@webiny/api-core 0.0.0-unstable.3c5210ad37

package/features/security/authorization/GroupsTeamsAuthorizer/GetPermissionsFromIdentity.d.ts

@@ -0,0 +1,23 @@
+import { WcpContext } from "../../../../features/wcp/WcpContext/index.js";
+import { Identity } from "../../../../features/security/IdentityContext/index.js";
+import { PermissionsProcessor } from "./abstractions.js";
+import { RolesRepository } from "../../../../features/security/roles/shared/abstractions.js";
+import { TeamsRepository } from "../../../../features/security/teams/shared/abstractions.js";
+import { AdminUsersRepository } from "../../../../features/users/shared/abstractions.js";
+export type RoleId = string | undefined;
+export type TeamId = string | undefined;
+declare class GetPermissionsFromGroupsAndTeamsImpl implements PermissionsProcessor.Interface {
+    private wcpContext;
+    private usersRepository;
+    private rolesRepository;
+    private teamsRepository;
+    constructor(wcpContext: WcpContext.Interface, usersRepository: AdminUsersRepository.Interface, rolesRepository: RolesRepository.Interface, teamsRepository: TeamsRepository.Interface);
+    getPermissions(identity: Identity): Promise<{
+        _src: string;
+        name: string;
+    }[] | null>;
+}
+export declare const GetPermissionsFromIdentity: typeof GetPermissionsFromGroupsAndTeamsImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("./abstractions.js").IPermissionsProcessor>;
+};
+export {};

package/features/security/authorization/GroupsTeamsAuthorizer/GetPermissionsFromIdentity.js

@@ -0,0 +1,80 @@
+import { WcpContext } from "../../../wcp/WcpContext/index.js";
+import { PermissionsProcessor } from "./abstractions.js";
+import { RolesRepository } from "../../roles/shared/abstractions.js";
+import { TeamsRepository } from "../../teams/shared/abstractions.js";
+import { getPermissionsFromRoles } from "../../utils/getPermissionsFromRoles.js";
+import { AdminUsersRepository } from "../../../users/shared/abstractions.js";
+class GetPermissionsFromGroupsAndTeamsImpl {
+  constructor(wcpContext, usersRepository, rolesRepository, teamsRepository) {
+    this.wcpContext = wcpContext;
+    this.usersRepository = usersRepository;
+    this.rolesRepository = rolesRepository;
+    this.teamsRepository = teamsRepository;
+  }
+  async getPermissions(identity) {
+    const userResult = await this.usersRepository.get({
+      id: identity.id
+    });
+    if (userResult.isFail()) {
+      return null;
+    }
+    const user = userResult.value;
+
+    // Load roles that are associated with the current identity. Also load roles
+    // that are assigned via one or more teams (if the Teams feature is enabled).
+    const roleIds = [];
+    const teamIds = [];
+    roleIds.push(...(user.roles ?? []));
+    const filteredRoleIds = roleIds.filter(Boolean);
+    const dedupedRoleIds = Array.from(new Set(filteredRoleIds));
+    const loadedRoles = [];
+    if (dedupedRoleIds.length > 0) {
+      const rolesResult = await this.rolesRepository.list({
+        where: {
+          id_in: dedupedRoleIds
+        }
+      });
+      const loadedRolesByIds = rolesResult.isOk() ? rolesResult.value : [];
+      loadedRoles.push(...loadedRolesByIds);
+    }
+    if (this.wcpContext.canUseTeams()) {
+      teamIds.push(...(user.teams ?? []));
+      const filteredTeamIds = teamIds.filter(Boolean);
+      const dedupedTeamIds = Array.from(new Set(filteredTeamIds));
+      if (dedupedTeamIds.length > 0) {
+        const teamsResult = await this.teamsRepository.list({
+          where: {
+            id_in: dedupedTeamIds
+          }
+        });
+        const loadedTeams = teamsResult.isOk() ? teamsResult.value : [];
+
+        // Upon returning teams, we're filtering out team roles that were already loaded.
+        // Also note that `team.roles` contains role IDs, not slugs.
+        const roleIdsFromTeams = loadedTeams.flatMap(team => team.roles).filter(roleId => {
+          const alreadyLoaded = loadedRoles.find(role => role.id === roleId);
+          return !alreadyLoaded;
+        });
+        if (roleIdsFromTeams.length > 0) {
+          const moreRolesResult = await this.rolesRepository.list({
+            where: {
+              id_in: roleIdsFromTeams
+            }
+          });
+          const rolesFromTeams = moreRolesResult.isOk() ? moreRolesResult.value : [];
+          loadedRoles.push(...rolesFromTeams);
+        }
+      }
+    }
+    if (loadedRoles.length > 0) {
+      return getPermissionsFromRoles(loadedRoles);
+    }
+    return null;
+  }
+}
+export const GetPermissionsFromIdentity = PermissionsProcessor.createImplementation({
+  implementation: GetPermissionsFromGroupsAndTeamsImpl,
+  dependencies: [WcpContext, AdminUsersRepository, RolesRepository, TeamsRepository]
+});
+
+//# sourceMappingURL=GetPermissionsFromIdentity.js.map

package/features/security/authorization/GroupsTeamsAuthorizer/GetPermissionsFromIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["WcpContext","PermissionsProcessor","RolesRepository","TeamsRepository","getPermissionsFromRoles","AdminUsersRepository","GetPermissionsFromGroupsAndTeamsImpl","constructor","wcpContext","usersRepository","rolesRepository","teamsRepository","getPermissions","identity","userResult","get","id","isFail","user","value","roleIds","teamIds","push","roles","filteredRoleIds","filter","Boolean","dedupedRoleIds","Array","from","Set","loadedRoles","length","rolesResult","list","where","id_in","loadedRolesByIds","isOk","canUseTeams","teams","filteredTeamIds","dedupedTeamIds","teamsResult","loadedTeams","roleIdsFromTeams","flatMap","team","roleId","alreadyLoaded","find","role","moreRolesResult","rolesFromTeams","GetPermissionsFromIdentity","createImplementation","implementation","dependencies"],"sources":["GetPermissionsFromIdentity.ts"],"sourcesContent":["import { WcpContext } from \"~/features/wcp/WcpContext/index.js\";\nimport type { SecurityRole } from \"~/types/security.js\";\nimport { Identity } from \"~/features/security/IdentityContext/index.js\";\nimport { PermissionsProcessor } from \"./abstractions.js\";\nimport { RolesRepository } from \"~/features/security/roles/shared/abstractions.js\";\nimport { TeamsRepository } from \"~/features/security/teams/shared/abstractions.js\";\nimport { getPermissionsFromRoles } from \"~/features/security/utils/getPermissionsFromRoles.js\";\nimport { AdminUsersRepository } from \"~/features/users/shared/abstractions.js\";\n\nexport type RoleId = string | undefined;\nexport type TeamId = string | undefined;\n\nclass GetPermissionsFromGroupsAndTeamsImpl implements PermissionsProcessor.Interface {\n    constructor(\n        private wcpContext: WcpContext.Interface,\n        private usersRepository: AdminUsersRepository.Interface,\n        private rolesRepository: RolesRepository.Interface,\n        private teamsRepository: TeamsRepository.Interface\n    ) {}\n\n    async getPermissions(identity: Identity) {\n        const userResult = await this.usersRepository.get({ id: identity.id });\n        if (userResult.isFail()) {\n            return null;\n        }\n\n        const user = userResult.value;\n\n        // Load roles that are associated with the current identity. Also load roles\n        // that are assigned via one or more teams (if the Teams feature is enabled).\n        const roleIds: RoleId[] = [];\n        const teamIds: TeamId[] = [];\n\n        roleIds.push(...(user.roles ?? []));\n\n        const filteredRoleIds = roleIds.filter(Boolean) as string[];\n        const dedupedRoleIds = Array.from(new Set(filteredRoleIds));\n\n        const loadedRoles: SecurityRole[] = [];\n\n        if (dedupedRoleIds.length > 0) {\n            const rolesResult = await this.rolesRepository.list({\n                where: { id_in: dedupedRoleIds }\n            });\n\n            const loadedRolesByIds = rolesResult.isOk() ? rolesResult.value : [];\n            loadedRoles.push(...loadedRolesByIds);\n        }\n\n        if (this.wcpContext.canUseTeams()) {\n            teamIds.push(...(user.teams ?? []));\n\n            const filteredTeamIds = teamIds.filter(Boolean) as string[];\n            const dedupedTeamIds = Array.from(new Set(filteredTeamIds));\n\n            if (dedupedTeamIds.length > 0) {\n                const teamsResult = await this.teamsRepository.list({\n                    where: { id_in: dedupedTeamIds }\n                });\n\n                const loadedTeams = teamsResult.isOk() ? teamsResult.value : [];\n\n                // Upon returning teams, we're filtering out team roles that were already loaded.\n                // Also note that `team.roles` contains role IDs, not slugs.\n                const roleIdsFromTeams = loadedTeams\n                    .flatMap(team => team.roles)\n                    .filter(roleId => {\n                        const alreadyLoaded = loadedRoles.find(role => role.id === roleId);\n                        return !alreadyLoaded;\n                    });\n\n                if (roleIdsFromTeams.length > 0) {\n                    const moreRolesResult = await this.rolesRepository.list({\n                        where: { id_in: roleIdsFromTeams }\n                    });\n\n                    const rolesFromTeams = moreRolesResult.isOk() ? moreRolesResult.value : [];\n                    loadedRoles.push(...rolesFromTeams);\n                }\n            }\n        }\n\n        if (loadedRoles.length > 0) {\n            return getPermissionsFromRoles(loadedRoles);\n        }\n\n        return null;\n    }\n}\n\nexport const GetPermissionsFromIdentity = PermissionsProcessor.createImplementation({\n    implementation: GetPermissionsFromGroupsAndTeamsImpl,\n    dependencies: [WcpContext, AdminUsersRepository, RolesRepository, TeamsRepository]\n});\n"],"mappings":"AAAA,SAASA,UAAU;AAGnB,SAASC,oBAAoB;AAC7B,SAASC,eAAe;AACxB,SAASC,eAAe;AACxB,SAASC,uBAAuB;AAChC,SAASC,oBAAoB;AAK7B,MAAMC,oCAAoC,CAA2C;EACjFC,WAAWA,CACCC,UAAgC,EAChCC,eAA+C,EAC/CC,eAA0C,EAC1CC,eAA0C,EACpD;IAAA,KAJUH,UAAgC,GAAhCA,UAAgC;IAAA,KAChCC,eAA+C,GAA/CA,eAA+C;IAAA,KAC/CC,eAA0C,GAA1CA,eAA0C;IAAA,KAC1CC,eAA0C,GAA1CA,eAA0C;EACnD;EAEH,MAAMC,cAAcA,CAACC,QAAkB,EAAE;IACrC,MAAMC,UAAU,GAAG,MAAM,IAAI,CAACL,eAAe,CAACM,GAAG,CAAC;MAAEC,EAAE,EAAEH,QAAQ,CAACG;IAAG,CAAC,CAAC;IACtE,IAAIF,UAAU,CAACG,MAAM,CAAC,CAAC,EAAE;MACrB,OAAO,IAAI;IACf;IAEA,MAAMC,IAAI,GAAGJ,UAAU,CAACK,KAAK;;IAE7B;IACA;IACA,MAAMC,OAAiB,GAAG,EAAE;IAC5B,MAAMC,OAAiB,GAAG,EAAE;IAE5BD,OAAO,CAACE,IAAI,CAAC,IAAIJ,IAAI,CAACK,KAAK,IAAI,EAAE,CAAC,CAAC;IAEnC,MAAMC,eAAe,GAAGJ,OAAO,CAACK,MAAM,CAACC,OAAO,CAAa;IAC3D,MAAMC,cAAc,GAAGC,KAAK,CAACC,IAAI,CAAC,IAAIC,GAAG,CAACN,eAAe,CAAC,CAAC;IAE3D,MAAMO,WAA2B,GAAG,EAAE;IAEtC,IAAIJ,cAAc,CAACK,MAAM,GAAG,CAAC,EAAE;MAC3B,MAAMC,WAAW,GAAG,MAAM,IAAI,CAACvB,eAAe,CAACwB,IAAI,CAAC;QAChDC,KAAK,EAAE;UAAEC,KAAK,EAAET;QAAe;MACnC,CAAC,CAAC;MAEF,MAAMU,gBAAgB,GAAGJ,WAAW,CAACK,IAAI,CAAC,CAAC,GAAGL,WAAW,CAACd,KAAK,GAAG,EAAE;MACpEY,WAAW,CAACT,IAAI,CAAC,GAAGe,gBAAgB,CAAC;IACzC;IAEA,IAAI,IAAI,CAAC7B,UAAU,CAAC+B,WAAW,CAAC,CAAC,EAAE;MAC/BlB,OAAO,CAACC,IAAI,CAAC,IAAIJ,IAAI,CAACsB,KAAK,IAAI,EAAE,CAAC,CAAC;MAEnC,MAAMC,eAAe,GAAGpB,OAAO,CAACI,MAAM,CAACC,OAAO,CAAa;MAC3D,MAAMgB,cAAc,GAAGd,KAAK,CAACC,IAAI,CAAC,IAAIC,GAAG,CAACW,eAAe,CAAC,CAAC;MAE3D,IAAIC,cAAc,CAACV,MAAM,GAAG,CAAC,EAAE;QAC3B,MAAMW,WAAW,GAAG,MAAM,IAAI,CAAChC,eAAe,CAACuB,IAAI,CAAC;UAChDC,KAAK,EAAE;YAAEC,KAAK,EAAEM;UAAe;QACnC,CAAC,CAAC;QAEF,MAAME,WAAW,GAAGD,WAAW,CAACL,IAAI,CAAC,CAAC,GAAGK,WAAW,CAACxB,KAAK,GAAG,EAAE;;QAE/D;QACA;QACA,MAAM0B,gBAAgB,GAAGD,WAAW,CAC/BE,OAAO,CAACC,IAAI,IAAIA,IAAI,CAACxB,KAAK,CAAC,CAC3BE,MAAM,CAACuB,MAAM,IAAI;UACd,MAAMC,aAAa,GAAGlB,WAAW,CAACmB,IAAI,CAACC,IAAI,IAAIA,IAAI,CAACnC,EAAE,KAAKgC,MAAM,CAAC;UAClE,OAAO,CAACC,aAAa;QACzB,CAAC,CAAC;QAEN,IAAIJ,gBAAgB,CAACb,MAAM,GAAG,CAAC,EAAE;UAC7B,MAAMoB,eAAe,GAAG,MAAM,IAAI,CAAC1C,eAAe,CAACwB,IAAI,CAAC;YACpDC,KAAK,EAAE;cAAEC,KAAK,EAAES;YAAiB;UACrC,CAAC,CAAC;UAEF,MAAMQ,cAAc,GAAGD,eAAe,CAACd,IAAI,CAAC,CAAC,GAAGc,eAAe,CAACjC,KAAK,GAAG,EAAE;UAC1EY,WAAW,CAACT,IAAI,CAAC,GAAG+B,cAAc,CAAC;QACvC;MACJ;IACJ;IAEA,IAAItB,WAAW,CAACC,MAAM,GAAG,CAAC,EAAE;MACxB,OAAO5B,uBAAuB,CAAC2B,WAAW,CAAC;IAC/C;IAEA,OAAO,IAAI;EACf;AACJ;AAEA,OAAO,MAAMuB,0BAA0B,GAAGrD,oBAAoB,CAACsD,oBAAoB,CAAC;EAChFC,cAAc,EAAElD,oCAAoC;EACpDmD,YAAY,EAAE,CAACzD,UAAU,EAAEK,oBAAoB,EAAEH,eAAe,EAAEC,eAAe;AACrF,CAAC,CAAC","ignoreList":[]}

package/features/security/authorization/GroupsTeamsAuthorizer/RolesTeamsAuthorizer.d.ts

@@ -0,0 +1,17 @@
+import { Authorizer } from "../../../../features/security/authorization/Authorizer/index.js";
+import { Identity } from "../../../../features/security/IdentityContext/index.js";
+import type { SecurityPermission } from "../../../../types/security.js";
+import { TenantContext } from "../../../../features/tenancy/TenantContext/index.js";
+import { GetTenantByIdUseCase } from "../../../../features/tenancy/GetTenantById/index.js";
+import { PermissionsProcessor } from "./abstractions.js";
+declare class GroupsTeamsAuthorizerImpl implements Authorizer.Interface {
+    private readonly tenantContext;
+    private readonly getTenantByIdUseCase;
+    private readonly permissionsProcessor;
+    constructor(tenantContext: TenantContext.Interface, getTenantByIdUseCase: GetTenantByIdUseCase.Interface, permissionsProcessor: PermissionsProcessor.Interface);
+    authorize(identity: Identity): Promise<SecurityPermission[] | null>;
+}
+export declare const RolesTeamsAuthorizer: typeof GroupsTeamsAuthorizerImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("~/features/security/authorization/Authorizer/index.js").IAuthorizer>;
+};
+export {};

package/features/security/authorization/GroupsTeamsAuthorizer/RolesTeamsAuthorizer.js

@@ -0,0 +1,51 @@
+import { Authorizer } from "../Authorizer/index.js";
+import { TenantContext } from "../../../tenancy/TenantContext/index.js";
+import { GetTenantByIdUseCase } from "../../../tenancy/GetTenantById/index.js";
+import { PermissionsProcessor } from "./abstractions.js";
+class GroupsTeamsAuthorizerImpl {
+  constructor(tenantContext, getTenantByIdUseCase, permissionsProcessor) {
+    this.tenantContext = tenantContext;
+    this.getTenantByIdUseCase = getTenantByIdUseCase;
+    this.permissionsProcessor = permissionsProcessor;
+  }
+  async authorize(identity) {
+    const tenant = this.tenantContext.getTenant();
+    if (identity.isAnonymous() || identity.type !== "admin") {
+      return null;
+    }
+    if (!identity.context.canAccessTenant) {
+      return null;
+    }
+    const currentTenantPermissions = await this.permissionsProcessor.getPermissions(identity);
+    if (Array.isArray(currentTenantPermissions)) {
+      return currentTenantPermissions;
+    }
+
+    // If no security roles were found, it could be due to an identity accessing a sub-tenant. In this case,
+    // let's try loading permissions from the parent tenant. Note that this will work well for flat tenant
+    // hierarchy where there's a `root` tenant and 1 level of sibling sub-tenants. For multi-level hierarchy,
+    // the best approach is to code a plugin with the desired permissions-fetching logic.
+    const parentTenantId = tenant.parent;
+    if (!parentTenantId) {
+      return null;
+    }
+    const result = await this.getTenantByIdUseCase.execute(parentTenantId);
+    if (result.isFail()) {
+      return null;
+    }
+    const parentTenant = result.value;
+    const parentTenantPermissions = await this.tenantContext.withTenant(parentTenant, () => {
+      return this.permissionsProcessor.getPermissions(identity);
+    });
+    if (Array.isArray(parentTenantPermissions)) {
+      return parentTenantPermissions;
+    }
+    return null;
+  }
+}
+export const RolesTeamsAuthorizer = Authorizer.createImplementation({
+  implementation: GroupsTeamsAuthorizerImpl,
+  dependencies: [TenantContext, GetTenantByIdUseCase, PermissionsProcessor]
+});
+
+//# sourceMappingURL=RolesTeamsAuthorizer.js.map

package/features/security/authorization/GroupsTeamsAuthorizer/RolesTeamsAuthorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["Authorizer","TenantContext","GetTenantByIdUseCase","PermissionsProcessor","GroupsTeamsAuthorizerImpl","constructor","tenantContext","getTenantByIdUseCase","permissionsProcessor","authorize","identity","tenant","getTenant","isAnonymous","type","context","canAccessTenant","currentTenantPermissions","getPermissions","Array","isArray","parentTenantId","parent","result","execute","isFail","parentTenant","value","parentTenantPermissions","withTenant","RolesTeamsAuthorizer","createImplementation","implementation","dependencies"],"sources":["RolesTeamsAuthorizer.ts"],"sourcesContent":["import { Authorizer } from \"~/features/security/authorization/Authorizer/index.js\";\nimport { Identity } from \"~/features/security/IdentityContext/index.js\";\nimport type { SecurityPermission } from \"~/types/security.js\";\nimport { TenantContext } from \"~/features/tenancy/TenantContext/index.js\";\nimport { GetTenantByIdUseCase } from \"~/features/tenancy/GetTenantById/index.js\";\nimport { PermissionsProcessor } from \"./abstractions.js\";\n\nclass GroupsTeamsAuthorizerImpl implements Authorizer.Interface {\n    constructor(\n        private readonly tenantContext: TenantContext.Interface,\n        private readonly getTenantByIdUseCase: GetTenantByIdUseCase.Interface,\n        private readonly permissionsProcessor: PermissionsProcessor.Interface\n    ) {}\n\n    async authorize(identity: Identity): Promise<SecurityPermission[] | null> {\n        const tenant = this.tenantContext.getTenant();\n\n        if (identity.isAnonymous() || identity.type !== \"admin\") {\n            return null;\n        }\n\n        if (!identity.context.canAccessTenant) {\n            return null;\n        }\n\n        const currentTenantPermissions = await this.permissionsProcessor.getPermissions(identity);\n\n        if (Array.isArray(currentTenantPermissions)) {\n            return currentTenantPermissions;\n        }\n\n        // If no security roles were found, it could be due to an identity accessing a sub-tenant. In this case,\n        // let's try loading permissions from the parent tenant. Note that this will work well for flat tenant\n        // hierarchy where there's a `root` tenant and 1 level of sibling sub-tenants. For multi-level hierarchy,\n        // the best approach is to code a plugin with the desired permissions-fetching logic.\n        const parentTenantId = tenant.parent;\n        if (!parentTenantId) {\n            return null;\n        }\n\n        const result = await this.getTenantByIdUseCase.execute(parentTenantId);\n        if (result.isFail()) {\n            return null;\n        }\n\n        const parentTenant = result.value;\n\n        const parentTenantPermissions = await this.tenantContext.withTenant(parentTenant, () => {\n            return this.permissionsProcessor.getPermissions(identity);\n        });\n\n        if (Array.isArray(parentTenantPermissions)) {\n            return parentTenantPermissions;\n        }\n\n        return null;\n    }\n}\n\nexport const RolesTeamsAuthorizer = Authorizer.createImplementation({\n    implementation: GroupsTeamsAuthorizerImpl,\n    dependencies: [TenantContext, GetTenantByIdUseCase, PermissionsProcessor]\n});\n"],"mappings":"AAAA,SAASA,UAAU;AAGnB,SAASC,aAAa;AACtB,SAASC,oBAAoB;AAC7B,SAASC,oBAAoB;AAE7B,MAAMC,yBAAyB,CAAiC;EAC5DC,WAAWA,CACUC,aAAsC,EACtCC,oBAAoD,EACpDC,oBAAoD,EACvE;IAAA,KAHmBF,aAAsC,GAAtCA,aAAsC;IAAA,KACtCC,oBAAoD,GAApDA,oBAAoD;IAAA,KACpDC,oBAAoD,GAApDA,oBAAoD;EACtE;EAEH,MAAMC,SAASA,CAACC,QAAkB,EAAwC;IACtE,MAAMC,MAAM,GAAG,IAAI,CAACL,aAAa,CAACM,SAAS,CAAC,CAAC;IAE7C,IAAIF,QAAQ,CAACG,WAAW,CAAC,CAAC,IAAIH,QAAQ,CAACI,IAAI,KAAK,OAAO,EAAE;MACrD,OAAO,IAAI;IACf;IAEA,IAAI,CAACJ,QAAQ,CAACK,OAAO,CAACC,eAAe,EAAE;MACnC,OAAO,IAAI;IACf;IAEA,MAAMC,wBAAwB,GAAG,MAAM,IAAI,CAACT,oBAAoB,CAACU,cAAc,CAACR,QAAQ,CAAC;IAEzF,IAAIS,KAAK,CAACC,OAAO,CAACH,wBAAwB,CAAC,EAAE;MACzC,OAAOA,wBAAwB;IACnC;;IAEA;IACA;IACA;IACA;IACA,MAAMI,cAAc,GAAGV,MAAM,CAACW,MAAM;IACpC,IAAI,CAACD,cAAc,EAAE;MACjB,OAAO,IAAI;IACf;IAEA,MAAME,MAAM,GAAG,MAAM,IAAI,CAAChB,oBAAoB,CAACiB,OAAO,CAACH,cAAc,CAAC;IACtE,IAAIE,MAAM,CAACE,MAAM,CAAC,CAAC,EAAE;MACjB,OAAO,IAAI;IACf;IAEA,MAAMC,YAAY,GAAGH,MAAM,CAACI,KAAK;IAEjC,MAAMC,uBAAuB,GAAG,MAAM,IAAI,CAACtB,aAAa,CAACuB,UAAU,CAACH,YAAY,EAAE,MAAM;MACpF,OAAO,IAAI,CAAClB,oBAAoB,CAACU,cAAc,CAACR,QAAQ,CAAC;IAC7D,CAAC,CAAC;IAEF,IAAIS,KAAK,CAACC,OAAO,CAACQ,uBAAuB,CAAC,EAAE;MACxC,OAAOA,uBAAuB;IAClC;IAEA,OAAO,IAAI;EACf;AACJ;AAEA,OAAO,MAAME,oBAAoB,GAAG9B,UAAU,CAAC+B,oBAAoB,CAAC;EAChEC,cAAc,EAAE5B,yBAAyB;EACzC6B,YAAY,EAAE,CAAChC,aAAa,EAAEC,oBAAoB,EAAEC,oBAAoB;AAC5E,CAAC,CAAC","ignoreList":[]}

package/features/security/authorization/GroupsTeamsAuthorizer/abstractions.d.ts

@@ -0,0 +1,13 @@
+import type { SecurityPermission } from "../../../../types/security.js";
+import { Identity } from "../../../../features/security/IdentityContext/index.js";
+export interface ITenantPermission extends SecurityPermission {
+    _src: string;
+}
+export interface IPermissionsProcessor {
+    getPermissions(identity: Identity): Promise<ITenantPermission[] | null>;
+}
+export declare const PermissionsProcessor: import("@webiny/di").Abstraction<IPermissionsProcessor>;
+export declare namespace PermissionsProcessor {
+    type Interface = IPermissionsProcessor;
+    type Permissions = ITenantPermission[];
+}

package/features/security/authorization/GroupsTeamsAuthorizer/abstractions.js

@@ -0,0 +1,4 @@
+import { createAbstraction } from "@webiny/feature/api";
+export const PermissionsProcessor = createAbstraction("PermissionsProcessor");
+
+//# sourceMappingURL=abstractions.js.map

package/features/security/authorization/GroupsTeamsAuthorizer/abstractions.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createAbstraction","PermissionsProcessor"],"sources":["abstractions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport type { SecurityPermission } from \"~/types/security.js\";\nimport { Identity } from \"~/features/security/IdentityContext/index.js\";\n\nexport interface ITenantPermission extends SecurityPermission {\n    _src: string;\n}\n\nexport interface IPermissionsProcessor {\n    getPermissions(identity: Identity): Promise<ITenantPermission[] | null>;\n}\n\nexport const PermissionsProcessor =\n    createAbstraction<IPermissionsProcessor>(\"PermissionsProcessor\");\n\nexport namespace PermissionsProcessor {\n    export type Interface = IPermissionsProcessor;\n    export type Permissions = ITenantPermission[];\n}\n"],"mappings":"AAAA,SAASA,iBAAiB,QAAQ,qBAAqB;AAYvD,OAAO,MAAMC,oBAAoB,GAC7BD,iBAAiB,CAAwB,sBAAsB,CAAC","ignoreList":[]}

package/features/security/authorization/GroupsTeamsAuthorizer/feature.d.ts

@@ -0,0 +1 @@
+export declare const GroupsTeamsAuthorizerFeature: import("@webiny/feature/api/createFeature.js").FeatureDefinition<unknown>;

package/features/security/authorization/GroupsTeamsAuthorizer/feature.js

@@ -0,0 +1,12 @@
+import { createFeature } from "@webiny/feature/api";
+import { RolesTeamsAuthorizer } from "./RolesTeamsAuthorizer.js";
+import { GetPermissionsFromIdentity } from "./GetPermissionsFromIdentity.js";
+export const GroupsTeamsAuthorizerFeature = createFeature({
+  name: "GroupsTeamsAuthorizer",
+  register(container) {
+    container.register(RolesTeamsAuthorizer).inSingletonScope();
+    container.register(GetPermissionsFromIdentity);
+  }
+});
+
+//# sourceMappingURL=feature.js.map

package/features/security/authorization/GroupsTeamsAuthorizer/feature.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createFeature","RolesTeamsAuthorizer","GetPermissionsFromIdentity","GroupsTeamsAuthorizerFeature","name","register","container","inSingletonScope"],"sources":["feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { RolesTeamsAuthorizer } from \"./RolesTeamsAuthorizer.js\";\nimport { GetPermissionsFromIdentity } from \"./GetPermissionsFromIdentity.js\";\n\nexport const GroupsTeamsAuthorizerFeature = createFeature({\n    name: \"GroupsTeamsAuthorizer\",\n    register(container) {\n        container.register(RolesTeamsAuthorizer).inSingletonScope();\n        container.register(GetPermissionsFromIdentity);\n    }\n});\n"],"mappings":"AAAA,SAASA,aAAa,QAAQ,qBAAqB;AACnD,SAASC,oBAAoB;AAC7B,SAASC,0BAA0B;AAEnC,OAAO,MAAMC,4BAA4B,GAAGH,aAAa,CAAC;EACtDI,IAAI,EAAE,uBAAuB;EAC7BC,QAAQA,CAACC,SAAS,EAAE;IAChBA,SAAS,CAACD,QAAQ,CAACJ,oBAAoB,CAAC,CAACM,gBAAgB,CAAC,CAAC;IAC3DD,SAAS,CAACD,QAAQ,CAACH,0BAA0B,CAAC;EAClD;AACJ,CAAC,CAAC","ignoreList":[]}

package/features/security/login/abstractions.d.ts

@@ -0,0 +1,15 @@
+import { DomainEvent } from "../../../features/eventPublisher/index.js";
+import type { IEventHandler } from "../../../features/eventPublisher/index.js";
+import { Identity } from "../../../features/security/IdentityContext/index.js";
+export interface AfterLoginPayload {
+    identity: Identity;
+}
+export declare class AfterLoginEvent extends DomainEvent<AfterLoginPayload> {
+    eventType: "login.afterLogin";
+    getHandlerAbstraction(): import("@webiny/di").Abstraction<IEventHandler<AfterLoginEvent>>;
+}
+export declare const AfterLoginHandler: import("@webiny/di").Abstraction<IEventHandler<AfterLoginEvent>>;
+export declare namespace AfterLoginHandler {
+    type Interface = IEventHandler<AfterLoginEvent>;
+    type Event = AfterLoginEvent;
+}

package/features/security/login/abstractions.js

@@ -0,0 +1,11 @@
+import { DomainEvent } from "../../eventPublisher/index.js";
+import { createAbstraction } from "@webiny/feature/api";
+export class AfterLoginEvent extends DomainEvent {
+  eventType = "login.afterLogin";
+  getHandlerAbstraction() {
+    return AfterLoginHandler;
+  }
+}
+export const AfterLoginHandler = createAbstraction("AfterLoginHandler");
+
+//# sourceMappingURL=abstractions.js.map

package/features/security/login/abstractions.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["DomainEvent","createAbstraction","AfterLoginEvent","eventType","getHandlerAbstraction","AfterLoginHandler"],"sources":["abstractions.ts"],"sourcesContent":["import { DomainEvent } from \"~/features/eventPublisher/index.js\";\nimport type { IEventHandler } from \"~/features/eventPublisher/index.js\";\nimport { createAbstraction } from \"@webiny/feature/api\";\nimport { Identity } from \"~/features/security/IdentityContext/index.js\";\n\nexport interface AfterLoginPayload {\n    identity: Identity;\n}\n\nexport class AfterLoginEvent extends DomainEvent<AfterLoginPayload> {\n    eventType = \"login.afterLogin\" as const;\n\n    getHandlerAbstraction() {\n        return AfterLoginHandler;\n    }\n}\n\nexport const AfterLoginHandler =\n    createAbstraction<IEventHandler<AfterLoginEvent>>(\"AfterLoginHandler\");\n\nexport namespace AfterLoginHandler {\n    export type Interface = IEventHandler<AfterLoginEvent>;\n    export type Event = AfterLoginEvent;\n}\n"],"mappings":"AAAA,SAASA,WAAW;AAEpB,SAASC,iBAAiB,QAAQ,qBAAqB;AAOvD,OAAO,MAAMC,eAAe,SAASF,WAAW,CAAoB;EAChEG,SAAS,GAAG,kBAAkB;EAE9BC,qBAAqBA,CAAA,EAAG;IACpB,OAAOC,iBAAiB;EAC5B;AACJ;AAEA,OAAO,MAAMA,iBAAiB,GAC1BJ,iBAAiB,CAAiC,mBAAmB,CAAC","ignoreList":[]}

package/features/security/login/index.d.ts

@@ -0,0 +1 @@
+export * from "./abstractions.js";

package/features/security/login/index.js

@@ -0,0 +1,3 @@
+export * from "./abstractions.js";
+
+//# sourceMappingURL=index.js.map

package/features/security/login/index.js.map

@@ -0,0 +1 @@
+{"version":3,"names":[],"sources":["index.ts"],"sourcesContent":["export * from \"./abstractions.js\";\n"],"mappings":"AAAA","ignoreList":[]}

package/features/security/permissions/createPermissions.d.ts

@@ -0,0 +1,8 @@
+import type { PermissionSchemaConfig } from "./types.js";
+import type { Permissions } from "./types.js";
+export declare function createPermissions<const S extends PermissionSchemaConfig>(schema: S): {
+    Abstraction: import("@webiny/di").Abstraction<Permissions<S>>;
+    Implementation: import("@webiny/di").Constructor<Permissions<S>> & {
+        __abstraction: import("@webiny/di").Abstraction<Permissions<S>>;
+    };
+};

package/features/security/permissions/createPermissions.js

@@ -0,0 +1,240 @@
+import { createAbstraction } from "@webiny/feature/api";
+import { IdentityContext } from "../IdentityContext/index.js";
+function buildEntityMap(schema) {
+  const map = new Map();
+  for (const entity of schema.entities ?? []) {
+    const actions = new Set();
+    for (const action of entity.actions ?? []) {
+      actions.add(action.name);
+    }
+    map.set(entity.id, {
+      permission: entity.permission,
+      actions,
+      hasOwn: entity.scopes.includes("own")
+    });
+  }
+  return map;
+}
+function getEntity(entityMap, entityId) {
+  const entity = entityMap.get(entityId);
+  if (!entity) {
+    throw new Error(`Unknown entity "${entityId}" in permission schema.`);
+  }
+  return entity;
+}
+export function createPermissions(schema) {
+  const entityMap = buildEntityMap(schema);
+  const fullAccessName = `${schema.prefix}.*`;
+  class SchemaPermissions {
+    constructor(identityContext) {
+      this.identityContext = identityContext;
+    }
+    async canAccess(entityId, item) {
+      if (await this.identityContext.hasFullAccess()) {
+        return true;
+      }
+      if (await this.hasFullSchemaAccess()) {
+        return true;
+      }
+      const entity = getEntity(entityMap, entityId);
+      const permissions = await this.getEntityPermissions(entity.permission);
+      if (!permissions.length) {
+        return false;
+      }
+      // No item — just check entity-level access.
+      if (item === undefined) {
+        return true;
+      }
+      // Item provided — if all permissions require own, verify ownership.
+      const ownOnly = !permissions.some(p => !p.own);
+      if (!ownOnly) {
+        return true;
+      }
+      const identity = this.identityContext.getIdentity();
+      return item.createdBy?.id === identity.id;
+    }
+    async onlyOwnRecords(entityId) {
+      if (await this.identityContext.hasFullAccess()) {
+        return false;
+      }
+      if (await this.hasFullSchemaAccess()) {
+        return false;
+      }
+      const entity = getEntity(entityMap, entityId);
+      const permissions = await this.getEntityPermissions(entity.permission);
+      if (!permissions.length) {
+        return false;
+      }
+      return !permissions.some(p => !p.own);
+    }
+    async canRead(entityId) {
+      if (await this.identityContext.hasFullAccess()) {
+        return true;
+      }
+      if (await this.hasFullSchemaAccess()) {
+        return true;
+      }
+      const entity = getEntity(entityMap, entityId);
+      const permissions = await this.getEntityPermissions(entity.permission);
+      if (!permissions.length) {
+        return false;
+      }
+      return permissions.some(permission => {
+        if (typeof permission.rwd !== "string") {
+          return true;
+        }
+        return permission.rwd.includes("r");
+      });
+    }
+    async canCreate(entityId) {
+      if (await this.identityContext.hasFullAccess()) {
+        return true;
+      }
+      if (await this.hasFullSchemaAccess()) {
+        return true;
+      }
+      const entity = getEntity(entityMap, entityId);
+      const permissions = await this.getEntityPermissions(entity.permission);
+      if (!permissions.length) {
+        return false;
+      }
+      return permissions.some(permission => {
+        if (typeof permission.rwd !== "string") {
+          return true;
+        }
+        return permission.rwd.includes("w");
+      });
+    }
+    async canEdit(entityId, item) {
+      if (await this.identityContext.hasFullAccess()) {
+        return true;
+      }
+      if (await this.hasFullSchemaAccess()) {
+        return true;
+      }
+      const entity = getEntity(entityMap, entityId);
+      const permissions = await this.getEntityPermissions(entity.permission);
+      if (!permissions.length) {
+        return false;
+      }
+      const identity = this.identityContext.getIdentity();
+      return permissions.some(permission => {
+        if (permission.own) {
+          // No item provided (new/unsaved) — allow access.
+          if (!item?.createdBy) {
+            return true;
+          }
+          return item.createdBy.id === identity.id;
+        }
+        if (typeof permission.rwd !== "string") {
+          return true;
+        }
+        return permission.rwd.includes("w");
+      });
+    }
+    async canDelete(entityId, item) {
+      if (await this.identityContext.hasFullAccess()) {
+        return true;
+      }
+      if (await this.hasFullSchemaAccess()) {
+        return true;
+      }
+      const entity = getEntity(entityMap, entityId);
+      const permissions = await this.getEntityPermissions(entity.permission);
+      if (!permissions.length) {
+        return false;
+      }
+      const identity = this.identityContext.getIdentity();
+      return permissions.some(permission => {
+        if (permission.own) {
+          return item?.createdBy?.id === identity.id;
+        }
+        if (typeof permission.rwd !== "string") {
+          return true;
+        }
+        return permission.rwd.includes("d");
+      });
+    }
+    async canPublish(entityId) {
+      if (await this.identityContext.hasFullAccess()) {
+        return true;
+      }
+      if (await this.hasFullSchemaAccess()) {
+        return true;
+      }
+      const entity = getEntity(entityMap, entityId);
+      const permissions = await this.getEntityPermissions(entity.permission);
+      if (!permissions.length) {
+        return false;
+      }
+      return permissions.some(permission => {
+        return permission.pw?.includes("p");
+      });
+    }
+    async canUnpublish(entityId) {
+      if (await this.identityContext.hasFullAccess()) {
+        return true;
+      }
+      if (await this.hasFullSchemaAccess()) {
+        return true;
+      }
+      const entity = getEntity(entityMap, entityId);
+      const permissions = await this.getEntityPermissions(entity.permission);
+      if (!permissions.length) {
+        return false;
+      }
+      return permissions.some(permission => {
+        return permission.pw?.includes("u");
+      });
+    }
+    async canAction(action, entityId) {
+      if (await this.identityContext.hasFullAccess()) {
+        return true;
+      }
+      if (await this.hasFullSchemaAccess()) {
+        return true;
+      }
+      const entity = getEntity(entityMap, entityId);
+      const permissions = await this.getEntityPermissions(entity.permission);
+      if (!permissions.length) {
+        return false;
+      }
+      return permissions.some(permission => {
+        return permission[action] === true;
+      });
+    }
+    async getEntityPermissions(entityPermission) {
+      const permissions = await this.identityContext.getPermissions(entityPermission);
+      if (permissions.length) {
+        return permissions;
+      }
+      // Fall back to the schema wildcard (e.g. "test.*") — its flags apply to all entities.
+      const wildcard = await this.identityContext.getPermission(fullAccessName);
+      return wildcard ? [wildcard] : [];
+    }
+    async hasFullSchemaAccess() {
+      const permission = await this.identityContext.getPermission(fullAccessName);
+      if (!permission) {
+        return false;
+      }
+      // Only treat as full access if the permission has no `rwd` flag.
+      // A permission like { name: "wb.*", rwd: "r" } should NOT grant full access.
+      const keys = Object.keys(permission).filter(k => k !== "name");
+      const hasRwd = keys.includes("rwd");
+
+      // It's full-access only if there's no `rwd` flag.
+      return !hasRwd;
+    }
+  }
+  const Abstraction = createAbstraction(`${schema.prefix}:Permissions`);
+  const Implementation = Abstraction.createImplementation({
+    implementation: SchemaPermissions,
+    dependencies: [IdentityContext]
+  });
+  return {
+    Abstraction,
+    Implementation
+  };
+}
+
+//# sourceMappingURL=createPermissions.js.map

package/features/security/permissions/createPermissions.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createAbstraction","IdentityContext","buildEntityMap","schema","map","Map","entity","entities","actions","Set","action","add","name","set","id","permission","hasOwn","scopes","includes","getEntity","entityMap","entityId","get","Error","createPermissions","fullAccessName","prefix","SchemaPermissions","constructor","identityContext","canAccess","item","hasFullAccess","hasFullSchemaAccess","permissions","getEntityPermissions","length","undefined","ownOnly","some","p","own","identity","getIdentity","createdBy","onlyOwnRecords","canRead","rwd","canCreate","canEdit","canDelete","canPublish","pw","canUnpublish","canAction","entityPermission","getPermissions","wildcard","getPermission","keys","Object","filter","k","hasRwd","Abstraction","Implementation","createImplementation","implementation","dependencies"],"sources":["createPermissions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport { IdentityContext } from \"~/features/security/IdentityContext/index.js\";\nimport type { PermissionSchemaConfig } from \"./types.js\";\nimport type { OwnableItem } from \"./types.js\";\nimport type { Permissions } from \"./types.js\";\n\ninterface EntityLookup {\n    permission: string;\n    actions: Set<string>;\n    hasOwn: boolean;\n}\n\nfunction buildEntityMap(schema: PermissionSchemaConfig): Map<string, EntityLookup> {\n    const map = new Map<string, EntityLookup>();\n    for (const entity of schema.entities ?? []) {\n        const actions = new Set<string>();\n        for (const action of entity.actions ?? []) {\n            actions.add(action.name);\n        }\n        map.set(entity.id, {\n            permission: entity.permission,\n            actions,\n            hasOwn: entity.scopes.includes(\"own\")\n        });\n    }\n    return map;\n}\n\nfunction getEntity(entityMap: Map<string, EntityLookup>, entityId: string): EntityLookup {\n    const entity = entityMap.get(entityId);\n    if (!entity) {\n        throw new Error(`Unknown entity \"${entityId}\" in permission schema.`);\n    }\n    return entity;\n}\n\nexport function createPermissions<const S extends PermissionSchemaConfig>(schema: S) {\n    const entityMap = buildEntityMap(schema);\n    const fullAccessName = `${schema.prefix}.*`;\n\n    class SchemaPermissions {\n        constructor(private identityContext: IdentityContext.Interface) {}\n\n        async canAccess(entityId: string, item?: OwnableItem): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            // No item — just check entity-level access.\n            if (item === undefined) {\n                return true;\n            }\n            // Item provided — if all permissions require own, verify ownership.\n            const ownOnly = !permissions.some(p => !p.own);\n            if (!ownOnly) {\n                return true;\n            }\n            const identity = this.identityContext.getIdentity();\n            return item.createdBy?.id === identity.id;\n        }\n\n        async onlyOwnRecords(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return false;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return false;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return !permissions.some(p => !p.own);\n        }\n\n        async canRead(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                if (typeof permission.rwd !== \"string\") {\n                    return true;\n                }\n                return permission.rwd.includes(\"r\");\n            });\n        }\n\n        async canCreate(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                if (typeof permission.rwd !== \"string\") {\n                    return true;\n                }\n                return permission.rwd.includes(\"w\");\n            });\n        }\n\n        async canEdit(entityId: string, item?: OwnableItem): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            const identity = this.identityContext.getIdentity();\n            return permissions.some(permission => {\n                if (permission.own) {\n                    // No item provided (new/unsaved) — allow access.\n                    if (!item?.createdBy) {\n                        return true;\n                    }\n                    return item.createdBy.id === identity.id;\n                }\n                if (typeof permission.rwd !== \"string\") {\n                    return true;\n                }\n                return permission.rwd.includes(\"w\");\n            });\n        }\n\n        async canDelete(entityId: string, item?: OwnableItem): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            const identity = this.identityContext.getIdentity();\n            return permissions.some(permission => {\n                if (permission.own) {\n                    return item?.createdBy?.id === identity.id;\n                }\n                if (typeof permission.rwd !== \"string\") {\n                    return true;\n                }\n                return permission.rwd.includes(\"d\");\n            });\n        }\n\n        async canPublish(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                return permission.pw?.includes(\"p\");\n            });\n        }\n\n        async canUnpublish(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                return permission.pw?.includes(\"u\");\n            });\n        }\n\n        async canAction(action: string, entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                return permission[action] === true;\n            });\n        }\n\n        private async getEntityPermissions(entityPermission: string): Promise<any[]> {\n            const permissions = await this.identityContext.getPermissions(entityPermission);\n            if (permissions.length) {\n                return permissions;\n            }\n            // Fall back to the schema wildcard (e.g. \"test.*\") — its flags apply to all entities.\n            const wildcard = await this.identityContext.getPermission(fullAccessName);\n            return wildcard ? [wildcard] : [];\n        }\n\n        private async hasFullSchemaAccess(): Promise<boolean> {\n            const permission = await this.identityContext.getPermission(fullAccessName);\n            if (!permission) {\n                return false;\n            }\n            // Only treat as full access if the permission has no `rwd` flag.\n            // A permission like { name: \"wb.*\", rwd: \"r\" } should NOT grant full access.\n            const keys = Object.keys(permission).filter(k => k !== \"name\");\n\n            const hasRwd = keys.includes(\"rwd\");\n\n            // It's full-access only if there's no `rwd` flag.\n            return !hasRwd;\n        }\n    }\n\n    const Abstraction = createAbstraction<Permissions<S>>(`${schema.prefix}:Permissions`);\n\n    const Implementation = Abstraction.createImplementation({\n        implementation: SchemaPermissions,\n        dependencies: [IdentityContext]\n    } as any);\n\n    return { Abstraction, Implementation };\n}\n"],"mappings":"AAAA,SAASA,iBAAiB,QAAQ,qBAAqB;AACvD,SAASC,eAAe;AAWxB,SAASC,cAAcA,CAACC,MAA8B,EAA6B;EAC/E,MAAMC,GAAG,GAAG,IAAIC,GAAG,CAAuB,CAAC;EAC3C,KAAK,MAAMC,MAAM,IAAIH,MAAM,CAACI,QAAQ,IAAI,EAAE,EAAE;IACxC,MAAMC,OAAO,GAAG,IAAIC,GAAG,CAAS,CAAC;IACjC,KAAK,MAAMC,MAAM,IAAIJ,MAAM,CAACE,OAAO,IAAI,EAAE,EAAE;MACvCA,OAAO,CAACG,GAAG,CAACD,MAAM,CAACE,IAAI,CAAC;IAC5B;IACAR,GAAG,CAACS,GAAG,CAACP,MAAM,CAACQ,EAAE,EAAE;MACfC,UAAU,EAAET,MAAM,CAACS,UAAU;MAC7BP,OAAO;MACPQ,MAAM,EAAEV,MAAM,CAACW,MAAM,CAACC,QAAQ,CAAC,KAAK;IACxC,CAAC,CAAC;EACN;EACA,OAAOd,GAAG;AACd;AAEA,SAASe,SAASA,CAACC,SAAoC,EAAEC,QAAgB,EAAgB;EACrF,MAAMf,MAAM,GAAGc,SAAS,CAACE,GAAG,CAACD,QAAQ,CAAC;EACtC,IAAI,CAACf,MAAM,EAAE;IACT,MAAM,IAAIiB,KAAK,CAAC,mBAAmBF,QAAQ,yBAAyB,CAAC;EACzE;EACA,OAAOf,MAAM;AACjB;AAEA,OAAO,SAASkB,iBAAiBA,CAAyCrB,MAAS,EAAE;EACjF,MAAMiB,SAAS,GAAGlB,cAAc,CAACC,MAAM,CAAC;EACxC,MAAMsB,cAAc,GAAG,GAAGtB,MAAM,CAACuB,MAAM,IAAI;EAE3C,MAAMC,iBAAiB,CAAC;IACpBC,WAAWA,CAASC,eAA0C,EAAE;MAAA,KAA5CA,eAA0C,GAA1CA,eAA0C;IAAG;IAEjE,MAAMC,SAASA,CAACT,QAAgB,EAAEU,IAAkB,EAAoB;MACpE,IAAI,MAAM,IAAI,CAACF,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA;MACA,IAAIL,IAAI,KAAKM,SAAS,EAAE;QACpB,OAAO,IAAI;MACf;MACA;MACA,MAAMC,OAAO,GAAG,CAACJ,WAAW,CAACK,IAAI,CAACC,CAAC,IAAI,CAACA,CAAC,CAACC,GAAG,CAAC;MAC9C,IAAI,CAACH,OAAO,EAAE;QACV,OAAO,IAAI;MACf;MACA,MAAMI,QAAQ,GAAG,IAAI,CAACb,eAAe,CAACc,WAAW,CAAC,CAAC;MACnD,OAAOZ,IAAI,CAACa,SAAS,EAAE9B,EAAE,KAAK4B,QAAQ,CAAC5B,EAAE;IAC7C;IAEA,MAAM+B,cAAcA,CAACxB,QAAgB,EAAoB;MACrD,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,KAAK;MAChB;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,KAAK;MAChB;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAO,CAACF,WAAW,CAACK,IAAI,CAACC,CAAC,IAAI,CAACA,CAAC,CAACC,GAAG,CAAC;IACzC;IAEA,MAAMK,OAAOA,CAACzB,QAAgB,EAAoB;MAC9C,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,IAAI,OAAOA,UAAU,CAACgC,GAAG,KAAK,QAAQ,EAAE;UACpC,OAAO,IAAI;QACf;QACA,OAAOhC,UAAU,CAACgC,GAAG,CAAC7B,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAM8B,SAASA,CAAC3B,QAAgB,EAAoB;MAChD,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,IAAI,OAAOA,UAAU,CAACgC,GAAG,KAAK,QAAQ,EAAE;UACpC,OAAO,IAAI;QACf;QACA,OAAOhC,UAAU,CAACgC,GAAG,CAAC7B,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAM+B,OAAOA,CAAC5B,QAAgB,EAAEU,IAAkB,EAAoB;MAClE,IAAI,MAAM,IAAI,CAACF,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,MAAMM,QAAQ,GAAG,IAAI,CAACb,eAAe,CAACc,WAAW,CAAC,CAAC;MACnD,OAAOT,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,IAAIA,UAAU,CAAC0B,GAAG,EAAE;UAChB;UACA,IAAI,CAACV,IAAI,EAAEa,SAAS,EAAE;YAClB,OAAO,IAAI;UACf;UACA,OAAOb,IAAI,CAACa,SAAS,CAAC9B,EAAE,KAAK4B,QAAQ,CAAC5B,EAAE;QAC5C;QACA,IAAI,OAAOC,UAAU,CAACgC,GAAG,KAAK,QAAQ,EAAE;UACpC,OAAO,IAAI;QACf;QACA,OAAOhC,UAAU,CAACgC,GAAG,CAAC7B,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAMgC,SAASA,CAAC7B,QAAgB,EAAEU,IAAkB,EAAoB;MACpE,IAAI,MAAM,IAAI,CAACF,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,MAAMM,QAAQ,GAAG,IAAI,CAACb,eAAe,CAACc,WAAW,CAAC,CAAC;MACnD,OAAOT,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,IAAIA,UAAU,CAAC0B,GAAG,EAAE;UAChB,OAAOV,IAAI,EAAEa,SAAS,EAAE9B,EAAE,KAAK4B,QAAQ,CAAC5B,EAAE;QAC9C;QACA,IAAI,OAAOC,UAAU,CAACgC,GAAG,KAAK,QAAQ,EAAE;UACpC,OAAO,IAAI;QACf;QACA,OAAOhC,UAAU,CAACgC,GAAG,CAAC7B,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAMiC,UAAUA,CAAC9B,QAAgB,EAAoB;MACjD,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,OAAOA,UAAU,CAACqC,EAAE,EAAElC,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAMmC,YAAYA,CAAChC,QAAgB,EAAoB;MACnD,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,OAAOA,UAAU,CAACqC,EAAE,EAAElC,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAMoC,SAASA,CAAC5C,MAAc,EAAEW,QAAgB,EAAoB;MAChE,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,OAAOA,UAAU,CAACL,MAAM,CAAC,KAAK,IAAI;MACtC,CAAC,CAAC;IACN;IAEA,MAAcyB,oBAAoBA,CAACoB,gBAAwB,EAAkB;MACzE,MAAMrB,WAAW,GAAG,MAAM,IAAI,CAACL,eAAe,CAAC2B,cAAc,CAACD,gBAAgB,CAAC;MAC/E,IAAIrB,WAAW,CAACE,MAAM,EAAE;QACpB,OAAOF,WAAW;MACtB;MACA;MACA,MAAMuB,QAAQ,GAAG,MAAM,IAAI,CAAC5B,eAAe,CAAC6B,aAAa,CAACjC,cAAc,CAAC;MACzE,OAAOgC,QAAQ,GAAG,CAACA,QAAQ,CAAC,GAAG,EAAE;IACrC;IAEA,MAAcxB,mBAAmBA,CAAA,EAAqB;MAClD,MAAMlB,UAAU,GAAG,MAAM,IAAI,CAACc,eAAe,CAAC6B,aAAa,CAACjC,cAAc,CAAC;MAC3E,IAAI,CAACV,UAAU,EAAE;QACb,OAAO,KAAK;MAChB;MACA;MACA;MACA,MAAM4C,IAAI,GAAGC,MAAM,CAACD,IAAI,CAAC5C,UAAU,CAAC,CAAC8C,MAAM,CAACC,CAAC,IAAIA,CAAC,KAAK,MAAM,CAAC;MAE9D,MAAMC,MAAM,GAAGJ,IAAI,CAACzC,QAAQ,CAAC,KAAK,CAAC;;MAEnC;MACA,OAAO,CAAC6C,MAAM;IAClB;EACJ;EAEA,MAAMC,WAAW,GAAGhE,iBAAiB,CAAiB,GAAGG,MAAM,CAACuB,MAAM,cAAc,CAAC;EAErF,MAAMuC,cAAc,GAAGD,WAAW,CAACE,oBAAoB,CAAC;IACpDC,cAAc,EAAExC,iBAAiB;IACjCyC,YAAY,EAAE,CAACnE,eAAe;EAClC,CAAQ,CAAC;EAET,OAAO;IAAE+D,WAAW;IAAEC;EAAe,CAAC;AAC1C","ignoreList":[]}

package/features/security/permissions/index.d.ts

@@ -0,0 +1,2 @@
+export { createPermissions } from "./createPermissions.js";
+export type { ActionDefinition, EntityDefinition, PermissionSchemaConfig, OwnableItem, Permissions, AllEntityIds, RwdEntityId, PwEntityId, CustomActionNames } from "./types.js";

package/features/security/permissions/index.js

@@ -0,0 +1,3 @@
+export { createPermissions } from "./createPermissions.js";
+
+//# sourceMappingURL=index.js.map

package/features/security/permissions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createPermissions"],"sources":["index.ts"],"sourcesContent":["export { createPermissions } from \"./createPermissions.js\";\nexport type {\n    ActionDefinition,\n    EntityDefinition,\n    PermissionSchemaConfig,\n    OwnableItem,\n    Permissions,\n    AllEntityIds,\n    RwdEntityId,\n    PwEntityId,\n    CustomActionNames\n} from \"./types.js\";\n"],"mappings":"AAAA,SAASA,iBAAiB","ignoreList":[]}