@webiny/api-core 0.0.0-unstable.6f45466a1d → 0.0.0-unstable.7be00a75a9

package/features/security/login/abstractions.d.ts

@@ -8,8 +8,9 @@ export declare class AfterLoginEvent extends DomainEvent<AfterLoginPayload> {
     eventType: "login.afterLogin";
     getHandlerAbstraction(): import("@webiny/di").Abstraction<IEventHandler<AfterLoginEvent>>;
 }
-export declare const AfterLoginHandler: import("@webiny/di").Abstraction<IEventHandler<AfterLoginEvent>>;
-export declare namespace AfterLoginHandler {
+/** Hook into login lifecycle after a user logs in. */
+export declare const AfterLoginEventHandler: import("@webiny/di").Abstraction<IEventHandler<AfterLoginEvent>>;
+export declare namespace AfterLoginEventHandler {
     type Interface = IEventHandler<AfterLoginEvent>;
     type Event = AfterLoginEvent;
 }

package/features/security/login/abstractions.js

@@ -1,11 +1,14 @@
 import { DomainEvent } from "../../eventPublisher/index.js";
 import { createAbstraction } from "@webiny/feature/api";
-export class AfterLoginEvent extends DomainEvent {
-  eventType = "login.afterLogin";
-  getHandlerAbstraction() {
-    return AfterLoginHandler;
-  }
+class AfterLoginEvent extends DomainEvent {
+    getHandlerAbstraction() {
+        return AfterLoginEventHandler;
+    }
+    constructor(...args){
+        super(...args), this.eventType = "login.afterLogin";
+    }
 }
-export const AfterLoginHandler = createAbstraction("AfterLoginHandler");
+const AfterLoginEventHandler = createAbstraction("AfterLoginEventHandler");
+export { AfterLoginEvent, AfterLoginEventHandler };
 
 //# sourceMappingURL=abstractions.js.map

package/features/security/login/abstractions.js.map

@@ -1 +1 @@
-{"version":3,"names":["DomainEvent","createAbstraction","AfterLoginEvent","eventType","getHandlerAbstraction","AfterLoginHandler"],"sources":["abstractions.ts"],"sourcesContent":["import { DomainEvent } from \"~/features/eventPublisher/index.js\";\nimport type { IEventHandler } from \"~/features/eventPublisher/index.js\";\nimport { createAbstraction } from \"@webiny/feature/api\";\nimport { Identity } from \"~/features/security/IdentityContext/index.js\";\n\nexport interface AfterLoginPayload {\n    identity: Identity;\n}\n\nexport class AfterLoginEvent extends DomainEvent<AfterLoginPayload> {\n    eventType = \"login.afterLogin\" as const;\n\n    getHandlerAbstraction() {\n        return AfterLoginHandler;\n    }\n}\n\nexport const AfterLoginHandler =\n    createAbstraction<IEventHandler<AfterLoginEvent>>(\"AfterLoginHandler\");\n\nexport namespace AfterLoginHandler {\n    export type Interface = IEventHandler<AfterLoginEvent>;\n    export type Event = AfterLoginEvent;\n}\n"],"mappings":"AAAA,SAASA,WAAW;AAEpB,SAASC,iBAAiB,QAAQ,qBAAqB;AAOvD,OAAO,MAAMC,eAAe,SAASF,WAAW,CAAoB;EAChEG,SAAS,GAAG,kBAAkB;EAE9BC,qBAAqBA,CAAA,EAAG;IACpB,OAAOC,iBAAiB;EAC5B;AACJ;AAEA,OAAO,MAAMA,iBAAiB,GAC1BJ,iBAAiB,CAAiC,mBAAmB,CAAC","ignoreList":[]}
+{"version":3,"file":"features/security/login/abstractions.js","sources":["../../../../src/features/security/login/abstractions.ts"],"sourcesContent":["import { DomainEvent } from \"~/features/eventPublisher/index.js\";\nimport type { IEventHandler } from \"~/features/eventPublisher/index.js\";\nimport { createAbstraction } from \"@webiny/feature/api\";\nimport { Identity } from \"~/features/security/IdentityContext/index.js\";\n\nexport interface AfterLoginPayload {\n    identity: Identity;\n}\n\nexport class AfterLoginEvent extends DomainEvent<AfterLoginPayload> {\n    eventType = \"login.afterLogin\" as const;\n\n    getHandlerAbstraction() {\n        return AfterLoginEventHandler;\n    }\n}\n\n/** Hook into login lifecycle after a user logs in. */\nexport const AfterLoginEventHandler =\n    createAbstraction<IEventHandler<AfterLoginEvent>>(\"AfterLoginEventHandler\");\n\nexport namespace AfterLoginEventHandler {\n    export type Interface = IEventHandler<AfterLoginEvent>;\n    export type Event = AfterLoginEvent;\n}\n"],"names":["AfterLoginEvent","DomainEvent","AfterLoginEventHandler","createAbstraction"],"mappings":";;AASO,MAAMA,wBAAwBC;IAGjC,wBAAwB;QACpB,OAAOC;IACX;;QALG,qBACH,SAAS,GAAG;;AAKhB;AAGO,MAAMA,yBACTC,kBAAkD"}

package/features/security/login/index.js

@@ -1,3 +1 @@
 export * from "./abstractions.js";
-
-//# sourceMappingURL=index.js.map

package/features/security/permissions/createPermissionSchema.d.ts

@@ -0,0 +1,2 @@
+import type { PermissionSchemaConfig } from "./types.js";
+export declare function createPermissionSchema<const T extends PermissionSchemaConfig>(config: T): T;

package/features/security/permissions/createPermissionSchema.js

@@ -0,0 +1,9 @@
+function createPermissionSchema(config) {
+    return {
+        ...config,
+        entities: config.entities ?? []
+    };
+}
+export { createPermissionSchema };
+
+//# sourceMappingURL=createPermissionSchema.js.map

package/features/security/permissions/createPermissionSchema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/permissions/createPermissionSchema.js","sources":["../../../../src/features/security/permissions/createPermissionSchema.ts"],"sourcesContent":["import type { PermissionSchemaConfig } from \"./types.js\";\n\nexport function createPermissionSchema<const T extends PermissionSchemaConfig>(config: T): T {\n    return {\n        ...config,\n        entities: config.entities ?? []\n    };\n}\n"],"names":["createPermissionSchema","config"],"mappings":"AAEO,SAASA,uBAA+DC,MAAS;IACpF,OAAO;QACH,GAAGA,MAAM;QACT,UAAUA,OAAO,QAAQ,IAAI,EAAE;IACnC;AACJ"}

package/features/security/permissions/createPermissions.d.ts

@@ -0,0 +1,8 @@
+import type { Abstraction } from "@webiny/di";
+import type { PermissionSchemaConfig } from "./types.js";
+import type { Permissions } from "./types.js";
+export declare function createPermissionsAbstraction<const S extends PermissionSchemaConfig>(schema: S): Abstraction<Permissions<S>>;
+export declare function createPermissionsFeature<const S extends PermissionSchemaConfig>(schema: S, abstraction: Abstraction<Permissions<S>>): {
+    name: string;
+    register(container: import("@webiny/di").Container): void;
+};

package/features/security/permissions/createPermissions.js

@@ -0,0 +1,162 @@
+import { createAbstraction, createFeature } from "@webiny/feature/api";
+import { IdentityContext } from "../IdentityContext/index.js";
+function buildEntityMap(schema) {
+    const map = new Map();
+    for (const entity of schema.entities ?? []){
+        const actions = new Set();
+        for (const action of entity.actions ?? [])actions.add(action.name);
+        map.set(entity.id, {
+            permission: entity.permission,
+            actions,
+            hasOwn: entity.scopes.includes("own")
+        });
+    }
+    return map;
+}
+function getEntity(entityMap, entityId) {
+    const entity = entityMap.get(entityId);
+    if (!entity) throw new Error(`Unknown entity "${entityId}" in permission schema.`);
+    return entity;
+}
+class SchemaPermissions {
+    constructor(schema, identityContext){
+        this.entityMap = buildEntityMap(schema);
+        this.fullAccessName = `${schema.prefix}.*`;
+        this.identityContext = identityContext;
+    }
+    async canAccess(entityId, item) {
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        if (void 0 === item) return true;
+        const ownOnly = !permissions.some((p)=>!p.own);
+        if (!ownOnly) return true;
+        const identity = this.identityContext.getIdentity();
+        return item.createdBy?.id === identity.id;
+    }
+    async onlyOwnRecords(entityId) {
+        if (await this.identityContext.hasFullAccess()) return false;
+        if (await this.hasFullSchemaAccess()) return false;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        return !permissions.some((p)=>!p.own);
+    }
+    async canRead(entityId) {
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        return permissions.some((permission)=>{
+            if ("string" != typeof permission.rwd) return true;
+            return permission.rwd.includes("r");
+        });
+    }
+    async canCreate(entityId) {
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        return permissions.some((permission)=>{
+            if ("string" != typeof permission.rwd) return true;
+            return permission.rwd.includes("w");
+        });
+    }
+    async canEdit(entityId, item) {
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        const identity = this.identityContext.getIdentity();
+        return permissions.some((permission)=>{
+            if (permission.own) {
+                if (!item?.createdBy) return true;
+                return item.createdBy.id === identity.id;
+            }
+            if ("string" != typeof permission.rwd) return true;
+            return permission.rwd.includes("w");
+        });
+    }
+    async canDelete(entityId, item) {
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        const identity = this.identityContext.getIdentity();
+        return permissions.some((permission)=>{
+            if (permission.own) return item?.createdBy?.id === identity.id;
+            if ("string" != typeof permission.rwd) return true;
+            return permission.rwd.includes("d");
+        });
+    }
+    async canPublish(entityId) {
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        return permissions.some((permission)=>permission.pw?.includes("p"));
+    }
+    async canUnpublish(entityId) {
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        return permissions.some((permission)=>permission.pw?.includes("u"));
+    }
+    async canAction(action, entityId) {
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        return permissions.some((permission)=>true === permission[action]);
+    }
+    async getEntityPermissions(entityPermission) {
+        const permissions = await this.identityContext.getPermissions(entityPermission);
+        if (permissions.length) return permissions;
+        const wildcard = await this.identityContext.getPermission(this.fullAccessName);
+        return wildcard ? [
+            wildcard
+        ] : [];
+    }
+    async hasFullSchemaAccess() {
+        const permission = await this.identityContext.getPermission(this.fullAccessName);
+        if (!permission) return false;
+        const keys = Object.keys(permission).filter((k)=>"name" !== k);
+        const hasRwd = keys.includes("rwd");
+        return !hasRwd;
+    }
+}
+function createPermissionsAbstraction(schema) {
+    return createAbstraction(`${schema.prefix}:Permissions`);
+}
+function createPermissionsFeature(schema, abstraction) {
+    class PermissionsImpl extends SchemaPermissions {
+        constructor(identityContext){
+            super(schema, identityContext);
+        }
+    }
+    const Implementation = abstraction.createImplementation({
+        implementation: PermissionsImpl,
+        dependencies: [
+            IdentityContext
+        ]
+    });
+    return createFeature({
+        name: `${schema.prefix}:Permissions`,
+        register (container) {
+            container.register(Implementation);
+        }
+    });
+}
+export { createPermissionsAbstraction, createPermissionsFeature };
+
+//# sourceMappingURL=createPermissions.js.map

package/features/security/permissions/createPermissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/permissions/createPermissions.js","sources":["../../../../src/features/security/permissions/createPermissions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport { createFeature } from \"@webiny/feature/api\";\nimport { IdentityContext } from \"~/features/security/IdentityContext/index.js\";\nimport type { Abstraction } from \"@webiny/di\";\nimport type { PermissionSchemaConfig } from \"./types.js\";\nimport type { OwnableItem } from \"./types.js\";\nimport type { Permissions } from \"./types.js\";\n\ninterface EntityLookup {\n    permission: string;\n    actions: Set<string>;\n    hasOwn: boolean;\n}\n\nfunction buildEntityMap(schema: PermissionSchemaConfig): Map<string, EntityLookup> {\n    const map = new Map<string, EntityLookup>();\n    for (const entity of schema.entities ?? []) {\n        const actions = new Set<string>();\n        for (const action of entity.actions ?? []) {\n            actions.add(action.name);\n        }\n        map.set(entity.id, {\n            permission: entity.permission,\n            actions,\n            hasOwn: entity.scopes.includes(\"own\")\n        });\n    }\n    return map;\n}\n\nfunction getEntity(entityMap: Map<string, EntityLookup>, entityId: string): EntityLookup {\n    const entity = entityMap.get(entityId);\n    if (!entity) {\n        throw new Error(`Unknown entity \"${entityId}\" in permission schema.`);\n    }\n    return entity;\n}\n\nclass SchemaPermissions<S extends PermissionSchemaConfig> {\n    private readonly entityMap: Map<string, EntityLookup>;\n    private readonly fullAccessName: string;\n    private readonly identityContext: IdentityContext.Interface;\n\n    constructor(schema: S, identityContext: IdentityContext.Interface) {\n        this.entityMap = buildEntityMap(schema);\n        this.fullAccessName = `${schema.prefix}.*`;\n        this.identityContext = identityContext;\n    }\n\n    async canAccess(entityId: string, item?: OwnableItem): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        // No item — just check entity-level access.\n        if (item === undefined) {\n            return true;\n        }\n        // Item provided — if all permissions require own, verify ownership.\n        const ownOnly = !permissions.some(p => !p.own);\n        if (!ownOnly) {\n            return true;\n        }\n        const identity = this.identityContext.getIdentity();\n        return item.createdBy?.id === identity.id;\n    }\n\n    async onlyOwnRecords(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return false;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return false;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return !permissions.some(p => !p.own);\n    }\n\n    async canRead(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"r\");\n        });\n    }\n\n    async canCreate(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"w\");\n        });\n    }\n\n    async canEdit(entityId: string, item?: OwnableItem): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        const identity = this.identityContext.getIdentity();\n        return permissions.some(permission => {\n            if (permission.own) {\n                // No item provided (new/unsaved) — allow access.\n                if (!item?.createdBy) {\n                    return true;\n                }\n                return item.createdBy.id === identity.id;\n            }\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"w\");\n        });\n    }\n\n    async canDelete(entityId: string, item?: OwnableItem): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        const identity = this.identityContext.getIdentity();\n        return permissions.some(permission => {\n            if (permission.own) {\n                return item?.createdBy?.id === identity.id;\n            }\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"d\");\n        });\n    }\n\n    async canPublish(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission.pw?.includes(\"p\");\n        });\n    }\n\n    async canUnpublish(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission.pw?.includes(\"u\");\n        });\n    }\n\n    async canAction(action: string, entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission[action] === true;\n        });\n    }\n\n    private async getEntityPermissions(entityPermission: string): Promise<any[]> {\n        const permissions = await this.identityContext.getPermissions(entityPermission);\n        if (permissions.length) {\n            return permissions;\n        }\n        // Fall back to the schema wildcard (e.g. \"test.*\") — its flags apply to all entities.\n        const wildcard = await this.identityContext.getPermission(this.fullAccessName);\n        return wildcard ? [wildcard] : [];\n    }\n\n    private async hasFullSchemaAccess(): Promise<boolean> {\n        const permission = await this.identityContext.getPermission(this.fullAccessName);\n        if (!permission) {\n            return false;\n        }\n        // Only treat as full access if the permission has no `rwd` flag.\n        // A permission like { name: \"wb.*\", rwd: \"r\" } should NOT grant full access.\n        const keys = Object.keys(permission).filter(k => k !== \"name\");\n\n        const hasRwd = keys.includes(\"rwd\");\n\n        // It's full-access only if there's no `rwd` flag.\n        return !hasRwd;\n    }\n}\n\nexport function createPermissionsAbstraction<const S extends PermissionSchemaConfig>(schema: S) {\n    return createAbstraction<Permissions<S>>(`${schema.prefix}:Permissions`);\n}\n\nexport function createPermissionsFeature<const S extends PermissionSchemaConfig>(\n    schema: S,\n    abstraction: Abstraction<Permissions<S>>\n) {\n    class PermissionsImpl extends SchemaPermissions<S> {\n        constructor(identityContext: IdentityContext.Interface) {\n            super(schema, identityContext);\n        }\n    }\n\n    const Implementation = abstraction.createImplementation({\n        implementation: PermissionsImpl,\n        dependencies: [IdentityContext]\n    } as any);\n\n    return createFeature({\n        name: `${schema.prefix}:Permissions`,\n        register(container) {\n            container.register(Implementation);\n        }\n    });\n}\n"],"names":["buildEntityMap","schema","map","Map","entity","actions","Set","action","getEntity","entityMap","entityId","Error","SchemaPermissions","identityContext","item","permissions","undefined","ownOnly","p","identity","permission","entityPermission","wildcard","keys","Object","k","hasRwd","createPermissionsAbstraction","createAbstraction","createPermissionsFeature","abstraction","PermissionsImpl","Implementation","IdentityContext","createFeature","container"],"mappings":";;AAcA,SAASA,eAAeC,MAA8B;IAClD,MAAMC,MAAM,IAAIC;IAChB,KAAK,MAAMC,UAAUH,OAAO,QAAQ,IAAI,EAAE,CAAE;QACxC,MAAMI,UAAU,IAAIC;QACpB,KAAK,MAAMC,UAAUH,OAAO,OAAO,IAAI,EAAE,CACrCC,QAAQ,GAAG,CAACE,OAAO,IAAI;QAE3BL,IAAI,GAAG,CAACE,OAAO,EAAE,EAAE;YACf,YAAYA,OAAO,UAAU;YAC7BC;YACA,QAAQD,OAAO,MAAM,CAAC,QAAQ,CAAC;QACnC;IACJ;IACA,OAAOF;AACX;AAEA,SAASM,UAAUC,SAAoC,EAAEC,QAAgB;IACrE,MAAMN,SAASK,UAAU,GAAG,CAACC;IAC7B,IAAI,CAACN,QACD,MAAM,IAAIO,MAAM,CAAC,gBAAgB,EAAED,SAAS,uBAAuB,CAAC;IAExE,OAAON;AACX;AAEA,MAAMQ;IAKF,YAAYX,MAAS,EAAEY,eAA0C,CAAE;QAC/D,IAAI,CAAC,SAAS,GAAGb,eAAeC;QAChC,IAAI,CAAC,cAAc,GAAG,GAAGA,OAAO,MAAM,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,eAAe,GAAGY;IAC3B;IAEA,MAAM,UAAUH,QAAgB,EAAEI,IAAkB,EAAoB;QACpE,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMV,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAGX,IAAID,AAASE,WAATF,MACA,OAAO;QAGX,MAAMG,UAAU,CAACF,YAAY,IAAI,CAACG,CAAAA,IAAK,CAACA,EAAE,GAAG;QAC7C,IAAI,CAACD,SACD,OAAO;QAEX,MAAME,WAAW,IAAI,CAAC,eAAe,CAAC,WAAW;QACjD,OAAOL,KAAK,SAAS,EAAE,OAAOK,SAAS,EAAE;IAC7C;IAEA,MAAM,eAAeT,QAAgB,EAAoB;QACrD,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,OAAO,CAACA,YAAY,IAAI,CAACG,CAAAA,IAAK,CAACA,EAAE,GAAG;IACxC;IAEA,MAAM,QAAQR,QAAgB,EAAoB;QAC9C,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,OAAOA,YAAY,IAAI,CAACK,CAAAA;YACpB,IAAI,AAA0B,YAA1B,OAAOA,WAAW,GAAG,EACrB,OAAO;YAEX,OAAOA,WAAW,GAAG,CAAC,QAAQ,CAAC;QACnC;IACJ;IAEA,MAAM,UAAUV,QAAgB,EAAoB;QAChD,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,OAAOA,YAAY,IAAI,CAACK,CAAAA;YACpB,IAAI,AAA0B,YAA1B,OAAOA,WAAW,GAAG,EACrB,OAAO;YAEX,OAAOA,WAAW,GAAG,CAAC,QAAQ,CAAC;QACnC;IACJ;IAEA,MAAM,QAAQV,QAAgB,EAAEI,IAAkB,EAAoB;QAClE,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMV,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,MAAMI,WAAW,IAAI,CAAC,eAAe,CAAC,WAAW;QACjD,OAAOJ,YAAY,IAAI,CAACK,CAAAA;YACpB,IAAIA,WAAW,GAAG,EAAE;gBAEhB,IAAI,CAACN,MAAM,WACP,OAAO;gBAEX,OAAOA,KAAK,SAAS,CAAC,EAAE,KAAKK,SAAS,EAAE;YAC5C;YACA,IAAI,AAA0B,YAA1B,OAAOC,WAAW,GAAG,EACrB,OAAO;YAEX,OAAOA,WAAW,GAAG,CAAC,QAAQ,CAAC;QACnC;IACJ;IAEA,MAAM,UAAUV,QAAgB,EAAEI,IAAkB,EAAoB;QACpE,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMV,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,MAAMI,WAAW,IAAI,CAAC,eAAe,CAAC,WAAW;QACjD,OAAOJ,YAAY,IAAI,CAACK,CAAAA;YACpB,IAAIA,WAAW,GAAG,EACd,OAAON,MAAM,WAAW,OAAOK,SAAS,EAAE;YAE9C,IAAI,AAA0B,YAA1B,OAAOC,WAAW,GAAG,EACrB,OAAO;YAEX,OAAOA,WAAW,GAAG,CAAC,QAAQ,CAAC;QACnC;IACJ;IAEA,MAAM,WAAWV,QAAgB,EAAoB;QACjD,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,OAAOA,YAAY,IAAI,CAACK,CAAAA,aACbA,WAAW,EAAE,EAAE,SAAS;IAEvC;IAEA,MAAM,aAAaV,QAAgB,EAAoB;QACnD,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,OAAOA,YAAY,IAAI,CAACK,CAAAA,aACbA,WAAW,EAAE,EAAE,SAAS;IAEvC;IAEA,MAAM,UAAUb,MAAc,EAAEG,QAAgB,EAAoB;QAChE,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,OAAOA,YAAY,IAAI,CAACK,CAAAA,aACbA,AAAuB,SAAvBA,UAAU,CAACb,OAAO;IAEjC;IAEA,MAAc,qBAAqBc,gBAAwB,EAAkB;QACzE,MAAMN,cAAc,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CAACM;QAC9D,IAAIN,YAAY,MAAM,EAClB,OAAOA;QAGX,MAAMO,WAAW,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc;QAC7E,OAAOA,WAAW;YAACA;SAAS,GAAG,EAAE;IACrC;IAEA,MAAc,sBAAwC;QAClD,MAAMF,aAAa,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc;QAC/E,IAAI,CAACA,YACD,OAAO;QAIX,MAAMG,OAAOC,OAAO,IAAI,CAACJ,YAAY,MAAM,CAACK,CAAAA,IAAKA,AAAM,WAANA;QAEjD,MAAMC,SAASH,KAAK,QAAQ,CAAC;QAG7B,OAAO,CAACG;IACZ;AACJ;AAEO,SAASC,6BAAqE1B,MAAS;IAC1F,OAAO2B,kBAAkC,GAAG3B,OAAO,MAAM,CAAC,YAAY,CAAC;AAC3E;AAEO,SAAS4B,yBACZ5B,MAAS,EACT6B,WAAwC;IAExC,MAAMC,wBAAwBnB;QAC1B,YAAYC,eAA0C,CAAE;YACpD,KAAK,CAACZ,QAAQY;QAClB;IACJ;IAEA,MAAMmB,iBAAiBF,YAAY,oBAAoB,CAAC;QACpD,gBAAgBC;QAChB,cAAc;YAACE;SAAgB;IACnC;IAEA,OAAOC,cAAc;QACjB,MAAM,GAAGjC,OAAO,MAAM,CAAC,YAAY,CAAC;QACpC,UAASkC,SAAS;YACdA,UAAU,QAAQ,CAACH;QACvB;IACJ;AACJ"}

package/features/security/permissions/index.d.ts

@@ -0,0 +1,3 @@
+export { createPermissionSchema } from "./createPermissionSchema.js";
+export { createPermissionsAbstraction, createPermissionsFeature } from "./createPermissions.js";
+export type { ActionDefinition, EntityDefinition, PermissionSchemaConfig, OwnableItem, Permissions, AllEntityIds, RwdEntityId, PwEntityId, CustomActionNames } from "./types.js";

package/features/security/permissions/index.js

@@ -0,0 +1,2 @@
+export { createPermissionSchema } from "./createPermissionSchema.js";
+export { createPermissionsAbstraction, createPermissionsFeature } from "./createPermissions.js";

package/features/security/permissions/types.d.ts

@@ -0,0 +1,137 @@
+/**
+ * An action definition on an entity.
+ *
+ * Built-in actions:
+ * - `{ name: "rwd" }` — read/write/delete (serialized as joined string, e.g. "rw")
+ * - `{ name: "pw" }` — publish/unpublish (serialized as joined string, e.g. "pu")
+ *
+ * Custom actions:
+ * - `{ name: "install" }` — boolean flag (serialized as `install: true`)
+ */
+export interface ActionDefinition {
+    /** Key on the permission object (e.g. "rwd", "pw", "install"). */
+    name: string;
+    /** Display label for the UI. Required for custom actions; ignored for built-in "rwd"/"pw". */
+    label?: string;
+}
+/**
+ * Defines an entity within a permission schema.
+ */
+export interface EntityDefinition {
+    /** Unique ID, used for form field naming: ${id}AccessScope, ${id}RWD, etc. */
+    id: string;
+    /** Display title for the UI renderer (e.g. "Files", "Settings"). */
+    title?: string;
+    /** Permission name emitted for this entity (e.g. "fm.file"). */
+    permission: string;
+    /** Available access scopes. */
+    scopes: readonly ("full" | "own")[];
+    /** Action definitions for this entity. */
+    actions?: readonly ActionDefinition[];
+    /** Dependency on another entity. */
+    dependsOn?: {
+        /** ID of parent entity. */
+        entity: string;
+        /** Required action character (e.g. "r"). */
+        requires: string;
+    };
+}
+/**
+ * Configuration for creating a permission schema.
+ */
+export interface PermissionSchemaConfig {
+    /** Permission prefix — used to filter permissions from the array. */
+    prefix: string;
+    /**
+     * Full access configuration.
+     * - `true` — emits `{ name: "${prefix}.*" }`.
+     * - `{ ...extras }` — emits `{ name: "${prefix}.*", ...extras }`.
+     */
+    fullAccess: boolean | {
+        [key: string]: any;
+    };
+    /** Entity definitions (optional — simple apps have none). */
+    entities?: readonly EntityDefinition[];
+}
+/**
+ * Item that may have an owner (used for own-scope permission checks).
+ */
+export interface OwnableItem {
+    createdBy?: {
+        id: string;
+    } | null;
+}
+/**
+ * Extract the union of entity definitions from a schema config type.
+ */
+type EntitiesOf<S extends PermissionSchemaConfig> = S extends {
+    entities: ReadonlyArray<infer E extends EntityDefinition>;
+} ? E : never;
+/**
+ * Extract entity IDs whose actions array contains an action with the given name.
+ */
+type EntityIdWithAction<S extends PermissionSchemaConfig, A extends string> = {
+    [K in EntitiesOf<S> as K extends {
+        actions: ReadonlyArray<infer Act>;
+    } ? Act extends {
+        name: A;
+    } ? K["id"] : never : never]: never;
+} extends infer M ? keyof M & string : never;
+/**
+ * All entity IDs in the schema.
+ */
+export type AllEntityIds<S extends PermissionSchemaConfig> = EntitiesOf<S>["id"];
+/**
+ * Entity IDs that have the "rwd" action.
+ */
+export type RwdEntityId<S extends PermissionSchemaConfig> = EntityIdWithAction<S, "rwd">;
+/**
+ * Entity IDs that have the "pw" action.
+ */
+export type PwEntityId<S extends PermissionSchemaConfig> = EntityIdWithAction<S, "pw">;
+/**
+ * Custom (non-builtin) action names across all entities.
+ */
+export type CustomActionNames<S extends PermissionSchemaConfig> = Exclude<EntitiesOf<S> extends {
+    actions: ReadonlyArray<infer Act extends ActionDefinition>;
+} ? Act["name"] : never, "rwd" | "pw">;
+/**
+ * Typed permissions interface for a given schema.
+ *
+ * When the schema has literal entity types, methods are narrowed to only accept valid entity IDs.
+ * When the schema is dynamically typed, all methods accept `string`.
+ */
+export type Permissions<S extends PermissionSchemaConfig> = string extends AllEntityIds<S> ? PermissionsUntyped : PermissionsTyped<S>;
+export interface PermissionsUntyped {
+    canAccess(entityId: string, item?: OwnableItem): Promise<boolean>;
+    onlyOwnRecords(entityId: string): Promise<boolean>;
+    canRead(entityId: string): Promise<boolean>;
+    canCreate(entityId: string): Promise<boolean>;
+    canEdit(entityId: string, item?: OwnableItem): Promise<boolean>;
+    canDelete(entityId: string, item?: OwnableItem): Promise<boolean>;
+    canPublish(entityId: string): Promise<boolean>;
+    canUnpublish(entityId: string): Promise<boolean>;
+    canAction(action: string, entityId: string): Promise<boolean>;
+}
+export type PermissionsTyped<S extends PermissionSchemaConfig> = {
+    canAccess(entityId: AllEntityIds<S>, item?: OwnableItem): Promise<boolean>;
+    onlyOwnRecords(entityId: AllEntityIds<S>): Promise<boolean>;
+    canAction(action: CustomActionNames<S> extends never ? string : CustomActionNames<S>, entityId: AllEntityIds<S>): Promise<boolean>;
+} & ([RwdEntityId<S>] extends [never] ? {
+    canRead(entityId: string): Promise<boolean>;
+    canCreate(entityId: string): Promise<boolean>;
+    canEdit(entityId: string, item?: OwnableItem): Promise<boolean>;
+    canDelete(entityId: string, item?: OwnableItem): Promise<boolean>;
+} : {
+    canRead(entityId: RwdEntityId<S>): Promise<boolean>;
+    canCreate(entityId: RwdEntityId<S>): Promise<boolean>;
+    canEdit(entityId: RwdEntityId<S>, item?: OwnableItem): Promise<boolean>;
+    canDelete(entityId: RwdEntityId<S>, item?: OwnableItem): Promise<boolean>;
+}) & ([PwEntityId<S>] extends [never] ? {
+    canPublish(entityId: string): Promise<boolean>;
+    canUnpublish(entityId: string): Promise<boolean>;
+} : {
+    canPublish(entityId: PwEntityId<S>): Promise<boolean>;
+    canUnpublish(entityId: PwEntityId<S>): Promise<boolean>;
+});
+export {};

package/features/security/roles/CreateRole/CreateRoleUseCase.d.ts

@@ -1,16 +1,14 @@
 import { Result } from "@webiny/feature/api";
-import { TenantContext } from "../../../../features/tenancy/TenantContext/index.js";
 import { EventPublisher } from "../../../../features/eventPublisher/index.js";
 import { CreateRoleUseCase as UseCaseAbstraction } from "./abstractions.js";
 import { RolesRepository } from "../shared/abstractions.js";
 import { IdentityContext } from "../../IdentityContext/abstractions.js";
 import type { Role, CreateRoleInput } from "../shared/types.js";
 declare class CreateRoleUseCaseImpl implements UseCaseAbstraction.Interface {
-    private tenantContext;
     private identityContext;
     private eventPublisher;
     private repository;
-    constructor(tenantContext: TenantContext.Interface, identityContext: IdentityContext.Interface, eventPublisher: EventPublisher.Interface, repository: RolesRepository.Interface);
+    constructor(identityContext: IdentityContext.Interface, eventPublisher: EventPublisher.Interface, repository: RolesRepository.Interface);
     execute(input: CreateRoleInput): Promise<Result<Role, UseCaseAbstraction.Error>>;
 }
 export declare const CreateRoleUseCase: import("@webiny/di").Implementation<typeof CreateRoleUseCaseImpl>;

package/features/security/roles/CreateRole/CreateRoleUseCase.js

@@ -1,76 +1,66 @@
 import { mdbid } from "@webiny/utils";
-import { createImplementation } from "@webiny/feature/api";
-import { Result } from "@webiny/feature/api";
-import { TenantContext } from "../../../tenancy/TenantContext/index.js";
+import { Result, createImplementation } from "@webiny/feature/api";
 import { EventPublisher } from "../../../eventPublisher/index.js";
-import { CreateRoleUseCase as UseCaseAbstraction } from "./abstractions.js";
+import { CreateRoleUseCase } from "./abstractions.js";
 import { RolesRepository } from "../shared/abstractions.js";
 import { IdentityContext } from "../../IdentityContext/abstractions.js";
 import { createRoleValidation } from "./schema.js";
-import { RoleBeforeCreateEvent, RoleAfterCreateEvent } from "./events.js";
+import { RoleAfterCreateEvent, RoleBeforeCreateEvent } from "./events.js";
 import { NotAuthorizedError, RoleExistsError, RoleValidationError } from "../shared/errors.js";
 class CreateRoleUseCaseImpl {
-  constructor(tenantContext, identityContext, eventPublisher, repository) {
-    this.tenantContext = tenantContext;
-    this.identityContext = identityContext;
-    this.eventPublisher = eventPublisher;
-    this.repository = repository;
-  }
-  async execute(input) {
-    const hasPermission = await this.identityContext.getPermission("security.role");
-    if (!hasPermission) {
-      return Result.fail(new NotAuthorizedError());
+    constructor(identityContext, eventPublisher, repository){
+        this.identityContext = identityContext;
+        this.eventPublisher = eventPublisher;
+        this.repository = repository;
     }
-    const validation = createRoleValidation.safeParse(input);
-    if (!validation.success) {
-      return Result.fail(new RoleValidationError(validation.error.errors[0].message));
+    async execute(input) {
+        const hasPermission = await this.identityContext.getPermission("security.role");
+        if (!hasPermission) return Result.fail(new NotAuthorizedError());
+        const validation = createRoleValidation.safeParse(input);
+        if (!validation.success) return Result.fail(new RoleValidationError(validation.error.issues[0].message));
+        const identity = this.identityContext.getIdentity();
+        const data = validation.data;
+        const existingRoleResult = await this.repository.get({
+            slug: data.slug
+        });
+        if (existingRoleResult.isOk()) return Result.fail(new RoleExistsError(data.slug));
+        const role = {
+            id: mdbid(),
+            name: data.name,
+            slug: data.slug,
+            description: data.description,
+            permissions: data.permissions,
+            system: input.system || false,
+            createdOn: new Date().toISOString(),
+            createdBy: {
+                id: identity.id,
+                displayName: identity.displayName,
+                type: identity.type
+            },
+            plugin: false
+        };
+        await this.eventPublisher.publish(new RoleBeforeCreateEvent({
+            role,
+            input: validation.data
+        }));
+        const result = await this.repository.create(role);
+        if (result.isFail()) return Result.fail(result.error);
+        await this.eventPublisher.publish(new RoleAfterCreateEvent({
+            role,
+            input: validation.data
+        }));
+        return Result.ok(role);
     }
-    const tenant = this.tenantContext.getTenant();
-    const identity = this.identityContext.getIdentity();
-    const data = validation.data;
-
-    // Check if role with same slug already exists
-    const existingRoleResult = await this.repository.get({
-      slug: data.slug
-    });
-    if (existingRoleResult.isOk()) {
-      return Result.fail(new RoleExistsError(data.slug));
-    }
-    const role = {
-      id: mdbid(),
-      name: data.name,
-      slug: data.slug,
-      description: data.description,
-      permissions: data.permissions,
-      system: input.system || false,
-      tenant: tenant.id,
-      createdOn: new Date().toISOString(),
-      createdBy: {
-        id: identity.id,
-        displayName: identity.displayName,
-        type: identity.type
-      },
-      plugin: false
-    };
-    await this.eventPublisher.publish(new RoleBeforeCreateEvent({
-      role,
-      input: validation.data
-    }));
-    const result = await this.repository.create(role);
-    if (result.isFail()) {
-      return Result.fail(result.error);
-    }
-    await this.eventPublisher.publish(new RoleAfterCreateEvent({
-      role,
-      input: validation.data
-    }));
-    return Result.ok(role);
-  }
 }
-export const CreateRoleUseCase = createImplementation({
-  abstraction: UseCaseAbstraction,
-  implementation: CreateRoleUseCaseImpl,
-  dependencies: [TenantContext, IdentityContext, EventPublisher, RolesRepository]
+const CreateRoleUseCase_CreateRoleUseCase = createImplementation({
+    abstraction: CreateRoleUseCase,
+    implementation: CreateRoleUseCaseImpl,
+    dependencies: [
+        IdentityContext,
+        EventPublisher,
+        RolesRepository
+    ]
 });
+export { CreateRoleUseCase_CreateRoleUseCase as CreateRoleUseCase };
 
 //# sourceMappingURL=CreateRoleUseCase.js.map

package/features/security/roles/CreateRole/CreateRoleUseCase.js.map

@@ -1 +1 @@
-{"version":3,"names":["mdbid","createImplementation","Result","TenantContext","EventPublisher","CreateRoleUseCase","UseCaseAbstraction","RolesRepository","IdentityContext","createRoleValidation","RoleBeforeCreateEvent","RoleAfterCreateEvent","NotAuthorizedError","RoleExistsError","RoleValidationError","CreateRoleUseCaseImpl","constructor","tenantContext","identityContext","eventPublisher","repository","execute","input","hasPermission","getPermission","fail","validation","safeParse","success","error","errors","message","tenant","getTenant","identity","getIdentity","data","existingRoleResult","get","slug","isOk","role","id","name","description","permissions","system","createdOn","Date","toISOString","createdBy","displayName","type","plugin","publish","result","create","isFail","ok","abstraction","implementation","dependencies"],"sources":["CreateRoleUseCase.ts"],"sourcesContent":["import { mdbid } from \"@webiny/utils\";\nimport { createImplementation } from \"@webiny/feature/api\";\nimport { Result } from \"@webiny/feature/api\";\nimport { TenantContext } from \"~/features/tenancy/TenantContext/index.js\";\nimport { EventPublisher } from \"~/features/eventPublisher/index.js\";\nimport { CreateRoleUseCase as UseCaseAbstraction } from \"./abstractions.js\";\nimport { RolesRepository } from \"../shared/abstractions.js\";\nimport { IdentityContext } from \"../../IdentityContext/abstractions.js\";\nimport { createRoleValidation } from \"./schema.js\";\nimport { RoleBeforeCreateEvent, RoleAfterCreateEvent } from \"./events.js\";\nimport type { Role, CreateRoleInput } from \"../shared/types.js\";\nimport { NotAuthorizedError, RoleExistsError, RoleValidationError } from \"../shared/errors.js\";\n\nclass CreateRoleUseCaseImpl implements UseCaseAbstraction.Interface {\n    constructor(\n        private tenantContext: TenantContext.Interface,\n        private identityContext: IdentityContext.Interface,\n        private eventPublisher: EventPublisher.Interface,\n        private repository: RolesRepository.Interface\n    ) {}\n\n    async execute(input: CreateRoleInput): Promise<Result<Role, UseCaseAbstraction.Error>> {\n        const hasPermission = await this.identityContext.getPermission(\"security.role\");\n\n        if (!hasPermission) {\n            return Result.fail(new NotAuthorizedError());\n        }\n\n        const validation = createRoleValidation.safeParse(input);\n        if (!validation.success) {\n            return Result.fail(new RoleValidationError(validation.error.errors[0].message));\n        }\n\n        const tenant = this.tenantContext.getTenant();\n        const identity = this.identityContext.getIdentity();\n        const data = validation.data;\n\n        // Check if role with same slug already exists\n        const existingRoleResult = await this.repository.get({ slug: data.slug });\n        if (existingRoleResult.isOk()) {\n            return Result.fail(new RoleExistsError(data.slug));\n        }\n\n        const role: Role = {\n            id: mdbid(),\n            name: data.name,\n            slug: data.slug,\n            description: data.description,\n            permissions: data.permissions,\n            system: input.system || false,\n            tenant: tenant.id,\n            createdOn: new Date().toISOString(),\n            createdBy: {\n                id: identity.id,\n                displayName: identity.displayName,\n                type: identity.type\n            },\n            plugin: false\n        };\n\n        await this.eventPublisher.publish(\n            new RoleBeforeCreateEvent({ role, input: validation.data })\n        );\n\n        const result = await this.repository.create(role);\n\n        if (result.isFail()) {\n            return Result.fail(result.error);\n        }\n\n        await this.eventPublisher.publish(\n            new RoleAfterCreateEvent({ role, input: validation.data })\n        );\n\n        return Result.ok(role);\n    }\n}\n\nexport const CreateRoleUseCase = createImplementation({\n    abstraction: UseCaseAbstraction,\n    implementation: CreateRoleUseCaseImpl,\n    dependencies: [TenantContext, IdentityContext, EventPublisher, RolesRepository]\n});\n"],"mappings":"AAAA,SAASA,KAAK,QAAQ,eAAe;AACrC,SAASC,oBAAoB,QAAQ,qBAAqB;AAC1D,SAASC,MAAM,QAAQ,qBAAqB;AAC5C,SAASC,aAAa;AACtB,SAASC,cAAc;AACvB,SAASC,iBAAiB,IAAIC,kBAAkB;AAChD,SAASC,eAAe;AACxB,SAASC,eAAe;AACxB,SAASC,oBAAoB;AAC7B,SAASC,qBAAqB,EAAEC,oBAAoB;AAEpD,SAASC,kBAAkB,EAAEC,eAAe,EAAEC,mBAAmB;AAEjE,MAAMC,qBAAqB,CAAyC;EAChEC,WAAWA,CACCC,aAAsC,EACtCC,eAA0C,EAC1CC,cAAwC,EACxCC,UAAqC,EAC/C;IAAA,KAJUH,aAAsC,GAAtCA,aAAsC;IAAA,KACtCC,eAA0C,GAA1CA,eAA0C;IAAA,KAC1CC,cAAwC,GAAxCA,cAAwC;IAAA,KACxCC,UAAqC,GAArCA,UAAqC;EAC9C;EAEH,MAAMC,OAAOA,CAACC,KAAsB,EAAmD;IACnF,MAAMC,aAAa,GAAG,MAAM,IAAI,CAACL,eAAe,CAACM,aAAa,CAAC,eAAe,CAAC;IAE/E,IAAI,CAACD,aAAa,EAAE;MAChB,OAAOrB,MAAM,CAACuB,IAAI,CAAC,IAAIb,kBAAkB,CAAC,CAAC,CAAC;IAChD;IAEA,MAAMc,UAAU,GAAGjB,oBAAoB,CAACkB,SAAS,CAACL,KAAK,CAAC;IACxD,IAAI,CAACI,UAAU,CAACE,OAAO,EAAE;MACrB,OAAO1B,MAAM,CAACuB,IAAI,CAAC,IAAIX,mBAAmB,CAACY,UAAU,CAACG,KAAK,CAACC,MAAM,CAAC,CAAC,CAAC,CAACC,OAAO,CAAC,CAAC;IACnF;IAEA,MAAMC,MAAM,GAAG,IAAI,CAACf,aAAa,CAACgB,SAAS,CAAC,CAAC;IAC7C,MAAMC,QAAQ,GAAG,IAAI,CAAChB,eAAe,CAACiB,WAAW,CAAC,CAAC;IACnD,MAAMC,IAAI,GAAGV,UAAU,CAACU,IAAI;;IAE5B;IACA,MAAMC,kBAAkB,GAAG,MAAM,IAAI,CAACjB,UAAU,CAACkB,GAAG,CAAC;MAAEC,IAAI,EAAEH,IAAI,CAACG;IAAK,CAAC,CAAC;IACzE,IAAIF,kBAAkB,CAACG,IAAI,CAAC,CAAC,EAAE;MAC3B,OAAOtC,MAAM,CAACuB,IAAI,CAAC,IAAIZ,eAAe,CAACuB,IAAI,CAACG,IAAI,CAAC,CAAC;IACtD;IAEA,MAAME,IAAU,GAAG;MACfC,EAAE,EAAE1C,KAAK,CAAC,CAAC;MACX2C,IAAI,EAAEP,IAAI,CAACO,IAAI;MACfJ,IAAI,EAAEH,IAAI,CAACG,IAAI;MACfK,WAAW,EAAER,IAAI,CAACQ,WAAW;MAC7BC,WAAW,EAAET,IAAI,CAACS,WAAW;MAC7BC,MAAM,EAAExB,KAAK,CAACwB,MAAM,IAAI,KAAK;MAC7Bd,MAAM,EAAEA,MAAM,CAACU,EAAE;MACjBK,SAAS,EAAE,IAAIC,IAAI,CAAC,CAAC,CAACC,WAAW,CAAC,CAAC;MACnCC,SAAS,EAAE;QACPR,EAAE,EAAER,QAAQ,CAACQ,EAAE;QACfS,WAAW,EAAEjB,QAAQ,CAACiB,WAAW;QACjCC,IAAI,EAAElB,QAAQ,CAACkB;MACnB,CAAC;MACDC,MAAM,EAAE;IACZ,CAAC;IAED,MAAM,IAAI,CAAClC,cAAc,CAACmC,OAAO,CAC7B,IAAI5C,qBAAqB,CAAC;MAAE+B,IAAI;MAAEnB,KAAK,EAAEI,UAAU,CAACU;IAAK,CAAC,CAC9D,CAAC;IAED,MAAMmB,MAAM,GAAG,MAAM,IAAI,CAACnC,UAAU,CAACoC,MAAM,CAACf,IAAI,CAAC;IAEjD,IAAIc,MAAM,CAACE,MAAM,CAAC,CAAC,EAAE;MACjB,OAAOvD,MAAM,CAACuB,IAAI,CAAC8B,MAAM,CAAC1B,KAAK,CAAC;IACpC;IAEA,MAAM,IAAI,CAACV,cAAc,CAACmC,OAAO,CAC7B,IAAI3C,oBAAoB,CAAC;MAAE8B,IAAI;MAAEnB,KAAK,EAAEI,UAAU,CAACU;IAAK,CAAC,CAC7D,CAAC;IAED,OAAOlC,MAAM,CAACwD,EAAE,CAACjB,IAAI,CAAC;EAC1B;AACJ;AAEA,OAAO,MAAMpC,iBAAiB,GAAGJ,oBAAoB,CAAC;EAClD0D,WAAW,EAAErD,kBAAkB;EAC/BsD,cAAc,EAAE7C,qBAAqB;EACrC8C,YAAY,EAAE,CAAC1D,aAAa,EAAEK,eAAe,EAAEJ,cAAc,EAAEG,eAAe;AAClF,CAAC,CAAC","ignoreList":[]}
+{"version":3,"file":"features/security/roles/CreateRole/CreateRoleUseCase.js","sources":["../../../../../src/features/security/roles/CreateRole/CreateRoleUseCase.ts"],"sourcesContent":["import { mdbid } from \"@webiny/utils\";\nimport { createImplementation } from \"@webiny/feature/api\";\nimport { Result } from \"@webiny/feature/api\";\nimport { EventPublisher } from \"~/features/eventPublisher/index.js\";\nimport { CreateRoleUseCase as UseCaseAbstraction } from \"./abstractions.js\";\nimport { RolesRepository } from \"../shared/abstractions.js\";\nimport { IdentityContext } from \"../../IdentityContext/abstractions.js\";\nimport { createRoleValidation } from \"./schema.js\";\nimport { RoleBeforeCreateEvent, RoleAfterCreateEvent } from \"./events.js\";\nimport type { Role, CreateRoleInput } from \"../shared/types.js\";\nimport { NotAuthorizedError, RoleExistsError, RoleValidationError } from \"../shared/errors.js\";\n\nclass CreateRoleUseCaseImpl implements UseCaseAbstraction.Interface {\n    constructor(\n        private identityContext: IdentityContext.Interface,\n        private eventPublisher: EventPublisher.Interface,\n        private repository: RolesRepository.Interface\n    ) {}\n\n    async execute(input: CreateRoleInput): Promise<Result<Role, UseCaseAbstraction.Error>> {\n        const hasPermission = await this.identityContext.getPermission(\"security.role\");\n\n        if (!hasPermission) {\n            return Result.fail(new NotAuthorizedError());\n        }\n\n        const validation = createRoleValidation.safeParse(input);\n        if (!validation.success) {\n            return Result.fail(new RoleValidationError(validation.error.issues[0].message));\n        }\n\n        const identity = this.identityContext.getIdentity();\n        const data = validation.data;\n\n        // Check if role with same slug already exists\n        const existingRoleResult = await this.repository.get({ slug: data.slug });\n        if (existingRoleResult.isOk()) {\n            return Result.fail(new RoleExistsError(data.slug));\n        }\n\n        const role: Role = {\n            id: mdbid(),\n            name: data.name,\n            slug: data.slug,\n            description: data.description,\n            permissions: data.permissions,\n            system: input.system || false,\n            createdOn: new Date().toISOString(),\n            createdBy: {\n                id: identity.id,\n                displayName: identity.displayName,\n                type: identity.type\n            },\n            plugin: false\n        };\n\n        await this.eventPublisher.publish(\n            new RoleBeforeCreateEvent({ role, input: validation.data })\n        );\n\n        const result = await this.repository.create(role);\n\n        if (result.isFail()) {\n            return Result.fail(result.error);\n        }\n\n        await this.eventPublisher.publish(\n            new RoleAfterCreateEvent({ role, input: validation.data })\n        );\n\n        return Result.ok(role);\n    }\n}\n\nexport const CreateRoleUseCase = createImplementation({\n    abstraction: UseCaseAbstraction,\n    implementation: CreateRoleUseCaseImpl,\n    dependencies: [IdentityContext, EventPublisher, RolesRepository]\n});\n"],"names":["CreateRoleUseCaseImpl","identityContext","eventPublisher","repository","input","hasPermission","Result","NotAuthorizedError","validation","createRoleValidation","RoleValidationError","identity","data","existingRoleResult","RoleExistsError","role","mdbid","Date","RoleBeforeCreateEvent","result","RoleAfterCreateEvent","CreateRoleUseCase","createImplementation","UseCaseAbstraction","IdentityContext","EventPublisher","RolesRepository"],"mappings":";;;;;;;;;AAYA,MAAMA;IACF,YACYC,eAA0C,EAC1CC,cAAwC,EACxCC,UAAqC,CAC/C;aAHUF,eAAe,GAAfA;aACAC,cAAc,GAAdA;aACAC,UAAU,GAAVA;IACT;IAEH,MAAM,QAAQC,KAAsB,EAAmD;QACnF,MAAMC,gBAAgB,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC;QAE/D,IAAI,CAACA,eACD,OAAOC,OAAO,IAAI,CAAC,IAAIC;QAG3B,MAAMC,aAAaC,qBAAqB,SAAS,CAACL;QAClD,IAAI,CAACI,WAAW,OAAO,EACnB,OAAOF,OAAO,IAAI,CAAC,IAAII,oBAAoBF,WAAW,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO;QAGjF,MAAMG,WAAW,IAAI,CAAC,eAAe,CAAC,WAAW;QACjD,MAAMC,OAAOJ,WAAW,IAAI;QAG5B,MAAMK,qBAAqB,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAMD,KAAK,IAAI;QAAC;QACvE,IAAIC,mBAAmB,IAAI,IACvB,OAAOP,OAAO,IAAI,CAAC,IAAIQ,gBAAgBF,KAAK,IAAI;QAGpD,MAAMG,OAAa;YACf,IAAIC;YACJ,MAAMJ,KAAK,IAAI;YACf,MAAMA,KAAK,IAAI;YACf,aAAaA,KAAK,WAAW;YAC7B,aAAaA,KAAK,WAAW;YAC7B,QAAQR,MAAM,MAAM,IAAI;YACxB,WAAW,IAAIa,OAAO,WAAW;YACjC,WAAW;gBACP,IAAIN,SAAS,EAAE;gBACf,aAAaA,SAAS,WAAW;gBACjC,MAAMA,SAAS,IAAI;YACvB;YACA,QAAQ;QACZ;QAEA,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAC7B,IAAIO,sBAAsB;YAAEH;YAAM,OAAOP,WAAW,IAAI;QAAC;QAG7D,MAAMW,SAAS,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAACJ;QAE5C,IAAII,OAAO,MAAM,IACb,OAAOb,OAAO,IAAI,CAACa,OAAO,KAAK;QAGnC,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAC7B,IAAIC,qBAAqB;YAAEL;YAAM,OAAOP,WAAW,IAAI;QAAC;QAG5D,OAAOF,OAAO,EAAE,CAACS;IACrB;AACJ;AAEO,MAAMM,sCAAoBC,qBAAqB;IAClD,aAAaC;IACb,gBAAgBvB;IAChB,cAAc;QAACwB;QAAiBC;QAAgBC;KAAgB;AACpE"}

package/features/security/roles/CreateRole/abstractions.d.ts

@@ -11,6 +11,7 @@ type CreateRoleError = ICreateRoleErrors[keyof ICreateRoleErrors] | RolesReposit
 export interface ICreateRole {
     execute(input: CreateRoleInput): Promise<Result<Role, CreateRoleError>>;
 }
+/** Create a new security role. */
 export declare const CreateRoleUseCase: import("@webiny/di").Abstraction<ICreateRole>;
 export declare namespace CreateRoleUseCase {
     type Interface = ICreateRole;

package/features/security/roles/CreateRole/abstractions.js

@@ -1,4 +1,5 @@
 import { createAbstraction } from "@webiny/feature/api";
-export const CreateRoleUseCase = createAbstraction("CreateRoleUseCase");
+const CreateRoleUseCase = createAbstraction("CreateRoleUseCase");
+export { CreateRoleUseCase };
 
 //# sourceMappingURL=abstractions.js.map