@webiny/api-core 0.0.0-unstable.3c5210ad37

package/features/security/teams/shared/abstractions.d.ts

@@ -0,0 +1,20 @@
+import { Result } from "@webiny/feature/api";
+import type { Team, GetTeamInput, ListTeamsInput } from "./types.js";
+import { TeamNotFoundError, TeamStorageError } from "./errors.js";
+export interface ITeamsRepositoryErrors {
+    base: TeamNotFoundError | TeamStorageError;
+}
+type RepositoryError = ITeamsRepositoryErrors[keyof ITeamsRepositoryErrors];
+export interface ITeamsRepository {
+    get(params: GetTeamInput): Promise<Result<Team, RepositoryError>>;
+    list(params: ListTeamsInput): Promise<Result<Team[], RepositoryError>>;
+    create(data: Team): Promise<Result<void, RepositoryError>>;
+    update(data: Team): Promise<Result<void, RepositoryError>>;
+    delete(team: Team): Promise<Result<void, RepositoryError>>;
+}
+export declare const TeamsRepository: import("@webiny/di").Abstraction<ITeamsRepository>;
+export declare namespace TeamsRepository {
+    type Interface = ITeamsRepository;
+    type Error = RepositoryError;
+}
+export {};

package/features/security/teams/shared/abstractions.js

@@ -0,0 +1,4 @@
+import { createAbstraction } from "@webiny/feature/api";
+export const TeamsRepository = createAbstraction("TeamsRepository");
+
+//# sourceMappingURL=abstractions.js.map

package/features/security/teams/shared/abstractions.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createAbstraction","TeamsRepository"],"sources":["abstractions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport { Result } from \"@webiny/feature/api\";\nimport type { Team, GetTeamInput, ListTeamsInput } from \"./types.js\";\nimport { TeamNotFoundError, TeamStorageError } from \"./errors.js\";\n\nexport interface ITeamsRepositoryErrors {\n    base: TeamNotFoundError | TeamStorageError;\n}\n\ntype RepositoryError = ITeamsRepositoryErrors[keyof ITeamsRepositoryErrors];\n\nexport interface ITeamsRepository {\n    get(params: GetTeamInput): Promise<Result<Team, RepositoryError>>;\n    list(params: ListTeamsInput): Promise<Result<Team[], RepositoryError>>;\n    create(data: Team): Promise<Result<void, RepositoryError>>;\n    update(data: Team): Promise<Result<void, RepositoryError>>;\n    delete(team: Team): Promise<Result<void, RepositoryError>>;\n}\n\nexport const TeamsRepository = createAbstraction<ITeamsRepository>(\"TeamsRepository\");\n\nexport namespace TeamsRepository {\n    export type Interface = ITeamsRepository;\n    export type Error = RepositoryError;\n}\n"],"mappings":"AAAA,SAASA,iBAAiB,QAAQ,qBAAqB;AAmBvD,OAAO,MAAMC,eAAe,GAAGD,iBAAiB,CAAmB,iBAAiB,CAAC","ignoreList":[]}

package/features/security/teams/shared/errors.d.ts

@@ -0,0 +1,47 @@
+import { BaseError } from "@webiny/feature/api";
+export declare class TeamStorageError extends BaseError {
+    readonly code: "TEAM_STORAGE_ERROR";
+    constructor(error: Error);
+}
+export declare class TeamNotFoundError extends BaseError {
+    readonly code: "TEAM_NOT_FOUND";
+    constructor();
+}
+type NotAuthorizedErrorData = {
+    message?: string;
+};
+export declare class NotAuthorizedError extends BaseError<NotAuthorizedErrorData> {
+    readonly code: "NOT_AUTHORIZED";
+    constructor(data?: NotAuthorizedErrorData);
+}
+type TeamExistsErrorData = {
+    slug: string;
+};
+export declare class TeamExistsError extends BaseError<TeamExistsErrorData> {
+    readonly code: "TEAM_EXISTS";
+    constructor(slug: string);
+}
+export declare class CannotUpdatePluginTeamsError extends BaseError {
+    readonly code: "CANNOT_UPDATE_PLUGIN_TEAMS";
+    constructor();
+}
+export declare class CannotDeletePluginTeamsError extends BaseError {
+    readonly code: "CANNOT_DELETE_PLUGIN_TEAMS";
+    constructor();
+}
+export declare class CannotUpdateSystemTeamsError extends BaseError {
+    readonly code: "CANNOT_UPDATE_SYSTEM_TEAMS";
+    constructor();
+}
+export declare class CannotDeleteSystemTeamsError extends BaseError {
+    readonly code: "CANNOT_DELETE_SYSTEM_TEAMS";
+    constructor();
+}
+type TeamValidationErrorData = {
+    message: string;
+};
+export declare class TeamValidationError extends BaseError<TeamValidationErrorData> {
+    readonly code: "TEAM_VALIDATION_ERROR";
+    constructor(message: string);
+}
+export {};

package/features/security/teams/shared/errors.js

@@ -0,0 +1,82 @@
+import { BaseError } from "@webiny/feature/api";
+export class TeamStorageError extends BaseError {
+  code = "TEAM_STORAGE_ERROR";
+  constructor(error) {
+    super({
+      message: error.message
+    });
+  }
+}
+export class TeamNotFoundError extends BaseError {
+  code = "TEAM_NOT_FOUND";
+  constructor() {
+    super({
+      message: `Team was not found!`
+    });
+  }
+}
+export class NotAuthorizedError extends BaseError {
+  code = "NOT_AUTHORIZED";
+  constructor(data = {}) {
+    super({
+      message: data.message || "Not authorized!",
+      data
+    });
+  }
+}
+export class TeamExistsError extends BaseError {
+  code = "TEAM_EXISTS";
+  constructor(slug) {
+    super({
+      message: `Team with slug "${slug}" already exists.`,
+      data: {
+        slug
+      }
+    });
+  }
+}
+export class CannotUpdatePluginTeamsError extends BaseError {
+  code = "CANNOT_UPDATE_PLUGIN_TEAMS";
+  constructor() {
+    super({
+      message: "Cannot update teams created via plugins."
+    });
+  }
+}
+export class CannotDeletePluginTeamsError extends BaseError {
+  code = "CANNOT_DELETE_PLUGIN_TEAMS";
+  constructor() {
+    super({
+      message: "Cannot delete teams created via plugins."
+    });
+  }
+}
+export class CannotUpdateSystemTeamsError extends BaseError {
+  code = "CANNOT_UPDATE_SYSTEM_TEAMS";
+  constructor() {
+    super({
+      message: "Cannot update system teams."
+    });
+  }
+}
+export class CannotDeleteSystemTeamsError extends BaseError {
+  code = "CANNOT_DELETE_SYSTEM_TEAMS";
+  constructor() {
+    super({
+      message: "Cannot delete system teams."
+    });
+  }
+}
+export class TeamValidationError extends BaseError {
+  code = "TEAM_VALIDATION_ERROR";
+  constructor(message) {
+    super({
+      message,
+      data: {
+        message
+      }
+    });
+  }
+}
+
+//# sourceMappingURL=errors.js.map

package/features/security/teams/shared/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["BaseError","TeamStorageError","code","constructor","error","message","TeamNotFoundError","NotAuthorizedError","data","TeamExistsError","slug","CannotUpdatePluginTeamsError","CannotDeletePluginTeamsError","CannotUpdateSystemTeamsError","CannotDeleteSystemTeamsError","TeamValidationError"],"sources":["errors.ts"],"sourcesContent":["import { BaseError } from \"@webiny/feature/api\";\n\nexport class TeamStorageError extends BaseError {\n    override readonly code = \"TEAM_STORAGE_ERROR\" as const;\n\n    constructor(error: Error) {\n        super({\n            message: error.message\n        });\n    }\n}\n\nexport class TeamNotFoundError extends BaseError {\n    override readonly code = \"TEAM_NOT_FOUND\" as const;\n\n    constructor() {\n        super({\n            message: `Team was not found!`\n        });\n    }\n}\n\ntype NotAuthorizedErrorData = {\n    message?: string;\n};\n\nexport class NotAuthorizedError extends BaseError<NotAuthorizedErrorData> {\n    override readonly code = \"NOT_AUTHORIZED\" as const;\n\n    constructor(data: NotAuthorizedErrorData = {}) {\n        super({\n            message: data.message || \"Not authorized!\",\n            data\n        });\n    }\n}\n\ntype TeamExistsErrorData = {\n    slug: string;\n};\n\nexport class TeamExistsError extends BaseError<TeamExistsErrorData> {\n    override readonly code = \"TEAM_EXISTS\" as const;\n\n    constructor(slug: string) {\n        super({\n            message: `Team with slug \"${slug}\" already exists.`,\n            data: { slug }\n        });\n    }\n}\n\nexport class CannotUpdatePluginTeamsError extends BaseError {\n    override readonly code = \"CANNOT_UPDATE_PLUGIN_TEAMS\" as const;\n\n    constructor() {\n        super({\n            message: \"Cannot update teams created via plugins.\"\n        });\n    }\n}\n\nexport class CannotDeletePluginTeamsError extends BaseError {\n    override readonly code = \"CANNOT_DELETE_PLUGIN_TEAMS\" as const;\n\n    constructor() {\n        super({\n            message: \"Cannot delete teams created via plugins.\"\n        });\n    }\n}\n\nexport class CannotUpdateSystemTeamsError extends BaseError {\n    override readonly code = \"CANNOT_UPDATE_SYSTEM_TEAMS\" as const;\n\n    constructor() {\n        super({\n            message: \"Cannot update system teams.\"\n        });\n    }\n}\n\nexport class CannotDeleteSystemTeamsError extends BaseError {\n    override readonly code = \"CANNOT_DELETE_SYSTEM_TEAMS\" as const;\n\n    constructor() {\n        super({\n            message: \"Cannot delete system teams.\"\n        });\n    }\n}\n\ntype TeamValidationErrorData = {\n    message: string;\n};\n\nexport class TeamValidationError extends BaseError<TeamValidationErrorData> {\n    override readonly code = \"TEAM_VALIDATION_ERROR\" as const;\n\n    constructor(message: string) {\n        super({\n            message,\n            data: { message }\n        });\n    }\n}\n"],"mappings":"AAAA,SAASA,SAAS,QAAQ,qBAAqB;AAE/C,OAAO,MAAMC,gBAAgB,SAASD,SAAS,CAAC;EAC1BE,IAAI,GAAG,oBAAoB;EAE7CC,WAAWA,CAACC,KAAY,EAAE;IACtB,KAAK,CAAC;MACFC,OAAO,EAAED,KAAK,CAACC;IACnB,CAAC,CAAC;EACN;AACJ;AAEA,OAAO,MAAMC,iBAAiB,SAASN,SAAS,CAAC;EAC3BE,IAAI,GAAG,gBAAgB;EAEzCC,WAAWA,CAAA,EAAG;IACV,KAAK,CAAC;MACFE,OAAO,EAAE;IACb,CAAC,CAAC;EACN;AACJ;AAMA,OAAO,MAAME,kBAAkB,SAASP,SAAS,CAAyB;EACpDE,IAAI,GAAG,gBAAgB;EAEzCC,WAAWA,CAACK,IAA4B,GAAG,CAAC,CAAC,EAAE;IAC3C,KAAK,CAAC;MACFH,OAAO,EAAEG,IAAI,CAACH,OAAO,IAAI,iBAAiB;MAC1CG;IACJ,CAAC,CAAC;EACN;AACJ;AAMA,OAAO,MAAMC,eAAe,SAAST,SAAS,CAAsB;EAC9CE,IAAI,GAAG,aAAa;EAEtCC,WAAWA,CAACO,IAAY,EAAE;IACtB,KAAK,CAAC;MACFL,OAAO,EAAE,mBAAmBK,IAAI,mBAAmB;MACnDF,IAAI,EAAE;QAAEE;MAAK;IACjB,CAAC,CAAC;EACN;AACJ;AAEA,OAAO,MAAMC,4BAA4B,SAASX,SAAS,CAAC;EACtCE,IAAI,GAAG,4BAA4B;EAErDC,WAAWA,CAAA,EAAG;IACV,KAAK,CAAC;MACFE,OAAO,EAAE;IACb,CAAC,CAAC;EACN;AACJ;AAEA,OAAO,MAAMO,4BAA4B,SAASZ,SAAS,CAAC;EACtCE,IAAI,GAAG,4BAA4B;EAErDC,WAAWA,CAAA,EAAG;IACV,KAAK,CAAC;MACFE,OAAO,EAAE;IACb,CAAC,CAAC;EACN;AACJ;AAEA,OAAO,MAAMQ,4BAA4B,SAASb,SAAS,CAAC;EACtCE,IAAI,GAAG,4BAA4B;EAErDC,WAAWA,CAAA,EAAG;IACV,KAAK,CAAC;MACFE,OAAO,EAAE;IACb,CAAC,CAAC;EACN;AACJ;AAEA,OAAO,MAAMS,4BAA4B,SAASd,SAAS,CAAC;EACtCE,IAAI,GAAG,4BAA4B;EAErDC,WAAWA,CAAA,EAAG;IACV,KAAK,CAAC;MACFE,OAAO,EAAE;IACb,CAAC,CAAC;EACN;AACJ;AAMA,OAAO,MAAMU,mBAAmB,SAASf,SAAS,CAA0B;EACtDE,IAAI,GAAG,uBAAuB;EAEhDC,WAAWA,CAACE,OAAe,EAAE;IACzB,KAAK,CAAC;MACFA,OAAO;MACPG,IAAI,EAAE;QAAEH;MAAQ;IACpB,CAAC,CAAC;EACN;AACJ","ignoreList":[]}

package/features/security/teams/shared/types.d.ts

@@ -0,0 +1,28 @@
+import type { Team } from "../../../../types/security.js";
+export type { Team };
+export interface CreateTeamInput {
+    name: string;
+    slug: string;
+    description: string;
+    roles: string[];
+    system?: boolean;
+}
+export interface UpdateTeamInput {
+    name?: string;
+    description?: string;
+    roles?: string[];
+}
+export type GetTeamInput = {
+    id: string;
+    slug?: never;
+} | {
+    slug: string;
+    id?: never;
+};
+export interface ListTeamsInput {
+    where?: {
+        id_in?: string[];
+        slug_in?: string[];
+    };
+    sort?: string[];
+}

package/features/security/teams/shared/types.js

@@ -0,0 +1,3 @@
+export {};
+
+//# sourceMappingURL=types.js.map

package/features/security/teams/shared/types.js.map

@@ -0,0 +1 @@
+{"version":3,"names":[],"sources":["types.ts"],"sourcesContent":["import type { Team } from \"~/types/security.js\";\n\nexport type { Team };\n\nexport interface CreateTeamInput {\n    name: string;\n    slug: string;\n    description: string;\n    roles: string[];\n    system?: boolean;\n}\n\nexport interface UpdateTeamInput {\n    name?: string;\n    description?: string;\n    roles?: string[];\n}\n\nexport type GetTeamInput =\n    | {\n          id: string;\n          slug?: never;\n      }\n    | {\n          slug: string;\n          id?: never;\n      };\n\nexport interface ListTeamsInput {\n    where?: {\n        id_in?: string[];\n        slug_in?: string[];\n    };\n    sort?: string[];\n}\n"],"mappings":"","ignoreList":[]}

package/features/security/utils/AppPermissions.d.ts

@@ -0,0 +1,27 @@
+import type { SecurityPermission, SecurityIdentity, CreatedBy } from "../../../types/security.js";
+export interface AppPermissionsParams<TPermission extends SecurityPermission = SecurityPermission> {
+    getIdentity: () => SecurityIdentity | Promise<SecurityIdentity>;
+    getPermissions: () => TPermission[] | Promise<TPermission[]>;
+    fullAccessPermissionName?: string;
+}
+export type EnsureParams = Partial<{
+    rwd: string;
+    pw: string;
+    owns: CreatedBy;
+}>;
+export declare class AppPermissions<TPermission extends SecurityPermission = SecurityPermission> {
+    getIdentity: () => SecurityIdentity | Promise<SecurityIdentity>;
+    getPermissions: () => TPermission[] | Promise<TPermission[]>;
+    private fullAccessPermissions;
+    constructor({ getIdentity, getPermissions, fullAccessPermissionName }: AppPermissionsParams<TPermission>);
+    ensure(params?: EnsureParams): Promise<boolean>;
+    hasFullAccess(): Promise<boolean>;
+    canAccessNonOwnedRecords(): Promise<boolean>;
+    canAccessOnlyOwnRecords(): Promise<boolean>;
+    private hasRwd;
+    private hasPw;
+    /**
+     * Filters out base `name` and `_src` properties from the permission object.
+     */
+    private filterOutSystemPermissionsObjectProperties;
+}

package/features/security/utils/AppPermissions.js

@@ -0,0 +1,99 @@
+const FULL_ACCESS_PERMISSION_NAME = "*";
+export class AppPermissions {
+  constructor({
+    getIdentity,
+    getPermissions,
+    fullAccessPermissionName
+  }) {
+    this.getIdentity = getIdentity;
+    this.getPermissions = getPermissions;
+    this.fullAccessPermissions = [FULL_ACCESS_PERMISSION_NAME, fullAccessPermissionName || ""].filter(Boolean);
+  }
+  async ensure(params = {}) {
+    if (await this.hasFullAccess()) {
+      return true;
+    }
+    if (params.owns) {
+      if (await this.canAccessNonOwnedRecords()) {
+        return true;
+      }
+
+      // If we got here, that means we didn't encounter a permission object
+      // that gives us the ability to access non-owned records.
+      const identity = await this.getIdentity();
+      if (identity.id === params.owns.id) {
+        return true;
+      }
+      return false;
+    }
+    const permissions = await this.getPermissions();
+    const hasPermission = permissions.some(current => {
+      if (params.rwd && !this.hasRwd(current, params.rwd)) {
+        return false;
+      }
+      if (params.pw && !this.hasPw(current, params.pw)) {
+        return false;
+      }
+      return true;
+    });
+    return hasPermission;
+  }
+  async hasFullAccess() {
+    const permissions = await this.getPermissions();
+    return permissions.some(p => this.fullAccessPermissions.filter(Boolean).includes(p.name));
+  }
+  async canAccessNonOwnedRecords() {
+    // First pass - check if we have full access.
+    if (await this.hasFullAccess()) {
+      return true;
+    }
+
+    // Second pass - if there's at least one permission that doesn't
+    // prevent us from accessing non-owned records, then we grant access.
+    const permissions = await this.getPermissions();
+    return permissions.some(p => !p.own);
+  }
+  async canAccessOnlyOwnRecords() {
+    // First pass - check if we have full access to Page Builder.
+    if (await this.hasFullAccess()) {
+      return false;
+    }
+
+    // Second pass - if there's at least one permission that doesn't
+    // prevent us from accessing non-owned records, then we grant access.
+    const permissions = await this.getPermissions();
+    return !permissions.some(p => !p.own);
+  }
+  hasRwd(permission, rwd) {
+    return typeof permission.rwd !== "string" || permission.rwd.includes(rwd);
+  }
+
+  // Has publishing workflow permissions?
+  hasPw(permission, pw) {
+    // `name` and `_src` properties are always present.
+    const permissionWithoutSystemProperties = this.filterOutSystemPermissionsObjectProperties(permission);
+    const isCustom = Object.keys(permissionWithoutSystemProperties).length > 0;
+    if (!isCustom) {
+      // Means it's a "full-access" permission.
+      return true;
+    }
+    if (typeof permission["pw"] !== "string") {
+      return false;
+    }
+    return permission["pw"].includes(pw);
+  }
+
+  /**
+   * Filters out base `name` and `_src` properties from the permission object.
+   */
+  filterOutSystemPermissionsObjectProperties(permission) {
+    return Object.keys(permission).reduce((acc, key) => {
+      if (key !== "name" && key !== "_src") {
+        acc[key] = permission[key];
+      }
+      return acc;
+    }, {});
+  }
+}
+
+//# sourceMappingURL=AppPermissions.js.map

package/features/security/utils/AppPermissions.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["FULL_ACCESS_PERMISSION_NAME","AppPermissions","constructor","getIdentity","getPermissions","fullAccessPermissionName","fullAccessPermissions","filter","Boolean","ensure","params","hasFullAccess","owns","canAccessNonOwnedRecords","identity","id","permissions","hasPermission","some","current","rwd","hasRwd","pw","hasPw","p","includes","name","own","canAccessOnlyOwnRecords","permission","permissionWithoutSystemProperties","filterOutSystemPermissionsObjectProperties","isCustom","Object","keys","length","reduce","acc","key"],"sources":["AppPermissions.ts"],"sourcesContent":["import type { SecurityPermission, SecurityIdentity, CreatedBy } from \"~/types/security.js\";\n\nconst FULL_ACCESS_PERMISSION_NAME = \"*\";\n\nexport interface AppPermissionsParams<TPermission extends SecurityPermission = SecurityPermission> {\n    getIdentity: () => SecurityIdentity | Promise<SecurityIdentity>;\n    getPermissions: () => TPermission[] | Promise<TPermission[]>;\n    fullAccessPermissionName?: string;\n}\n\nexport type EnsureParams = Partial<{\n    rwd: string;\n    pw: string;\n    owns: CreatedBy;\n}>;\n\nexport class AppPermissions<TPermission extends SecurityPermission = SecurityPermission> {\n    getIdentity: () => SecurityIdentity | Promise<SecurityIdentity>;\n    getPermissions: () => TPermission[] | Promise<TPermission[]>;\n    private fullAccessPermissions: string[];\n\n    constructor({\n        getIdentity,\n        getPermissions,\n        fullAccessPermissionName\n    }: AppPermissionsParams<TPermission>) {\n        this.getIdentity = getIdentity;\n        this.getPermissions = getPermissions;\n        this.fullAccessPermissions = [\n            FULL_ACCESS_PERMISSION_NAME,\n            fullAccessPermissionName || \"\"\n        ].filter(Boolean);\n    }\n\n    async ensure(params: EnsureParams = {}): Promise<boolean> {\n        if (await this.hasFullAccess()) {\n            return true;\n        }\n\n        if (params.owns) {\n            if (await this.canAccessNonOwnedRecords()) {\n                return true;\n            }\n\n            // If we got here, that means we didn't encounter a permission object\n            // that gives us the ability to access non-owned records.\n            const identity = await this.getIdentity();\n            if (identity.id === params.owns.id) {\n                return true;\n            }\n\n            return false;\n        }\n\n        const permissions = await this.getPermissions();\n        const hasPermission = permissions.some(current => {\n            if (params.rwd && !this.hasRwd(current, params.rwd)) {\n                return false;\n            }\n\n            if (params.pw && !this.hasPw(current, params.pw)) {\n                return false;\n            }\n\n            return true;\n        });\n\n        return hasPermission;\n    }\n\n    async hasFullAccess() {\n        const permissions = await this.getPermissions();\n        return permissions.some(p => this.fullAccessPermissions.filter(Boolean).includes(p.name));\n    }\n\n    async canAccessNonOwnedRecords() {\n        // First pass - check if we have full access.\n        if (await this.hasFullAccess()) {\n            return true;\n        }\n\n        // Second pass - if there's at least one permission that doesn't\n        // prevent us from accessing non-owned records, then we grant access.\n        const permissions = await this.getPermissions();\n        return permissions.some(p => !p.own);\n    }\n\n    async canAccessOnlyOwnRecords() {\n        // First pass - check if we have full access to Page Builder.\n        if (await this.hasFullAccess()) {\n            return false;\n        }\n\n        // Second pass - if there's at least one permission that doesn't\n        // prevent us from accessing non-owned records, then we grant access.\n        const permissions = await this.getPermissions();\n        return !permissions.some(p => !p.own);\n    }\n\n    private hasRwd(permission: TPermission, rwd: string) {\n        return typeof permission.rwd !== \"string\" || permission.rwd.includes(rwd);\n    }\n\n    // Has publishing workflow permissions?\n    private hasPw(permission: TPermission, pw: string) {\n        // `name` and `_src` properties are always present.\n        const permissionWithoutSystemProperties =\n            this.filterOutSystemPermissionsObjectProperties(permission);\n\n        const isCustom = Object.keys(permissionWithoutSystemProperties).length > 0;\n\n        if (!isCustom) {\n            // Means it's a \"full-access\" permission.\n            return true;\n        }\n\n        if (typeof permission[\"pw\"] !== \"string\") {\n            return false;\n        }\n\n        return permission[\"pw\"].includes(pw);\n    }\n\n    /**\n     * Filters out base `name` and `_src` properties from the permission object.\n     */\n    private filterOutSystemPermissionsObjectProperties(permission: SecurityPermission) {\n        return Object.keys(permission).reduce(\n            (acc, key) => {\n                if (key !== \"name\" && key !== \"_src\") {\n                    acc[key] = permission[key];\n                }\n                return acc;\n            },\n            {} as Record<string, any>\n        );\n    }\n}\n"],"mappings":"AAEA,MAAMA,2BAA2B,GAAG,GAAG;AAcvC,OAAO,MAAMC,cAAc,CAA8D;EAKrFC,WAAWA,CAAC;IACRC,WAAW;IACXC,cAAc;IACdC;EAC+B,CAAC,EAAE;IAClC,IAAI,CAACF,WAAW,GAAGA,WAAW;IAC9B,IAAI,CAACC,cAAc,GAAGA,cAAc;IACpC,IAAI,CAACE,qBAAqB,GAAG,CACzBN,2BAA2B,EAC3BK,wBAAwB,IAAI,EAAE,CACjC,CAACE,MAAM,CAACC,OAAO,CAAC;EACrB;EAEA,MAAMC,MAAMA,CAACC,MAAoB,GAAG,CAAC,CAAC,EAAoB;IACtD,IAAI,MAAM,IAAI,CAACC,aAAa,CAAC,CAAC,EAAE;MAC5B,OAAO,IAAI;IACf;IAEA,IAAID,MAAM,CAACE,IAAI,EAAE;MACb,IAAI,MAAM,IAAI,CAACC,wBAAwB,CAAC,CAAC,EAAE;QACvC,OAAO,IAAI;MACf;;MAEA;MACA;MACA,MAAMC,QAAQ,GAAG,MAAM,IAAI,CAACX,WAAW,CAAC,CAAC;MACzC,IAAIW,QAAQ,CAACC,EAAE,KAAKL,MAAM,CAACE,IAAI,CAACG,EAAE,EAAE;QAChC,OAAO,IAAI;MACf;MAEA,OAAO,KAAK;IAChB;IAEA,MAAMC,WAAW,GAAG,MAAM,IAAI,CAACZ,cAAc,CAAC,CAAC;IAC/C,MAAMa,aAAa,GAAGD,WAAW,CAACE,IAAI,CAACC,OAAO,IAAI;MAC9C,IAAIT,MAAM,CAACU,GAAG,IAAI,CAAC,IAAI,CAACC,MAAM,CAACF,OAAO,EAAET,MAAM,CAACU,GAAG,CAAC,EAAE;QACjD,OAAO,KAAK;MAChB;MAEA,IAAIV,MAAM,CAACY,EAAE,IAAI,CAAC,IAAI,CAACC,KAAK,CAACJ,OAAO,EAAET,MAAM,CAACY,EAAE,CAAC,EAAE;QAC9C,OAAO,KAAK;MAChB;MAEA,OAAO,IAAI;IACf,CAAC,CAAC;IAEF,OAAOL,aAAa;EACxB;EAEA,MAAMN,aAAaA,CAAA,EAAG;IAClB,MAAMK,WAAW,GAAG,MAAM,IAAI,CAACZ,cAAc,CAAC,CAAC;IAC/C,OAAOY,WAAW,CAACE,IAAI,CAACM,CAAC,IAAI,IAAI,CAAClB,qBAAqB,CAACC,MAAM,CAACC,OAAO,CAAC,CAACiB,QAAQ,CAACD,CAAC,CAACE,IAAI,CAAC,CAAC;EAC7F;EAEA,MAAMb,wBAAwBA,CAAA,EAAG;IAC7B;IACA,IAAI,MAAM,IAAI,CAACF,aAAa,CAAC,CAAC,EAAE;MAC5B,OAAO,IAAI;IACf;;IAEA;IACA;IACA,MAAMK,WAAW,GAAG,MAAM,IAAI,CAACZ,cAAc,CAAC,CAAC;IAC/C,OAAOY,WAAW,CAACE,IAAI,CAACM,CAAC,IAAI,CAACA,CAAC,CAACG,GAAG,CAAC;EACxC;EAEA,MAAMC,uBAAuBA,CAAA,EAAG;IAC5B;IACA,IAAI,MAAM,IAAI,CAACjB,aAAa,CAAC,CAAC,EAAE;MAC5B,OAAO,KAAK;IAChB;;IAEA;IACA;IACA,MAAMK,WAAW,GAAG,MAAM,IAAI,CAACZ,cAAc,CAAC,CAAC;IAC/C,OAAO,CAACY,WAAW,CAACE,IAAI,CAACM,CAAC,IAAI,CAACA,CAAC,CAACG,GAAG,CAAC;EACzC;EAEQN,MAAMA,CAACQ,UAAuB,EAAET,GAAW,EAAE;IACjD,OAAO,OAAOS,UAAU,CAACT,GAAG,KAAK,QAAQ,IAAIS,UAAU,CAACT,GAAG,CAACK,QAAQ,CAACL,GAAG,CAAC;EAC7E;;EAEA;EACQG,KAAKA,CAACM,UAAuB,EAAEP,EAAU,EAAE;IAC/C;IACA,MAAMQ,iCAAiC,GACnC,IAAI,CAACC,0CAA0C,CAACF,UAAU,CAAC;IAE/D,MAAMG,QAAQ,GAAGC,MAAM,CAACC,IAAI,CAACJ,iCAAiC,CAAC,CAACK,MAAM,GAAG,CAAC;IAE1E,IAAI,CAACH,QAAQ,EAAE;MACX;MACA,OAAO,IAAI;IACf;IAEA,IAAI,OAAOH,UAAU,CAAC,IAAI,CAAC,KAAK,QAAQ,EAAE;MACtC,OAAO,KAAK;IAChB;IAEA,OAAOA,UAAU,CAAC,IAAI,CAAC,CAACJ,QAAQ,CAACH,EAAE,CAAC;EACxC;;EAEA;AACJ;AACA;EACYS,0CAA0CA,CAACF,UAA8B,EAAE;IAC/E,OAAOI,MAAM,CAACC,IAAI,CAACL,UAAU,CAAC,CAACO,MAAM,CACjC,CAACC,GAAG,EAAEC,GAAG,KAAK;MACV,IAAIA,GAAG,KAAK,MAAM,IAAIA,GAAG,KAAK,MAAM,EAAE;QAClCD,GAAG,CAACC,GAAG,CAAC,GAAGT,UAAU,CAACS,GAAG,CAAC;MAC9B;MACA,OAAOD,GAAG;IACd,CAAC,EACD,CAAC,CACL,CAAC;EACL;AACJ","ignoreList":[]}

package/features/security/utils/IdentityValue.d.ts

@@ -0,0 +1,18 @@
+import type { SecurityIdentity } from "../../../types/security.js";
+type IdentityInput = SecurityIdentity | null | undefined;
+export declare class IdentityValue {
+    private readonly value;
+    private constructor();
+    static create(identity: IdentityInput): IdentityValue;
+    getValue(): {
+        id: string;
+        displayName: string;
+        type: string;
+    } | null;
+    getValueOrFallback(fallback: IdentityInput): {
+        id: string;
+        displayName: string;
+        type: string;
+    } | null;
+}
+export {};

package/features/security/utils/IdentityValue.js

@@ -0,0 +1,27 @@
+export class IdentityValue {
+  constructor(value) {
+    this.value = value;
+  }
+  static create(identity) {
+    return new IdentityValue(identity);
+  }
+  getValue() {
+    if (!this.value) {
+      return null;
+    }
+    return {
+      id: this.value.id,
+      displayName: this.value.displayName,
+      type: this.value.type
+    };
+  }
+  getValueOrFallback(fallback) {
+    const value = this.getValue();
+    if (value) {
+      return value;
+    }
+    return IdentityValue.create(fallback).getValue();
+  }
+}
+
+//# sourceMappingURL=IdentityValue.js.map

package/features/security/utils/IdentityValue.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["IdentityValue","constructor","value","create","identity","getValue","id","displayName","type","getValueOrFallback","fallback"],"sources":["IdentityValue.ts"],"sourcesContent":["import type { SecurityIdentity } from \"~/types/security.js\";\n\ntype IdentityInput = SecurityIdentity | null | undefined;\n\nexport class IdentityValue {\n    private readonly value: IdentityInput;\n\n    private constructor(value: IdentityInput) {\n        this.value = value;\n    }\n\n    static create(identity: IdentityInput) {\n        return new IdentityValue(identity);\n    }\n\n    getValue() {\n        if (!this.value) {\n            return null;\n        }\n\n        return {\n            id: this.value.id,\n            displayName: this.value.displayName,\n            type: this.value.type\n        };\n    }\n\n    getValueOrFallback(fallback: IdentityInput) {\n        const value = this.getValue();\n\n        if (value) {\n            return value;\n        }\n\n        return IdentityValue.create(fallback).getValue();\n    }\n}\n"],"mappings":"AAIA,OAAO,MAAMA,aAAa,CAAC;EAGfC,WAAWA,CAACC,KAAoB,EAAE;IACtC,IAAI,CAACA,KAAK,GAAGA,KAAK;EACtB;EAEA,OAAOC,MAAMA,CAACC,QAAuB,EAAE;IACnC,OAAO,IAAIJ,aAAa,CAACI,QAAQ,CAAC;EACtC;EAEAC,QAAQA,CAAA,EAAG;IACP,IAAI,CAAC,IAAI,CAACH,KAAK,EAAE;MACb,OAAO,IAAI;IACf;IAEA,OAAO;MACHI,EAAE,EAAE,IAAI,CAACJ,KAAK,CAACI,EAAE;MACjBC,WAAW,EAAE,IAAI,CAACL,KAAK,CAACK,WAAW;MACnCC,IAAI,EAAE,IAAI,CAACN,KAAK,CAACM;IACrB,CAAC;EACL;EAEAC,kBAAkBA,CAACC,QAAuB,EAAE;IACxC,MAAMR,KAAK,GAAG,IAAI,CAACG,QAAQ,CAAC,CAAC;IAE7B,IAAIH,KAAK,EAAE;MACP,OAAOA,KAAK;IAChB;IAEA,OAAOF,aAAa,CAACG,MAAM,CAACO,QAAQ,CAAC,CAACL,QAAQ,CAAC,CAAC;EACpD;AACJ","ignoreList":[]}

package/features/security/utils/filterOutCustomWbyAppsPermissions.d.ts

@@ -0,0 +1,2 @@
+import type { SecurityPermission } from "../../../types/security.js";
+export declare const filterOutCustomWbyAppsPermissions: (permissions: SecurityPermission[]) => SecurityPermission[];

package/features/security/utils/filterOutCustomWbyAppsPermissions.js

@@ -0,0 +1,29 @@
+const WBY_APPS_PERMISSIONS_PREFIXES = ["pb", "fb", "fm", "cms", "security", "adminUsers", "i18n"];
+export const filterOutCustomWbyAppsPermissions = permissions => {
+  return permissions.filter(permission => {
+    // Just in case, if the `name` property is missing, we don't omit the permission.
+    if (!permission.name) {
+      return true;
+    }
+    let isWbyAppPermission = false,
+      wbyAppPermissionPrefix = "";
+    for (let i = 0; i < WBY_APPS_PERMISSIONS_PREFIXES.length; i++) {
+      const prefix = WBY_APPS_PERMISSIONS_PREFIXES[i];
+      if (permission.name.startsWith(`${prefix}.`)) {
+        isWbyAppPermission = true;
+        wbyAppPermissionPrefix = prefix;
+        break;
+      }
+    }
+
+    // Not a Webiny app permission? Then don't omit the permission.
+    if (!isWbyAppPermission) {
+      return true;
+    }
+
+    // Only allow full access (`${wbyAppPermissionPrefix}.*`) permissions.
+    return permission.name === `${wbyAppPermissionPrefix}.*`;
+  });
+};
+
+//# sourceMappingURL=filterOutCustomWbyAppsPermissions.js.map

package/features/security/utils/filterOutCustomWbyAppsPermissions.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["WBY_APPS_PERMISSIONS_PREFIXES","filterOutCustomWbyAppsPermissions","permissions","filter","permission","name","isWbyAppPermission","wbyAppPermissionPrefix","i","length","prefix","startsWith"],"sources":["filterOutCustomWbyAppsPermissions.ts"],"sourcesContent":["import type { SecurityPermission } from \"~/types/security.js\";\n\nconst WBY_APPS_PERMISSIONS_PREFIXES = [\"pb\", \"fb\", \"fm\", \"cms\", \"security\", \"adminUsers\", \"i18n\"];\n\nexport const filterOutCustomWbyAppsPermissions = (permissions: SecurityPermission[]) => {\n    return permissions.filter(permission => {\n        // Just in case, if the `name` property is missing, we don't omit the permission.\n        if (!permission.name) {\n            return true;\n        }\n\n        let isWbyAppPermission = false,\n            wbyAppPermissionPrefix = \"\";\n        for (let i = 0; i < WBY_APPS_PERMISSIONS_PREFIXES.length; i++) {\n            const prefix = WBY_APPS_PERMISSIONS_PREFIXES[i];\n            if (permission.name.startsWith(`${prefix}.`)) {\n                isWbyAppPermission = true;\n                wbyAppPermissionPrefix = prefix;\n                break;\n            }\n        }\n\n        // Not a Webiny app permission? Then don't omit the permission.\n        if (!isWbyAppPermission) {\n            return true;\n        }\n\n        // Only allow full access (`${wbyAppPermissionPrefix}.*`) permissions.\n        return permission.name === `${wbyAppPermissionPrefix}.*`;\n    });\n};\n"],"mappings":"AAEA,MAAMA,6BAA6B,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,CAAC;AAEjG,OAAO,MAAMC,iCAAiC,GAAIC,WAAiC,IAAK;EACpF,OAAOA,WAAW,CAACC,MAAM,CAACC,UAAU,IAAI;IACpC;IACA,IAAI,CAACA,UAAU,CAACC,IAAI,EAAE;MAClB,OAAO,IAAI;IACf;IAEA,IAAIC,kBAAkB,GAAG,KAAK;MAC1BC,sBAAsB,GAAG,EAAE;IAC/B,KAAK,IAAIC,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAGR,6BAA6B,CAACS,MAAM,EAAED,CAAC,EAAE,EAAE;MAC3D,MAAME,MAAM,GAAGV,6BAA6B,CAACQ,CAAC,CAAC;MAC/C,IAAIJ,UAAU,CAACC,IAAI,CAACM,UAAU,CAAC,GAAGD,MAAM,GAAG,CAAC,EAAE;QAC1CJ,kBAAkB,GAAG,IAAI;QACzBC,sBAAsB,GAAGG,MAAM;QAC/B;MACJ;IACJ;;IAEA;IACA,IAAI,CAACJ,kBAAkB,EAAE;MACrB,OAAO,IAAI;IACf;;IAEA;IACA,OAAOF,UAAU,CAACC,IAAI,KAAK,GAAGE,sBAAsB,IAAI;EAC5D,CAAC,CAAC;AACN,CAAC","ignoreList":[]}

package/features/security/utils/getPermissionsFromRoles.d.ts

@@ -0,0 +1,8 @@
+import type { SecurityPermission } from "../../../types/security.js";
+export declare const getPermissionsFromRoles: (securityGroups: Array<{
+    permissions: SecurityPermission[];
+    id: string;
+}>) => {
+    _src: string;
+    name: string;
+}[];

package/features/security/utils/getPermissionsFromRoles.js

@@ -0,0 +1,12 @@
+// This filter was introduced when we added the `teams` feature and the ability to
+// have multiple security roles assigned to a user.
+export const getPermissionsFromRoles = securityGroups => {
+  return securityGroups.flatMap(securityRole => securityRole.permissions.map(permission => {
+    return {
+      ...permission,
+      _src: "role:" + securityRole.id
+    };
+  }));
+};
+
+//# sourceMappingURL=getPermissionsFromRoles.js.map

package/features/security/utils/getPermissionsFromRoles.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["getPermissionsFromRoles","securityGroups","flatMap","securityRole","permissions","map","permission","_src","id"],"sources":["getPermissionsFromRoles.ts"],"sourcesContent":["import type { SecurityPermission } from \"~/types/security.js\";\n\n// This filter was introduced when we added the `teams` feature and the ability to\n// have multiple security roles assigned to a user.\nexport const getPermissionsFromRoles = (\n    securityGroups: Array<{ permissions: SecurityPermission[]; id: string }>\n) => {\n    return securityGroups.flatMap(securityRole =>\n        securityRole.permissions.map(permission => {\n            return {\n                ...permission,\n                _src: \"role:\" + securityRole.id\n            };\n        })\n    );\n};\n"],"mappings":"AAEA;AACA;AACA,OAAO,MAAMA,uBAAuB,GAChCC,cAAwE,IACvE;EACD,OAAOA,cAAc,CAACC,OAAO,CAACC,YAAY,IACtCA,YAAY,CAACC,WAAW,CAACC,GAAG,CAACC,UAAU,IAAI;IACvC,OAAO;MACH,GAAGA,UAAU;MACbC,IAAI,EAAE,OAAO,GAAGJ,YAAY,CAACK;IACjC,CAAC;EACL,CAAC,CACL,CAAC;AACL,CAAC","ignoreList":[]}

package/features/security/utils/isJwt.d.ts

@@ -0,0 +1 @@
+export declare const isJwt: (token: string) => boolean;

package/features/security/utils/isJwt.js

@@ -0,0 +1,3 @@
+export const isJwt = token => token.split(".").length === 3;
+
+//# sourceMappingURL=isJwt.js.map

package/features/security/utils/isJwt.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["isJwt","token","split","length"],"sources":["isJwt.ts"],"sourcesContent":["export const isJwt = (token: string) => token.split(\".\").length === 3;\n"],"mappings":"AAAA,OAAO,MAAMA,KAAK,GAAIC,KAAa,IAAKA,KAAK,CAACC,KAAK,CAAC,GAAG,CAAC,CAACC,MAAM,KAAK,CAAC","ignoreList":[]}

package/features/security/utils/verifyJwtUsingJwk.d.ts

@@ -0,0 +1,10 @@
+import jwt from "jsonwebtoken";
+export interface Jwk {
+    kid: string;
+    [key: string]: string;
+}
+export type Jwt = {
+    header: jwt.JwtHeader;
+    payload: jwt.JwtPayload;
+};
+export declare const verifyJwtUsingJwk: (token: string, jwk: Jwk) => Promise<jwt.JwtPayload>;

package/features/security/utils/verifyJwtUsingJwk.js

@@ -0,0 +1,11 @@
+import jwt from "jsonwebtoken";
+import { importJWK, exportSPKI } from "jose";
+export const verifyJwtUsingJwk = async (token, jwk) => {
+  // Casting to `any` because `jose` v5 has some incompatibilities with types.
+  // v6 works as expected, but we can't have v6 because it's ESM-only.
+  const key = await importJWK(jwk);
+  const pemKey = await exportSPKI(key);
+  return jwt.verify(token, pemKey);
+};
+
+//# sourceMappingURL=verifyJwtUsingJwk.js.map

package/features/security/utils/verifyJwtUsingJwk.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["jwt","importJWK","exportSPKI","verifyJwtUsingJwk","token","jwk","key","pemKey","verify"],"sources":["verifyJwtUsingJwk.ts"],"sourcesContent":["import jwt from \"jsonwebtoken\";\nimport { importJWK, exportSPKI } from \"jose\";\n\nexport interface Jwk {\n    kid: string;\n    [key: string]: string;\n}\n\nexport type Jwt = {\n    header: jwt.JwtHeader;\n    payload: jwt.JwtPayload;\n};\n\nexport const verifyJwtUsingJwk = async (token: string, jwk: Jwk) => {\n    // Casting to `any` because `jose` v5 has some incompatibilities with types.\n    // v6 works as expected, but we can't have v6 because it's ESM-only.\n    const key = (await importJWK(jwk as any)) as CryptoKey;\n    const pemKey = await exportSPKI(key);\n\n    return jwt.verify(token, pemKey) as jwt.JwtPayload;\n};\n"],"mappings":"AAAA,OAAOA,GAAG,MAAM,cAAc;AAC9B,SAASC,SAAS,EAAEC,UAAU,QAAQ,MAAM;AAY5C,OAAO,MAAMC,iBAAiB,GAAG,MAAAA,CAAOC,KAAa,EAAEC,GAAQ,KAAK;EAChE;EACA;EACA,MAAMC,GAAG,GAAI,MAAML,SAAS,CAACI,GAAU,CAAe;EACtD,MAAME,MAAM,GAAG,MAAML,UAAU,CAACI,GAAG,CAAC;EAEpC,OAAON,GAAG,CAACQ,MAAM,CAACJ,KAAK,EAAEG,MAAM,CAAC;AACpC,CAAC","ignoreList":[]}

package/features/system/InstallSystem/InstallSystemUseCase.d.ts

@@ -0,0 +1,24 @@
+import { Result } from "@webiny/feature/api";
+import { EventPublisher } from "../../../features/eventPublisher/index.js";
+import { InstallSystemUseCase as UseCaseAbstraction } from "./abstractions.js";
+import { InstallTenantUseCase } from "../../../features/tenancy/InstallTenant/index.js";
+import { GetRootTenantUseCase } from "../../../features/tenancy/GetRootTenant/index.js";
+import { CreateTenantUseCase } from "../../../features/tenancy/CreateTenant/index.js";
+import { DeleteTenantUseCase } from "../../../features/tenancy/DeleteTenant/index.js";
+import { TenantContext } from "../../../features/tenancy/TenantContext/index.js";
+import { IdentityContext } from "../../../features/security/IdentityContext/index.js";
+import type { InstallSystemInput } from "./abstractions.js";
+import { SystemAlreadyInstalledError } from "./errors.js";
+declare class InstallSystemUseCaseImpl implements UseCaseAbstraction.Interface {
+    private identityContext;
+    private tenantContext;
+    private eventPublisher;
+    private installTenantUseCase;
+    private getRootTenantUseCase;
+    private createTenantUseCase;
+    private deleteTenantUseCase;
+    constructor(identityContext: IdentityContext.Interface, tenantContext: TenantContext.Interface, eventPublisher: EventPublisher.Interface, installTenantUseCase: InstallTenantUseCase.Interface, getRootTenantUseCase: GetRootTenantUseCase.Interface, createTenantUseCase: CreateTenantUseCase.Interface, deleteTenantUseCase: DeleteTenantUseCase.Interface);
+    execute(installationInput: InstallSystemInput): Promise<Result<void, never> | Result<never, import("../../tenancy/CreateTenant/errors.js").CreateTenantError> | Result<never, SystemAlreadyInstalledError> | Result<never, import("~/features/tenancy/InstallTenant/index.js").InstallTenantError | import("~/features/tenancy/InstallTenant/index.js").InstallationDependencyError>>;
+}
+export declare const InstallSystemUseCase: import("@webiny/di").Implementation<typeof InstallSystemUseCaseImpl>;
+export {};

package/features/system/InstallSystem/InstallSystemUseCase.js

@@ -0,0 +1,61 @@
+import { Result, createImplementation } from "@webiny/feature/api";
+import { EventPublisher } from "../../eventPublisher/index.js";
+import { InstallSystemUseCase as UseCaseAbstraction } from "./abstractions.js";
+import { InstallTenantUseCase } from "../../tenancy/InstallTenant/index.js";
+import { GetRootTenantUseCase } from "../../tenancy/GetRootTenant/index.js";
+import { CreateTenantUseCase } from "../../tenancy/CreateTenant/index.js";
+import { DeleteTenantUseCase } from "../../tenancy/DeleteTenant/index.js";
+import { TenantContext } from "../../tenancy/TenantContext/index.js";
+import { IdentityContext } from "../../security/IdentityContext/index.js";
+import { SystemAlreadyInstalledError } from "./errors.js";
+import { SystemInstalledEvent } from "./events.js";
+class InstallSystemUseCaseImpl {
+  constructor(identityContext, tenantContext, eventPublisher, installTenantUseCase, getRootTenantUseCase, createTenantUseCase, deleteTenantUseCase) {
+    this.identityContext = identityContext;
+    this.tenantContext = tenantContext;
+    this.eventPublisher = eventPublisher;
+    this.installTenantUseCase = installTenantUseCase;
+    this.getRootTenantUseCase = getRootTenantUseCase;
+    this.createTenantUseCase = createTenantUseCase;
+    this.deleteTenantUseCase = deleteTenantUseCase;
+  }
+  async execute(installationInput) {
+    const rootTenantResult = await this.getRootTenantUseCase.execute();
+    if (rootTenantResult.isOk()) {
+      return Result.fail(new SystemAlreadyInstalledError());
+    }
+    const createTenantResult = await this.createTenantUseCase.execute({
+      id: "root",
+      name: "Root",
+      tags: [],
+      description: "The top-level Webiny tenant.",
+      parent: ""
+    });
+    if (createTenantResult.isFail()) {
+      return Result.fail(createTenantResult.error);
+    }
+    const rootTenant = createTenantResult.value;
+    this.tenantContext.setTenant(rootTenant);
+    const installResult = await this.identityContext.withoutAuthorization(() => {
+      return this.installTenantUseCase.execute({
+        tenant: rootTenant,
+        installationInput
+      });
+    });
+    if (installResult.isOk()) {
+      await this.eventPublisher.publish(new SystemInstalledEvent());
+      return Result.ok();
+    }
+
+    // If tenant installation failed, delete the root tenant
+    await this.deleteTenantUseCase.execute("root");
+    return Result.fail(installResult.error);
+  }
+}
+export const InstallSystemUseCase = createImplementation({
+  abstraction: UseCaseAbstraction,
+  implementation: InstallSystemUseCaseImpl,
+  dependencies: [IdentityContext, TenantContext, EventPublisher, InstallTenantUseCase, GetRootTenantUseCase, CreateTenantUseCase, DeleteTenantUseCase]
+});
+
+//# sourceMappingURL=InstallSystemUseCase.js.map

package/features/system/InstallSystem/InstallSystemUseCase.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["Result","createImplementation","EventPublisher","InstallSystemUseCase","UseCaseAbstraction","InstallTenantUseCase","GetRootTenantUseCase","CreateTenantUseCase","DeleteTenantUseCase","TenantContext","IdentityContext","SystemAlreadyInstalledError","SystemInstalledEvent","InstallSystemUseCaseImpl","constructor","identityContext","tenantContext","eventPublisher","installTenantUseCase","getRootTenantUseCase","createTenantUseCase","deleteTenantUseCase","execute","installationInput","rootTenantResult","isOk","fail","createTenantResult","id","name","tags","description","parent","isFail","error","rootTenant","value","setTenant","installResult","withoutAuthorization","tenant","publish","ok","abstraction","implementation","dependencies"],"sources":["InstallSystemUseCase.ts"],"sourcesContent":["import { Result, createImplementation } from \"@webiny/feature/api\";\nimport { EventPublisher } from \"~/features/eventPublisher/index.js\";\nimport { InstallSystemUseCase as UseCaseAbstraction } from \"./abstractions.js\";\nimport { InstallTenantUseCase } from \"~/features/tenancy/InstallTenant/index.js\";\nimport { GetRootTenantUseCase } from \"~/features/tenancy/GetRootTenant/index.js\";\nimport { CreateTenantUseCase } from \"~/features/tenancy/CreateTenant/index.js\";\nimport { DeleteTenantUseCase } from \"~/features/tenancy/DeleteTenant/index.js\";\nimport { TenantContext } from \"~/features/tenancy/TenantContext/index.js\";\nimport { IdentityContext } from \"~/features/security/IdentityContext/index.js\";\nimport type { InstallSystemInput } from \"./abstractions.js\";\nimport { SystemAlreadyInstalledError } from \"./errors.js\";\nimport { SystemInstalledEvent } from \"./events.js\";\n\nclass InstallSystemUseCaseImpl implements UseCaseAbstraction.Interface {\n    constructor(\n        private identityContext: IdentityContext.Interface,\n        private tenantContext: TenantContext.Interface,\n        private eventPublisher: EventPublisher.Interface,\n        private installTenantUseCase: InstallTenantUseCase.Interface,\n        private getRootTenantUseCase: GetRootTenantUseCase.Interface,\n        private createTenantUseCase: CreateTenantUseCase.Interface,\n        private deleteTenantUseCase: DeleteTenantUseCase.Interface\n    ) {}\n\n    async execute(installationInput: InstallSystemInput) {\n        const rootTenantResult = await this.getRootTenantUseCase.execute();\n\n        if (rootTenantResult.isOk()) {\n            return Result.fail(new SystemAlreadyInstalledError());\n        }\n\n        const createTenantResult = await this.createTenantUseCase.execute({\n            id: \"root\",\n            name: \"Root\",\n            tags: [],\n            description: \"The top-level Webiny tenant.\",\n            parent: \"\"\n        });\n\n        if (createTenantResult.isFail()) {\n            return Result.fail(createTenantResult.error);\n        }\n\n        const rootTenant = createTenantResult.value;\n\n        this.tenantContext.setTenant(rootTenant);\n\n        const installResult = await this.identityContext.withoutAuthorization(() => {\n            return this.installTenantUseCase.execute({\n                tenant: rootTenant,\n                installationInput\n            });\n        });\n\n        if (installResult.isOk()) {\n            await this.eventPublisher.publish(new SystemInstalledEvent());\n            return Result.ok();\n        }\n\n        // If tenant installation failed, delete the root tenant\n        await this.deleteTenantUseCase.execute(\"root\");\n\n        return Result.fail(installResult.error);\n    }\n}\n\nexport const InstallSystemUseCase = createImplementation({\n    abstraction: UseCaseAbstraction,\n    implementation: InstallSystemUseCaseImpl,\n    dependencies: [\n        IdentityContext,\n        TenantContext,\n        EventPublisher,\n        InstallTenantUseCase,\n        GetRootTenantUseCase,\n        CreateTenantUseCase,\n        DeleteTenantUseCase\n    ]\n});\n"],"mappings":"AAAA,SAASA,MAAM,EAAEC,oBAAoB,QAAQ,qBAAqB;AAClE,SAASC,cAAc;AACvB,SAASC,oBAAoB,IAAIC,kBAAkB;AACnD,SAASC,oBAAoB;AAC7B,SAASC,oBAAoB;AAC7B,SAASC,mBAAmB;AAC5B,SAASC,mBAAmB;AAC5B,SAASC,aAAa;AACtB,SAASC,eAAe;AAExB,SAASC,2BAA2B;AACpC,SAASC,oBAAoB;AAE7B,MAAMC,wBAAwB,CAAyC;EACnEC,WAAWA,CACCC,eAA0C,EAC1CC,aAAsC,EACtCC,cAAwC,EACxCC,oBAAoD,EACpDC,oBAAoD,EACpDC,mBAAkD,EAClDC,mBAAkD,EAC5D;IAAA,KAPUN,eAA0C,GAA1CA,eAA0C;IAAA,KAC1CC,aAAsC,GAAtCA,aAAsC;IAAA,KACtCC,cAAwC,GAAxCA,cAAwC;IAAA,KACxCC,oBAAoD,GAApDA,oBAAoD;IAAA,KACpDC,oBAAoD,GAApDA,oBAAoD;IAAA,KACpDC,mBAAkD,GAAlDA,mBAAkD;IAAA,KAClDC,mBAAkD,GAAlDA,mBAAkD;EAC3D;EAEH,MAAMC,OAAOA,CAACC,iBAAqC,EAAE;IACjD,MAAMC,gBAAgB,GAAG,MAAM,IAAI,CAACL,oBAAoB,CAACG,OAAO,CAAC,CAAC;IAElE,IAAIE,gBAAgB,CAACC,IAAI,CAAC,CAAC,EAAE;MACzB,OAAOzB,MAAM,CAAC0B,IAAI,CAAC,IAAIf,2BAA2B,CAAC,CAAC,CAAC;IACzD;IAEA,MAAMgB,kBAAkB,GAAG,MAAM,IAAI,CAACP,mBAAmB,CAACE,OAAO,CAAC;MAC9DM,EAAE,EAAE,MAAM;MACVC,IAAI,EAAE,MAAM;MACZC,IAAI,EAAE,EAAE;MACRC,WAAW,EAAE,8BAA8B;MAC3CC,MAAM,EAAE;IACZ,CAAC,CAAC;IAEF,IAAIL,kBAAkB,CAACM,MAAM,CAAC,CAAC,EAAE;MAC7B,OAAOjC,MAAM,CAAC0B,IAAI,CAACC,kBAAkB,CAACO,KAAK,CAAC;IAChD;IAEA,MAAMC,UAAU,GAAGR,kBAAkB,CAACS,KAAK;IAE3C,IAAI,CAACpB,aAAa,CAACqB,SAAS,CAACF,UAAU,CAAC;IAExC,MAAMG,aAAa,GAAG,MAAM,IAAI,CAACvB,eAAe,CAACwB,oBAAoB,CAAC,MAAM;MACxE,OAAO,IAAI,CAACrB,oBAAoB,CAACI,OAAO,CAAC;QACrCkB,MAAM,EAAEL,UAAU;QAClBZ;MACJ,CAAC,CAAC;IACN,CAAC,CAAC;IAEF,IAAIe,aAAa,CAACb,IAAI,CAAC,CAAC,EAAE;MACtB,MAAM,IAAI,CAACR,cAAc,CAACwB,OAAO,CAAC,IAAI7B,oBAAoB,CAAC,CAAC,CAAC;MAC7D,OAAOZ,MAAM,CAAC0C,EAAE,CAAC,CAAC;IACtB;;IAEA;IACA,MAAM,IAAI,CAACrB,mBAAmB,CAACC,OAAO,CAAC,MAAM,CAAC;IAE9C,OAAOtB,MAAM,CAAC0B,IAAI,CAACY,aAAa,CAACJ,KAAK,CAAC;EAC3C;AACJ;AAEA,OAAO,MAAM/B,oBAAoB,GAAGF,oBAAoB,CAAC;EACrD0C,WAAW,EAAEvC,kBAAkB;EAC/BwC,cAAc,EAAE/B,wBAAwB;EACxCgC,YAAY,EAAE,CACVnC,eAAe,EACfD,aAAa,EACbP,cAAc,EACdG,oBAAoB,EACpBC,oBAAoB,EACpBC,mBAAmB,EACnBC,mBAAmB;AAE3B,CAAC,CAAC","ignoreList":[]}