    }
+    async onlyOwnRecords(entityId) {
+        if (await this.identityContext.hasFullAccess()) return false;
+        if (await this.hasFullSchemaAccess()) return false;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        return !permissions.some((p)=>!p.own);
+    }
+    async canRead(entityId) {
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        return permissions.some((permission)=>{
+            if ("string" != typeof permission.rwd) return true;
+            return permission.rwd.includes("r");
+        });
+    }
+    async canCreate(entityId) {
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        return permissions.some((permission)=>{
+            if ("string" != typeof permission.rwd) return true;
+            return permission.rwd.includes("w");
+        });
+    }
+    async canEdit(entityId, item) {
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        const identity = this.identityContext.getIdentity();
+        return permissions.some((permission)=>{
+            if (permission.own) {
+                if (!item?.createdBy) return true;
+                return item.createdBy.id === identity.id;
+            }
+            if ("string" != typeof permission.rwd) return true;
+            return permission.rwd.includes("w");
+        });
+    }
+    async canDelete(entityId, item) {
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        const identity = this.identityContext.getIdentity();
+        return permissions.some((permission)=>{
+            if (permission.own) return item?.createdBy?.id === identity.id;
+            if ("string" != typeof permission.rwd) return true;
+            return permission.rwd.includes("d");
+        });
+    }
+    async canPublish(entityId) {
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        return permissions.some((permission)=>permission.pw?.includes("p"));
+    }
+    async canUnpublish(entityId) {
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        return permissions.some((permission)=>permission.pw?.includes("u"));
+    }
+    async canAction(action, entityId) {
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        return permissions.some((permission)=>true === permission[action]);
+    }
+    async getEntityPermissions(entityPermission) {
+        const permissions = await this.identityContext.getPermissions(entityPermission);
+        if (permissions.length) return permissions;
+        const wildcard = await this.identityContext.getPermission(this.fullAccessName);
+        return wildcard ? [
+            wildcard
+        ] : [];
+    }
+    async hasFullSchemaAccess() {
+        const permission = await this.identityContext.getPermission(this.fullAccessName);
+        if (!permission) return false;
+        const keys = Object.keys(permission).filter((k)=>"name" !== k);
+        const hasRwd = keys.includes("rwd");
+        return !hasRwd;
+    }
+}
+function createPermissionsAbstraction(schema) {
+    return createAbstraction(`${schema.prefix}:Permissions`);
+}
+function createPermissionsFeature(schema, abstraction) {
+    class PermissionsImpl extends SchemaPermissions {
+        constructor(identityContext){
+            super(schema, identityContext);
+        }
+    }
+    const Implementation = abstraction.createImplementation({
+        implementation: PermissionsImpl,
+        dependencies: [
+            IdentityContext
+        ]
+    });
+    return createFeature({
+        name: `${schema.prefix}:Permissions`,
+        register (container) {
+            container.register(Implementation);
+        }
+    });
+}
+export { createPermissionsAbstraction, createPermissionsFeature };
+
+//# sourceMappingURL=createPermissions.js.map

package/features/security/permissions/createPermissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/permissions/createPermissions.js","sources":["../../../../src/features/security/permissions/createPermissions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport { createFeature } from \"@webiny/feature/api\";\nimport { IdentityContext } from \"~/features/security/IdentityContext/index.js\";\nimport type { Abstraction } from \"@webiny/di\";\nimport type { PermissionSchemaConfig } from \"./types.js\";\nimport type { OwnableItem } from \"./types.js\";\nimport type { Permissions } from \"./types.js\";\n\ninterface EntityLookup {\n    permission: string;\n    actions: Set<string>;\n    hasOwn: boolean;\n}\n\nfunction buildEntityMap(schema: PermissionSchemaConfig): Map<string, EntityLookup> {\n    const map = new Map<string, EntityLookup>();\n    for (const entity of schema.entities ?? []) {\n        const actions = new Set<string>();\n        for (const action of entity.actions ?? []) {\n            actions.add(action.name);\n        }\n        map.set(entity.id, {\n            permission: entity.permission,\n            actions,\n            hasOwn: entity.scopes.includes(\"own\")\n        });\n    }\n    return map;\n}\n\nfunction getEntity(entityMap: Map<string, EntityLookup>, entityId: string): EntityLookup {\n    const entity = entityMap.get(entityId);\n    if (!entity) {\n        throw new Error(`Unknown entity \"${entityId}\" in permission schema.`);\n    }\n    return entity;\n}\n\nclass SchemaPermissions<S extends PermissionSchemaConfig> {\n    private readonly entityMap: Map<string, EntityLookup>;\n    private readonly fullAccessName: string;\n    private readonly identityContext: IdentityContext.Interface;\n\n    constructor(schema: S, identityContext: IdentityContext.Interface) {\n        this.entityMap = buildEntityMap(schema);\n        this.fullAccessName = `${schema.prefix}.*`;\n        this.identityContext = identityContext;\n    }\n\n    async canAccess(entityId: string, item?: OwnableItem): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        // No item — just check entity-level access.\n        if (item === undefined) {\n            return true;\n        }\n        // Item provided — if all permissions require own, verify ownership.\n        const ownOnly = !permissions.some(p => !p.own);\n        if (!ownOnly) {\n            return true;\n        }\n        const identity = this.identityContext.getIdentity();\n        return item.createdBy?.id === identity.id;\n    }\n\n    async onlyOwnRecords(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return false;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return false;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return !permissions.some(p => !p.own);\n    }\n\n    async canRead(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"r\");\n        });\n    }\n\n    async canCreate(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"w\");\n        });\n    }\n\n    async canEdit(entityId: string, item?: OwnableItem): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        const identity = this.identityContext.getIdentity();\n        return permissions.some(permission => {\n            if (permission.own) {\n                // No item provided (new/unsaved) — allow access.\n                if (!item?.createdBy) {\n                    return true;\n                }\n                return item.createdBy.id === identity.id;\n            }\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"w\");\n        });\n    }\n\n    async canDelete(entityId: string, item?: OwnableItem): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        const identity = this.identityContext.getIdentity();\n        return permissions.some(permission => {\n            if (permission.own) {\n                return item?.createdBy?.id === identity.id;\n            }\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"d\");\n        });\n    }\n\n    async canPublish(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission.pw?.includes(\"p\");\n        });\n    }\n\n    async canUnpublish(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission.pw?.includes(\"u\");\n        });\n    }\n\n    async canAction(action: string, entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission[action] === true;\n        });\n    }\n\n    private async getEntityPermissions(entityPermission: string): Promise<any[]> {\n        const permissions = await this.identityContext.getPermissions(entityPermission);\n        if (permissions.length) {\n            return permissions;\n        }\n        // Fall back to the schema wildcard (e.g. \"test.*\") — its flags apply to all entities.\n        const wildcard = await this.identityContext.getPermission(this.fullAccessName);\n        return wildcard ? [wildcard] : [];\n    }\n\n    private async hasFullSchemaAccess(): Promise<boolean> {\n        const permission = await this.identityContext.getPermission(this.fullAccessName);\n        if (!permission) {\n            return false;\n        }\n        // Only treat as full access if the permission has no `rwd` flag.\n        // A permission like { name: \"wb.*\", rwd: \"r\" } should NOT grant full access.\n        const keys = Object.keys(permission).filter(k => k !== \"name\");\n\n        const hasRwd = keys.includes(\"rwd\");\n\n        // It's full-access only if there's no `rwd` flag.\n        return !hasRwd;\n    }\n}\n\nexport function createPermissionsAbstraction<const S extends PermissionSchemaConfig>(schema: S) {\n    return createAbstraction<Permissions<S>>(`${schema.prefix}:Permissions`);\n}\n\nexport function createPermissionsFeature<const S extends PermissionSchemaConfig>(\n    schema: S,\n    abstraction: Abstraction<Permissions<S>>\n) {\n    class PermissionsImpl extends SchemaPermissions<S> {\n        constructor(identityContext: IdentityContext.Interface) {\n            super(schema, identityContext);\n        }\n    }\n\n    const Implementation = abstraction.createImplementation({\n        implementation: PermissionsImpl,\n        dependencies: [IdentityContext]\n    } as any);\n\n    return createFeature({\n        name: `${schema.prefix}:Permissions`,\n        register(container) {\n            container.register(Implementation);\n        }\n    });\n}\n"],"names":["buildEntityMap","schema","map","Map","entity","actions","Set","action","getEntity","entityMap","entityId","Error","SchemaPermissions","identityContext","item","permissions","undefined","ownOnly","p","identity","permission","entityPermission","wildcard","keys","Object","k","hasRwd","createPermissionsAbstraction","createAbstraction","createPermissionsFeature","abstraction","PermissionsImpl","Implementation","IdentityContext","createFeature","container"],"mappings":";;AAcA,SAASA,eAAeC,MAA8B;IAClD,MAAMC,MAAM,IAAIC;IAChB,KAAK,MAAMC,UAAUH,OAAO,QAAQ,IAAI,EAAE,CAAE;QACxC,MAAMI,UAAU,IAAIC;QACpB,KAAK,MAAMC,UAAUH,OAAO,OAAO,IAAI,EAAE,CACrCC,QAAQ,GAAG,CAACE,OAAO,IAAI;QAE3BL,IAAI,GAAG,CAACE,OAAO,EAAE,EAAE;YACf,YAAYA,OAAO,UAAU;YAC7BC;YACA,QAAQD,OAAO,MAAM,CAAC,QAAQ,CAAC;QACnC;IACJ;IACA,OAAOF;AACX;AAEA,SAASM,UAAUC,SAAoC,EAAEC,QAAgB;IACrE,MAAMN,SAASK,UAAU,GAAG,CAACC;IAC7B,IAAI,CAACN,QACD,MAAM,IAAIO,MAAM,CAAC,gBAAgB,EAAED,SAAS,uBAAuB,CAAC;IAExE,OAAON;AACX;AAEA,MAAMQ;IAKF,YAAYX,MAAS,EAAEY,eAA0C,CAAE;QAC/D,IAAI,CAAC,SAAS,GAAGb,eAAeC;QAChC,IAAI,CAAC,cAAc,GAAG,GAAGA,OAAO,MAAM,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,eAAe,GAAGY;IAC3B;IAEA,MAAM,UAAUH,QAAgB,EAAEI,IAAkB,EAAoB;QACpE,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMV,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAGX,IAAID,AAASE,WAATF,MACA,OAAO;QAGX,MAAMG,UAAU,CAACF,YAAY,IAAI,CAACG,CAAAA,IAAK,CAACA,EAAE,GAAG;QAC7C,IAAI,CAACD,SACD,OAAO;QAEX,MAAME,WAAW,IAAI,CAAC,eAAe,CAAC,WAAW;QACjD,OAAOL,KAAK,SAAS,EAAE,OAAOK,SAAS,EAAE;IAC7C;IAEA,MAAM,eAAeT,QAAgB,EAAoB;QACrD,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,OAAO,CAACA,YAAY,IAAI,CAACG,CAAAA,IAAK,CAACA,EAAE,GAAG;IACxC;IAEA,MAAM,QAAQR,QAAgB,EAAoB;QAC9C,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,OAAOA,YAAY,IAAI,CAACK,CAAAA;YACpB,IAAI,AAA0B,YAA1B,OAAOA,WAAW,GAAG,EACrB,OAAO;YAEX,OAAOA,WAAW,GAAG,CAAC,QAAQ,CAAC;QACnC;IACJ;IAEA,MAAM,UAAUV,QAAgB,EAAoB;QAChD,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,OAAOA,YAAY,IAAI,CAACK,CAAAA;YACpB,IAAI,AAA0B,YAA1B,OAAOA,WAAW,GAAG,EACrB,OAAO;YAEX,OAAOA,WAAW,GAAG,CAAC,QAAQ,CAAC;QACnC;IACJ;IAEA,MAAM,QAAQV,QAAgB,EAAEI,IAAkB,EAAoB;QAClE,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMV,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,MAAMI,WAAW,IAAI,CAAC,eAAe,CAAC,WAAW;QACjD,OAAOJ,YAAY,IAAI,CAACK,CAAAA;YACpB,IAAIA,WAAW,GAAG,EAAE;gBAEhB,IAAI,CAACN,MAAM,WACP,OAAO;gBAEX,OAAOA,KAAK,SAAS,CAAC,EAAE,KAAKK,SAAS,EAAE;YAC5C;YACA,IAAI,AAA0B,YAA1B,OAAOC,WAAW,GAAG,EACrB,OAAO;YAEX,OAAOA,WAAW,GAAG,CAAC,QAAQ,CAAC;QACnC;IACJ;IAEA,MAAM,UAAUV,QAAgB,EAAEI,IAAkB,EAAoB;QACpE,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMV,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,MAAMI,WAAW,IAAI,CAAC,eAAe,CAAC,WAAW;QACjD,OAAOJ,YAAY,IAAI,CAACK,CAAAA;YACpB,IAAIA,WAAW,GAAG,EACd,OAAON,MAAM,WAAW,OAAOK,SAAS,EAAE;YAE9C,IAAI,AAA0B,YAA1B,OAAOC,WAAW,GAAG,EACrB,OAAO;YAEX,OAAOA,WAAW,GAAG,CAAC,QAAQ,CAAC;QACnC;IACJ;IAEA,MAAM,WAAWV,QAAgB,EAAoB;QACjD,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,OAAOA,YAAY,IAAI,CAACK,CAAAA,aACbA,WAAW,EAAE,EAAE,SAAS;IAEvC;IAEA,MAAM,aAAaV,QAAgB,EAAoB;QACnD,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,OAAOA,YAAY,IAAI,CAACK,CAAAA,aACbA,WAAW,EAAE,EAAE,SAAS;IAEvC;IAEA,MAAM,UAAUb,MAAc,EAAEG,QAAgB,EAAoB;QAChE,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,OAAOA,YAAY,IAAI,CAACK,CAAAA,aACbA,AAAuB,SAAvBA,UAAU,CAACb,OAAO;IAEjC;IAEA,MAAc,qBAAqBc,gBAAwB,EAAkB;QACzE,MAAMN,cAAc,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CAACM;QAC9D,IAAIN,YAAY,MAAM,EAClB,OAAOA;QAGX,MAAMO,WAAW,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc;QAC7E,OAAOA,WAAW;YAACA;SAAS,GAAG,EAAE;IACrC;IAEA,MAAc,sBAAwC;QAClD,MAAMF,aAAa,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc;QAC/E,IAAI,CAACA,YACD,OAAO;QAIX,MAAMG,OAAOC,OAAO,IAAI,CAACJ,YAAY,MAAM,CAACK,CAAAA,IAAKA,AAAM,WAANA;QAEjD,MAAMC,SAASH,KAAK,QAAQ,CAAC;QAG7B,OAAO,CAACG;IACZ;AACJ;AAEO,SAASC,6BAAqE1B,MAAS;IAC1F,OAAO2B,kBAAkC,GAAG3B,OAAO,MAAM,CAAC,YAAY,CAAC;AAC3E;AAEO,SAAS4B,yBACZ5B,MAAS,EACT6B,WAAwC;IAExC,MAAMC,wBAAwBnB;QAC1B,YAAYC,eAA0C,CAAE;YACpD,KAAK,CAACZ,QAAQY;QAClB;IACJ;IAEA,MAAMmB,iBAAiBF,YAAY,oBAAoB,CAAC;QACpD,gBAAgBC;QAChB,cAAc;YAACE;SAAgB;IACnC;IAEA,OAAOC,cAAc;QACjB,MAAM,GAAGjC,OAAO,MAAM,CAAC,YAAY,CAAC;QACpC,UAASkC,SAAS;YACdA,UAAU,QAAQ,CAACH;QACvB;IACJ;AACJ"}

package/features/security/permissions/index.d.ts

@@ -0,0 +1,3 @@
+export { createPermissionSchema } from "./createPermissionSchema.js";
+export { createPermissionsAbstraction, createPermissionsFeature } from "./createPermissions.js";
+export type { ActionDefinition, EntityDefinition, PermissionSchemaConfig, OwnableItem, Permissions, AllEntityIds, RwdEntityId, PwEntityId, CustomActionNames } from "./types.js";

package/features/security/permissions/index.js

@@ -0,0 +1,2 @@
+export { createPermissionSchema } from "./createPermissionSchema.js";
+export { createPermissionsAbstraction, createPermissionsFeature } from "./createPermissions.js";

package/features/security/permissions/types.d.ts

@@ -0,0 +1,137 @@
+/**
+ * An action definition on an entity.
+ *
+ * Built-in actions:
+ * - `{ name: "rwd" }` — read/write/delete (serialized as joined string, e.g. "rw")
+ * - `{ name: "pw" }` — publish/unpublish (serialized as joined string, e.g. "pu")
+ *
+ * Custom actions:
+ * - `{ name: "install" }` — boolean flag (serialized as `install: true`)
+ */
+export interface ActionDefinition {
+    /** Key on the permission object (e.g. "rwd", "pw", "install"). */
+    name: string;
+    /** Display label for the UI. Required for custom actions; ignored for built-in "rwd"/"pw". */
+    label?: string;
+}
+/**
+ * Defines an entity within a permission schema.
+ */
+export interface EntityDefinition {
+    /** Unique ID, used for form field naming: ${id}AccessScope, ${id}RWD, etc. */
+    id: string;
+    /** Display title for the UI renderer (e.g. "Files", "Settings"). */
+    title?: string;
+    /** Permission name emitted for this entity (e.g. "fm.file"). */
+    permission: string;
+    /** Available access scopes. */
+    scopes: readonly ("full" | "own")[];
+    /** Action definitions for this entity. */
+    actions?: readonly ActionDefinition[];
+    /** Dependency on another entity. */
+    dependsOn?: {
+        /** ID of parent entity. */
+        entity: string;
+        /** Required action character (e.g. "r"). */
+        requires: string;
+    };
+}
+/**
+ * Configuration for creating a permission schema.
+ */
+export interface PermissionSchemaConfig {
+    /** Permission prefix — used to filter permissions from the array. */
+    prefix: string;
+    /**
+     * Full access configuration.
+     * - `true` — emits `{ name: "${prefix}.*" }`.
+     * - `{ ...extras }` — emits `{ name: "${prefix}.*", ...extras }`.
+     */
+    fullAccess: boolean | {
+        [key: string]: any;
+    };
+    /** Entity definitions (optional — simple apps have none). */
+    entities?: readonly EntityDefinition[];
+}
+/**
+ * Item that may have an owner (used for own-scope permission checks).
+ */
+export interface OwnableItem {
+    createdBy?: {
+        id: string;
+    } | null;
+}
+/**
+ * Extract the union of entity definitions from a schema config type.
+ */
+type EntitiesOf<S extends PermissionSchemaConfig> = S extends {
+    entities: ReadonlyArray<infer E extends EntityDefinition>;
+} ? E : never;
+/**
+ * Extract entity IDs whose actions array contains an action with the given name.
+ */
+type EntityIdWithAction<S extends PermissionSchemaConfig, A extends string> = {
+    [K in EntitiesOf<S> as K extends {
+        actions: ReadonlyArray<infer Act>;
+    } ? Act extends {
+        name: A;
+    } ? K["id"] : never : never]: never;
+} extends infer M ? keyof M & string : never;
+/**
+ * All entity IDs in the schema.
+ */
+export type AllEntityIds<S extends PermissionSchemaConfig> = EntitiesOf<S>["id"];
+/**
+ * Entity IDs that have the "rwd" action.
+ */
+export type RwdEntityId<S extends PermissionSchemaConfig> = EntityIdWithAction<S, "rwd">;
+/**
+ * Entity IDs that have the "pw" action.
+ */
+export type PwEntityId<S extends PermissionSchemaConfig> = EntityIdWithAction<S, "pw">;
+/**
+ * Custom (non-builtin) action names across all entities.
+ */
+export type CustomActionNames<S extends PermissionSchemaConfig> = Exclude<EntitiesOf<S> extends {
+    actions: ReadonlyArray<infer Act extends ActionDefinition>;
+} ? Act["name"] : never, "rwd" | "pw">;
+/**
+ * Typed permissions interface for a given schema.
+ *
+ * When the schema has literal entity types, methods are narrowed to only accept valid entity IDs.
+ * When the schema is dynamically typed, all methods accept `string`.
+ */
+export type Permissions<S extends PermissionSchemaConfig> = string extends AllEntityIds<S> ? PermissionsUntyped : PermissionsTyped<S>;
+export interface PermissionsUntyped {
+    canAccess(entityId: string, item?: OwnableItem): Promise<boolean>;
+    onlyOwnRecords(entityId: string): Promise<boolean>;
+    canRead(entityId: string): Promise<boolean>;
+    canCreate(entityId: string): Promise<boolean>;
+    canEdit(entityId: string, item?: OwnableItem): Promise<boolean>;
+    canDelete(entityId: string, item?: OwnableItem): Promise<boolean>;
+    canPublish(entityId: string): Promise<boolean>;
+    canUnpublish(entityId: string): Promise<boolean>;
+    canAction(action: string, entityId: string): Promise<boolean>;
+}
+export type PermissionsTyped<S extends PermissionSchemaConfig> = {
+    canAccess(entityId: AllEntityIds<S>, item?: OwnableItem): Promise<boolean>;
+    onlyOwnRecords(entityId: AllEntityIds<S>): Promise<boolean>;
+    canAction(action: CustomActionNames<S> extends never ? string : CustomActionNames<S>, entityId: AllEntityIds<S>): Promise<boolean>;
+} & ([RwdEntityId<S>] extends [never] ? {
+    canRead(entityId: string): Promise<boolean>;
+    canCreate(entityId: string): Promise<boolean>;
+    canEdit(entityId: string, item?: OwnableItem): Promise<boolean>;
+    canDelete(entityId: string, item?: OwnableItem): Promise<boolean>;
+} : {
+    canRead(entityId: RwdEntityId<S>): Promise<boolean>;
+    canCreate(entityId: RwdEntityId<S>): Promise<boolean>;
+    canEdit(entityId: RwdEntityId<S>, item?: OwnableItem): Promise<boolean>;
+    canDelete(entityId: RwdEntityId<S>, item?: OwnableItem): Promise<boolean>;
+}) & ([PwEntityId<S>] extends [never] ? {
+    canPublish(entityId: string): Promise<boolean>;
+    canUnpublish(entityId: string): Promise<boolean>;
+} : {
+    canPublish(entityId: PwEntityId<S>): Promise<boolean>;
+    canUnpublish(entityId: PwEntityId<S>): Promise<boolean>;
+});
+export {};

package/features/security/roles/CreateRole/CreateRoleUseCase.d.ts

@@ -0,0 +1,15 @@
+import { Result } from "@webiny/feature/api";
+import { EventPublisher } from "../../../../features/eventPublisher/index.js";
+import { CreateRoleUseCase as UseCaseAbstraction } from "./abstractions.js";
+import { RolesRepository } from "../shared/abstractions.js";
+import { IdentityContext } from "../../IdentityContext/abstractions.js";
+import type { Role, CreateRoleInput } from "../shared/types.js";
+declare class CreateRoleUseCaseImpl implements UseCaseAbstraction.Interface {
+    private identityContext;
+    private eventPublisher;
+    private repository;
+    constructor(identityContext: IdentityContext.Interface, eventPublisher: EventPublisher.Interface, repository: RolesRepository.Interface);
+    execute(input: CreateRoleInput): Promise<Result<Role, UseCaseAbstraction.Error>>;
+}
+export declare const CreateRoleUseCase: import("@webiny/di").Implementation<typeof CreateRoleUseCaseImpl>;
+export {};

package/features/security/roles/CreateRole/CreateRoleUseCase.js

@@ -0,0 +1,66 @@
+import { mdbid } from "@webiny/utils";
+import { Result, createImplementation } from "@webiny/feature/api";
+import { EventPublisher } from "../../../eventPublisher/index.js";
+import { CreateRoleUseCase } from "./abstractions.js";
+import { RolesRepository } from "../shared/abstractions.js";
+import { IdentityContext } from "../../IdentityContext/abstractions.js";
+import { createRoleValidation } from "./schema.js";
+import { RoleAfterCreateEvent, RoleBeforeCreateEvent } from "./events.js";
+import { NotAuthorizedError, RoleExistsError, RoleValidationError } from "../shared/errors.js";
+class CreateRoleUseCaseImpl {
+    constructor(identityContext, eventPublisher, repository){
+        this.identityContext = identityContext;
+        this.eventPublisher = eventPublisher;
+        this.repository = repository;
+    }
+    async execute(input) {
+        const hasPermission = await this.identityContext.getPermission("security.role");
+        if (!hasPermission) return Result.fail(new NotAuthorizedError());
+        const validation = createRoleValidation.safeParse(input);
+        if (!validation.success) return Result.fail(new RoleValidationError(validation.error.issues[0].message));
+        const identity = this.identityContext.getIdentity();
+        const data = validation.data;
+        const existingRoleResult = await this.repository.get({
+            slug: data.slug
+        });
+        if (existingRoleResult.isOk()) return Result.fail(new RoleExistsError(data.slug));
+        const role = {
+            id: mdbid(),
+            name: data.name,
+            slug: data.slug,
+            description: data.description,
+            permissions: data.permissions,
+            system: input.system || false,
+            createdOn: new Date().toISOString(),
+            createdBy: {
+                id: identity.id,
+                displayName: identity.displayName,
+                type: identity.type
+            },
+            plugin: false
+        };
+        await this.eventPublisher.publish(new RoleBeforeCreateEvent({
+            role,
+            input: validation.data
+        }));
+        const result = await this.repository.create(role);
+        if (result.isFail()) return Result.fail(result.error);
+        await this.eventPublisher.publish(new RoleAfterCreateEvent({
+            role,
+            input: validation.data
+        }));
+        return Result.ok(role);
+    }
+}
+const CreateRoleUseCase_CreateRoleUseCase = createImplementation({
+    abstraction: CreateRoleUseCase,
+    implementation: CreateRoleUseCaseImpl,
+    dependencies: [
+        IdentityContext,
+        EventPublisher,
+        RolesRepository
+    ]
+});
+export { CreateRoleUseCase_CreateRoleUseCase as CreateRoleUseCase };
+
+//# sourceMappingURL=CreateRoleUseCase.js.map

package/features/security/roles/CreateRole/CreateRoleUseCase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/roles/CreateRole/CreateRoleUseCase.js","sources":["../../../../../src/features/security/roles/CreateRole/CreateRoleUseCase.ts"],"sourcesContent":["import { mdbid } from \"@webiny/utils\";\nimport { createImplementation } from \"@webiny/feature/api\";\nimport { Result } from \"@webiny/feature/api\";\nimport { EventPublisher } from \"~/features/eventPublisher/index.js\";\nimport { CreateRoleUseCase as UseCaseAbstraction } from \"./abstractions.js\";\nimport { RolesRepository } from \"../shared/abstractions.js\";\nimport { IdentityContext } from \"../../IdentityContext/abstractions.js\";\nimport { createRoleValidation } from \"./schema.js\";\nimport { RoleBeforeCreateEvent, RoleAfterCreateEvent } from \"./events.js\";\nimport type { Role, CreateRoleInput } from \"../shared/types.js\";\nimport { NotAuthorizedError, RoleExistsError, RoleValidationError } from \"../shared/errors.js\";\n\nclass CreateRoleUseCaseImpl implements UseCaseAbstraction.Interface {\n    constructor(\n        private identityContext: IdentityContext.Interface,\n        private eventPublisher: EventPublisher.Interface,\n        private repository: RolesRepository.Interface\n    ) {}\n\n    async execute(input: CreateRoleInput): Promise<Result<Role, UseCaseAbstraction.Error>> {\n        const hasPermission = await this.identityContext.getPermission(\"security.role\");\n\n        if (!hasPermission) {\n            return Result.fail(new NotAuthorizedError());\n        }\n\n        const validation = createRoleValidation.safeParse(input);\n        if (!validation.success) {\n            return Result.fail(new RoleValidationError(validation.error.issues[0].message));\n        }\n\n        const identity = this.identityContext.getIdentity();\n        const data = validation.data;\n\n        // Check if role with same slug already exists\n        const existingRoleResult = await this.repository.get({ slug: data.slug });\n        if (existingRoleResult.isOk()) {\n            return Result.fail(new RoleExistsError(data.slug));\n        }\n\n        const role: Role = {\n            id: mdbid(),\n            name: data.name,\n            slug: data.slug,\n            description: data.description,\n            permissions: data.permissions,\n            system: input.system || false,\n            createdOn: new Date().toISOString(),\n            createdBy: {\n                id: identity.id,\n                displayName: identity.displayName,\n                type: identity.type\n            },\n            plugin: false\n        };\n\n        await this.eventPublisher.publish(\n            new RoleBeforeCreateEvent({ role, input: validation.data })\n        );\n\n        const result = await this.repository.create(role);\n\n        if (result.isFail()) {\n            return Result.fail(result.error);\n        }\n\n        await this.eventPublisher.publish(\n            new RoleAfterCreateEvent({ role, input: validation.data })\n        );\n\n        return Result.ok(role);\n    }\n}\n\nexport const CreateRoleUseCase = createImplementation({\n    abstraction: UseCaseAbstraction,\n    implementation: CreateRoleUseCaseImpl,\n    dependencies: [IdentityContext, EventPublisher, RolesRepository]\n});\n"],"names":["CreateRoleUseCaseImpl","identityContext","eventPublisher","repository","input","hasPermission","Result","NotAuthorizedError","validation","createRoleValidation","RoleValidationError","identity","data","existingRoleResult","RoleExistsError","role","mdbid","Date","RoleBeforeCreateEvent","result","RoleAfterCreateEvent","CreateRoleUseCase","createImplementation","UseCaseAbstraction","IdentityContext","EventPublisher","RolesRepository"],"mappings":";;;;;;;;;AAYA,MAAMA;IACF,YACYC,eAA0C,EAC1CC,cAAwC,EACxCC,UAAqC,CAC/C;aAHUF,eAAe,GAAfA;aACAC,cAAc,GAAdA;aACAC,UAAU,GAAVA;IACT;IAEH,MAAM,QAAQC,KAAsB,EAAmD;QACnF,MAAMC,gBAAgB,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC;QAE/D,IAAI,CAACA,eACD,OAAOC,OAAO,IAAI,CAAC,IAAIC;QAG3B,MAAMC,aAAaC,qBAAqB,SAAS,CAACL;QAClD,IAAI,CAACI,WAAW,OAAO,EACnB,OAAOF,OAAO,IAAI,CAAC,IAAII,oBAAoBF,WAAW,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO;QAGjF,MAAMG,WAAW,IAAI,CAAC,eAAe,CAAC,WAAW;QACjD,MAAMC,OAAOJ,WAAW,IAAI;QAG5B,MAAMK,qBAAqB,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAMD,KAAK,IAAI;QAAC;QACvE,IAAIC,mBAAmB,IAAI,IACvB,OAAOP,OAAO,IAAI,CAAC,IAAIQ,gBAAgBF,KAAK,IAAI;QAGpD,MAAMG,OAAa;YACf,IAAIC;YACJ,MAAMJ,KAAK,IAAI;YACf,MAAMA,KAAK,IAAI;YACf,aAAaA,KAAK,WAAW;YAC7B,aAAaA,KAAK,WAAW;YAC7B,QAAQR,MAAM,MAAM,IAAI;YACxB,WAAW,IAAIa,OAAO,WAAW;YACjC,WAAW;gBACP,IAAIN,SAAS,EAAE;gBACf,aAAaA,SAAS,WAAW;gBACjC,MAAMA,SAAS,IAAI;YACvB;YACA,QAAQ;QACZ;QAEA,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAC7B,IAAIO,sBAAsB;YAAEH;YAAM,OAAOP,WAAW,IAAI;QAAC;QAG7D,MAAMW,SAAS,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAACJ;QAE5C,IAAII,OAAO,MAAM,IACb,OAAOb,OAAO,IAAI,CAACa,OAAO,KAAK;QAGnC,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAC7B,IAAIC,qBAAqB;YAAEL;YAAM,OAAOP,WAAW,IAAI;QAAC;QAG5D,OAAOF,OAAO,EAAE,CAACS;IACrB;AACJ;AAEO,MAAMM,sCAAoBC,qBAAqB;IAClD,aAAaC;IACb,gBAAgBvB;IAChB,cAAc;QAACwB;QAAiBC;QAAgBC;KAAgB;AACpE"}

package/features/security/roles/CreateRole/abstractions.d.ts

@@ -0,0 +1,28 @@
+import { Result } from "@webiny/feature/api";
+import type { Role, CreateRoleInput } from "../shared/types.js";
+import { RolesRepository } from "../shared/abstractions.js";
+import { NotAuthorizedError, RoleExistsError, RoleValidationError } from "../shared/errors.js";
+export interface ICreateRoleErrors {
+    notAuthorized: NotAuthorizedError;
+    roleExists: RoleExistsError;
+    validation: RoleValidationError;
+}
+type CreateRoleError = ICreateRoleErrors[keyof ICreateRoleErrors] | RolesRepository.Error;
+export interface ICreateRole {
+    execute(input: CreateRoleInput): Promise<Result<Role, CreateRoleError>>;
+}
+/** Create a new security role. */
+export declare const CreateRoleUseCase: import("@webiny/di").Abstraction<ICreateRole>;
+export declare namespace CreateRoleUseCase {
+    type Interface = ICreateRole;
+    type Error = CreateRoleError;
+}
+export interface RoleBeforeCreatePayload {
+    role: Role;
+    input: CreateRoleInput;
+}
+export interface RoleAfterCreatePayload {
+    role: Role;
+    input: CreateRoleInput;
+}
+export {};

package/features/security/roles/CreateRole/abstractions.js

@@ -0,0 +1,5 @@
+import { createAbstraction } from "@webiny/feature/api";
+const CreateRoleUseCase = createAbstraction("CreateRoleUseCase");
+export { CreateRoleUseCase };
+
+//# sourceMappingURL=abstractions.js.map

package/features/security/roles/CreateRole/abstractions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/roles/CreateRole/abstractions.js","sources":["../../../../../src/features/security/roles/CreateRole/abstractions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport { Result } from \"@webiny/feature/api\";\nimport type { Role, CreateRoleInput } from \"../shared/types.js\";\nimport { RolesRepository } from \"../shared/abstractions.js\";\nimport { NotAuthorizedError, RoleExistsError, RoleValidationError } from \"../shared/errors.js\";\n\nexport interface ICreateRoleErrors {\n    notAuthorized: NotAuthorizedError;\n    roleExists: RoleExistsError;\n    validation: RoleValidationError;\n}\n\ntype CreateRoleError = ICreateRoleErrors[keyof ICreateRoleErrors] | RolesRepository.Error;\n\nexport interface ICreateRole {\n    execute(input: CreateRoleInput): Promise<Result<Role, CreateRoleError>>;\n}\n\n/** Create a new security role. */\nexport const CreateRoleUseCase = createAbstraction<ICreateRole>(\"CreateRoleUseCase\");\n\nexport namespace CreateRoleUseCase {\n    export type Interface = ICreateRole;\n    export type Error = CreateRoleError;\n}\n\nexport interface RoleBeforeCreatePayload {\n    role: Role;\n    input: CreateRoleInput;\n}\n\nexport interface RoleAfterCreatePayload {\n    role: Role;\n    input: CreateRoleInput;\n}\n"],"names":["CreateRoleUseCase","createAbstraction"],"mappings":";AAmBO,MAAMA,oBAAoBC,kBAA+B"}

package/features/security/roles/CreateRole/events.d.ts

@@ -0,0 +1,23 @@
+import { DomainEvent } from "../../../../features/eventPublisher/index.js";
+import type { IEventHandler } from "../../../../features/eventPublisher/index.js";
+import type { RoleBeforeCreatePayload, RoleAfterCreatePayload } from "./abstractions.js";
+export declare class RoleBeforeCreateEvent extends DomainEvent<RoleBeforeCreatePayload> {
+    eventType: "role.beforeCreate";
+    getHandlerAbstraction(): import("@webiny/di").Abstraction<IEventHandler<RoleBeforeCreateEvent>>;
+}
+/** Hook into role lifecycle before a role is created. */
+export declare const RoleBeforeCreateEventHandler: import("@webiny/di").Abstraction<IEventHandler<RoleBeforeCreateEvent>>;
+export declare namespace RoleBeforeCreateEventHandler {
+    type Interface = IEventHandler<RoleBeforeCreateEvent>;
+    type Event = RoleBeforeCreateEvent;
+}
+export declare class RoleAfterCreateEvent extends DomainEvent<RoleAfterCreatePayload> {
+    eventType: "role.afterCreate";
+    getHandlerAbstraction(): import("@webiny/di").Abstraction<IEventHandler<RoleAfterCreateEvent>>;
+}
+/** Hook into role lifecycle after a role is created. */
+export declare const RoleAfterCreateEventHandler: import("@webiny/di").Abstraction<IEventHandler<RoleAfterCreateEvent>>;
+export declare namespace RoleAfterCreateEventHandler {
+    type Interface = IEventHandler<RoleAfterCreateEvent>;
+    type Event = RoleAfterCreateEvent;
+}

package/features/security/roles/CreateRole/events.js

@@ -0,0 +1,23 @@
+import { createAbstraction } from "@webiny/feature/api";
+import { DomainEvent } from "../../../eventPublisher/index.js";
+class RoleBeforeCreateEvent extends DomainEvent {
+    getHandlerAbstraction() {
+        return RoleBeforeCreateEventHandler;
+    }
+    constructor(...args){
+        super(...args), this.eventType = "role.beforeCreate";
+    }
+}
+const RoleBeforeCreateEventHandler = createAbstraction("RoleBeforeCreateEventHandler");
+class RoleAfterCreateEvent extends DomainEvent {
+    getHandlerAbstraction() {
+        return RoleAfterCreateEventHandler;
+    }
+    constructor(...args){
+        super(...args), this.eventType = "role.afterCreate";
+    }
+}
+const RoleAfterCreateEventHandler = createAbstraction("RoleAfterCreateEventHandler");
+export { RoleAfterCreateEvent, RoleAfterCreateEventHandler, RoleBeforeCreateEvent, RoleBeforeCreateEventHandler };
+
+//# sourceMappingURL=events.js.map

package/features/security/roles/CreateRole/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/roles/CreateRole/events.js","sources":["../../../../../src/features/security/roles/CreateRole/events.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport { DomainEvent } from \"~/features/eventPublisher/index.js\";\nimport type { IEventHandler } from \"~/features/eventPublisher/index.js\";\nimport type { RoleBeforeCreatePayload, RoleAfterCreatePayload } from \"./abstractions.js\";\n\nexport class RoleBeforeCreateEvent extends DomainEvent<RoleBeforeCreatePayload> {\n    eventType = \"role.beforeCreate\" as const;\n\n    getHandlerAbstraction() {\n        return RoleBeforeCreateEventHandler;\n    }\n}\n\n/** Hook into role lifecycle before a role is created. */\nexport const RoleBeforeCreateEventHandler = createAbstraction<IEventHandler<RoleBeforeCreateEvent>>(\n    \"RoleBeforeCreateEventHandler\"\n);\n\nexport namespace RoleBeforeCreateEventHandler {\n    export type Interface = IEventHandler<RoleBeforeCreateEvent>;\n    export type Event = RoleBeforeCreateEvent;\n}\n\nexport class RoleAfterCreateEvent extends DomainEvent<RoleAfterCreatePayload> {\n    eventType = \"role.afterCreate\" as const;\n\n    getHandlerAbstraction() {\n        return RoleAfterCreateEventHandler;\n    }\n}\n\n/** Hook into role lifecycle after a role is created. */\nexport const RoleAfterCreateEventHandler = createAbstraction<IEventHandler<RoleAfterCreateEvent>>(\n    \"RoleAfterCreateEventHandler\"\n);\n\nexport namespace RoleAfterCreateEventHandler {\n    export type Interface = IEventHandler<RoleAfterCreateEvent>;\n    export type Event = RoleAfterCreateEvent;\n}\n"],"names":["RoleBeforeCreateEvent","DomainEvent","RoleBeforeCreateEventHandler","createAbstraction","RoleAfterCreateEvent","RoleAfterCreateEventHandler"],"mappings":";;AAKO,MAAMA,8BAA8BC;IAGvC,wBAAwB;QACpB,OAAOC;IACX;;QALG,qBACH,SAAS,GAAG;;AAKhB;AAGO,MAAMA,+BAA+BC,kBACxC;AAQG,MAAMC,6BAA6BH;IAGtC,wBAAwB;QACpB,OAAOI;IACX;;QALG,qBACH,SAAS,GAAG;;AAKhB;AAGO,MAAMA,8BAA8BF,kBACvC"}

package/features/security/roles/CreateRole/feature.d.ts

@@ -0,0 +1,4 @@
+export declare const CreateRoleFeature: {
+    name: string;
+    register(container: import("@webiny/di").Container): void;
+};

package/features/security/roles/CreateRole/feature.js

@@ -0,0 +1,11 @@
+import { createFeature } from "@webiny/feature/api";
+import { CreateRoleUseCase } from "./CreateRoleUseCase.js";
+const CreateRoleFeature = createFeature({
+    name: "CreateRole",
+    register (container) {
+        container.register(CreateRoleUseCase);
+    }
+});
+export { CreateRoleFeature };
+
+//# sourceMappingURL=feature.js.map

package/features/security/roles/CreateRole/feature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/roles/CreateRole/feature.js","sources":["../../../../../src/features/security/roles/CreateRole/feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { CreateRoleUseCase } from \"./CreateRoleUseCase.js\";\n\nexport const CreateRoleFeature = createFeature({\n    name: \"CreateRole\",\n    register(container) {\n        container.register(CreateRoleUseCase);\n    }\n});\n"],"names":["CreateRoleFeature","createFeature","container","CreateRoleUseCase"],"mappings":";;AAGO,MAAMA,oBAAoBC,cAAc;IAC3C,MAAM;IACN,UAASC,SAAS;QACdA,UAAU,QAAQ,CAACC;IACvB;AACJ"}

package/features/security/roles/CreateRole/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./abstractions.js";
+export * from "./events.js";

package/features/security/roles/CreateRole/index.js

@@ -0,0 +1,2 @@
+export * from "./abstractions.js";
+export * from "./events.js";

package/features/security/roles/CreateRole/schema.d.ts

@@ -0,0 +1,9 @@
+import { z } from "zod";
+export declare const createRoleValidation: z.ZodObject<{
+    name: z.ZodString;
+    slug: z.ZodString;
+    description: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    permissions: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+    }, z.core.$loose>>;
+}, z.core.$strip>;

package/features/security/roles/CreateRole/schema.js

@@ -0,0 +1,12 @@
+import { z } from "zod";
+const createRoleValidation = z.object({
+    name: z.string().min(3),
+    slug: z.string().min(3),
+    description: z.string().max(500).optional().default(""),
+    permissions: z.array(z.looseObject({
+        name: z.string()
+    }))
+});
+export { createRoleValidation };
+
+//# sourceMappingURL=schema.js.map

package/features/security/roles/CreateRole/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/roles/CreateRole/schema.js","sources":["../../../../../src/features/security/roles/CreateRole/schema.ts"],"sourcesContent":["import { z } from \"zod\";\n\nexport const createRoleValidation = z.object({\n    name: z.string().min(3),\n    slug: z.string().min(3),\n    description: z.string().max(500).optional().default(\"\"),\n    permissions: z.array(z.looseObject({ name: z.string() }))\n});\n"],"names":["createRoleValidation","z"],"mappings":";AAEO,MAAMA,uBAAuBC,EAAE,MAAM,CAAC;IACzC,MAAMA,EAAE,MAAM,GAAG,GAAG,CAAC;IACrB,MAAMA,EAAE,MAAM,GAAG,GAAG,CAAC;IACrB,aAAaA,EAAE,MAAM,GAAG,GAAG,CAAC,KAAK,QAAQ,GAAG,OAAO,CAAC;IACpD,aAAaA,EAAE,KAAK,CAACA,EAAE,WAAW,CAAC;QAAE,MAAMA,EAAE,MAAM;IAAG;AAC1D"}