@webiny/api-core 0.0.0-unstable.0d717d18dd

package/features/security/IdentityContext/Identity.d.ts

@@ -0,0 +1,79 @@
+import type { SecurityPermission } from "../../../types/security.js";
+export declare namespace Identity {
+    type Profile = IdentityProfile;
+}
+export interface IdentityContext {
+    /**
+     * Which tenant is the home tenant for this identity?
+     * If omitted, it will default to `root`.
+     */
+    defaultTenantId?: string;
+    /**
+     * Can this identity access the current tenant?
+     * If omitted, it will default to `true`.
+     */
+    canAccessTenant?: boolean;
+    /**
+     * Any other custom context data.
+     */
+    [key: string]: any;
+}
+interface IdentityProfileContext {
+    canAccessTenant?: boolean;
+    defaultTenantId?: string;
+    [key: string]: any;
+}
+export type IdentityData = {
+    id: string;
+    displayName: string;
+    type: string;
+    roles?: string[];
+    teams?: string[];
+    permissions?: SecurityPermission[];
+    profile?: IdentityProfileData;
+    context?: IdentityProfileContext;
+};
+/**
+ * Abstract base class for all identity types.
+ * Provides a common interface for identity checks across the codebase.
+ */
+export declare abstract class Identity {
+    private readonly data;
+    readonly profile: IdentityProfile;
+    readonly context: IdentityContext;
+    constructor(identityData: IdentityData);
+    get id(): string;
+    get displayName(): string;
+    get type(): string;
+    get permissions(): SecurityPermission[];
+    get roles(): string[];
+    get teams(): string[];
+    /**
+     * Check if this identity represents an anonymous (unauthenticated) user.
+     */
+    abstract isAnonymous(): boolean;
+    isAdmin(): boolean;
+    toJson(): Required<Omit<IdentityData, "context">>;
+}
+interface IdentityProfileData {
+    firstName?: string;
+    lastName?: string;
+    email?: string;
+    external?: boolean;
+}
+declare class IdentityProfile {
+    private id;
+    private data;
+    constructor(id: string, data: Partial<IdentityProfileData>);
+    get firstName(): string;
+    get lastName(): string;
+    get email(): string;
+    get external(): boolean;
+    toJson(): {
+        firstName: string;
+        lastName: string;
+        email: string;
+        external: boolean;
+    };
+}
+export {};

package/features/security/IdentityContext/Identity.js

@@ -0,0 +1,68 @@
+class Identity {
+    constructor(identityData){
+        this.data = identityData;
+        this.profile = new IdentityProfile(this.id, identityData.profile || {});
+        this.context = identityData.context ?? {};
+    }
+    get id() {
+        return this.data.id;
+    }
+    get displayName() {
+        return this.data.displayName;
+    }
+    get type() {
+        return this.data.type;
+    }
+    get permissions() {
+        return this.data.permissions ?? [];
+    }
+    get roles() {
+        return this.data.roles ?? [];
+    }
+    get teams() {
+        return this.data.teams ?? [];
+    }
+    isAdmin() {
+        return "admin" === this.type;
+    }
+    toJson() {
+        return {
+            id: this.id,
+            displayName: this.displayName,
+            type: this.type,
+            roles: this.roles,
+            teams: this.teams,
+            permissions: this.permissions,
+            profile: this.profile.toJson()
+        };
+    }
+}
+class IdentityProfile {
+    constructor(id, data){
+        this.id = id;
+        this.data = data;
+    }
+    get firstName() {
+        return this.data.firstName ?? "";
+    }
+    get lastName() {
+        return this.data.lastName ?? "";
+    }
+    get email() {
+        return this.data.email ?? `id:${this.id}`;
+    }
+    get external() {
+        return this.data.external ?? false;
+    }
+    toJson() {
+        return {
+            firstName: this.firstName,
+            lastName: this.lastName,
+            email: this.email,
+            external: this.external
+        };
+    }
+}
+export { Identity };
+
+//# sourceMappingURL=Identity.js.map

package/features/security/IdentityContext/Identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/IdentityContext/Identity.js","sources":["../../../../src/features/security/IdentityContext/Identity.ts"],"sourcesContent":["import type { SecurityPermission } from \"~/types/security.js\";\n\nexport namespace Identity {\n    export type Profile = IdentityProfile;\n}\n\nexport interface IdentityContext {\n    /**\n     * Which tenant is the home tenant for this identity?\n     * If omitted, it will default to `root`.\n     */\n    defaultTenantId?: string;\n    /**\n     * Can this identity access the current tenant?\n     * If omitted, it will default to `true`.\n     */\n    canAccessTenant?: boolean;\n    /**\n     * Any other custom context data.\n     */\n    [key: string]: any;\n}\n\ninterface IdentityProfileContext {\n    canAccessTenant?: boolean;\n    defaultTenantId?: string;\n    [key: string]: any;\n}\n\nexport type IdentityData = {\n    id: string;\n    displayName: string;\n    type: string;\n    roles?: string[];\n    teams?: string[];\n    permissions?: SecurityPermission[];\n    profile?: IdentityProfileData;\n    context?: IdentityProfileContext;\n};\n\n/**\n * Abstract base class for all identity types.\n * Provides a common interface for identity checks across the codebase.\n */\nexport abstract class Identity {\n    private readonly data: IdentityData;\n    public readonly profile: IdentityProfile;\n    public readonly context: IdentityContext;\n\n    constructor(identityData: IdentityData) {\n        this.data = identityData;\n        this.profile = new IdentityProfile(this.id, identityData.profile || {});\n        this.context = identityData.context ?? {};\n    }\n\n    get id() {\n        return this.data.id;\n    }\n\n    get displayName() {\n        return this.data.displayName;\n    }\n    get type() {\n        return this.data.type;\n    }\n\n    get permissions(): SecurityPermission[] {\n        return this.data.permissions ?? [];\n    }\n\n    get roles(): string[] {\n        return this.data.roles ?? [];\n    }\n\n    get teams(): string[] {\n        return this.data.teams ?? [];\n    }\n\n    /**\n     * Check if this identity represents an anonymous (unauthenticated) user.\n     */\n    abstract isAnonymous(): boolean;\n\n    isAdmin(): boolean {\n        return this.type === \"admin\";\n    }\n\n    toJson(): Required<Omit<IdentityData, \"context\">> {\n        return {\n            id: this.id,\n            displayName: this.displayName,\n            type: this.type,\n            roles: this.roles,\n            teams: this.teams,\n            permissions: this.permissions,\n            profile: this.profile.toJson()\n        };\n    }\n}\n\ninterface IdentityProfileData {\n    firstName?: string;\n    lastName?: string;\n    email?: string;\n    external?: boolean;\n}\n\nclass IdentityProfile {\n    constructor(\n        private id: string,\n        private data: Partial<IdentityProfileData>\n    ) {}\n\n    get firstName(): string {\n        return this.data.firstName ?? \"\";\n    }\n\n    get lastName(): string {\n        return this.data.lastName ?? \"\";\n    }\n\n    get email(): string {\n        return this.data.email ?? `id:${this.id}`;\n    }\n\n    get external(): boolean {\n        return this.data.external ?? false;\n    }\n\n    toJson() {\n        return {\n            firstName: this.firstName,\n            lastName: this.lastName,\n            email: this.email,\n            external: this.external\n        };\n    }\n}\n"],"names":["Identity","identityData","IdentityProfile","id","data"],"mappings":"AA4CO,MAAeA;IAKlB,YAAYC,YAA0B,CAAE;QACpC,IAAI,CAAC,IAAI,GAAGA;QACZ,IAAI,CAAC,OAAO,GAAG,IAAIC,gBAAgB,IAAI,CAAC,EAAE,EAAED,aAAa,OAAO,IAAI,CAAC;QACrE,IAAI,CAAC,OAAO,GAAGA,aAAa,OAAO,IAAI,CAAC;IAC5C;IAEA,IAAI,KAAK;QACL,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE;IACvB;IAEA,IAAI,cAAc;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW;IAChC;IACA,IAAI,OAAO;QACP,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI;IACzB;IAEA,IAAI,cAAoC;QACpC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE;IACtC;IAEA,IAAI,QAAkB;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;IAChC;IAEA,IAAI,QAAkB;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;IAChC;IAOA,UAAmB;QACf,OAAO,AAAc,YAAd,IAAI,CAAC,IAAI;IACpB;IAEA,SAAkD;QAC9C,OAAO;YACH,IAAI,IAAI,CAAC,EAAE;YACX,aAAa,IAAI,CAAC,WAAW;YAC7B,MAAM,IAAI,CAAC,IAAI;YACf,OAAO,IAAI,CAAC,KAAK;YACjB,OAAO,IAAI,CAAC,KAAK;YACjB,aAAa,IAAI,CAAC,WAAW;YAC7B,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM;QAChC;IACJ;AACJ;AASA,MAAMC;IACF,YACYC,EAAU,EACVC,IAAkC,CAC5C;aAFUD,EAAE,GAAFA;aACAC,IAAI,GAAJA;IACT;IAEH,IAAI,YAAoB;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI;IAClC;IAEA,IAAI,WAAmB;QACnB,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI;IACjC;IAEA,IAAI,QAAgB;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE;IAC7C;IAEA,IAAI,WAAoB;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI;IACjC;IAEA,SAAS;QACL,OAAO;YACH,WAAW,IAAI,CAAC,SAAS;YACzB,UAAU,IAAI,CAAC,QAAQ;YACvB,OAAO,IAAI,CAAC,KAAK;YACjB,UAAU,IAAI,CAAC,QAAQ;QAC3B;IACJ;AACJ"}

package/features/security/IdentityContext/IdentityContext.d.ts

@@ -0,0 +1,23 @@
+import { IdentityContext as Abstraction } from "./abstractions.js";
+import { Identity } from "./Identity.js";
+import { AuthorizationContext } from "../authorization/AuthorizationContext/index.js";
+import type { SecurityPermission } from "../../../types/security.js";
+import { WcpContext } from "../../wcp/WcpContext/index.js";
+declare class IdentityContextImpl implements Abstraction.Interface {
+    private authorizationContext;
+    private wcpContext;
+    private identity;
+    constructor(authorizationContext: AuthorizationContext.Interface, wcpContext: WcpContext.Interface);
+    getIdentity(): Identity;
+    setIdentity(identity: Identity | undefined): void;
+    withIdentity<T>(identity: Identity | undefined, cb: () => Promise<T>): Promise<T>;
+    withoutAuthorization<T>(cb: () => Promise<T>): Promise<T>;
+    isAuthorizationEnabled(): boolean;
+    getPermission<TPermission extends SecurityPermission = SecurityPermission>(name: string): Promise<TPermission | null>;
+    getPermissions<TPermission extends SecurityPermission = SecurityPermission>(name: string): Promise<TPermission[]>;
+    listPermissions(): Promise<SecurityPermission[]>;
+    hasFullAccess(): Promise<boolean>;
+    private applyAaclLogic;
+}
+export declare const IdentityContext: import("@webiny/di").Implementation<typeof IdentityContextImpl>;
+export {};

package/features/security/IdentityContext/IdentityContext.js

@@ -0,0 +1,88 @@
+import { AsyncLocalStorage } from "async_hooks";
+import { minimatch } from "minimatch";
+import { createImplementation } from "@webiny/di";
+import { IdentityContext } from "./abstractions.js";
+import { AnonymousIdentity } from "./AnonymousIdentity.js";
+import { AuthorizationContext } from "../authorization/AuthorizationContext/index.js";
+import { filterOutCustomWbyAppsPermissions } from "../utils/filterOutCustomWbyAppsPermissions.js";
+import { WcpContext } from "../../wcp/WcpContext/index.js";
+const identityStorage = new AsyncLocalStorage();
+class IdentityContextImpl {
+    constructor(authorizationContext, wcpContext){
+        this.authorizationContext = authorizationContext;
+        this.wcpContext = wcpContext;
+        this.identity = new AnonymousIdentity();
+    }
+    getIdentity() {
+        const override = identityStorage.getStore();
+        if (void 0 !== override) return override;
+        return this.identity;
+    }
+    setIdentity(identity) {
+        this.identity = identity ?? new AnonymousIdentity();
+        this.authorizationContext.clearPermissionsCache();
+    }
+    withIdentity(identity, cb) {
+        return identityStorage.run(identity, cb);
+    }
+    withoutAuthorization(cb) {
+        return this.authorizationContext.withoutAuthorization(cb);
+    }
+    isAuthorizationEnabled() {
+        return this.authorizationContext.isAuthorizationEnabled();
+    }
+    async getPermission(name) {
+        if (!this.isAuthorizationEnabled()) return {
+            name: "*"
+        };
+        const permissions = await this.listPermissions();
+        const exactMatch = permissions.find((p)=>p.name === name);
+        if (exactMatch) return exactMatch;
+        const patternMatch = permissions.find((p)=>minimatch(name, p.name));
+        if (patternMatch) return patternMatch;
+        return null;
+    }
+    async getPermissions(name) {
+        if (!this.isAuthorizationEnabled()) return [
+            {
+                name: "*"
+            }
+        ];
+        const permissions = await this.listPermissions();
+        return permissions.filter((p)=>{
+            if (p.name === name) return true;
+            return minimatch(name, p.name);
+        });
+    }
+    async listPermissions() {
+        const permissions = await this.authorizationContext.loadPermissions(this.getIdentity());
+        return this.applyAaclLogic(permissions);
+    }
+    async hasFullAccess() {
+        const permissions = await this.listPermissions();
+        return permissions.some((p)=>"*" === p.name);
+    }
+    applyAaclLogic(permissions) {
+        const aaclEnabled = this.wcpContext.canUseAacl();
+        const teamsEnabled = this.wcpContext.canUseTeams();
+        if (aaclEnabled) return [
+            ...permissions,
+            {
+                name: "aacl",
+                teams: teamsEnabled
+            }
+        ];
+        return filterOutCustomWbyAppsPermissions(permissions);
+    }
+}
+const IdentityContext_IdentityContext = createImplementation({
+    abstraction: IdentityContext,
+    implementation: IdentityContextImpl,
+    dependencies: [
+        AuthorizationContext,
+        WcpContext
+    ]
+});
+export { IdentityContext_IdentityContext as IdentityContext };
+
+//# sourceMappingURL=IdentityContext.js.map

package/features/security/IdentityContext/IdentityContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/IdentityContext/IdentityContext.js","sources":["../../../../src/features/security/IdentityContext/IdentityContext.ts"],"sourcesContent":["import { AsyncLocalStorage } from \"async_hooks\";\nimport { minimatch } from \"minimatch\";\nimport { createImplementation } from \"@webiny/di\";\nimport { IdentityContext as Abstraction } from \"./abstractions.js\";\nimport { Identity } from \"./Identity.js\";\nimport { AnonymousIdentity } from \"./AnonymousIdentity.js\";\nimport { AuthorizationContext } from \"../authorization/AuthorizationContext/index.js\";\nimport { filterOutCustomWbyAppsPermissions } from \"../utils/filterOutCustomWbyAppsPermissions.js\";\nimport type { SecurityPermission } from \"~/types/security.js\";\nimport type { AaclPermission } from \"../../wcp/WcpContext/types.js\";\nimport { WcpContext } from \"../../wcp/WcpContext/index.js\";\n\nconst identityStorage = new AsyncLocalStorage<Identity | undefined>();\n\nclass IdentityContextImpl implements Abstraction.Interface {\n    private identity: Identity = new AnonymousIdentity();\n\n    constructor(\n        private authorizationContext: AuthorizationContext.Interface,\n        private wcpContext: WcpContext.Interface\n    ) {}\n\n    // ========================================================================\n    // Identity Methods\n    // ========================================================================\n\n    getIdentity(): Identity {\n        // Check for identity override first (from withIdentity())\n        const override = identityStorage.getStore();\n        if (override !== undefined) {\n            return override;\n        }\n        return this.identity;\n    }\n\n    setIdentity(identity: Identity | undefined): void {\n        // If undefined, set to anonymous identity\n        this.identity = identity ?? new AnonymousIdentity();\n\n        // Clear permissions cache when identity changes\n        this.authorizationContext.clearPermissionsCache();\n    }\n\n    withIdentity<T>(identity: Identity | undefined, cb: () => Promise<T>): Promise<T> {\n        return identityStorage.run(identity, cb);\n    }\n\n    // ========================================================================\n    // Authorization State Methods\n    // ========================================================================\n\n    withoutAuthorization<T>(cb: () => Promise<T>): Promise<T> {\n        return this.authorizationContext.withoutAuthorization(cb);\n    }\n\n    isAuthorizationEnabled(): boolean {\n        return this.authorizationContext.isAuthorizationEnabled();\n    }\n\n    // ========================================================================\n    // Permission Methods\n    // ========================================================================\n\n    async getPermission<TPermission extends SecurityPermission = SecurityPermission>(\n        name: string\n    ): Promise<TPermission | null> {\n        if (!this.isAuthorizationEnabled()) {\n            return { name: \"*\" } as TPermission;\n        }\n\n        const permissions = await this.listPermissions();\n\n        // Try exact match first\n        const exactMatch = permissions.find(p => p.name === name);\n        if (exactMatch) {\n            return exactMatch as TPermission;\n        }\n\n        // Try pattern matching\n        const patternMatch = permissions.find(p => minimatch(name, p.name));\n        if (patternMatch) {\n            return patternMatch as TPermission;\n        }\n\n        return null;\n    }\n\n    async getPermissions<TPermission extends SecurityPermission = SecurityPermission>(\n        name: string\n    ): Promise<TPermission[]> {\n        if (!this.isAuthorizationEnabled()) {\n            return [{ name: \"*\" }] as TPermission[];\n        }\n\n        const permissions = await this.listPermissions();\n\n        return permissions.filter(p => {\n            if (p.name === name) {\n                return true;\n            }\n            return minimatch(name, p.name);\n        }) as TPermission[];\n    }\n\n    async listPermissions(): Promise<SecurityPermission[]> {\n        const permissions = await this.authorizationContext.loadPermissions(this.getIdentity());\n        // TODO: extract this into a decorator\n        return this.applyAaclLogic(permissions);\n    }\n\n    async hasFullAccess(): Promise<boolean> {\n        const permissions = await this.listPermissions();\n        return permissions.some(p => p.name === \"*\");\n    }\n\n    // ========================================================================\n    // Private Helper Methods\n    // ========================================================================\n\n    private applyAaclLogic(permissions: SecurityPermission[]): SecurityPermission[] {\n        const aaclEnabled = this.wcpContext.canUseAacl();\n        const teamsEnabled = this.wcpContext.canUseTeams();\n\n        if (aaclEnabled) {\n            // Add AACL metadata permission\n            return [\n                ...permissions,\n                {\n                    name: \"aacl\",\n                    teams: teamsEnabled\n                } as AaclPermission\n            ];\n        }\n\n        // If AACL is not enabled, filter out custom Webiny apps permissions\n        return filterOutCustomWbyAppsPermissions(permissions);\n    }\n}\n\nexport const IdentityContext = createImplementation({\n    abstraction: Abstraction,\n    implementation: IdentityContextImpl,\n    dependencies: [AuthorizationContext, WcpContext]\n});\n"],"names":["identityStorage","AsyncLocalStorage","IdentityContextImpl","authorizationContext","wcpContext","AnonymousIdentity","override","undefined","identity","cb","name","permissions","exactMatch","p","patternMatch","minimatch","aaclEnabled","teamsEnabled","filterOutCustomWbyAppsPermissions","IdentityContext","createImplementation","Abstraction","AuthorizationContext","WcpContext"],"mappings":";;;;;;;;AAYA,MAAMA,kBAAkB,IAAIC;AAE5B,MAAMC;IAGF,YACYC,oBAAoD,EACpDC,UAAgC,CAC1C;aAFUD,oBAAoB,GAApBA;aACAC,UAAU,GAAVA;aAJJ,QAAQ,GAAa,IAAIC;IAK9B;IAMH,cAAwB;QAEpB,MAAMC,WAAWN,gBAAgB,QAAQ;QACzC,IAAIM,AAAaC,WAAbD,UACA,OAAOA;QAEX,OAAO,IAAI,CAAC,QAAQ;IACxB;IAEA,YAAYE,QAA8B,EAAQ;QAE9C,IAAI,CAAC,QAAQ,GAAGA,YAAY,IAAIH;QAGhC,IAAI,CAAC,oBAAoB,CAAC,qBAAqB;IACnD;IAEA,aAAgBG,QAA8B,EAAEC,EAAoB,EAAc;QAC9E,OAAOT,gBAAgB,GAAG,CAACQ,UAAUC;IACzC;IAMA,qBAAwBA,EAAoB,EAAc;QACtD,OAAO,IAAI,CAAC,oBAAoB,CAAC,oBAAoB,CAACA;IAC1D;IAEA,yBAAkC;QAC9B,OAAO,IAAI,CAAC,oBAAoB,CAAC,sBAAsB;IAC3D;IAMA,MAAM,cACFC,IAAY,EACe;QAC3B,IAAI,CAAC,IAAI,CAAC,sBAAsB,IAC5B,OAAO;YAAE,MAAM;QAAI;QAGvB,MAAMC,cAAc,MAAM,IAAI,CAAC,eAAe;QAG9C,MAAMC,aAAaD,YAAY,IAAI,CAACE,CAAAA,IAAKA,EAAE,IAAI,KAAKH;QACpD,IAAIE,YACA,OAAOA;QAIX,MAAME,eAAeH,YAAY,IAAI,CAACE,CAAAA,IAAKE,UAAUL,MAAMG,EAAE,IAAI;QACjE,IAAIC,cACA,OAAOA;QAGX,OAAO;IACX;IAEA,MAAM,eACFJ,IAAY,EACU;QACtB,IAAI,CAAC,IAAI,CAAC,sBAAsB,IAC5B,OAAO;YAAC;gBAAE,MAAM;YAAI;SAAE;QAG1B,MAAMC,cAAc,MAAM,IAAI,CAAC,eAAe;QAE9C,OAAOA,YAAY,MAAM,CAACE,CAAAA;YACtB,IAAIA,EAAE,IAAI,KAAKH,MACX,OAAO;YAEX,OAAOK,UAAUL,MAAMG,EAAE,IAAI;QACjC;IACJ;IAEA,MAAM,kBAAiD;QACnD,MAAMF,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW;QAEpF,OAAO,IAAI,CAAC,cAAc,CAACA;IAC/B;IAEA,MAAM,gBAAkC;QACpC,MAAMA,cAAc,MAAM,IAAI,CAAC,eAAe;QAC9C,OAAOA,YAAY,IAAI,CAACE,CAAAA,IAAKA,AAAW,QAAXA,EAAE,IAAI;IACvC;IAMQ,eAAeF,WAAiC,EAAwB;QAC5E,MAAMK,cAAc,IAAI,CAAC,UAAU,CAAC,UAAU;QAC9C,MAAMC,eAAe,IAAI,CAAC,UAAU,CAAC,WAAW;QAEhD,IAAID,aAEA,OAAO;eACAL;YACH;gBACI,MAAM;gBACN,OAAOM;YACX;SACH;QAIL,OAAOC,kCAAkCP;IAC7C;AACJ;AAEO,MAAMQ,kCAAkBC,qBAAqB;IAChD,aAAaC;IACb,gBAAgBnB;IAChB,cAAc;QAACoB;QAAsBC;KAAW;AACpD"}

package/features/security/IdentityContext/abstractions.d.ts

@@ -0,0 +1,18 @@
+import type { Identity } from "./Identity.js";
+import type { SecurityPermission } from "../../../types/security.js";
+export interface IIdentityContext {
+    getIdentity(): Identity;
+    setIdentity(identity: Identity | undefined): void;
+    withIdentity<T>(identity: Identity | undefined, cb: () => Promise<T>): Promise<T>;
+    getPermission<TPermission extends SecurityPermission = SecurityPermission>(name: string): Promise<TPermission | null>;
+    getPermissions<TPermission extends SecurityPermission = SecurityPermission>(name: string): Promise<TPermission[]>;
+    listPermissions(): Promise<SecurityPermission[]>;
+    hasFullAccess(): Promise<boolean>;
+    withoutAuthorization<T>(cb: () => Promise<T>): Promise<T>;
+    isAuthorizationEnabled(): boolean;
+}
+/** Provides access to the current identity and its permissions. */
+export declare const IdentityContext: import("@webiny/di").Abstraction<IIdentityContext>;
+export declare namespace IdentityContext {
+    type Interface = IIdentityContext;
+}

package/features/security/IdentityContext/abstractions.js

@@ -0,0 +1,5 @@
+import { createAbstraction } from "@webiny/feature/api";
+const IdentityContext = createAbstraction("IdentityContext");
+export { IdentityContext };
+
+//# sourceMappingURL=abstractions.js.map

package/features/security/IdentityContext/abstractions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/IdentityContext/abstractions.js","sources":["../../../../src/features/security/IdentityContext/abstractions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport type { Identity } from \"./Identity.js\";\nimport type { SecurityPermission } from \"~/types/security.js\";\n\nexport interface IIdentityContext {\n    // Identity methods\n    getIdentity(): Identity;\n    setIdentity(identity: Identity | undefined): void;\n    withIdentity<T>(identity: Identity | undefined, cb: () => Promise<T>): Promise<T>;\n\n    // Permission methods\n    getPermission<TPermission extends SecurityPermission = SecurityPermission>(\n        name: string\n    ): Promise<TPermission | null>;\n\n    getPermissions<TPermission extends SecurityPermission = SecurityPermission>(\n        name: string\n    ): Promise<TPermission[]>;\n\n    listPermissions(): Promise<SecurityPermission[]>;\n\n    hasFullAccess(): Promise<boolean>;\n\n    // Authorization context methods\n    withoutAuthorization<T>(cb: () => Promise<T>): Promise<T>;\n    isAuthorizationEnabled(): boolean;\n}\n\n/** Provides access to the current identity and its permissions. */\nexport const IdentityContext = createAbstraction<IIdentityContext>(\"IdentityContext\");\n\nexport namespace IdentityContext {\n    export type Interface = IIdentityContext;\n}\n"],"names":["IdentityContext","createAbstraction"],"mappings":";AA6BO,MAAMA,kBAAkBC,kBAAoC"}

package/features/security/IdentityContext/feature.d.ts

@@ -0,0 +1,4 @@
+export declare const IdentityContextFeature: {
+    name: string;
+    register(container: import("@webiny/di").Container): void;
+};

package/features/security/IdentityContext/feature.js

@@ -0,0 +1,11 @@
+import { createFeature } from "@webiny/feature/api";
+import { IdentityContext } from "./IdentityContext.js";
+const IdentityContextFeature = createFeature({
+    name: "IdentityContext",
+    register (container) {
+        container.register(IdentityContext).inSingletonScope();
+    }
+});
+export { IdentityContextFeature };
+
+//# sourceMappingURL=feature.js.map

package/features/security/IdentityContext/feature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/IdentityContext/feature.js","sources":["../../../../src/features/security/IdentityContext/feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { IdentityContext } from \"./IdentityContext.js\";\n\nexport const IdentityContextFeature = createFeature({\n    name: \"IdentityContext\",\n    register(container) {\n        container.register(IdentityContext).inSingletonScope();\n    }\n});\n"],"names":["IdentityContextFeature","createFeature","container","IdentityContext"],"mappings":";;AAGO,MAAMA,yBAAyBC,cAAc;IAChD,MAAM;IACN,UAASC,SAAS;QACdA,UAAU,QAAQ,CAACC,iBAAiB,gBAAgB;IACxD;AACJ"}

package/features/security/IdentityContext/index.d.ts

@@ -0,0 +1,6 @@
+export { IdentityContextFeature } from "./feature.js";
+export { IdentityContext } from "./abstractions.js";
+export type { IIdentityContext } from "./abstractions.js";
+export { Identity, type IdentityData } from "./Identity.js";
+export { AuthenticatedIdentity } from "./AuthenticatedIdentity.js";
+export { AnonymousIdentity } from "./AnonymousIdentity.js";

package/features/security/IdentityContext/index.js

@@ -0,0 +1,5 @@
+export { IdentityContextFeature } from "./feature.js";
+export { IdentityContext } from "./abstractions.js";
+export { Identity } from "./Identity.js";
+export { AuthenticatedIdentity } from "./AuthenticatedIdentity.js";
+export { AnonymousIdentity } from "./AnonymousIdentity.js";

package/features/security/SecurityFeature.d.ts

@@ -0,0 +1,13 @@
+import type { Container } from "@webiny/di";
+import type { SecurityStorageOperations as ISecurityStorageOperations } from "../../types/security.js";
+/**
+ * Setup all security features in the DI container.
+ * This is the main entry point for registering all security-related features.
+ *
+ * @param container - DI container instance
+ * @param storageOperations - Storage operations implementation
+ */
+export declare const SecurityFeature: {
+    name: string;
+    register(container: Container, context: ISecurityStorageOperations): void;
+};

package/features/security/SecurityFeature.js

@@ -0,0 +1,25 @@
+import { createFeature } from "@webiny/feature/api";
+import { SecurityStorageOperations } from "./shared/abstractions.js";
+import { AuthenticationContextFeature } from "./authentication/AuthenticationContext/index.js";
+import { AuthorizationContextFeature } from "./authorization/AuthorizationContext/index.js";
+import { GroupsTeamsAuthorizerFeature } from "./authorization/GroupsTeamsAuthorizer/feature.js";
+import { IdentityContextFeature } from "./IdentityContext/index.js";
+import { ApiKeysFeature } from "./apiKeys/feature.js";
+import { TeamsFeature } from "./teams/feature.js";
+import { RolesFeature } from "./roles/feature.js";
+const SecurityFeature = createFeature({
+    name: "SecurityFeature",
+    register (container, storageOperations) {
+        container.registerInstance(SecurityStorageOperations, storageOperations);
+        AuthorizationContextFeature.register(container);
+        AuthenticationContextFeature.register(container);
+        IdentityContextFeature.register(container);
+        ApiKeysFeature.register(container);
+        RolesFeature.register(container);
+        TeamsFeature.register(container);
+        GroupsTeamsAuthorizerFeature.register(container);
+    }
+});
+export { SecurityFeature };
+
+//# sourceMappingURL=SecurityFeature.js.map

package/features/security/SecurityFeature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/SecurityFeature.js","sources":["../../../src/features/security/SecurityFeature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport type { Container } from \"@webiny/di\";\nimport type { SecurityStorageOperations as ISecurityStorageOperations } from \"~/types/security.js\";\nimport { SecurityStorageOperations } from \"./shared/abstractions.js\";\nimport { AuthenticationContextFeature } from \"./authentication/AuthenticationContext/index.js\";\nimport { AuthorizationContextFeature } from \"./authorization/AuthorizationContext/index.js\";\nimport { GroupsTeamsAuthorizerFeature } from \"./authorization/GroupsTeamsAuthorizer/feature.js\";\nimport { IdentityContextFeature } from \"./IdentityContext/index.js\";\nimport { ApiKeysFeature } from \"./apiKeys/feature.js\";\nimport { TeamsFeature } from \"./teams/feature.js\";\nimport { RolesFeature } from \"~/features/security/roles/feature.js\";\n\n/**\n * Setup all security features in the DI container.\n * This is the main entry point for registering all security-related features.\n *\n * @param container - DI container instance\n * @param storageOperations - Storage operations implementation\n */\nexport const SecurityFeature = createFeature({\n    name: \"SecurityFeature\",\n    register(container: Container, storageOperations: ISecurityStorageOperations) {\n        // Register storage operations abstraction (singleton)\n        container.registerInstance(SecurityStorageOperations, storageOperations);\n\n        AuthorizationContextFeature.register(container);\n        AuthenticationContextFeature.register(container);\n        IdentityContextFeature.register(container);\n        ApiKeysFeature.register(container);\n        RolesFeature.register(container);\n        TeamsFeature.register(container);\n        GroupsTeamsAuthorizerFeature.register(container);\n    }\n});\n"],"names":["SecurityFeature","createFeature","container","storageOperations","SecurityStorageOperations","AuthorizationContextFeature","AuthenticationContextFeature","IdentityContextFeature","ApiKeysFeature","RolesFeature","TeamsFeature","GroupsTeamsAuthorizerFeature"],"mappings":";;;;;;;;;AAmBO,MAAMA,kBAAkBC,cAAc;IACzC,MAAM;IACN,UAASC,SAAoB,EAAEC,iBAA6C;QAExED,UAAU,gBAAgB,CAACE,2BAA2BD;QAEtDE,4BAA4B,QAAQ,CAACH;QACrCI,6BAA6B,QAAQ,CAACJ;QACtCK,uBAAuB,QAAQ,CAACL;QAChCM,eAAe,QAAQ,CAACN;QACxBO,aAAa,QAAQ,CAACP;QACtBQ,aAAa,QAAQ,CAACR;QACtBS,6BAA6B,QAAQ,CAACT;IAC1C;AACJ"}

package/features/security/apiKeys/ApiKeyAuthenticator.d.ts

@@ -0,0 +1,14 @@
+import { Logger } from "../../../features/logger/index.js";
+import type { IAuthenticator } from "../../../features/security/authentication/Authenticator/abstractions.js";
+import type { IApiKeysRepository } from "./shared/abstractions.js";
+import type { IdentityData } from "../../../features/security/IdentityContext/Identity.js";
+declare class ApiKeyAuthenticatorImpl implements IAuthenticator {
+    private repository;
+    private logger;
+    constructor(repository: IApiKeysRepository, logger: Logger.Interface);
+    authenticate(token: string): Promise<IdentityData | null>;
+}
+export declare const ApiKeyAuthenticator: typeof ApiKeyAuthenticatorImpl & {
+    __abstraction: import("@webiny/di").Abstraction<IAuthenticator>;
+};
+export {};

package/features/security/apiKeys/ApiKeyAuthenticator.js

@@ -0,0 +1,36 @@
+import { Authenticator } from "../authentication/Authenticator/abstractions.js";
+import { ApiKeysRepository } from "./shared/abstractions.js";
+import { Logger } from "../../logger/index.js";
+class ApiKeyAuthenticatorImpl {
+    constructor(repository, logger){
+        this.repository = repository;
+        this.logger = logger;
+    }
+    async authenticate(token) {
+        if ("string" != typeof token || !token.startsWith("wat_")) return null;
+        const result = await this.repository.getByToken(token);
+        if (!result.isOk()) {
+            this.logger.warn({
+                error: result.error
+            }, "API key authentication failed; request will proceed as anonymous.");
+            return null;
+        }
+        const apiKey = result.value;
+        return {
+            id: apiKey.id,
+            displayName: apiKey.name,
+            type: "api-key",
+            permissions: apiKey.permissions
+        };
+    }
+}
+const ApiKeyAuthenticator = Authenticator.createImplementation({
+    implementation: ApiKeyAuthenticatorImpl,
+    dependencies: [
+        ApiKeysRepository,
+        Logger
+    ]
+});
+export { ApiKeyAuthenticator };
+
+//# sourceMappingURL=ApiKeyAuthenticator.js.map

package/features/security/apiKeys/ApiKeyAuthenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/apiKeys/ApiKeyAuthenticator.js","sources":["../../../../src/features/security/apiKeys/ApiKeyAuthenticator.ts"],"sourcesContent":["import { Authenticator } from \"~/features/security/authentication/Authenticator/abstractions.js\";\nimport { ApiKeysRepository } from \"./shared/abstractions.js\";\nimport { Logger } from \"~/features/logger/index.js\";\nimport type { IAuthenticator } from \"~/features/security/authentication/Authenticator/abstractions.js\";\nimport type { IApiKeysRepository } from \"./shared/abstractions.js\";\nimport type { IdentityData } from \"~/features/security/IdentityContext/Identity.js\";\n\nclass ApiKeyAuthenticatorImpl implements IAuthenticator {\n    constructor(\n        private repository: IApiKeysRepository,\n        private logger: Logger.Interface\n    ) {}\n\n    async authenticate(token: string): Promise<IdentityData | null> {\n        if (typeof token !== \"string\" || !token.startsWith(\"wat_\")) {\n            return null;\n        }\n        const result = await this.repository.getByToken(token);\n        if (!result.isOk()) {\n            // The token looked like an API key (\"wat_\") but could not be resolved. Log it — otherwise\n            // this degrades silently to an anonymous request (which is what made the tenant-ordering\n            // bug so hard to find). A genuine unknown/revoked key logs here too, which is acceptable.\n            this.logger.warn(\n                { error: result.error },\n                \"API key authentication failed; request will proceed as anonymous.\"\n            );\n            return null;\n        }\n        const apiKey = result.value;\n        return {\n            id: apiKey.id,\n            displayName: apiKey.name,\n            type: \"api-key\",\n            permissions: apiKey.permissions\n        };\n    }\n}\n\nexport const ApiKeyAuthenticator = Authenticator.createImplementation({\n    implementation: ApiKeyAuthenticatorImpl,\n    dependencies: [ApiKeysRepository, Logger]\n});\n"],"names":["ApiKeyAuthenticatorImpl","repository","logger","token","result","apiKey","ApiKeyAuthenticator","Authenticator","ApiKeysRepository","Logger"],"mappings":";;;AAOA,MAAMA;IACF,YACYC,UAA8B,EAC9BC,MAAwB,CAClC;aAFUD,UAAU,GAAVA;aACAC,MAAM,GAANA;IACT;IAEH,MAAM,aAAaC,KAAa,EAAgC;QAC5D,IAAI,AAAiB,YAAjB,OAAOA,SAAsB,CAACA,MAAM,UAAU,CAAC,SAC/C,OAAO;QAEX,MAAMC,SAAS,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAACD;QAChD,IAAI,CAACC,OAAO,IAAI,IAAI;YAIhB,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ;gBAAE,OAAOA,OAAO,KAAK;YAAC,GACtB;YAEJ,OAAO;QACX;QACA,MAAMC,SAASD,OAAO,KAAK;QAC3B,OAAO;YACH,IAAIC,OAAO,EAAE;YACb,aAAaA,OAAO,IAAI;YACxB,MAAM;YACN,aAAaA,OAAO,WAAW;QACnC;IACJ;AACJ;AAEO,MAAMC,sBAAsBC,cAAc,oBAAoB,CAAC;IAClE,gBAAgBP;IAChB,cAAc;QAACQ;QAAmBC;KAAO;AAC7C"}

package/features/security/apiKeys/ApiKeyAuthorizer.d.ts

@@ -0,0 +1,10 @@
+import type { IAuthorizer } from "../../../features/security/authorization/Authorizer/abstractions.js";
+import type { Identity } from "../../../features/security/IdentityContext/Identity.js";
+import type { SecurityPermission } from "../../../types/security.js";
+declare class ApiKeyAuthorizerImpl implements IAuthorizer {
+    authorize(identity: Identity): Promise<SecurityPermission[] | null>;
+}
+export declare const ApiKeyAuthorizer: typeof ApiKeyAuthorizerImpl & {
+    __abstraction: import("@webiny/di").Abstraction<IAuthorizer>;
+};
+export {};

package/features/security/apiKeys/ApiKeyAuthorizer.js

@@ -0,0 +1,15 @@
+import { Authorizer } from "../authorization/Authorizer/abstractions.js";
+class ApiKeyAuthorizerImpl {
+    async authorize(identity) {
+        if (!identity || "api-key" !== identity.type) return null;
+        const permissions = identity.permissions;
+        return Array.isArray(permissions) ? permissions : [];
+    }
+}
+const ApiKeyAuthorizer = Authorizer.createImplementation({
+    implementation: ApiKeyAuthorizerImpl,
+    dependencies: []
+});
+export { ApiKeyAuthorizer };
+
+//# sourceMappingURL=ApiKeyAuthorizer.js.map

package/features/security/apiKeys/ApiKeyAuthorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/apiKeys/ApiKeyAuthorizer.js","sources":["../../../../src/features/security/apiKeys/ApiKeyAuthorizer.ts"],"sourcesContent":["import { Authorizer } from \"~/features/security/authorization/Authorizer/abstractions.js\";\nimport type { IAuthorizer } from \"~/features/security/authorization/Authorizer/abstractions.js\";\nimport type { Identity } from \"~/features/security/IdentityContext/Identity.js\";\nimport type { SecurityPermission } from \"~/types/security.js\";\n\nclass ApiKeyAuthorizerImpl implements IAuthorizer {\n    async authorize(identity: Identity): Promise<SecurityPermission[] | null> {\n        if (!identity || identity.type !== \"api-key\") {\n            return null;\n        }\n        const permissions = (identity as any).permissions;\n        return Array.isArray(permissions) ? (permissions as SecurityPermission[]) : [];\n    }\n}\n\nexport const ApiKeyAuthorizer = Authorizer.createImplementation({\n    implementation: ApiKeyAuthorizerImpl,\n    dependencies: []\n});\n"],"names":["ApiKeyAuthorizerImpl","identity","permissions","Array","ApiKeyAuthorizer","Authorizer"],"mappings":";AAKA,MAAMA;IACF,MAAM,UAAUC,QAAkB,EAAwC;QACtE,IAAI,CAACA,YAAYA,AAAkB,cAAlBA,SAAS,IAAI,EAC1B,OAAO;QAEX,MAAMC,cAAeD,SAAiB,WAAW;QACjD,OAAOE,MAAM,OAAO,CAACD,eAAgBA,cAAuC,EAAE;IAClF;AACJ;AAEO,MAAME,mBAAmBC,WAAW,oBAAoB,CAAC;IAC5D,gBAAgBL;IAChB,cAAc,EAAE;AACpB"}

package/features/security/apiKeys/CreateApiKey/CreateApiKeyUseCase.d.ts

@@ -0,0 +1,17 @@
+import { Result } from "@webiny/feature/api";
+import { EventPublisher } from "../../../../features/eventPublisher/index.js";
+import { CreateApiKeyUseCase as CreateApiKeyUseCaseAbstraction } from "./abstractions.js";
+import { ApiKeysRepository } from "../shared/abstractions.js";
+import { IdentityContext } from "../../IdentityContext/abstractions.js";
+import type { ApiKey, CreateApiKeyInput } from "../shared/types.js";
+declare class CreateApiKeyUseCaseImpl implements CreateApiKeyUseCaseAbstraction.Interface {
+    private identityContext;
+    private eventPublisher;
+    private repository;
+    constructor(identityContext: IdentityContext.Interface, eventPublisher: EventPublisher.Interface, repository: ApiKeysRepository.Interface);
+    execute(input: CreateApiKeyInput): Promise<Result<ApiKey, CreateApiKeyUseCaseAbstraction.Error>>;
+}
+export declare const CreateApiKeyUseCase: typeof CreateApiKeyUseCaseImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("./abstractions.js").ICreateApiKey>;
+};
+export {};

package/features/security/apiKeys/CreateApiKey/CreateApiKeyUseCase.js

@@ -0,0 +1,62 @@
+import { mdbid } from "@webiny/utils";
+import { Result } from "@webiny/feature/api";
+import { EventPublisher } from "../../../eventPublisher/index.js";
+import { CreateApiKeyUseCase } from "./abstractions.js";
+import { ApiKeysRepository } from "../shared/abstractions.js";
+import { IdentityContext } from "../../IdentityContext/abstractions.js";
+import { createApiKeyInputSchema } from "../shared/schemas.js";
+import { ApiKeyAfterCreateEvent, ApiKeyBeforeCreateEvent } from "./events.js";
+import { generateToken } from "../shared/generateToken.js";
+import { ApiKeyNotAuthorizedError, ApiKeyValidationError } from "../shared/errors.js";
+class CreateApiKeyUseCaseImpl {
+    constructor(identityContext, eventPublisher, repository){
+        this.identityContext = identityContext;
+        this.eventPublisher = eventPublisher;
+        this.repository = repository;
+    }
+    async execute(input) {
+        const hasPermission = await this.identityContext.getPermission("security.apiKey");
+        if (!hasPermission) return Result.fail(new ApiKeyNotAuthorizedError());
+        const validation = createApiKeyInputSchema.safeParse(input);
+        if (!validation.success) return Result.fail(new ApiKeyValidationError(validation.error.issues[0].message));
+        const token = generateToken();
+        const identity = this.identityContext.getIdentity();
+        const data = validation.data;
+        const apiKey = {
+            id: mdbid(),
+            name: data.name,
+            slug: data.slug,
+            description: data.description,
+            token,
+            permissions: data.permissions,
+            createdOn: new Date().toISOString(),
+            createdBy: {
+                id: identity.id,
+                displayName: identity.displayName,
+                type: identity.type
+            }
+        };
+        await this.eventPublisher.publish(new ApiKeyBeforeCreateEvent({
+            apiKey,
+            input: validation.data
+        }));
+        const result = await this.repository.create(apiKey);
+        if (result.isFail()) return Result.fail(result.error);
+        await this.eventPublisher.publish(new ApiKeyAfterCreateEvent({
+            apiKey,
+            input: validation.data
+        }));
+        return Result.ok(apiKey);
+    }
+}
+const CreateApiKeyUseCase_CreateApiKeyUseCase = CreateApiKeyUseCase.createImplementation({
+    implementation: CreateApiKeyUseCaseImpl,
+    dependencies: [
+        IdentityContext,
+        EventPublisher,
+        ApiKeysRepository
+    ]
+});
+export { CreateApiKeyUseCase_CreateApiKeyUseCase as CreateApiKeyUseCase };
+
+//# sourceMappingURL=CreateApiKeyUseCase.js.map

package/features/security/apiKeys/CreateApiKey/CreateApiKeyUseCase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/apiKeys/CreateApiKey/CreateApiKeyUseCase.js","sources":["../../../../../src/features/security/apiKeys/CreateApiKey/CreateApiKeyUseCase.ts"],"sourcesContent":["import { mdbid } from \"@webiny/utils\";\nimport { Result } from \"@webiny/feature/api\";\nimport { EventPublisher } from \"~/features/eventPublisher/index.js\";\nimport { CreateApiKeyUseCase as CreateApiKeyUseCaseAbstraction } from \"./abstractions.js\";\nimport { ApiKeysRepository } from \"../shared/abstractions.js\";\nimport { IdentityContext } from \"../../IdentityContext/abstractions.js\";\nimport { createApiKeyInputSchema } from \"../shared/schemas.js\";\nimport { ApiKeyBeforeCreateEvent, ApiKeyAfterCreateEvent } from \"./events.js\";\nimport type { ApiKey, CreateApiKeyInput } from \"../shared/types.js\";\nimport type { ApiKeyPermission } from \"~/types/security.js\";\nimport { generateToken } from \"../shared/generateToken.js\";\nimport { ApiKeyValidationError, ApiKeyNotAuthorizedError } from \"../shared/errors.js\";\n\nclass CreateApiKeyUseCaseImpl implements CreateApiKeyUseCaseAbstraction.Interface {\n    constructor(\n        private identityContext: IdentityContext.Interface,\n        private eventPublisher: EventPublisher.Interface,\n        private repository: ApiKeysRepository.Interface\n    ) {}\n\n    async execute(\n        input: CreateApiKeyInput\n    ): Promise<Result<ApiKey, CreateApiKeyUseCaseAbstraction.Error>> {\n        const hasPermission =\n            await this.identityContext.getPermission<ApiKeyPermission>(\"security.apiKey\");\n\n        if (!hasPermission) {\n            return Result.fail(new ApiKeyNotAuthorizedError());\n        }\n\n        const validation = createApiKeyInputSchema.safeParse(input);\n        if (!validation.success) {\n            return Result.fail(new ApiKeyValidationError(validation.error.issues[0].message));\n        }\n\n        const token = generateToken();\n        const identity = this.identityContext.getIdentity();\n        const data = validation.data;\n\n        const apiKey: ApiKey = {\n            id: mdbid(),\n            name: data.name,\n            slug: data.slug,\n            description: data.description,\n            token,\n            permissions: data.permissions,\n            createdOn: new Date().toISOString(),\n            createdBy: {\n                id: identity.id,\n                displayName: identity.displayName,\n                type: identity.type\n            }\n        };\n\n        await this.eventPublisher.publish(\n            new ApiKeyBeforeCreateEvent({ apiKey, input: validation.data })\n        );\n\n        const result = await this.repository.create(apiKey);\n\n        if (result.isFail()) {\n            return Result.fail(result.error);\n        }\n\n        await this.eventPublisher.publish(\n            new ApiKeyAfterCreateEvent({ apiKey, input: validation.data })\n        );\n\n        return Result.ok(apiKey);\n    }\n}\n\nexport const CreateApiKeyUseCase = CreateApiKeyUseCaseAbstraction.createImplementation({\n    implementation: CreateApiKeyUseCaseImpl,\n    dependencies: [IdentityContext, EventPublisher, ApiKeysRepository]\n});\n"],"names":["CreateApiKeyUseCaseImpl","identityContext","eventPublisher","repository","input","hasPermission","Result","ApiKeyNotAuthorizedError","validation","createApiKeyInputSchema","ApiKeyValidationError","token","generateToken","identity","data","apiKey","mdbid","Date","ApiKeyBeforeCreateEvent","result","ApiKeyAfterCreateEvent","CreateApiKeyUseCase","CreateApiKeyUseCaseAbstraction","IdentityContext","EventPublisher","ApiKeysRepository"],"mappings":";;;;;;;;;;AAaA,MAAMA;IACF,YACYC,eAA0C,EAC1CC,cAAwC,EACxCC,UAAuC,CACjD;aAHUF,eAAe,GAAfA;aACAC,cAAc,GAAdA;aACAC,UAAU,GAAVA;IACT;IAEH,MAAM,QACFC,KAAwB,EACqC;QAC7D,MAAMC,gBACF,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAmB;QAE/D,IAAI,CAACA,eACD,OAAOC,OAAO,IAAI,CAAC,IAAIC;QAG3B,MAAMC,aAAaC,wBAAwB,SAAS,CAACL;QACrD,IAAI,CAACI,WAAW,OAAO,EACnB,OAAOF,OAAO,IAAI,CAAC,IAAII,sBAAsBF,WAAW,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO;QAGnF,MAAMG,QAAQC;QACd,MAAMC,WAAW,IAAI,CAAC,eAAe,CAAC,WAAW;QACjD,MAAMC,OAAON,WAAW,IAAI;QAE5B,MAAMO,SAAiB;YACnB,IAAIC;YACJ,MAAMF,KAAK,IAAI;YACf,MAAMA,KAAK,IAAI;YACf,aAAaA,KAAK,WAAW;YAC7BH;YACA,aAAaG,KAAK,WAAW;YAC7B,WAAW,IAAIG,OAAO,WAAW;YACjC,WAAW;gBACP,IAAIJ,SAAS,EAAE;gBACf,aAAaA,SAAS,WAAW;gBACjC,MAAMA,SAAS,IAAI;YACvB;QACJ;QAEA,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAC7B,IAAIK,wBAAwB;YAAEH;YAAQ,OAAOP,WAAW,IAAI;QAAC;QAGjE,MAAMW,SAAS,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAACJ;QAE5C,IAAII,OAAO,MAAM,IACb,OAAOb,OAAO,IAAI,CAACa,OAAO,KAAK;QAGnC,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAC7B,IAAIC,uBAAuB;YAAEL;YAAQ,OAAOP,WAAW,IAAI;QAAC;QAGhE,OAAOF,OAAO,EAAE,CAACS;IACrB;AACJ;AAEO,MAAMM,0CAAsBC,oBAAAA,oBAAmD,CAAC;IACnF,gBAAgBtB;IAChB,cAAc;QAACuB;QAAiBC;QAAgBC;KAAkB;AACtE"}

package/features/security/apiKeys/CreateApiKey/abstractions.d.ts

@@ -0,0 +1,27 @@
+import { Result } from "@webiny/feature/api";
+import type { ApiKey, CreateApiKeyInput } from "../shared/types.js";
+import { ApiKeysRepository } from "../shared/abstractions.js";
+import { ApiKeyNotAuthorizedError, ApiKeyValidationError } from "../shared/errors.js";
+export interface ICreateApiKeyErrors {
+    notAuthorized: ApiKeyNotAuthorizedError;
+    validation: ApiKeyValidationError;
+}
+type CreateApiKeyError = ICreateApiKeyErrors[keyof ICreateApiKeyErrors] | ApiKeysRepository.Error;
+export interface ICreateApiKey {
+    execute(input: CreateApiKeyInput): Promise<Result<ApiKey, CreateApiKeyError>>;
+}
+/** Create a new API key. */
+export declare const CreateApiKeyUseCase: import("@webiny/di").Abstraction<ICreateApiKey>;
+export declare namespace CreateApiKeyUseCase {
+    type Interface = ICreateApiKey;
+    type Error = CreateApiKeyError;
+}
+export interface ApiKeyBeforeCreatePayload {
+    apiKey: ApiKey;
+    input: CreateApiKeyInput;
+}
+export interface ApiKeyAfterCreatePayload {
+    apiKey: ApiKey;
+    input: CreateApiKeyInput;
+}
+export {};

package/features/security/apiKeys/CreateApiKey/abstractions.js

@@ -0,0 +1,5 @@
+import { createAbstraction } from "@webiny/feature/api";
+const CreateApiKeyUseCase = createAbstraction("CreateApiKeyUseCase");
+export { CreateApiKeyUseCase };
+
+//# sourceMappingURL=abstractions.js.map