@webiny/api-core 0.0.0-unstable.ac6ebf63c6 → 0.0.0-unstable.b6d7105cee

package/features/security/teams/shared/errors.js.map

@@ -1 +1 @@
-{"version":3,"names":["BaseError","TeamStorageError","code","constructor","error","message","TeamNotFoundError","NotAuthorizedError","data","TeamExistsError","slug","CannotUpdatePluginTeamsError","CannotDeletePluginTeamsError","CannotUpdateSystemTeamsError","CannotDeleteSystemTeamsError","TeamValidationError"],"sources":["errors.ts"],"sourcesContent":["import { BaseError } from \"@webiny/feature/api\";\n\nexport class TeamStorageError extends BaseError {\n    override readonly code = \"TEAM_STORAGE_ERROR\" as const;\n\n    constructor(error: Error) {\n        super({\n            message: error.message\n        });\n    }\n}\n\nexport class TeamNotFoundError extends BaseError {\n    override readonly code = \"TEAM_NOT_FOUND\" as const;\n\n    constructor() {\n        super({\n            message: `Team was not found!`\n        });\n    }\n}\n\ntype NotAuthorizedErrorData = {\n    message?: string;\n};\n\nexport class NotAuthorizedError extends BaseError<NotAuthorizedErrorData> {\n    override readonly code = \"NOT_AUTHORIZED\" as const;\n\n    constructor(data: NotAuthorizedErrorData = {}) {\n        super({\n            message: data.message || \"Not authorized!\",\n            data\n        });\n    }\n}\n\ntype TeamExistsErrorData = {\n    slug: string;\n};\n\nexport class TeamExistsError extends BaseError<TeamExistsErrorData> {\n    override readonly code = \"TEAM_EXISTS\" as const;\n\n    constructor(slug: string) {\n        super({\n            message: `Team with slug \"${slug}\" already exists.`,\n            data: { slug }\n        });\n    }\n}\n\nexport class CannotUpdatePluginTeamsError extends BaseError {\n    override readonly code = \"CANNOT_UPDATE_PLUGIN_TEAMS\" as const;\n\n    constructor() {\n        super({\n            message: \"Cannot update teams created via plugins.\"\n        });\n    }\n}\n\nexport class CannotDeletePluginTeamsError extends BaseError {\n    override readonly code = \"CANNOT_DELETE_PLUGIN_TEAMS\" as const;\n\n    constructor() {\n        super({\n            message: \"Cannot delete teams created via plugins.\"\n        });\n    }\n}\n\nexport class CannotUpdateSystemTeamsError extends BaseError {\n    override readonly code = \"CANNOT_UPDATE_SYSTEM_TEAMS\" as const;\n\n    constructor() {\n        super({\n            message: \"Cannot update system teams.\"\n        });\n    }\n}\n\nexport class CannotDeleteSystemTeamsError extends BaseError {\n    override readonly code = \"CANNOT_DELETE_SYSTEM_TEAMS\" as const;\n\n    constructor() {\n        super({\n            message: \"Cannot delete system teams.\"\n        });\n    }\n}\n\ntype TeamValidationErrorData = {\n    message: string;\n};\n\nexport class TeamValidationError extends BaseError<TeamValidationErrorData> {\n    override readonly code = \"TEAM_VALIDATION_ERROR\" as const;\n\n    constructor(message: string) {\n        super({\n            message,\n            data: { message }\n        });\n    }\n}\n"],"mappings":"AAAA,SAASA,SAAS,QAAQ,qBAAqB;AAE/C,OAAO,MAAMC,gBAAgB,SAASD,SAAS,CAAC;EAC1BE,IAAI,GAAG,oBAAoB;EAE7CC,WAAWA,CAACC,KAAY,EAAE;IACtB,KAAK,CAAC;MACFC,OAAO,EAAED,KAAK,CAACC;IACnB,CAAC,CAAC;EACN;AACJ;AAEA,OAAO,MAAMC,iBAAiB,SAASN,SAAS,CAAC;EAC3BE,IAAI,GAAG,gBAAgB;EAEzCC,WAAWA,CAAA,EAAG;IACV,KAAK,CAAC;MACFE,OAAO,EAAE;IACb,CAAC,CAAC;EACN;AACJ;AAMA,OAAO,MAAME,kBAAkB,SAASP,SAAS,CAAyB;EACpDE,IAAI,GAAG,gBAAgB;EAEzCC,WAAWA,CAACK,IAA4B,GAAG,CAAC,CAAC,EAAE;IAC3C,KAAK,CAAC;MACFH,OAAO,EAAEG,IAAI,CAACH,OAAO,IAAI,iBAAiB;MAC1CG;IACJ,CAAC,CAAC;EACN;AACJ;AAMA,OAAO,MAAMC,eAAe,SAAST,SAAS,CAAsB;EAC9CE,IAAI,GAAG,aAAa;EAEtCC,WAAWA,CAACO,IAAY,EAAE;IACtB,KAAK,CAAC;MACFL,OAAO,EAAE,mBAAmBK,IAAI,mBAAmB;MACnDF,IAAI,EAAE;QAAEE;MAAK;IACjB,CAAC,CAAC;EACN;AACJ;AAEA,OAAO,MAAMC,4BAA4B,SAASX,SAAS,CAAC;EACtCE,IAAI,GAAG,4BAA4B;EAErDC,WAAWA,CAAA,EAAG;IACV,KAAK,CAAC;MACFE,OAAO,EAAE;IACb,CAAC,CAAC;EACN;AACJ;AAEA,OAAO,MAAMO,4BAA4B,SAASZ,SAAS,CAAC;EACtCE,IAAI,GAAG,4BAA4B;EAErDC,WAAWA,CAAA,EAAG;IACV,KAAK,CAAC;MACFE,OAAO,EAAE;IACb,CAAC,CAAC;EACN;AACJ;AAEA,OAAO,MAAMQ,4BAA4B,SAASb,SAAS,CAAC;EACtCE,IAAI,GAAG,4BAA4B;EAErDC,WAAWA,CAAA,EAAG;IACV,KAAK,CAAC;MACFE,OAAO,EAAE;IACb,CAAC,CAAC;EACN;AACJ;AAEA,OAAO,MAAMS,4BAA4B,SAASd,SAAS,CAAC;EACtCE,IAAI,GAAG,4BAA4B;EAErDC,WAAWA,CAAA,EAAG;IACV,KAAK,CAAC;MACFE,OAAO,EAAE;IACb,CAAC,CAAC;EACN;AACJ;AAMA,OAAO,MAAMU,mBAAmB,SAASf,SAAS,CAA0B;EACtDE,IAAI,GAAG,uBAAuB;EAEhDC,WAAWA,CAACE,OAAe,EAAE;IACzB,KAAK,CAAC;MACFA,OAAO;MACPG,IAAI,EAAE;QAAEH;MAAQ;IACpB,CAAC,CAAC;EACN;AACJ","ignoreList":[]}
+{"version":3,"file":"features/security/teams/shared/errors.js","sources":["../../../../../src/features/security/teams/shared/errors.ts"],"sourcesContent":["import { BaseError } from \"@webiny/feature/api\";\n\nexport class TeamStorageError extends BaseError {\n    override readonly code = \"TEAM_STORAGE_ERROR\" as const;\n\n    constructor(error: Error) {\n        super({\n            message: error.message\n        });\n    }\n}\n\nexport class TeamNotFoundError extends BaseError {\n    override readonly code = \"TEAM_NOT_FOUND\" as const;\n\n    constructor() {\n        super({\n            message: `Team was not found!`\n        });\n    }\n}\n\ntype NotAuthorizedErrorData = {\n    message?: string;\n};\n\nexport class NotAuthorizedError extends BaseError<NotAuthorizedErrorData> {\n    override readonly code = \"NOT_AUTHORIZED\" as const;\n\n    constructor(data: NotAuthorizedErrorData = {}) {\n        super({\n            message: data.message || \"Not authorized!\",\n            data\n        });\n    }\n}\n\ntype TeamExistsErrorData = {\n    slug: string;\n};\n\nexport class TeamExistsError extends BaseError<TeamExistsErrorData> {\n    override readonly code = \"TEAM_EXISTS\" as const;\n\n    constructor(slug: string) {\n        super({\n            message: `Team with slug \"${slug}\" already exists.`,\n            data: { slug }\n        });\n    }\n}\n\nexport class CannotUpdatePluginTeamsError extends BaseError {\n    override readonly code = \"CANNOT_UPDATE_PLUGIN_TEAMS\" as const;\n\n    constructor() {\n        super({\n            message: \"Cannot update teams created via plugins.\"\n        });\n    }\n}\n\nexport class CannotDeletePluginTeamsError extends BaseError {\n    override readonly code = \"CANNOT_DELETE_PLUGIN_TEAMS\" as const;\n\n    constructor() {\n        super({\n            message: \"Cannot delete teams created via plugins.\"\n        });\n    }\n}\n\nexport class CannotUpdateSystemTeamsError extends BaseError {\n    override readonly code = \"CANNOT_UPDATE_SYSTEM_TEAMS\" as const;\n\n    constructor() {\n        super({\n            message: \"Cannot update system teams.\"\n        });\n    }\n}\n\nexport class CannotDeleteSystemTeamsError extends BaseError {\n    override readonly code = \"CANNOT_DELETE_SYSTEM_TEAMS\" as const;\n\n    constructor() {\n        super({\n            message: \"Cannot delete system teams.\"\n        });\n    }\n}\n\ntype TeamValidationErrorData = {\n    message: string;\n};\n\nexport class TeamValidationError extends BaseError<TeamValidationErrorData> {\n    override readonly code = \"TEAM_VALIDATION_ERROR\" as const;\n\n    constructor(message: string) {\n        super({\n            message,\n            data: { message }\n        });\n    }\n}\n"],"names":["TeamStorageError","BaseError","error","TeamNotFoundError","NotAuthorizedError","data","TeamExistsError","slug","CannotUpdatePluginTeamsError","CannotDeletePluginTeamsError","CannotUpdateSystemTeamsError","CannotDeleteSystemTeamsError","TeamValidationError","message"],"mappings":";AAEO,MAAMA,yBAAyBC;IAGlC,YAAYC,KAAY,CAAE;QACtB,KAAK,CAAC;YACF,SAASA,MAAM,OAAO;QAC1B,SALc,IAAI,GAAG;IAMzB;AACJ;AAEO,MAAMC,0BAA0BF;IAGnC,aAAc;QACV,KAAK,CAAC;YACF,SAAS;QACb,SALc,IAAI,GAAG;IAMzB;AACJ;AAMO,MAAMG,2BAA2BH;IAGpC,YAAYI,OAA+B,CAAC,CAAC,CAAE;QAC3C,KAAK,CAAC;YACF,SAASA,KAAK,OAAO,IAAI;YACzBA;QACJ,SANc,IAAI,GAAG;IAOzB;AACJ;AAMO,MAAMC,wBAAwBL;IAGjC,YAAYM,IAAY,CAAE;QACtB,KAAK,CAAC;YACF,SAAS,CAAC,gBAAgB,EAAEA,KAAK,iBAAiB,CAAC;YACnD,MAAM;gBAAEA;YAAK;QACjB,SANc,IAAI,GAAG;IAOzB;AACJ;AAEO,MAAMC,qCAAqCP;IAG9C,aAAc;QACV,KAAK,CAAC;YACF,SAAS;QACb,SALc,IAAI,GAAG;IAMzB;AACJ;AAEO,MAAMQ,qCAAqCR;IAG9C,aAAc;QACV,KAAK,CAAC;YACF,SAAS;QACb,SALc,IAAI,GAAG;IAMzB;AACJ;AAEO,MAAMS,qCAAqCT;IAG9C,aAAc;QACV,KAAK,CAAC;YACF,SAAS;QACb,SALc,IAAI,GAAG;IAMzB;AACJ;AAEO,MAAMU,qCAAqCV;IAG9C,aAAc;QACV,KAAK,CAAC;YACF,SAAS;QACb,SALc,IAAI,GAAG;IAMzB;AACJ;AAMO,MAAMW,4BAA4BX;IAGrC,YAAYY,OAAe,CAAE;QACzB,KAAK,CAAC;YACFA;YACA,MAAM;gBAAEA;YAAQ;QACpB,SANc,IAAI,GAAG;IAOzB;AACJ"}

package/features/security/teams/shared/types.js

@@ -1,3 +0,0 @@
-export {};
-
-//# sourceMappingURL=types.js.map

package/features/security/utils/AppPermissions.js

@@ -1,99 +1,60 @@
 const FULL_ACCESS_PERMISSION_NAME = "*";
-export class AppPermissions {
-  constructor({
-    getIdentity,
-    getPermissions,
-    fullAccessPermissionName
-  }) {
-    this.getIdentity = getIdentity;
-    this.getPermissions = getPermissions;
-    this.fullAccessPermissions = [FULL_ACCESS_PERMISSION_NAME, fullAccessPermissionName || ""].filter(Boolean);
-  }
-  async ensure(params = {}) {
-    if (await this.hasFullAccess()) {
-      return true;
+class AppPermissions {
+    constructor({ getIdentity, getPermissions, fullAccessPermissionName }){
+        this.getIdentity = getIdentity;
+        this.getPermissions = getPermissions;
+        this.fullAccessPermissions = [
+            FULL_ACCESS_PERMISSION_NAME,
+            fullAccessPermissionName || ""
+        ].filter(Boolean);
     }
-    if (params.owns) {
-      if (await this.canAccessNonOwnedRecords()) {
-        return true;
-      }
-
-      // If we got here, that means we didn't encounter a permission object
-      // that gives us the ability to access non-owned records.
-      const identity = await this.getIdentity();
-      if (identity.id === params.owns.id) {
-        return true;
-      }
-      return false;
+    async ensure(params = {}) {
+        if (await this.hasFullAccess()) return true;
+        if (params.owns) {
+            if (await this.canAccessNonOwnedRecords()) return true;
+            const identity = await this.getIdentity();
+            if (identity.id === params.owns.id) return true;
+            return false;
+        }
+        const permissions = await this.getPermissions();
+        const hasPermission = permissions.some((current)=>{
+            if (params.rwd && !this.hasRwd(current, params.rwd)) return false;
+            if (params.pw && !this.hasPw(current, params.pw)) return false;
+            return true;
+        });
+        return hasPermission;
     }
-    const permissions = await this.getPermissions();
-    const hasPermission = permissions.some(current => {
-      if (params.rwd && !this.hasRwd(current, params.rwd)) {
-        return false;
-      }
-      if (params.pw && !this.hasPw(current, params.pw)) {
-        return false;
-      }
-      return true;
-    });
-    return hasPermission;
-  }
-  async hasFullAccess() {
-    const permissions = await this.getPermissions();
-    return permissions.some(p => this.fullAccessPermissions.filter(Boolean).includes(p.name));
-  }
-  async canAccessNonOwnedRecords() {
-    // First pass - check if we have full access.
-    if (await this.hasFullAccess()) {
-      return true;
+    async hasFullAccess() {
+        const permissions = await this.getPermissions();
+        return permissions.some((p)=>this.fullAccessPermissions.filter(Boolean).includes(p.name));
     }
-
-    // Second pass - if there's at least one permission that doesn't
-    // prevent us from accessing non-owned records, then we grant access.
-    const permissions = await this.getPermissions();
-    return permissions.some(p => !p.own);
-  }
-  async canAccessOnlyOwnRecords() {
-    // First pass - check if we have full access to Page Builder.
-    if (await this.hasFullAccess()) {
-      return false;
+    async canAccessNonOwnedRecords() {
+        if (await this.hasFullAccess()) return true;
+        const permissions = await this.getPermissions();
+        return permissions.some((p)=>!p.own);
     }
-
-    // Second pass - if there's at least one permission that doesn't
-    // prevent us from accessing non-owned records, then we grant access.
-    const permissions = await this.getPermissions();
-    return !permissions.some(p => !p.own);
-  }
-  hasRwd(permission, rwd) {
-    return typeof permission.rwd !== "string" || permission.rwd.includes(rwd);
-  }
-
-  // Has publishing workflow permissions?
-  hasPw(permission, pw) {
-    // `name` and `_src` properties are always present.
-    const permissionWithoutSystemProperties = this.filterOutSystemPermissionsObjectProperties(permission);
-    const isCustom = Object.keys(permissionWithoutSystemProperties).length > 0;
-    if (!isCustom) {
-      // Means it's a "full-access" permission.
-      return true;
+    async canAccessOnlyOwnRecords() {
+        if (await this.hasFullAccess()) return false;
+        const permissions = await this.getPermissions();
+        return !permissions.some((p)=>!p.own);
     }
-    if (typeof permission["pw"] !== "string") {
-      return false;
+    hasRwd(permission, rwd) {
+        return "string" != typeof permission.rwd || permission.rwd.includes(rwd);
+    }
+    hasPw(permission, pw) {
+        const permissionWithoutSystemProperties = this.filterOutSystemPermissionsObjectProperties(permission);
+        const isCustom = Object.keys(permissionWithoutSystemProperties).length > 0;
+        if (!isCustom) return true;
+        if ("string" != typeof permission["pw"]) return false;
+        return permission["pw"].includes(pw);
+    }
+    filterOutSystemPermissionsObjectProperties(permission) {
+        return Object.keys(permission).reduce((acc, key)=>{
+            if ("name" !== key && "_src" !== key) acc[key] = permission[key];
+            return acc;
+        }, {});
     }
-    return permission["pw"].includes(pw);
-  }
-
-  /**
-   * Filters out base `name` and `_src` properties from the permission object.
-   */
-  filterOutSystemPermissionsObjectProperties(permission) {
-    return Object.keys(permission).reduce((acc, key) => {
-      if (key !== "name" && key !== "_src") {
-        acc[key] = permission[key];
-      }
-      return acc;
-    }, {});
-  }
 }
+export { AppPermissions };
 
 //# sourceMappingURL=AppPermissions.js.map

package/features/security/utils/AppPermissions.js.map

@@ -1 +1 @@
-{"version":3,"names":["FULL_ACCESS_PERMISSION_NAME","AppPermissions","constructor","getIdentity","getPermissions","fullAccessPermissionName","fullAccessPermissions","filter","Boolean","ensure","params","hasFullAccess","owns","canAccessNonOwnedRecords","identity","id","permissions","hasPermission","some","current","rwd","hasRwd","pw","hasPw","p","includes","name","own","canAccessOnlyOwnRecords","permission","permissionWithoutSystemProperties","filterOutSystemPermissionsObjectProperties","isCustom","Object","keys","length","reduce","acc","key"],"sources":["AppPermissions.ts"],"sourcesContent":["import type { SecurityPermission, SecurityIdentity, CreatedBy } from \"~/types/security.js\";\n\nconst FULL_ACCESS_PERMISSION_NAME = \"*\";\n\nexport interface AppPermissionsParams<TPermission extends SecurityPermission = SecurityPermission> {\n    getIdentity: () => SecurityIdentity | Promise<SecurityIdentity>;\n    getPermissions: () => TPermission[] | Promise<TPermission[]>;\n    fullAccessPermissionName?: string;\n}\n\nexport type EnsureParams = Partial<{\n    rwd: string;\n    pw: string;\n    owns: CreatedBy;\n}>;\n\nexport class AppPermissions<TPermission extends SecurityPermission = SecurityPermission> {\n    getIdentity: () => SecurityIdentity | Promise<SecurityIdentity>;\n    getPermissions: () => TPermission[] | Promise<TPermission[]>;\n    private fullAccessPermissions: string[];\n\n    constructor({\n        getIdentity,\n        getPermissions,\n        fullAccessPermissionName\n    }: AppPermissionsParams<TPermission>) {\n        this.getIdentity = getIdentity;\n        this.getPermissions = getPermissions;\n        this.fullAccessPermissions = [\n            FULL_ACCESS_PERMISSION_NAME,\n            fullAccessPermissionName || \"\"\n        ].filter(Boolean);\n    }\n\n    async ensure(params: EnsureParams = {}): Promise<boolean> {\n        if (await this.hasFullAccess()) {\n            return true;\n        }\n\n        if (params.owns) {\n            if (await this.canAccessNonOwnedRecords()) {\n                return true;\n            }\n\n            // If we got here, that means we didn't encounter a permission object\n            // that gives us the ability to access non-owned records.\n            const identity = await this.getIdentity();\n            if (identity.id === params.owns.id) {\n                return true;\n            }\n\n            return false;\n        }\n\n        const permissions = await this.getPermissions();\n        const hasPermission = permissions.some(current => {\n            if (params.rwd && !this.hasRwd(current, params.rwd)) {\n                return false;\n            }\n\n            if (params.pw && !this.hasPw(current, params.pw)) {\n                return false;\n            }\n\n            return true;\n        });\n\n        return hasPermission;\n    }\n\n    async hasFullAccess() {\n        const permissions = await this.getPermissions();\n        return permissions.some(p => this.fullAccessPermissions.filter(Boolean).includes(p.name));\n    }\n\n    async canAccessNonOwnedRecords() {\n        // First pass - check if we have full access.\n        if (await this.hasFullAccess()) {\n            return true;\n        }\n\n        // Second pass - if there's at least one permission that doesn't\n        // prevent us from accessing non-owned records, then we grant access.\n        const permissions = await this.getPermissions();\n        return permissions.some(p => !p.own);\n    }\n\n    async canAccessOnlyOwnRecords() {\n        // First pass - check if we have full access to Page Builder.\n        if (await this.hasFullAccess()) {\n            return false;\n        }\n\n        // Second pass - if there's at least one permission that doesn't\n        // prevent us from accessing non-owned records, then we grant access.\n        const permissions = await this.getPermissions();\n        return !permissions.some(p => !p.own);\n    }\n\n    private hasRwd(permission: TPermission, rwd: string) {\n        return typeof permission.rwd !== \"string\" || permission.rwd.includes(rwd);\n    }\n\n    // Has publishing workflow permissions?\n    private hasPw(permission: TPermission, pw: string) {\n        // `name` and `_src` properties are always present.\n        const permissionWithoutSystemProperties =\n            this.filterOutSystemPermissionsObjectProperties(permission);\n\n        const isCustom = Object.keys(permissionWithoutSystemProperties).length > 0;\n\n        if (!isCustom) {\n            // Means it's a \"full-access\" permission.\n            return true;\n        }\n\n        if (typeof permission[\"pw\"] !== \"string\") {\n            return false;\n        }\n\n        return permission[\"pw\"].includes(pw);\n    }\n\n    /**\n     * Filters out base `name` and `_src` properties from the permission object.\n     */\n    private filterOutSystemPermissionsObjectProperties(permission: SecurityPermission) {\n        return Object.keys(permission).reduce(\n            (acc, key) => {\n                if (key !== \"name\" && key !== \"_src\") {\n                    acc[key] = permission[key];\n                }\n                return acc;\n            },\n            {} as Record<string, any>\n        );\n    }\n}\n"],"mappings":"AAEA,MAAMA,2BAA2B,GAAG,GAAG;AAcvC,OAAO,MAAMC,cAAc,CAA8D;EAKrFC,WAAWA,CAAC;IACRC,WAAW;IACXC,cAAc;IACdC;EAC+B,CAAC,EAAE;IAClC,IAAI,CAACF,WAAW,GAAGA,WAAW;IAC9B,IAAI,CAACC,cAAc,GAAGA,cAAc;IACpC,IAAI,CAACE,qBAAqB,GAAG,CACzBN,2BAA2B,EAC3BK,wBAAwB,IAAI,EAAE,CACjC,CAACE,MAAM,CAACC,OAAO,CAAC;EACrB;EAEA,MAAMC,MAAMA,CAACC,MAAoB,GAAG,CAAC,CAAC,EAAoB;IACtD,IAAI,MAAM,IAAI,CAACC,aAAa,CAAC,CAAC,EAAE;MAC5B,OAAO,IAAI;IACf;IAEA,IAAID,MAAM,CAACE,IAAI,EAAE;MACb,IAAI,MAAM,IAAI,CAACC,wBAAwB,CAAC,CAAC,EAAE;QACvC,OAAO,IAAI;MACf;;MAEA;MACA;MACA,MAAMC,QAAQ,GAAG,MAAM,IAAI,CAACX,WAAW,CAAC,CAAC;MACzC,IAAIW,QAAQ,CAACC,EAAE,KAAKL,MAAM,CAACE,IAAI,CAACG,EAAE,EAAE;QAChC,OAAO,IAAI;MACf;MAEA,OAAO,KAAK;IAChB;IAEA,MAAMC,WAAW,GAAG,MAAM,IAAI,CAACZ,cAAc,CAAC,CAAC;IAC/C,MAAMa,aAAa,GAAGD,WAAW,CAACE,IAAI,CAACC,OAAO,IAAI;MAC9C,IAAIT,MAAM,CAACU,GAAG,IAAI,CAAC,IAAI,CAACC,MAAM,CAACF,OAAO,EAAET,MAAM,CAACU,GAAG,CAAC,EAAE;QACjD,OAAO,KAAK;MAChB;MAEA,IAAIV,MAAM,CAACY,EAAE,IAAI,CAAC,IAAI,CAACC,KAAK,CAACJ,OAAO,EAAET,MAAM,CAACY,EAAE,CAAC,EAAE;QAC9C,OAAO,KAAK;MAChB;MAEA,OAAO,IAAI;IACf,CAAC,CAAC;IAEF,OAAOL,aAAa;EACxB;EAEA,MAAMN,aAAaA,CAAA,EAAG;IAClB,MAAMK,WAAW,GAAG,MAAM,IAAI,CAACZ,cAAc,CAAC,CAAC;IAC/C,OAAOY,WAAW,CAACE,IAAI,CAACM,CAAC,IAAI,IAAI,CAAClB,qBAAqB,CAACC,MAAM,CAACC,OAAO,CAAC,CAACiB,QAAQ,CAACD,CAAC,CAACE,IAAI,CAAC,CAAC;EAC7F;EAEA,MAAMb,wBAAwBA,CAAA,EAAG;IAC7B;IACA,IAAI,MAAM,IAAI,CAACF,aAAa,CAAC,CAAC,EAAE;MAC5B,OAAO,IAAI;IACf;;IAEA;IACA;IACA,MAAMK,WAAW,GAAG,MAAM,IAAI,CAACZ,cAAc,CAAC,CAAC;IAC/C,OAAOY,WAAW,CAACE,IAAI,CAACM,CAAC,IAAI,CAACA,CAAC,CAACG,GAAG,CAAC;EACxC;EAEA,MAAMC,uBAAuBA,CAAA,EAAG;IAC5B;IACA,IAAI,MAAM,IAAI,CAACjB,aAAa,CAAC,CAAC,EAAE;MAC5B,OAAO,KAAK;IAChB;;IAEA;IACA;IACA,MAAMK,WAAW,GAAG,MAAM,IAAI,CAACZ,cAAc,CAAC,CAAC;IAC/C,OAAO,CAACY,WAAW,CAACE,IAAI,CAACM,CAAC,IAAI,CAACA,CAAC,CAACG,GAAG,CAAC;EACzC;EAEQN,MAAMA,CAACQ,UAAuB,EAAET,GAAW,EAAE;IACjD,OAAO,OAAOS,UAAU,CAACT,GAAG,KAAK,QAAQ,IAAIS,UAAU,CAACT,GAAG,CAACK,QAAQ,CAACL,GAAG,CAAC;EAC7E;;EAEA;EACQG,KAAKA,CAACM,UAAuB,EAAEP,EAAU,EAAE;IAC/C;IACA,MAAMQ,iCAAiC,GACnC,IAAI,CAACC,0CAA0C,CAACF,UAAU,CAAC;IAE/D,MAAMG,QAAQ,GAAGC,MAAM,CAACC,IAAI,CAACJ,iCAAiC,CAAC,CAACK,MAAM,GAAG,CAAC;IAE1E,IAAI,CAACH,QAAQ,EAAE;MACX;MACA,OAAO,IAAI;IACf;IAEA,IAAI,OAAOH,UAAU,CAAC,IAAI,CAAC,KAAK,QAAQ,EAAE;MACtC,OAAO,KAAK;IAChB;IAEA,OAAOA,UAAU,CAAC,IAAI,CAAC,CAACJ,QAAQ,CAACH,EAAE,CAAC;EACxC;;EAEA;AACJ;AACA;EACYS,0CAA0CA,CAACF,UAA8B,EAAE;IAC/E,OAAOI,MAAM,CAACC,IAAI,CAACL,UAAU,CAAC,CAACO,MAAM,CACjC,CAACC,GAAG,EAAEC,GAAG,KAAK;MACV,IAAIA,GAAG,KAAK,MAAM,IAAIA,GAAG,KAAK,MAAM,EAAE;QAClCD,GAAG,CAACC,GAAG,CAAC,GAAGT,UAAU,CAACS,GAAG,CAAC;MAC9B;MACA,OAAOD,GAAG;IACd,CAAC,EACD,CAAC,CACL,CAAC;EACL;AACJ","ignoreList":[]}
+{"version":3,"file":"features/security/utils/AppPermissions.js","sources":["../../../../src/features/security/utils/AppPermissions.ts"],"sourcesContent":["import type { SecurityPermission, SecurityIdentity, CreatedBy } from \"~/types/security.js\";\n\nconst FULL_ACCESS_PERMISSION_NAME = \"*\";\n\nexport interface AppPermissionsParams<TPermission extends SecurityPermission = SecurityPermission> {\n    getIdentity: () => SecurityIdentity | Promise<SecurityIdentity>;\n    getPermissions: () => TPermission[] | Promise<TPermission[]>;\n    fullAccessPermissionName?: string;\n}\n\nexport type EnsureParams = Partial<{\n    rwd: string;\n    pw: string;\n    owns: CreatedBy;\n}>;\n\nexport class AppPermissions<TPermission extends SecurityPermission = SecurityPermission> {\n    getIdentity: () => SecurityIdentity | Promise<SecurityIdentity>;\n    getPermissions: () => TPermission[] | Promise<TPermission[]>;\n    private fullAccessPermissions: string[];\n\n    constructor({\n        getIdentity,\n        getPermissions,\n        fullAccessPermissionName\n    }: AppPermissionsParams<TPermission>) {\n        this.getIdentity = getIdentity;\n        this.getPermissions = getPermissions;\n        this.fullAccessPermissions = [\n            FULL_ACCESS_PERMISSION_NAME,\n            fullAccessPermissionName || \"\"\n        ].filter(Boolean);\n    }\n\n    async ensure(params: EnsureParams = {}): Promise<boolean> {\n        if (await this.hasFullAccess()) {\n            return true;\n        }\n\n        if (params.owns) {\n            if (await this.canAccessNonOwnedRecords()) {\n                return true;\n            }\n\n            // If we got here, that means we didn't encounter a permission object\n            // that gives us the ability to access non-owned records.\n            const identity = await this.getIdentity();\n            if (identity.id === params.owns.id) {\n                return true;\n            }\n\n            return false;\n        }\n\n        const permissions = await this.getPermissions();\n        const hasPermission = permissions.some(current => {\n            if (params.rwd && !this.hasRwd(current, params.rwd)) {\n                return false;\n            }\n\n            if (params.pw && !this.hasPw(current, params.pw)) {\n                return false;\n            }\n\n            return true;\n        });\n\n        return hasPermission;\n    }\n\n    async hasFullAccess() {\n        const permissions = await this.getPermissions();\n        return permissions.some(p => this.fullAccessPermissions.filter(Boolean).includes(p.name));\n    }\n\n    async canAccessNonOwnedRecords() {\n        // First pass - check if we have full access.\n        if (await this.hasFullAccess()) {\n            return true;\n        }\n\n        // Second pass - if there's at least one permission that doesn't\n        // prevent us from accessing non-owned records, then we grant access.\n        const permissions = await this.getPermissions();\n        return permissions.some(p => !p.own);\n    }\n\n    async canAccessOnlyOwnRecords() {\n        // First pass - check if we have full access to Page Builder.\n        if (await this.hasFullAccess()) {\n            return false;\n        }\n\n        // Second pass - if there's at least one permission that doesn't\n        // prevent us from accessing non-owned records, then we grant access.\n        const permissions = await this.getPermissions();\n        return !permissions.some(p => !p.own);\n    }\n\n    private hasRwd(permission: TPermission, rwd: string) {\n        return typeof permission.rwd !== \"string\" || permission.rwd.includes(rwd);\n    }\n\n    // Has publishing workflow permissions?\n    private hasPw(permission: TPermission, pw: string) {\n        // `name` and `_src` properties are always present.\n        const permissionWithoutSystemProperties =\n            this.filterOutSystemPermissionsObjectProperties(permission);\n\n        const isCustom = Object.keys(permissionWithoutSystemProperties).length > 0;\n\n        if (!isCustom) {\n            // Means it's a \"full-access\" permission.\n            return true;\n        }\n\n        if (typeof permission[\"pw\"] !== \"string\") {\n            return false;\n        }\n\n        return permission[\"pw\"].includes(pw);\n    }\n\n    /**\n     * Filters out base `name` and `_src` properties from the permission object.\n     */\n    private filterOutSystemPermissionsObjectProperties(permission: SecurityPermission) {\n        return Object.keys(permission).reduce(\n            (acc, key) => {\n                if (key !== \"name\" && key !== \"_src\") {\n                    acc[key] = permission[key];\n                }\n                return acc;\n            },\n            {} as Record<string, any>\n        );\n    }\n}\n"],"names":["FULL_ACCESS_PERMISSION_NAME","AppPermissions","getIdentity","getPermissions","fullAccessPermissionName","Boolean","params","identity","permissions","hasPermission","current","p","permission","rwd","pw","permissionWithoutSystemProperties","isCustom","Object","acc","key"],"mappings":"AAEA,MAAMA,8BAA8B;AAc7B,MAAMC;IAKT,YAAY,EACRC,WAAW,EACXC,cAAc,EACdC,wBAAwB,EACQ,CAAE;QAClC,IAAI,CAAC,WAAW,GAAGF;QACnB,IAAI,CAAC,cAAc,GAAGC;QACtB,IAAI,CAAC,qBAAqB,GAAG;YACzBH;YACAI,4BAA4B;SAC/B,CAAC,MAAM,CAACC;IACb;IAEA,MAAM,OAAOC,SAAuB,CAAC,CAAC,EAAoB;QACtD,IAAI,MAAM,IAAI,CAAC,aAAa,IACxB,OAAO;QAGX,IAAIA,OAAO,IAAI,EAAE;YACb,IAAI,MAAM,IAAI,CAAC,wBAAwB,IACnC,OAAO;YAKX,MAAMC,WAAW,MAAM,IAAI,CAAC,WAAW;YACvC,IAAIA,SAAS,EAAE,KAAKD,OAAO,IAAI,CAAC,EAAE,EAC9B,OAAO;YAGX,OAAO;QACX;QAEA,MAAME,cAAc,MAAM,IAAI,CAAC,cAAc;QAC7C,MAAMC,gBAAgBD,YAAY,IAAI,CAACE,CAAAA;YACnC,IAAIJ,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAACI,SAASJ,OAAO,GAAG,GAC9C,OAAO;YAGX,IAAIA,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAACI,SAASJ,OAAO,EAAE,GAC3C,OAAO;YAGX,OAAO;QACX;QAEA,OAAOG;IACX;IAEA,MAAM,gBAAgB;QAClB,MAAMD,cAAc,MAAM,IAAI,CAAC,cAAc;QAC7C,OAAOA,YAAY,IAAI,CAACG,CAAAA,IAAK,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAACN,SAAS,QAAQ,CAACM,EAAE,IAAI;IAC3F;IAEA,MAAM,2BAA2B;QAE7B,IAAI,MAAM,IAAI,CAAC,aAAa,IACxB,OAAO;QAKX,MAAMH,cAAc,MAAM,IAAI,CAAC,cAAc;QAC7C,OAAOA,YAAY,IAAI,CAACG,CAAAA,IAAK,CAACA,EAAE,GAAG;IACvC;IAEA,MAAM,0BAA0B;QAE5B,IAAI,MAAM,IAAI,CAAC,aAAa,IACxB,OAAO;QAKX,MAAMH,cAAc,MAAM,IAAI,CAAC,cAAc;QAC7C,OAAO,CAACA,YAAY,IAAI,CAACG,CAAAA,IAAK,CAACA,EAAE,GAAG;IACxC;IAEQ,OAAOC,UAAuB,EAAEC,GAAW,EAAE;QACjD,OAAO,AAA0B,YAA1B,OAAOD,WAAW,GAAG,IAAiBA,WAAW,GAAG,CAAC,QAAQ,CAACC;IACzE;IAGQ,MAAMD,UAAuB,EAAEE,EAAU,EAAE;QAE/C,MAAMC,oCACF,IAAI,CAAC,0CAA0C,CAACH;QAEpD,MAAMI,WAAWC,OAAO,IAAI,CAACF,mCAAmC,MAAM,GAAG;QAEzE,IAAI,CAACC,UAED,OAAO;QAGX,IAAI,AAA4B,YAA5B,OAAOJ,UAAU,CAAC,KAAK,EACvB,OAAO;QAGX,OAAOA,UAAU,CAAC,KAAK,CAAC,QAAQ,CAACE;IACrC;IAKQ,2CAA2CF,UAA8B,EAAE;QAC/E,OAAOK,OAAO,IAAI,CAACL,YAAY,MAAM,CACjC,CAACM,KAAKC;YACF,IAAIA,AAAQ,WAARA,OAAkBA,AAAQ,WAARA,KAClBD,GAAG,CAACC,IAAI,GAAGP,UAAU,CAACO,IAAI;YAE9B,OAAOD;QACX,GACA,CAAC;IAET;AACJ"}

package/features/security/utils/IdentityValue.js

@@ -1,27 +1,24 @@
-export class IdentityValue {
-  constructor(value) {
-    this.value = value;
-  }
-  static create(identity) {
-    return new IdentityValue(identity);
-  }
-  getValue() {
-    if (!this.value) {
-      return null;
+class IdentityValue {
+    constructor(value){
+        this.value = value;
     }
-    return {
-      id: this.value.id,
-      displayName: this.value.displayName,
-      type: this.value.type
-    };
-  }
-  getValueOrFallback(fallback) {
-    const value = this.getValue();
-    if (value) {
-      return value;
+    static create(identity) {
+        return new IdentityValue(identity);
+    }
+    getValue() {
+        if (!this.value) return null;
+        return {
+            id: this.value.id,
+            displayName: this.value.displayName,
+            type: this.value.type
+        };
+    }
+    getValueOrFallback(fallback) {
+        const value = this.getValue();
+        if (value) return value;
+        return IdentityValue.create(fallback).getValue();
     }
-    return IdentityValue.create(fallback).getValue();
-  }
 }
+export { IdentityValue };
 
 //# sourceMappingURL=IdentityValue.js.map

package/features/security/utils/IdentityValue.js.map

@@ -1 +1 @@
-{"version":3,"names":["IdentityValue","constructor","value","create","identity","getValue","id","displayName","type","getValueOrFallback","fallback"],"sources":["IdentityValue.ts"],"sourcesContent":["import type { SecurityIdentity } from \"~/types/security.js\";\n\ntype IdentityInput = SecurityIdentity | null | undefined;\n\nexport class IdentityValue {\n    private readonly value: IdentityInput;\n\n    private constructor(value: IdentityInput) {\n        this.value = value;\n    }\n\n    static create(identity: IdentityInput) {\n        return new IdentityValue(identity);\n    }\n\n    getValue() {\n        if (!this.value) {\n            return null;\n        }\n\n        return {\n            id: this.value.id,\n            displayName: this.value.displayName,\n            type: this.value.type\n        };\n    }\n\n    getValueOrFallback(fallback: IdentityInput) {\n        const value = this.getValue();\n\n        if (value) {\n            return value;\n        }\n\n        return IdentityValue.create(fallback).getValue();\n    }\n}\n"],"mappings":"AAIA,OAAO,MAAMA,aAAa,CAAC;EAGfC,WAAWA,CAACC,KAAoB,EAAE;IACtC,IAAI,CAACA,KAAK,GAAGA,KAAK;EACtB;EAEA,OAAOC,MAAMA,CAACC,QAAuB,EAAE;IACnC,OAAO,IAAIJ,aAAa,CAACI,QAAQ,CAAC;EACtC;EAEAC,QAAQA,CAAA,EAAG;IACP,IAAI,CAAC,IAAI,CAACH,KAAK,EAAE;MACb,OAAO,IAAI;IACf;IAEA,OAAO;MACHI,EAAE,EAAE,IAAI,CAACJ,KAAK,CAACI,EAAE;MACjBC,WAAW,EAAE,IAAI,CAACL,KAAK,CAACK,WAAW;MACnCC,IAAI,EAAE,IAAI,CAACN,KAAK,CAACM;IACrB,CAAC;EACL;EAEAC,kBAAkBA,CAACC,QAAuB,EAAE;IACxC,MAAMR,KAAK,GAAG,IAAI,CAACG,QAAQ,CAAC,CAAC;IAE7B,IAAIH,KAAK,EAAE;MACP,OAAOA,KAAK;IAChB;IAEA,OAAOF,aAAa,CAACG,MAAM,CAACO,QAAQ,CAAC,CAACL,QAAQ,CAAC,CAAC;EACpD;AACJ","ignoreList":[]}
+{"version":3,"file":"features/security/utils/IdentityValue.js","sources":["../../../../src/features/security/utils/IdentityValue.ts"],"sourcesContent":["import type { SecurityIdentity } from \"~/types/security.js\";\n\ntype IdentityInput = SecurityIdentity | null | undefined;\n\nexport class IdentityValue {\n    private readonly value: IdentityInput;\n\n    private constructor(value: IdentityInput) {\n        this.value = value;\n    }\n\n    static create(identity: IdentityInput) {\n        return new IdentityValue(identity);\n    }\n\n    getValue() {\n        if (!this.value) {\n            return null;\n        }\n\n        return {\n            id: this.value.id,\n            displayName: this.value.displayName,\n            type: this.value.type\n        };\n    }\n\n    getValueOrFallback(fallback: IdentityInput) {\n        const value = this.getValue();\n\n        if (value) {\n            return value;\n        }\n\n        return IdentityValue.create(fallback).getValue();\n    }\n}\n"],"names":["IdentityValue","value","identity","fallback"],"mappings":"AAIO,MAAMA;IAGT,YAAoBC,KAAoB,CAAE;QACtC,IAAI,CAAC,KAAK,GAAGA;IACjB;IAEA,OAAO,OAAOC,QAAuB,EAAE;QACnC,OAAO,IAAIF,cAAcE;IAC7B;IAEA,WAAW;QACP,IAAI,CAAC,IAAI,CAAC,KAAK,EACX,OAAO;QAGX,OAAO;YACH,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE;YACjB,aAAa,IAAI,CAAC,KAAK,CAAC,WAAW;YACnC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI;QACzB;IACJ;IAEA,mBAAmBC,QAAuB,EAAE;QACxC,MAAMF,QAAQ,IAAI,CAAC,QAAQ;QAE3B,IAAIA,OACA,OAAOA;QAGX,OAAOD,cAAc,MAAM,CAACG,UAAU,QAAQ;IAClD;AACJ"}

package/features/security/utils/filterOutCustomWbyAppsPermissions.js

@@ -1,29 +1,26 @@
-const WBY_APPS_PERMISSIONS_PREFIXES = ["pb", "fb", "fm", "cms", "security", "adminUsers", "i18n"];
-export const filterOutCustomWbyAppsPermissions = permissions => {
-  return permissions.filter(permission => {
-    // Just in case, if the `name` property is missing, we don't omit the permission.
-    if (!permission.name) {
-      return true;
-    }
-    let isWbyAppPermission = false,
-      wbyAppPermissionPrefix = "";
-    for (let i = 0; i < WBY_APPS_PERMISSIONS_PREFIXES.length; i++) {
-      const prefix = WBY_APPS_PERMISSIONS_PREFIXES[i];
-      if (permission.name.startsWith(`${prefix}.`)) {
-        isWbyAppPermission = true;
-        wbyAppPermissionPrefix = prefix;
-        break;
-      }
-    }
-
-    // Not a Webiny app permission? Then don't omit the permission.
-    if (!isWbyAppPermission) {
-      return true;
-    }
-
-    // Only allow full access (`${wbyAppPermissionPrefix}.*`) permissions.
-    return permission.name === `${wbyAppPermissionPrefix}.*`;
-  });
-};
+const WBY_APPS_PERMISSIONS_PREFIXES = [
+    "pb",
+    "fb",
+    "fm",
+    "cms",
+    "security",
+    "adminUsers",
+    "i18n"
+];
+const filterOutCustomWbyAppsPermissions = (permissions)=>permissions.filter((permission)=>{
+        if (!permission.name) return true;
+        let isWbyAppPermission = false, wbyAppPermissionPrefix = "";
+        for(let i = 0; i < WBY_APPS_PERMISSIONS_PREFIXES.length; i++){
+            const prefix = WBY_APPS_PERMISSIONS_PREFIXES[i];
+            if (permission.name.startsWith(`${prefix}.`)) {
+                isWbyAppPermission = true;
+                wbyAppPermissionPrefix = prefix;
+                break;
+            }
+        }
+        if (!isWbyAppPermission) return true;
+        return permission.name === `${wbyAppPermissionPrefix}.*`;
+    });
+export { filterOutCustomWbyAppsPermissions };
 
 //# sourceMappingURL=filterOutCustomWbyAppsPermissions.js.map

package/features/security/utils/filterOutCustomWbyAppsPermissions.js.map

@@ -1 +1 @@
-{"version":3,"names":["WBY_APPS_PERMISSIONS_PREFIXES","filterOutCustomWbyAppsPermissions","permissions","filter","permission","name","isWbyAppPermission","wbyAppPermissionPrefix","i","length","prefix","startsWith"],"sources":["filterOutCustomWbyAppsPermissions.ts"],"sourcesContent":["import type { SecurityPermission } from \"~/types/security.js\";\n\nconst WBY_APPS_PERMISSIONS_PREFIXES = [\"pb\", \"fb\", \"fm\", \"cms\", \"security\", \"adminUsers\", \"i18n\"];\n\nexport const filterOutCustomWbyAppsPermissions = (permissions: SecurityPermission[]) => {\n    return permissions.filter(permission => {\n        // Just in case, if the `name` property is missing, we don't omit the permission.\n        if (!permission.name) {\n            return true;\n        }\n\n        let isWbyAppPermission = false,\n            wbyAppPermissionPrefix = \"\";\n        for (let i = 0; i < WBY_APPS_PERMISSIONS_PREFIXES.length; i++) {\n            const prefix = WBY_APPS_PERMISSIONS_PREFIXES[i];\n            if (permission.name.startsWith(`${prefix}.`)) {\n                isWbyAppPermission = true;\n                wbyAppPermissionPrefix = prefix;\n                break;\n            }\n        }\n\n        // Not a Webiny app permission? Then don't omit the permission.\n        if (!isWbyAppPermission) {\n            return true;\n        }\n\n        // Only allow full access (`${wbyAppPermissionPrefix}.*`) permissions.\n        return permission.name === `${wbyAppPermissionPrefix}.*`;\n    });\n};\n"],"mappings":"AAEA,MAAMA,6BAA6B,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,CAAC;AAEjG,OAAO,MAAMC,iCAAiC,GAAIC,WAAiC,IAAK;EACpF,OAAOA,WAAW,CAACC,MAAM,CAACC,UAAU,IAAI;IACpC;IACA,IAAI,CAACA,UAAU,CAACC,IAAI,EAAE;MAClB,OAAO,IAAI;IACf;IAEA,IAAIC,kBAAkB,GAAG,KAAK;MAC1BC,sBAAsB,GAAG,EAAE;IAC/B,KAAK,IAAIC,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAGR,6BAA6B,CAACS,MAAM,EAAED,CAAC,EAAE,EAAE;MAC3D,MAAME,MAAM,GAAGV,6BAA6B,CAACQ,CAAC,CAAC;MAC/C,IAAIJ,UAAU,CAACC,IAAI,CAACM,UAAU,CAAC,GAAGD,MAAM,GAAG,CAAC,EAAE;QAC1CJ,kBAAkB,GAAG,IAAI;QACzBC,sBAAsB,GAAGG,MAAM;QAC/B;MACJ;IACJ;;IAEA;IACA,IAAI,CAACJ,kBAAkB,EAAE;MACrB,OAAO,IAAI;IACf;;IAEA;IACA,OAAOF,UAAU,CAACC,IAAI,KAAK,GAAGE,sBAAsB,IAAI;EAC5D,CAAC,CAAC;AACN,CAAC","ignoreList":[]}
+{"version":3,"file":"features/security/utils/filterOutCustomWbyAppsPermissions.js","sources":["../../../../src/features/security/utils/filterOutCustomWbyAppsPermissions.ts"],"sourcesContent":["import type { SecurityPermission } from \"~/types/security.js\";\n\nconst WBY_APPS_PERMISSIONS_PREFIXES = [\"pb\", \"fb\", \"fm\", \"cms\", \"security\", \"adminUsers\", \"i18n\"];\n\nexport const filterOutCustomWbyAppsPermissions = (permissions: SecurityPermission[]) => {\n    return permissions.filter(permission => {\n        // Just in case, if the `name` property is missing, we don't omit the permission.\n        if (!permission.name) {\n            return true;\n        }\n\n        let isWbyAppPermission = false,\n            wbyAppPermissionPrefix = \"\";\n        for (let i = 0; i < WBY_APPS_PERMISSIONS_PREFIXES.length; i++) {\n            const prefix = WBY_APPS_PERMISSIONS_PREFIXES[i];\n            if (permission.name.startsWith(`${prefix}.`)) {\n                isWbyAppPermission = true;\n                wbyAppPermissionPrefix = prefix;\n                break;\n            }\n        }\n\n        // Not a Webiny app permission? Then don't omit the permission.\n        if (!isWbyAppPermission) {\n            return true;\n        }\n\n        // Only allow full access (`${wbyAppPermissionPrefix}.*`) permissions.\n        return permission.name === `${wbyAppPermissionPrefix}.*`;\n    });\n};\n"],"names":["WBY_APPS_PERMISSIONS_PREFIXES","filterOutCustomWbyAppsPermissions","permissions","permission","isWbyAppPermission","wbyAppPermissionPrefix","i","prefix"],"mappings":"AAEA,MAAMA,gCAAgC;IAAC;IAAM;IAAM;IAAM;IAAO;IAAY;IAAc;CAAO;AAE1F,MAAMC,oCAAoC,CAACC,cACvCA,YAAY,MAAM,CAACC,CAAAA;QAEtB,IAAI,CAACA,WAAW,IAAI,EAChB,OAAO;QAGX,IAAIC,qBAAqB,OACrBC,yBAAyB;QAC7B,IAAK,IAAIC,IAAI,GAAGA,IAAIN,8BAA8B,MAAM,EAAEM,IAAK;YAC3D,MAAMC,SAASP,6BAA6B,CAACM,EAAE;YAC/C,IAAIH,WAAW,IAAI,CAAC,UAAU,CAAC,GAAGI,OAAO,CAAC,CAAC,GAAG;gBAC1CH,qBAAqB;gBACrBC,yBAAyBE;gBACzB;YACJ;QACJ;QAGA,IAAI,CAACH,oBACD,OAAO;QAIX,OAAOD,WAAW,IAAI,KAAK,GAAGE,uBAAuB,EAAE,CAAC;IAC5D"}

package/features/security/utils/getPermissionsFromRoles.d.ts

@@ -3,6 +3,6 @@ export declare const getPermissionsFromRoles: (securityGroups: Array<{
     permissions: SecurityPermission[];
     id: string;
 }>) => {
-    _src: string;
     name: string;
+    _src: string;
 }[];

package/features/security/utils/getPermissionsFromRoles.js

@@ -1,12 +1,7 @@
-// This filter was introduced when we added the `teams` feature and the ability to
-// have multiple security roles assigned to a user.
-export const getPermissionsFromRoles = securityGroups => {
-  return securityGroups.flatMap(securityRole => securityRole.permissions.map(permission => {
-    return {
-      ...permission,
-      _src: "role:" + securityRole.id
-    };
-  }));
-};
+const getPermissionsFromRoles = (securityGroups)=>securityGroups.flatMap((securityRole)=>securityRole.permissions.map((permission)=>({
+                ...permission,
+                _src: "role:" + securityRole.id
+            })));
+export { getPermissionsFromRoles };
 
 //# sourceMappingURL=getPermissionsFromRoles.js.map

package/features/security/utils/getPermissionsFromRoles.js.map

@@ -1 +1 @@
-{"version":3,"names":["getPermissionsFromRoles","securityGroups","flatMap","securityRole","permissions","map","permission","_src","id"],"sources":["getPermissionsFromRoles.ts"],"sourcesContent":["import type { SecurityPermission } from \"~/types/security.js\";\n\n// This filter was introduced when we added the `teams` feature and the ability to\n// have multiple security roles assigned to a user.\nexport const getPermissionsFromRoles = (\n    securityGroups: Array<{ permissions: SecurityPermission[]; id: string }>\n) => {\n    return securityGroups.flatMap(securityRole =>\n        securityRole.permissions.map(permission => {\n            return {\n                ...permission,\n                _src: \"role:\" + securityRole.id\n            };\n        })\n    );\n};\n"],"mappings":"AAEA;AACA;AACA,OAAO,MAAMA,uBAAuB,GAChCC,cAAwE,IACvE;EACD,OAAOA,cAAc,CAACC,OAAO,CAACC,YAAY,IACtCA,YAAY,CAACC,WAAW,CAACC,GAAG,CAACC,UAAU,IAAI;IACvC,OAAO;MACH,GAAGA,UAAU;MACbC,IAAI,EAAE,OAAO,GAAGJ,YAAY,CAACK;IACjC,CAAC;EACL,CAAC,CACL,CAAC;AACL,CAAC","ignoreList":[]}
+{"version":3,"file":"features/security/utils/getPermissionsFromRoles.js","sources":["../../../../src/features/security/utils/getPermissionsFromRoles.ts"],"sourcesContent":["import type { SecurityPermission } from \"~/types/security.js\";\n\n// This filter was introduced when we added the `teams` feature and the ability to\n// have multiple security roles assigned to a user.\nexport const getPermissionsFromRoles = (\n    securityGroups: Array<{ permissions: SecurityPermission[]; id: string }>\n) => {\n    return securityGroups.flatMap(securityRole =>\n        securityRole.permissions.map(permission => {\n            return {\n                ...permission,\n                _src: \"role:\" + securityRole.id\n            };\n        })\n    );\n};\n"],"names":["getPermissionsFromRoles","securityGroups","securityRole","permission"],"mappings":"AAIO,MAAMA,0BAA0B,CACnCC,iBAEOA,eAAe,OAAO,CAACC,CAAAA,eAC1BA,aAAa,WAAW,CAAC,GAAG,CAACC,CAAAA,aAClB;gBACH,GAAGA,UAAU;gBACb,MAAM,UAAUD,aAAa,EAAE;YACnC"}

package/features/security/utils/isJwt.js

@@ -1,3 +1,4 @@
-export const isJwt = token => token.split(".").length === 3;
+const isJwt = (token)=>3 === token.split(".").length;
+export { isJwt };
 
 //# sourceMappingURL=isJwt.js.map

package/features/security/utils/isJwt.js.map

@@ -1 +1 @@
-{"version":3,"names":["isJwt","token","split","length"],"sources":["isJwt.ts"],"sourcesContent":["export const isJwt = (token: string) => token.split(\".\").length === 3;\n"],"mappings":"AAAA,OAAO,MAAMA,KAAK,GAAIC,KAAa,IAAKA,KAAK,CAACC,KAAK,CAAC,GAAG,CAAC,CAACC,MAAM,KAAK,CAAC","ignoreList":[]}
+{"version":3,"file":"features/security/utils/isJwt.js","sources":["../../../../src/features/security/utils/isJwt.ts"],"sourcesContent":["export const isJwt = (token: string) => token.split(\".\").length === 3;\n"],"names":["isJwt","token"],"mappings":"AAAO,MAAMA,QAAQ,CAACC,QAAkBA,AAA4B,MAA5BA,MAAM,KAAK,CAAC,KAAK,MAAM"}

package/features/security/utils/verifyJwtUsingJwk.d.ts

@@ -1,8 +1,6 @@
 import jwt from "jsonwebtoken";
-export interface Jwk {
-    kid: string;
-    [key: string]: string;
-}
+import { type JWK } from "jose";
+export type Jwk = JWK;
 export type Jwt = {
     header: jwt.JwtHeader;
     payload: jwt.JwtPayload;

package/features/security/utils/verifyJwtUsingJwk.js

@@ -1,11 +1,10 @@
-import jwt from "jsonwebtoken";
-import { importJWK, exportSPKI } from "jose";
-export const verifyJwtUsingJwk = async (token, jwk) => {
-  // Casting to `any` because `jose` v5 has some incompatibilities with types.
-  // v6 works as expected, but we can't have v6 because it's ESM-only.
-  const key = await importJWK(jwk);
-  const pemKey = await exportSPKI(key);
-  return jwt.verify(token, pemKey);
+import jsonwebtoken from "jsonwebtoken";
+import { exportSPKI, importJWK } from "jose";
+const verifyJwtUsingJwk = async (token, jwk)=>{
+    const key = await importJWK(jwk);
+    const pemKey = await exportSPKI(key);
+    return jsonwebtoken.verify(token, pemKey);
 };
+export { verifyJwtUsingJwk };
 
 //# sourceMappingURL=verifyJwtUsingJwk.js.map

package/features/security/utils/verifyJwtUsingJwk.js.map

@@ -1 +1 @@
-{"version":3,"names":["jwt","importJWK","exportSPKI","verifyJwtUsingJwk","token","jwk","key","pemKey","verify"],"sources":["verifyJwtUsingJwk.ts"],"sourcesContent":["import jwt from \"jsonwebtoken\";\nimport { importJWK, exportSPKI } from \"jose\";\n\nexport interface Jwk {\n    kid: string;\n    [key: string]: string;\n}\n\nexport type Jwt = {\n    header: jwt.JwtHeader;\n    payload: jwt.JwtPayload;\n};\n\nexport const verifyJwtUsingJwk = async (token: string, jwk: Jwk) => {\n    // Casting to `any` because `jose` v5 has some incompatibilities with types.\n    // v6 works as expected, but we can't have v6 because it's ESM-only.\n    const key = (await importJWK(jwk as any)) as CryptoKey;\n    const pemKey = await exportSPKI(key);\n\n    return jwt.verify(token, pemKey) as jwt.JwtPayload;\n};\n"],"mappings":"AAAA,OAAOA,GAAG,MAAM,cAAc;AAC9B,SAASC,SAAS,EAAEC,UAAU,QAAQ,MAAM;AAY5C,OAAO,MAAMC,iBAAiB,GAAG,MAAAA,CAAOC,KAAa,EAAEC,GAAQ,KAAK;EAChE;EACA;EACA,MAAMC,GAAG,GAAI,MAAML,SAAS,CAACI,GAAU,CAAe;EACtD,MAAME,MAAM,GAAG,MAAML,UAAU,CAACI,GAAG,CAAC;EAEpC,OAAON,GAAG,CAACQ,MAAM,CAACJ,KAAK,EAAEG,MAAM,CAAC;AACpC,CAAC","ignoreList":[]}
+{"version":3,"file":"features/security/utils/verifyJwtUsingJwk.js","sources":["../../../../src/features/security/utils/verifyJwtUsingJwk.ts"],"sourcesContent":["import jwt from \"jsonwebtoken\";\nimport { exportSPKI, importJWK, type JWK } from \"jose\";\n\nexport type Jwk = JWK;\n\nexport type Jwt = {\n    header: jwt.JwtHeader;\n    payload: jwt.JwtPayload;\n};\n\nexport const verifyJwtUsingJwk = async (token: string, jwk: Jwk) => {\n    // Casting to `any` because `jose` v5 has some incompatibilities with types.\n    // v6 works as expected, but we can't have v6 because it's ESM-only.\n    const key = (await importJWK(jwk)) as CryptoKey;\n    const pemKey = await exportSPKI(key);\n\n    return jwt.verify(token, pemKey) as jwt.JwtPayload;\n};\n"],"names":["verifyJwtUsingJwk","token","jwk","key","importJWK","pemKey","exportSPKI","jwt"],"mappings":";;AAUO,MAAMA,oBAAoB,OAAOC,OAAeC;IAGnD,MAAMC,MAAO,MAAMC,UAAUF;IAC7B,MAAMG,SAAS,MAAMC,WAAWH;IAEhC,OAAOI,aAAAA,MAAU,CAACN,OAAOI;AAC7B"}

package/features/serviceDiscovery/ServiceDiscovery.d.ts

@@ -0,0 +1,17 @@
+import type { GenericRecord } from "@webiny/api/types.js";
+export interface IServiceManifest {
+    name: string;
+    manifest: GenericRecord<string>;
+}
+export interface IServiceManifestLoader {
+    load(): Promise<IServiceManifest[] | undefined>;
+}
+type Manifest = GenericRecord<string>;
+export declare class ServiceDiscovery {
+    private static loader;
+    private static manifest;
+    static setLoader(loader: IServiceManifestLoader): void;
+    static load(): Promise<Manifest | undefined>;
+    static clear(): void;
+}
+export {};

package/features/serviceDiscovery/ServiceDiscovery.js

@@ -0,0 +1,22 @@
+class ServiceDiscovery {
+    static setLoader(loader) {
+        this.loader = loader;
+    }
+    static async load() {
+        if (this.manifest) return this.manifest;
+        if (!this.loader) throw new Error("ServiceDiscovery loader not configured. Call ServiceDiscovery.setLoader() before loading manifests.");
+        const manifests = await this.loader.load();
+        if (!manifests) return;
+        this.manifest = manifests.reduce((acc, item)=>({
+                ...acc,
+                [item.name]: item.manifest
+            }), {});
+        return this.manifest;
+    }
+    static clear() {
+        this.manifest = void 0;
+    }
+}
+export { ServiceDiscovery };
+
+//# sourceMappingURL=ServiceDiscovery.js.map

package/features/serviceDiscovery/ServiceDiscovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/serviceDiscovery/ServiceDiscovery.js","sources":["../../../src/features/serviceDiscovery/ServiceDiscovery.ts"],"sourcesContent":["import type { GenericRecord } from \"@webiny/api/types.js\";\n\nexport interface IServiceManifest {\n    name: string;\n    manifest: GenericRecord<string>;\n}\n\nexport interface IServiceManifestLoader {\n    load(): Promise<IServiceManifest[] | undefined>;\n}\n\ntype Manifest = GenericRecord<string>;\n\nexport class ServiceDiscovery {\n    private static loader: IServiceManifestLoader | undefined;\n    private static manifest: Manifest | undefined;\n\n    static setLoader(loader: IServiceManifestLoader): void {\n        this.loader = loader;\n    }\n\n    static async load(): Promise<Manifest | undefined> {\n        if (this.manifest) {\n            return this.manifest;\n        }\n\n        if (!this.loader) {\n            throw new Error(\n                \"ServiceDiscovery loader not configured. Call ServiceDiscovery.setLoader() before loading manifests.\"\n            );\n        }\n\n        const manifests = await this.loader.load();\n\n        if (!manifests) {\n            return undefined;\n        }\n\n        this.manifest = manifests.reduce<Manifest>((acc, item) => {\n            return { ...acc, [item.name]: item.manifest };\n        }, {});\n\n        return this.manifest;\n    }\n\n    static clear(): void {\n        this.manifest = undefined;\n    }\n}\n"],"names":["ServiceDiscovery","loader","Error","manifests","acc","item","undefined"],"mappings":"AAaO,MAAMA;IAIT,OAAO,UAAUC,MAA8B,EAAQ;QACnD,IAAI,CAAC,MAAM,GAAGA;IAClB;IAEA,aAAa,OAAsC;QAC/C,IAAI,IAAI,CAAC,QAAQ,EACb,OAAO,IAAI,CAAC,QAAQ;QAGxB,IAAI,CAAC,IAAI,CAAC,MAAM,EACZ,MAAM,IAAIC,MACN;QAIR,MAAMC,YAAY,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI;QAExC,IAAI,CAACA,WACD;QAGJ,IAAI,CAAC,QAAQ,GAAGA,UAAU,MAAM,CAAW,CAACC,KAAKC,OACtC;gBAAE,GAAGD,GAAG;gBAAE,CAACC,KAAK,IAAI,CAAC,EAAEA,KAAK,QAAQ;YAAC,IAC7C,CAAC;QAEJ,OAAO,IAAI,CAAC,QAAQ;IACxB;IAEA,OAAO,QAAc;QACjB,IAAI,CAAC,QAAQ,GAAGC;IACpB;AACJ"}

package/features/serviceDiscovery/__tests__/ServiceDiscovery.test.d.ts

@@ -0,0 +1 @@
+export {};

package/features/serviceDiscovery/__tests__/ServiceDiscovery.test.js

@@ -0,0 +1,111 @@
+import { beforeEach, describe, expect, it } from "vitest";
+import { ServiceDiscovery } from "../ServiceDiscovery.js";
+describe("ServiceDiscovery", ()=>{
+    beforeEach(()=>{
+        ServiceDiscovery.clear();
+    });
+    it("should throw if no loader is set", async ()=>{
+        ServiceDiscovery.loader = void 0;
+        await expect(ServiceDiscovery.load()).rejects.toThrow("ServiceDiscovery loader not configured");
+    });
+    it("should load manifests and combine them by name", async ()=>{
+        const loader = {
+            async load () {
+                return [
+                    {
+                        name: "api",
+                        manifest: {
+                            cloudfront: {
+                                distributionId: "123"
+                            }
+                        }
+                    },
+                    {
+                        name: "core",
+                        manifest: {
+                            bucket: {
+                                name: "my-bucket"
+                            }
+                        }
+                    }
+                ];
+            }
+        };
+        ServiceDiscovery.setLoader(loader);
+        const result = await ServiceDiscovery.load();
+        expect(result).toEqual({
+            api: {
+                cloudfront: {
+                    distributionId: "123"
+                }
+            },
+            core: {
+                bucket: {
+                    name: "my-bucket"
+                }
+            }
+        });
+    });
+    it("should cache the result and not call loader again", async ()=>{
+        let callCount = 0;
+        const loader = {
+            async load () {
+                callCount++;
+                return [
+                    {
+                        name: "api",
+                        manifest: {
+                            url: "https://example.com"
+                        }
+                    }
+                ];
+            }
+        };
+        ServiceDiscovery.setLoader(loader);
+        await ServiceDiscovery.load();
+        await ServiceDiscovery.load();
+        await ServiceDiscovery.load();
+        expect(callCount).toBe(1);
+    });
+    it("should return undefined when loader returns undefined", async ()=>{
+        const loader = {
+            async load () {}
+        };
+        ServiceDiscovery.setLoader(loader);
+        const result = await ServiceDiscovery.load();
+        expect(result).toBeUndefined();
+    });
+    it("should reload after clear()", async ()=>{
+        let callCount = 0;
+        const loader = {
+            async load () {
+                callCount++;
+                return [
+                    {
+                        name: "api",
+                        manifest: {
+                            version: callCount
+                        }
+                    }
+                ];
+            }
+        };
+        ServiceDiscovery.setLoader(loader);
+        const first = await ServiceDiscovery.load();
+        expect(first).toEqual({
+            api: {
+                version: 1
+            }
+        });
+        ServiceDiscovery.clear();
+        const second = await ServiceDiscovery.load();
+        expect(second).toEqual({
+            api: {
+                version: 2
+            }
+        });
+        expect(callCount).toBe(2);
+    });
+});
+
+//# sourceMappingURL=ServiceDiscovery.test.js.map