@webiny/api-core 0.0.0-unstable.6844005670 → 0.0.0-unstable.7be00a75a9

package/features/security/login/abstractions.d.ts

@@ -8,8 +8,9 @@ export declare class AfterLoginEvent extends DomainEvent<AfterLoginPayload> {
     eventType: "login.afterLogin";
     getHandlerAbstraction(): import("@webiny/di").Abstraction<IEventHandler<AfterLoginEvent>>;
 }
-export declare const AfterLoginHandler: import("@webiny/di").Abstraction<IEventHandler<AfterLoginEvent>>;
-export declare namespace AfterLoginHandler {
+/** Hook into login lifecycle after a user logs in. */
+export declare const AfterLoginEventHandler: import("@webiny/di").Abstraction<IEventHandler<AfterLoginEvent>>;
+export declare namespace AfterLoginEventHandler {
     type Interface = IEventHandler<AfterLoginEvent>;
     type Event = AfterLoginEvent;
 }

package/features/security/login/abstractions.js

@@ -1,11 +1,14 @@
 import { DomainEvent } from "../../eventPublisher/index.js";
 import { createAbstraction } from "@webiny/feature/api";
-export class AfterLoginEvent extends DomainEvent {
-  eventType = "login.afterLogin";
-  getHandlerAbstraction() {
-    return AfterLoginHandler;
-  }
+class AfterLoginEvent extends DomainEvent {
+    getHandlerAbstraction() {
+        return AfterLoginEventHandler;
+    }
+    constructor(...args){
+        super(...args), this.eventType = "login.afterLogin";
+    }
 }
-export const AfterLoginHandler = createAbstraction("AfterLoginHandler");
+const AfterLoginEventHandler = createAbstraction("AfterLoginEventHandler");
+export { AfterLoginEvent, AfterLoginEventHandler };
 
 //# sourceMappingURL=abstractions.js.map

package/features/security/login/abstractions.js.map

@@ -1 +1 @@
-{"version":3,"names":["DomainEvent","createAbstraction","AfterLoginEvent","eventType","getHandlerAbstraction","AfterLoginHandler"],"sources":["abstractions.ts"],"sourcesContent":["import { DomainEvent } from \"~/features/eventPublisher/index.js\";\nimport type { IEventHandler } from \"~/features/eventPublisher/index.js\";\nimport { createAbstraction } from \"@webiny/feature/api\";\nimport { Identity } from \"~/features/security/IdentityContext/index.js\";\n\nexport interface AfterLoginPayload {\n    identity: Identity;\n}\n\nexport class AfterLoginEvent extends DomainEvent<AfterLoginPayload> {\n    eventType = \"login.afterLogin\" as const;\n\n    getHandlerAbstraction() {\n        return AfterLoginHandler;\n    }\n}\n\nexport const AfterLoginHandler =\n    createAbstraction<IEventHandler<AfterLoginEvent>>(\"AfterLoginHandler\");\n\nexport namespace AfterLoginHandler {\n    export type Interface = IEventHandler<AfterLoginEvent>;\n    export type Event = AfterLoginEvent;\n}\n"],"mappings":"AAAA,SAASA,WAAW;AAEpB,SAASC,iBAAiB,QAAQ,qBAAqB;AAOvD,OAAO,MAAMC,eAAe,SAASF,WAAW,CAAoB;EAChEG,SAAS,GAAG,kBAAkB;EAE9BC,qBAAqBA,CAAA,EAAG;IACpB,OAAOC,iBAAiB;EAC5B;AACJ;AAEA,OAAO,MAAMA,iBAAiB,GAC1BJ,iBAAiB,CAAiC,mBAAmB,CAAC","ignoreList":[]}
+{"version":3,"file":"features/security/login/abstractions.js","sources":["../../../../src/features/security/login/abstractions.ts"],"sourcesContent":["import { DomainEvent } from \"~/features/eventPublisher/index.js\";\nimport type { IEventHandler } from \"~/features/eventPublisher/index.js\";\nimport { createAbstraction } from \"@webiny/feature/api\";\nimport { Identity } from \"~/features/security/IdentityContext/index.js\";\n\nexport interface AfterLoginPayload {\n    identity: Identity;\n}\n\nexport class AfterLoginEvent extends DomainEvent<AfterLoginPayload> {\n    eventType = \"login.afterLogin\" as const;\n\n    getHandlerAbstraction() {\n        return AfterLoginEventHandler;\n    }\n}\n\n/** Hook into login lifecycle after a user logs in. */\nexport const AfterLoginEventHandler =\n    createAbstraction<IEventHandler<AfterLoginEvent>>(\"AfterLoginEventHandler\");\n\nexport namespace AfterLoginEventHandler {\n    export type Interface = IEventHandler<AfterLoginEvent>;\n    export type Event = AfterLoginEvent;\n}\n"],"names":["AfterLoginEvent","DomainEvent","AfterLoginEventHandler","createAbstraction"],"mappings":";;AASO,MAAMA,wBAAwBC;IAGjC,wBAAwB;QACpB,OAAOC;IACX;;QALG,qBACH,SAAS,GAAG;;AAKhB;AAGO,MAAMA,yBACTC,kBAAkD"}

package/features/security/login/index.js

@@ -1,3 +1 @@
 export * from "./abstractions.js";
-
-//# sourceMappingURL=index.js.map

package/features/security/permissions/createPermissionSchema.d.ts

@@ -0,0 +1,2 @@
+import type { PermissionSchemaConfig } from "./types.js";
+export declare function createPermissionSchema<const T extends PermissionSchemaConfig>(config: T): T;

package/features/security/permissions/createPermissionSchema.js

@@ -0,0 +1,9 @@
+function createPermissionSchema(config) {
+    return {
+        ...config,
+        entities: config.entities ?? []
+    };
+}
+export { createPermissionSchema };
+
+//# sourceMappingURL=createPermissionSchema.js.map

package/features/security/permissions/createPermissionSchema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/permissions/createPermissionSchema.js","sources":["../../../../src/features/security/permissions/createPermissionSchema.ts"],"sourcesContent":["import type { PermissionSchemaConfig } from \"./types.js\";\n\nexport function createPermissionSchema<const T extends PermissionSchemaConfig>(config: T): T {\n    return {\n        ...config,\n        entities: config.entities ?? []\n    };\n}\n"],"names":["createPermissionSchema","config"],"mappings":"AAEO,SAASA,uBAA+DC,MAAS;IACpF,OAAO;QACH,GAAGA,MAAM;QACT,UAAUA,OAAO,QAAQ,IAAI,EAAE;IACnC;AACJ"}

package/features/security/permissions/createPermissions.d.ts

@@ -1,8 +1,8 @@
+import type { Abstraction } from "@webiny/di";
 import type { PermissionSchemaConfig } from "./types.js";
 import type { Permissions } from "./types.js";
-export declare function createPermissions<const S extends PermissionSchemaConfig>(schema: S): {
-    Abstraction: import("@webiny/di").Abstraction<Permissions<S>>;
-    Implementation: import("@webiny/di").Constructor<Permissions<S>> & {
-        __abstraction: import("@webiny/di").Abstraction<Permissions<S>>;
-    };
+export declare function createPermissionsAbstraction<const S extends PermissionSchemaConfig>(schema: S): Abstraction<Permissions<S>>;
+export declare function createPermissionsFeature<const S extends PermissionSchemaConfig>(schema: S, abstraction: Abstraction<Permissions<S>>): {
+    name: string;
+    register(container: import("@webiny/di").Container): void;
 };

package/features/security/permissions/createPermissions.js

@@ -1,240 +1,162 @@
-import { createAbstraction } from "@webiny/feature/api";
+import { createAbstraction, createFeature } from "@webiny/feature/api";
 import { IdentityContext } from "../IdentityContext/index.js";
 function buildEntityMap(schema) {
-  const map = new Map();
-  for (const entity of schema.entities ?? []) {
-    const actions = new Set();
-    for (const action of entity.actions ?? []) {
-      actions.add(action.name);
+    const map = new Map();
+    for (const entity of schema.entities ?? []){
+        const actions = new Set();
+        for (const action of entity.actions ?? [])actions.add(action.name);
+        map.set(entity.id, {
+            permission: entity.permission,
+            actions,
+            hasOwn: entity.scopes.includes("own")
+        });
     }
-    map.set(entity.id, {
-      permission: entity.permission,
-      actions,
-      hasOwn: entity.scopes.includes("own")
-    });
-  }
-  return map;
+    return map;
 }
 function getEntity(entityMap, entityId) {
-  const entity = entityMap.get(entityId);
-  if (!entity) {
-    throw new Error(`Unknown entity "${entityId}" in permission schema.`);
-  }
-  return entity;
+    const entity = entityMap.get(entityId);
+    if (!entity) throw new Error(`Unknown entity "${entityId}" in permission schema.`);
+    return entity;
 }
-export function createPermissions(schema) {
-  const entityMap = buildEntityMap(schema);
-  const fullAccessName = `${schema.prefix}.*`;
-  class SchemaPermissions {
-    constructor(identityContext) {
-      this.identityContext = identityContext;
+class SchemaPermissions {
+    constructor(schema, identityContext){
+        this.entityMap = buildEntityMap(schema);
+        this.fullAccessName = `${schema.prefix}.*`;
+        this.identityContext = identityContext;
     }
     async canAccess(entityId, item) {
-      if (await this.identityContext.hasFullAccess()) {
-        return true;
-      }
-      if (await this.hasFullSchemaAccess()) {
-        return true;
-      }
-      const entity = getEntity(entityMap, entityId);
-      const permissions = await this.getEntityPermissions(entity.permission);
-      if (!permissions.length) {
-        return false;
-      }
-      // No item — just check entity-level access.
-      if (item === undefined) {
-        return true;
-      }
-      // Item provided — if all permissions require own, verify ownership.
-      const ownOnly = !permissions.some(p => !p.own);
-      if (!ownOnly) {
-        return true;
-      }
-      const identity = this.identityContext.getIdentity();
-      return item.createdBy?.id === identity.id;
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        if (void 0 === item) return true;
+        const ownOnly = !permissions.some((p)=>!p.own);
+        if (!ownOnly) return true;
+        const identity = this.identityContext.getIdentity();
+        return item.createdBy?.id === identity.id;
     }
     async onlyOwnRecords(entityId) {
-      if (await this.identityContext.hasFullAccess()) {
-        return false;
-      }
-      if (await this.hasFullSchemaAccess()) {
-        return false;
-      }
-      const entity = getEntity(entityMap, entityId);
-      const permissions = await this.getEntityPermissions(entity.permission);
-      if (!permissions.length) {
-        return false;
-      }
-      return !permissions.some(p => !p.own);
+        if (await this.identityContext.hasFullAccess()) return false;
+        if (await this.hasFullSchemaAccess()) return false;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        return !permissions.some((p)=>!p.own);
     }
     async canRead(entityId) {
-      if (await this.identityContext.hasFullAccess()) {
-        return true;
-      }
-      if (await this.hasFullSchemaAccess()) {
-        return true;
-      }
-      const entity = getEntity(entityMap, entityId);
-      const permissions = await this.getEntityPermissions(entity.permission);
-      if (!permissions.length) {
-        return false;
-      }
-      return permissions.some(permission => {
-        if (typeof permission.rwd !== "string") {
-          return true;
-        }
-        return permission.rwd.includes("r");
-      });
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        return permissions.some((permission)=>{
+            if ("string" != typeof permission.rwd) return true;
+            return permission.rwd.includes("r");
+        });
     }
     async canCreate(entityId) {
-      if (await this.identityContext.hasFullAccess()) {
-        return true;
-      }
-      if (await this.hasFullSchemaAccess()) {
-        return true;
-      }
-      const entity = getEntity(entityMap, entityId);
-      const permissions = await this.getEntityPermissions(entity.permission);
-      if (!permissions.length) {
-        return false;
-      }
-      return permissions.some(permission => {
-        if (typeof permission.rwd !== "string") {
-          return true;
-        }
-        return permission.rwd.includes("w");
-      });
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        return permissions.some((permission)=>{
+            if ("string" != typeof permission.rwd) return true;
+            return permission.rwd.includes("w");
+        });
     }
     async canEdit(entityId, item) {
-      if (await this.identityContext.hasFullAccess()) {
-        return true;
-      }
-      if (await this.hasFullSchemaAccess()) {
-        return true;
-      }
-      const entity = getEntity(entityMap, entityId);
-      const permissions = await this.getEntityPermissions(entity.permission);
-      if (!permissions.length) {
-        return false;
-      }
-      const identity = this.identityContext.getIdentity();
-      return permissions.some(permission => {
-        if (permission.own) {
-          // No item provided (new/unsaved) — allow access.
-          if (!item?.createdBy) {
-            return true;
-          }
-          return item.createdBy.id === identity.id;
-        }
-        if (typeof permission.rwd !== "string") {
-          return true;
-        }
-        return permission.rwd.includes("w");
-      });
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        const identity = this.identityContext.getIdentity();
+        return permissions.some((permission)=>{
+            if (permission.own) {
+                if (!item?.createdBy) return true;
+                return item.createdBy.id === identity.id;
+            }
+            if ("string" != typeof permission.rwd) return true;
+            return permission.rwd.includes("w");
+        });
     }
     async canDelete(entityId, item) {
-      if (await this.identityContext.hasFullAccess()) {
-        return true;
-      }
-      if (await this.hasFullSchemaAccess()) {
-        return true;
-      }
-      const entity = getEntity(entityMap, entityId);
-      const permissions = await this.getEntityPermissions(entity.permission);
-      if (!permissions.length) {
-        return false;
-      }
-      const identity = this.identityContext.getIdentity();
-      return permissions.some(permission => {
-        if (permission.own) {
-          return item?.createdBy?.id === identity.id;
-        }
-        if (typeof permission.rwd !== "string") {
-          return true;
-        }
-        return permission.rwd.includes("d");
-      });
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        const identity = this.identityContext.getIdentity();
+        return permissions.some((permission)=>{
+            if (permission.own) return item?.createdBy?.id === identity.id;
+            if ("string" != typeof permission.rwd) return true;
+            return permission.rwd.includes("d");
+        });
     }
     async canPublish(entityId) {
-      if (await this.identityContext.hasFullAccess()) {
-        return true;
-      }
-      if (await this.hasFullSchemaAccess()) {
-        return true;
-      }
-      const entity = getEntity(entityMap, entityId);
-      const permissions = await this.getEntityPermissions(entity.permission);
-      if (!permissions.length) {
-        return false;
-      }
-      return permissions.some(permission => {
-        return permission.pw?.includes("p");
-      });
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        return permissions.some((permission)=>permission.pw?.includes("p"));
     }
     async canUnpublish(entityId) {
-      if (await this.identityContext.hasFullAccess()) {
-        return true;
-      }
-      if (await this.hasFullSchemaAccess()) {
-        return true;
-      }
-      const entity = getEntity(entityMap, entityId);
-      const permissions = await this.getEntityPermissions(entity.permission);
-      if (!permissions.length) {
-        return false;
-      }
-      return permissions.some(permission => {
-        return permission.pw?.includes("u");
-      });
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        return permissions.some((permission)=>permission.pw?.includes("u"));
     }
     async canAction(action, entityId) {
-      if (await this.identityContext.hasFullAccess()) {
-        return true;
-      }
-      if (await this.hasFullSchemaAccess()) {
-        return true;
-      }
-      const entity = getEntity(entityMap, entityId);
-      const permissions = await this.getEntityPermissions(entity.permission);
-      if (!permissions.length) {
-        return false;
-      }
-      return permissions.some(permission => {
-        return permission[action] === true;
-      });
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        return permissions.some((permission)=>true === permission[action]);
     }
     async getEntityPermissions(entityPermission) {
-      const permissions = await this.identityContext.getPermissions(entityPermission);
-      if (permissions.length) {
-        return permissions;
-      }
-      // Fall back to the schema wildcard (e.g. "test.*") — its flags apply to all entities.
-      const wildcard = await this.identityContext.getPermission(fullAccessName);
-      return wildcard ? [wildcard] : [];
+        const permissions = await this.identityContext.getPermissions(entityPermission);
+        if (permissions.length) return permissions;
+        const wildcard = await this.identityContext.getPermission(this.fullAccessName);
+        return wildcard ? [
+            wildcard
+        ] : [];
     }
     async hasFullSchemaAccess() {
-      const permission = await this.identityContext.getPermission(fullAccessName);
-      if (!permission) {
-        return false;
-      }
-      // Only treat as full access if the permission has no `rwd` flag.
-      // A permission like { name: "wb.*", rwd: "r" } should NOT grant full access.
-      const keys = Object.keys(permission).filter(k => k !== "name");
-      const hasRwd = keys.includes("rwd");
-
-      // It's full-access only if there's no `rwd` flag.
-      return !hasRwd;
+        const permission = await this.identityContext.getPermission(this.fullAccessName);
+        if (!permission) return false;
+        const keys = Object.keys(permission).filter((k)=>"name" !== k);
+        const hasRwd = keys.includes("rwd");
+        return !hasRwd;
     }
-  }
-  const Abstraction = createAbstraction(`${schema.prefix}:Permissions`);
-  const Implementation = Abstraction.createImplementation({
-    implementation: SchemaPermissions,
-    dependencies: [IdentityContext]
-  });
-  return {
-    Abstraction,
-    Implementation
-  };
 }
+function createPermissionsAbstraction(schema) {
+    return createAbstraction(`${schema.prefix}:Permissions`);
+}
+function createPermissionsFeature(schema, abstraction) {
+    class PermissionsImpl extends SchemaPermissions {
+        constructor(identityContext){
+            super(schema, identityContext);
+        }
+    }
+    const Implementation = abstraction.createImplementation({
+        implementation: PermissionsImpl,
+        dependencies: [
+            IdentityContext
+        ]
+    });
+    return createFeature({
+        name: `${schema.prefix}:Permissions`,
+        register (container) {
+            container.register(Implementation);
+        }
+    });
+}
+export { createPermissionsAbstraction, createPermissionsFeature };
 
 //# sourceMappingURL=createPermissions.js.map

package/features/security/permissions/createPermissions.js.map

@@ -1 +1 @@
-{"version":3,"names":["createAbstraction","IdentityContext","buildEntityMap","schema","map","Map","entity","entities","actions","Set","action","add","name","set","id","permission","hasOwn","scopes","includes","getEntity","entityMap","entityId","get","Error","createPermissions","fullAccessName","prefix","SchemaPermissions","constructor","identityContext","canAccess","item","hasFullAccess","hasFullSchemaAccess","permissions","getEntityPermissions","length","undefined","ownOnly","some","p","own","identity","getIdentity","createdBy","onlyOwnRecords","canRead","rwd","canCreate","canEdit","canDelete","canPublish","pw","canUnpublish","canAction","entityPermission","getPermissions","wildcard","getPermission","keys","Object","filter","k","hasRwd","Abstraction","Implementation","createImplementation","implementation","dependencies"],"sources":["createPermissions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport { IdentityContext } from \"~/features/security/IdentityContext/index.js\";\nimport type { PermissionSchemaConfig } from \"./types.js\";\nimport type { OwnableItem } from \"./types.js\";\nimport type { Permissions } from \"./types.js\";\n\ninterface EntityLookup {\n    permission: string;\n    actions: Set<string>;\n    hasOwn: boolean;\n}\n\nfunction buildEntityMap(schema: PermissionSchemaConfig): Map<string, EntityLookup> {\n    const map = new Map<string, EntityLookup>();\n    for (const entity of schema.entities ?? []) {\n        const actions = new Set<string>();\n        for (const action of entity.actions ?? []) {\n            actions.add(action.name);\n        }\n        map.set(entity.id, {\n            permission: entity.permission,\n            actions,\n            hasOwn: entity.scopes.includes(\"own\")\n        });\n    }\n    return map;\n}\n\nfunction getEntity(entityMap: Map<string, EntityLookup>, entityId: string): EntityLookup {\n    const entity = entityMap.get(entityId);\n    if (!entity) {\n        throw new Error(`Unknown entity \"${entityId}\" in permission schema.`);\n    }\n    return entity;\n}\n\nexport function createPermissions<const S extends PermissionSchemaConfig>(schema: S) {\n    const entityMap = buildEntityMap(schema);\n    const fullAccessName = `${schema.prefix}.*`;\n\n    class SchemaPermissions {\n        constructor(private identityContext: IdentityContext.Interface) {}\n\n        async canAccess(entityId: string, item?: OwnableItem): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            // No item — just check entity-level access.\n            if (item === undefined) {\n                return true;\n            }\n            // Item provided — if all permissions require own, verify ownership.\n            const ownOnly = !permissions.some(p => !p.own);\n            if (!ownOnly) {\n                return true;\n            }\n            const identity = this.identityContext.getIdentity();\n            return item.createdBy?.id === identity.id;\n        }\n\n        async onlyOwnRecords(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return false;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return false;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return !permissions.some(p => !p.own);\n        }\n\n        async canRead(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                if (typeof permission.rwd !== \"string\") {\n                    return true;\n                }\n                return permission.rwd.includes(\"r\");\n            });\n        }\n\n        async canCreate(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                if (typeof permission.rwd !== \"string\") {\n                    return true;\n                }\n                return permission.rwd.includes(\"w\");\n            });\n        }\n\n        async canEdit(entityId: string, item?: OwnableItem): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            const identity = this.identityContext.getIdentity();\n            return permissions.some(permission => {\n                if (permission.own) {\n                    // No item provided (new/unsaved) — allow access.\n                    if (!item?.createdBy) {\n                        return true;\n                    }\n                    return item.createdBy.id === identity.id;\n                }\n                if (typeof permission.rwd !== \"string\") {\n                    return true;\n                }\n                return permission.rwd.includes(\"w\");\n            });\n        }\n\n        async canDelete(entityId: string, item?: OwnableItem): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            const identity = this.identityContext.getIdentity();\n            return permissions.some(permission => {\n                if (permission.own) {\n                    return item?.createdBy?.id === identity.id;\n                }\n                if (typeof permission.rwd !== \"string\") {\n                    return true;\n                }\n                return permission.rwd.includes(\"d\");\n            });\n        }\n\n        async canPublish(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                return permission.pw?.includes(\"p\");\n            });\n        }\n\n        async canUnpublish(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                return permission.pw?.includes(\"u\");\n            });\n        }\n\n        async canAction(action: string, entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                return permission[action] === true;\n            });\n        }\n\n        private async getEntityPermissions(entityPermission: string): Promise<any[]> {\n            const permissions = await this.identityContext.getPermissions(entityPermission);\n            if (permissions.length) {\n                return permissions;\n            }\n            // Fall back to the schema wildcard (e.g. \"test.*\") — its flags apply to all entities.\n            const wildcard = await this.identityContext.getPermission(fullAccessName);\n            return wildcard ? [wildcard] : [];\n        }\n\n        private async hasFullSchemaAccess(): Promise<boolean> {\n            const permission = await this.identityContext.getPermission(fullAccessName);\n            if (!permission) {\n                return false;\n            }\n            // Only treat as full access if the permission has no `rwd` flag.\n            // A permission like { name: \"wb.*\", rwd: \"r\" } should NOT grant full access.\n            const keys = Object.keys(permission).filter(k => k !== \"name\");\n\n            const hasRwd = keys.includes(\"rwd\");\n\n            // It's full-access only if there's no `rwd` flag.\n            return !hasRwd;\n        }\n    }\n\n    const Abstraction = createAbstraction<Permissions<S>>(`${schema.prefix}:Permissions`);\n\n    const Implementation = Abstraction.createImplementation({\n        implementation: SchemaPermissions,\n        dependencies: [IdentityContext]\n    } as any);\n\n    return { Abstraction, Implementation };\n}\n"],"mappings":"AAAA,SAASA,iBAAiB,QAAQ,qBAAqB;AACvD,SAASC,eAAe;AAWxB,SAASC,cAAcA,CAACC,MAA8B,EAA6B;EAC/E,MAAMC,GAAG,GAAG,IAAIC,GAAG,CAAuB,CAAC;EAC3C,KAAK,MAAMC,MAAM,IAAIH,MAAM,CAACI,QAAQ,IAAI,EAAE,EAAE;IACxC,MAAMC,OAAO,GAAG,IAAIC,GAAG,CAAS,CAAC;IACjC,KAAK,MAAMC,MAAM,IAAIJ,MAAM,CAACE,OAAO,IAAI,EAAE,EAAE;MACvCA,OAAO,CAACG,GAAG,CAACD,MAAM,CAACE,IAAI,CAAC;IAC5B;IACAR,GAAG,CAACS,GAAG,CAACP,MAAM,CAACQ,EAAE,EAAE;MACfC,UAAU,EAAET,MAAM,CAACS,UAAU;MAC7BP,OAAO;MACPQ,MAAM,EAAEV,MAAM,CAACW,MAAM,CAACC,QAAQ,CAAC,KAAK;IACxC,CAAC,CAAC;EACN;EACA,OAAOd,GAAG;AACd;AAEA,SAASe,SAASA,CAACC,SAAoC,EAAEC,QAAgB,EAAgB;EACrF,MAAMf,MAAM,GAAGc,SAAS,CAACE,GAAG,CAACD,QAAQ,CAAC;EACtC,IAAI,CAACf,MAAM,EAAE;IACT,MAAM,IAAIiB,KAAK,CAAC,mBAAmBF,QAAQ,yBAAyB,CAAC;EACzE;EACA,OAAOf,MAAM;AACjB;AAEA,OAAO,SAASkB,iBAAiBA,CAAyCrB,MAAS,EAAE;EACjF,MAAMiB,SAAS,GAAGlB,cAAc,CAACC,MAAM,CAAC;EACxC,MAAMsB,cAAc,GAAG,GAAGtB,MAAM,CAACuB,MAAM,IAAI;EAE3C,MAAMC,iBAAiB,CAAC;IACpBC,WAAWA,CAASC,eAA0C,EAAE;MAAA,KAA5CA,eAA0C,GAA1CA,eAA0C;IAAG;IAEjE,MAAMC,SAASA,CAACT,QAAgB,EAAEU,IAAkB,EAAoB;MACpE,IAAI,MAAM,IAAI,CAACF,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA;MACA,IAAIL,IAAI,KAAKM,SAAS,EAAE;QACpB,OAAO,IAAI;MACf;MACA;MACA,MAAMC,OAAO,GAAG,CAACJ,WAAW,CAACK,IAAI,CAACC,CAAC,IAAI,CAACA,CAAC,CAACC,GAAG,CAAC;MAC9C,IAAI,CAACH,OAAO,EAAE;QACV,OAAO,IAAI;MACf;MACA,MAAMI,QAAQ,GAAG,IAAI,CAACb,eAAe,CAACc,WAAW,CAAC,CAAC;MACnD,OAAOZ,IAAI,CAACa,SAAS,EAAE9B,EAAE,KAAK4B,QAAQ,CAAC5B,EAAE;IAC7C;IAEA,MAAM+B,cAAcA,CAACxB,QAAgB,EAAoB;MACrD,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,KAAK;MAChB;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,KAAK;MAChB;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAO,CAACF,WAAW,CAACK,IAAI,CAACC,CAAC,IAAI,CAACA,CAAC,CAACC,GAAG,CAAC;IACzC;IAEA,MAAMK,OAAOA,CAACzB,QAAgB,EAAoB;MAC9C,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,IAAI,OAAOA,UAAU,CAACgC,GAAG,KAAK,QAAQ,EAAE;UACpC,OAAO,IAAI;QACf;QACA,OAAOhC,UAAU,CAACgC,GAAG,CAAC7B,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAM8B,SAASA,CAAC3B,QAAgB,EAAoB;MAChD,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,IAAI,OAAOA,UAAU,CAACgC,GAAG,KAAK,QAAQ,EAAE;UACpC,OAAO,IAAI;QACf;QACA,OAAOhC,UAAU,CAACgC,GAAG,CAAC7B,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAM+B,OAAOA,CAAC5B,QAAgB,EAAEU,IAAkB,EAAoB;MAClE,IAAI,MAAM,IAAI,CAACF,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,MAAMM,QAAQ,GAAG,IAAI,CAACb,eAAe,CAACc,WAAW,CAAC,CAAC;MACnD,OAAOT,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,IAAIA,UAAU,CAAC0B,GAAG,EAAE;UAChB;UACA,IAAI,CAACV,IAAI,EAAEa,SAAS,EAAE;YAClB,OAAO,IAAI;UACf;UACA,OAAOb,IAAI,CAACa,SAAS,CAAC9B,EAAE,KAAK4B,QAAQ,CAAC5B,EAAE;QAC5C;QACA,IAAI,OAAOC,UAAU,CAACgC,GAAG,KAAK,QAAQ,EAAE;UACpC,OAAO,IAAI;QACf;QACA,OAAOhC,UAAU,CAACgC,GAAG,CAAC7B,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAMgC,SAASA,CAAC7B,QAAgB,EAAEU,IAAkB,EAAoB;MACpE,IAAI,MAAM,IAAI,CAACF,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,MAAMM,QAAQ,GAAG,IAAI,CAACb,eAAe,CAACc,WAAW,CAAC,CAAC;MACnD,OAAOT,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,IAAIA,UAAU,CAAC0B,GAAG,EAAE;UAChB,OAAOV,IAAI,EAAEa,SAAS,EAAE9B,EAAE,KAAK4B,QAAQ,CAAC5B,EAAE;QAC9C;QACA,IAAI,OAAOC,UAAU,CAACgC,GAAG,KAAK,QAAQ,EAAE;UACpC,OAAO,IAAI;QACf;QACA,OAAOhC,UAAU,CAACgC,GAAG,CAAC7B,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAMiC,UAAUA,CAAC9B,QAAgB,EAAoB;MACjD,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,OAAOA,UAAU,CAACqC,EAAE,EAAElC,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAMmC,YAAYA,CAAChC,QAAgB,EAAoB;MACnD,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,OAAOA,UAAU,CAACqC,EAAE,EAAElC,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAMoC,SAASA,CAAC5C,MAAc,EAAEW,QAAgB,EAAoB;MAChE,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,OAAOA,UAAU,CAACL,MAAM,CAAC,KAAK,IAAI;MACtC,CAAC,CAAC;IACN;IAEA,MAAcyB,oBAAoBA,CAACoB,gBAAwB,EAAkB;MACzE,MAAMrB,WAAW,GAAG,MAAM,IAAI,CAACL,eAAe,CAAC2B,cAAc,CAACD,gBAAgB,CAAC;MAC/E,IAAIrB,WAAW,CAACE,MAAM,EAAE;QACpB,OAAOF,WAAW;MACtB;MACA;MACA,MAAMuB,QAAQ,GAAG,MAAM,IAAI,CAAC5B,eAAe,CAAC6B,aAAa,CAACjC,cAAc,CAAC;MACzE,OAAOgC,QAAQ,GAAG,CAACA,QAAQ,CAAC,GAAG,EAAE;IACrC;IAEA,MAAcxB,mBAAmBA,CAAA,EAAqB;MAClD,MAAMlB,UAAU,GAAG,MAAM,IAAI,CAACc,eAAe,CAAC6B,aAAa,CAACjC,cAAc,CAAC;MAC3E,IAAI,CAACV,UAAU,EAAE;QACb,OAAO,KAAK;MAChB;MACA;MACA;MACA,MAAM4C,IAAI,GAAGC,MAAM,CAACD,IAAI,CAAC5C,UAAU,CAAC,CAAC8C,MAAM,CAACC,CAAC,IAAIA,CAAC,KAAK,MAAM,CAAC;MAE9D,MAAMC,MAAM,GAAGJ,IAAI,CAACzC,QAAQ,CAAC,KAAK,CAAC;;MAEnC;MACA,OAAO,CAAC6C,MAAM;IAClB;EACJ;EAEA,MAAMC,WAAW,GAAGhE,iBAAiB,CAAiB,GAAGG,MAAM,CAACuB,MAAM,cAAc,CAAC;EAErF,MAAMuC,cAAc,GAAGD,WAAW,CAACE,oBAAoB,CAAC;IACpDC,cAAc,EAAExC,iBAAiB;IACjCyC,YAAY,EAAE,CAACnE,eAAe;EAClC,CAAQ,CAAC;EAET,OAAO;IAAE+D,WAAW;IAAEC;EAAe,CAAC;AAC1C","ignoreList":[]}
+{"version":3,"file":"features/security/permissions/createPermissions.js","sources":["../../../../src/features/security/permissions/createPermissions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport { createFeature } from \"@webiny/feature/api\";\nimport { IdentityContext } from \"~/features/security/IdentityContext/index.js\";\nimport type { Abstraction } from \"@webiny/di\";\nimport type { PermissionSchemaConfig } from \"./types.js\";\nimport type { OwnableItem } from \"./types.js\";\nimport type { Permissions } from \"./types.js\";\n\ninterface EntityLookup {\n    permission: string;\n    actions: Set<string>;\n    hasOwn: boolean;\n}\n\nfunction buildEntityMap(schema: PermissionSchemaConfig): Map<string, EntityLookup> {\n    const map = new Map<string, EntityLookup>();\n    for (const entity of schema.entities ?? []) {\n        const actions = new Set<string>();\n        for (const action of entity.actions ?? []) {\n            actions.add(action.name);\n        }\n        map.set(entity.id, {\n            permission: entity.permission,\n            actions,\n            hasOwn: entity.scopes.includes(\"own\")\n        });\n    }\n    return map;\n}\n\nfunction getEntity(entityMap: Map<string, EntityLookup>, entityId: string): EntityLookup {\n    const entity = entityMap.get(entityId);\n    if (!entity) {\n        throw new Error(`Unknown entity \"${entityId}\" in permission schema.`);\n    }\n    return entity;\n}\n\nclass SchemaPermissions<S extends PermissionSchemaConfig> {\n    private readonly entityMap: Map<string, EntityLookup>;\n    private readonly fullAccessName: string;\n    private readonly identityContext: IdentityContext.Interface;\n\n    constructor(schema: S, identityContext: IdentityContext.Interface) {\n        this.entityMap = buildEntityMap(schema);\n        this.fullAccessName = `${schema.prefix}.*`;\n        this.identityContext = identityContext;\n    }\n\n    async canAccess(entityId: string, item?: OwnableItem): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        // No item — just check entity-level access.\n        if (item === undefined) {\n            return true;\n        }\n        // Item provided — if all permissions require own, verify ownership.\n        const ownOnly = !permissions.some(p => !p.own);\n        if (!ownOnly) {\n            return true;\n        }\n        const identity = this.identityContext.getIdentity();\n        return item.createdBy?.id === identity.id;\n    }\n\n    async onlyOwnRecords(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return false;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return false;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return !permissions.some(p => !p.own);\n    }\n\n    async canRead(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"r\");\n        });\n    }\n\n    async canCreate(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"w\");\n        });\n    }\n\n    async canEdit(entityId: string, item?: OwnableItem): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        const identity = this.identityContext.getIdentity();\n        return permissions.some(permission => {\n            if (permission.own) {\n                // No item provided (new/unsaved) — allow access.\n                if (!item?.createdBy) {\n                    return true;\n                }\n                return item.createdBy.id === identity.id;\n            }\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"w\");\n        });\n    }\n\n    async canDelete(entityId: string, item?: OwnableItem): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        const identity = this.identityContext.getIdentity();\n        return permissions.some(permission => {\n            if (permission.own) {\n                return item?.createdBy?.id === identity.id;\n            }\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"d\");\n        });\n    }\n\n    async canPublish(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission.pw?.includes(\"p\");\n        });\n    }\n\n    async canUnpublish(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission.pw?.includes(\"u\");\n        });\n    }\n\n    async canAction(action: string, entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission[action] === true;\n        });\n    }\n\n    private async getEntityPermissions(entityPermission: string): Promise<any[]> {\n        const permissions = await this.identityContext.getPermissions(entityPermission);\n        if (permissions.length) {\n            return permissions;\n        }\n        // Fall back to the schema wildcard (e.g. \"test.*\") — its flags apply to all entities.\n        const wildcard = await this.identityContext.getPermission(this.fullAccessName);\n        return wildcard ? [wildcard] : [];\n    }\n\n    private async hasFullSchemaAccess(): Promise<boolean> {\n        const permission = await this.identityContext.getPermission(this.fullAccessName);\n        if (!permission) {\n            return false;\n        }\n        // Only treat as full access if the permission has no `rwd` flag.\n        // A permission like { name: \"wb.*\", rwd: \"r\" } should NOT grant full access.\n        const keys = Object.keys(permission).filter(k => k !== \"name\");\n\n        const hasRwd = keys.includes(\"rwd\");\n\n        // It's full-access only if there's no `rwd` flag.\n        return !hasRwd;\n    }\n}\n\nexport function createPermissionsAbstraction<const S extends PermissionSchemaConfig>(schema: S) {\n    return createAbstraction<Permissions<S>>(`${schema.prefix}:Permissions`);\n}\n\nexport function createPermissionsFeature<const S extends PermissionSchemaConfig>(\n    schema: S,\n    abstraction: Abstraction<Permissions<S>>\n) {\n    class PermissionsImpl extends SchemaPermissions<S> {\n        constructor(identityContext: IdentityContext.Interface) {\n            super(schema, identityContext);\n        }\n    }\n\n    const Implementation = abstraction.createImplementation({\n        implementation: PermissionsImpl,\n        dependencies: [IdentityContext]\n    } as any);\n\n    return createFeature({\n        name: `${schema.prefix}:Permissions`,\n        register(container) {\n            container.register(Implementation);\n        }\n    });\n}\n"],"names":["buildEntityMap","schema","map","Map","entity","actions","Set","action","getEntity","entityMap","entityId","Error","SchemaPermissions","identityContext","item","permissions","undefined","ownOnly","p","identity","permission","entityPermission","wildcard","keys","Object","k","hasRwd","createPermissionsAbstraction","createAbstraction","createPermissionsFeature","abstraction","PermissionsImpl","Implementation","IdentityContext","createFeature","container"],"mappings":";;AAcA,SAASA,eAAeC,MAA8B;IAClD,MAAMC,MAAM,IAAIC;IAChB,KAAK,MAAMC,UAAUH,OAAO,QAAQ,IAAI,EAAE,CAAE;QACxC,MAAMI,UAAU,IAAIC;QACpB,KAAK,MAAMC,UAAUH,OAAO,OAAO,IAAI,EAAE,CACrCC,QAAQ,GAAG,CAACE,OAAO,IAAI;QAE3BL,IAAI,GAAG,CAACE,OAAO,EAAE,EAAE;YACf,YAAYA,OAAO,UAAU;YAC7BC;YACA,QAAQD,OAAO,MAAM,CAAC,QAAQ,CAAC;QACnC;IACJ;IACA,OAAOF;AACX;AAEA,SAASM,UAAUC,SAAoC,EAAEC,QAAgB;IACrE,MAAMN,SAASK,UAAU,GAAG,CAACC;IAC7B,IAAI,CAACN,QACD,MAAM,IAAIO,MAAM,CAAC,gBAAgB,EAAED,SAAS,uBAAuB,CAAC;IAExE,OAAON;AACX;AAEA,MAAMQ;IAKF,YAAYX,MAAS,EAAEY,eAA0C,CAAE;QAC/D,IAAI,CAAC,SAAS,GAAGb,eAAeC;QAChC,IAAI,CAAC,cAAc,GAAG,GAAGA,OAAO,MAAM,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,eAAe,GAAGY;IAC3B;IAEA,MAAM,UAAUH,QAAgB,EAAEI,IAAkB,EAAoB;QACpE,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMV,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAGX,IAAID,AAASE,WAATF,MACA,OAAO;QAGX,MAAMG,UAAU,CAACF,YAAY,IAAI,CAACG,CAAAA,IAAK,CAACA,EAAE,GAAG;QAC7C,IAAI,CAACD,SACD,OAAO;QAEX,MAAME,WAAW,IAAI,CAAC,eAAe,CAAC,WAAW;QACjD,OAAOL,KAAK,SAAS,EAAE,OAAOK,SAAS,EAAE;IAC7C;IAEA,MAAM,eAAeT,QAAgB,EAAoB;QACrD,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,OAAO,CAACA,YAAY,IAAI,CAACG,CAAAA,IAAK,CAACA,EAAE,GAAG;IACxC;IAEA,MAAM,QAAQR,QAAgB,EAAoB;QAC9C,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,OAAOA,YAAY,IAAI,CAACK,CAAAA;YACpB,IAAI,AAA0B,YAA1B,OAAOA,WAAW,GAAG,EACrB,OAAO;YAEX,OAAOA,WAAW,GAAG,CAAC,QAAQ,CAAC;QACnC;IACJ;IAEA,MAAM,UAAUV,QAAgB,EAAoB;QAChD,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,OAAOA,YAAY,IAAI,CAACK,CAAAA;YACpB,IAAI,AAA0B,YAA1B,OAAOA,WAAW,GAAG,EACrB,OAAO;YAEX,OAAOA,WAAW,GAAG,CAAC,QAAQ,CAAC;QACnC;IACJ;IAEA,MAAM,QAAQV,QAAgB,EAAEI,IAAkB,EAAoB;QAClE,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMV,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,MAAMI,WAAW,IAAI,CAAC,eAAe,CAAC,WAAW;QACjD,OAAOJ,YAAY,IAAI,CAACK,CAAAA;YACpB,IAAIA,WAAW,GAAG,EAAE;gBAEhB,IAAI,CAACN,MAAM,WACP,OAAO;gBAEX,OAAOA,KAAK,SAAS,CAAC,EAAE,KAAKK,SAAS,EAAE;YAC5C;YACA,IAAI,AAA0B,YAA1B,OAAOC,WAAW,GAAG,EACrB,OAAO;YAEX,OAAOA,WAAW,GAAG,CAAC,QAAQ,CAAC;QACnC;IACJ;IAEA,MAAM,UAAUV,QAAgB,EAAEI,IAAkB,EAAoB;QACpE,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMV,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,MAAMI,WAAW,IAAI,CAAC,eAAe,CAAC,WAAW;QACjD,OAAOJ,YAAY,IAAI,CAACK,CAAAA;YACpB,IAAIA,WAAW,GAAG,EACd,OAAON,MAAM,WAAW,OAAOK,SAAS,EAAE;YAE9C,IAAI,AAA0B,YAA1B,OAAOC,WAAW,GAAG,EACrB,OAAO;YAEX,OAAOA,WAAW,GAAG,CAAC,QAAQ,CAAC;QACnC;IACJ;IAEA,MAAM,WAAWV,QAAgB,EAAoB;QACjD,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,OAAOA,YAAY,IAAI,CAACK,CAAAA,aACbA,WAAW,EAAE,EAAE,SAAS;IAEvC;IAEA,MAAM,aAAaV,QAAgB,EAAoB;QACnD,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,OAAOA,YAAY,IAAI,CAACK,CAAAA,aACbA,WAAW,EAAE,EAAE,SAAS;IAEvC;IAEA,MAAM,UAAUb,MAAc,EAAEG,QAAgB,EAAoB;QAChE,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,OAAOA,YAAY,IAAI,CAACK,CAAAA,aACbA,AAAuB,SAAvBA,UAAU,CAACb,OAAO;IAEjC;IAEA,MAAc,qBAAqBc,gBAAwB,EAAkB;QACzE,MAAMN,cAAc,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CAACM;QAC9D,IAAIN,YAAY,MAAM,EAClB,OAAOA;QAGX,MAAMO,WAAW,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc;QAC7E,OAAOA,WAAW;YAACA;SAAS,GAAG,EAAE;IACrC;IAEA,MAAc,sBAAwC;QAClD,MAAMF,aAAa,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc;QAC/E,IAAI,CAACA,YACD,OAAO;QAIX,MAAMG,OAAOC,OAAO,IAAI,CAACJ,YAAY,MAAM,CAACK,CAAAA,IAAKA,AAAM,WAANA;QAEjD,MAAMC,SAASH,KAAK,QAAQ,CAAC;QAG7B,OAAO,CAACG;IACZ;AACJ;AAEO,SAASC,6BAAqE1B,MAAS;IAC1F,OAAO2B,kBAAkC,GAAG3B,OAAO,MAAM,CAAC,YAAY,CAAC;AAC3E;AAEO,SAAS4B,yBACZ5B,MAAS,EACT6B,WAAwC;IAExC,MAAMC,wBAAwBnB;QAC1B,YAAYC,eAA0C,CAAE;YACpD,KAAK,CAACZ,QAAQY;QAClB;IACJ;IAEA,MAAMmB,iBAAiBF,YAAY,oBAAoB,CAAC;QACpD,gBAAgBC;QAChB,cAAc;YAACE;SAAgB;IACnC;IAEA,OAAOC,cAAc;QACjB,MAAM,GAAGjC,OAAO,MAAM,CAAC,YAAY,CAAC;QACpC,UAASkC,SAAS;YACdA,UAAU,QAAQ,CAACH;QACvB;IACJ;AACJ"}

package/features/security/permissions/index.d.ts

@@ -1,2 +1,3 @@
-export { createPermissions } from "./createPermissions.js";
+export { createPermissionSchema } from "./createPermissionSchema.js";
+export { createPermissionsAbstraction, createPermissionsFeature } from "./createPermissions.js";
 export type { ActionDefinition, EntityDefinition, PermissionSchemaConfig, OwnableItem, Permissions, AllEntityIds, RwdEntityId, PwEntityId, CustomActionNames } from "./types.js";

package/features/security/permissions/index.js

@@ -1,3 +1,2 @@
-export { createPermissions } from "./createPermissions.js";
-
-//# sourceMappingURL=index.js.map
+export { createPermissionSchema } from "./createPermissionSchema.js";
+export { createPermissionsAbstraction, createPermissionsFeature } from "./createPermissions.js";

package/features/security/permissions/types.js

@@ -1,3 +0,0 @@
-export {};
-
-//# sourceMappingURL=types.js.map

package/features/security/roles/CreateRole/CreateRoleUseCase.d.ts

@@ -1,16 +1,14 @@
 import { Result } from "@webiny/feature/api";
-import { TenantContext } from "../../../../features/tenancy/TenantContext/index.js";
 import { EventPublisher } from "../../../../features/eventPublisher/index.js";
 import { CreateRoleUseCase as UseCaseAbstraction } from "./abstractions.js";
 import { RolesRepository } from "../shared/abstractions.js";
 import { IdentityContext } from "../../IdentityContext/abstractions.js";
 import type { Role, CreateRoleInput } from "../shared/types.js";
 declare class CreateRoleUseCaseImpl implements UseCaseAbstraction.Interface {
-    private tenantContext;
     private identityContext;
     private eventPublisher;
     private repository;
-    constructor(tenantContext: TenantContext.Interface, identityContext: IdentityContext.Interface, eventPublisher: EventPublisher.Interface, repository: RolesRepository.Interface);
+    constructor(identityContext: IdentityContext.Interface, eventPublisher: EventPublisher.Interface, repository: RolesRepository.Interface);
     execute(input: CreateRoleInput): Promise<Result<Role, UseCaseAbstraction.Error>>;
 }
 export declare const CreateRoleUseCase: import("@webiny/di").Implementation<typeof CreateRoleUseCaseImpl>;