@webiny/api-core 0.0.0-unstable.ac6ebf63c6 → 0.0.0-unstable.b9b64acb6d

package/ApiCoreFeature.js

@@ -8,6 +8,7 @@ import { AdminUsersFeature } from "./features/users/AdminUsersFeature.js";
 import { IdpAuthenticatorFeature } from "./idp/feature.js";
 import { KeyValueStoreFeature } from "./features/keyValueStore/feature.js";
 import { BuildParamsFeature } from "./features/buildParams/feature.js";
+import { FeatureFlagsFeature } from "./features/featureFlags/feature.js";
 export const ApiCoreFeature = createFeature({
   name: "ApiCore",
   register(container, config) {
@@ -15,6 +16,7 @@ export const ApiCoreFeature = createFeature({
     LoggerFeature.register(container);
     EventPublisherFeature.register(container);
     BuildParamsFeature.register(container);
+    FeatureFlagsFeature.register(container);
     TenancyFeature.register(container, config.tenancyStorageOperations);
     SecurityFeature.register(container, config.securityStorageOperations);
     AdminUsersFeature.register(container, config.usersStorageOperations);

package/ApiCoreFeature.js.map

@@ -1 +1 @@
-{"version":3,"names":["createFeature","EventPublisherFeature","LoggerFeature","SecurityFeature","SystemFeature","TenancyFeature","AdminUsersFeature","IdpAuthenticatorFeature","KeyValueStoreFeature","BuildParamsFeature","ApiCoreFeature","name","register","container","config","tenancyStorageOperations","securityStorageOperations","usersStorageOperations","keyValueStorageOperations"],"sources":["ApiCoreFeature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { Container } from \"@webiny/di\";\nimport { EventPublisherFeature } from \"~/features/eventPublisher/feature.js\";\nimport { LoggerFeature } from \"~/features/logger/feature.js\";\nimport { SecurityFeature } from \"~/features/security/SecurityFeature.js\";\nimport { SystemFeature } from \"~/features/system/SystemFeature.js\";\nimport { TenancyFeature } from \"./features/tenancy/TenancyFeature.js\";\nimport { AdminUsersFeature } from \"~/features/users/AdminUsersFeature.js\";\nimport type { ApiCoreStorageOperations } from \"~/types/core.js\";\nimport { IdpAuthenticatorFeature } from \"~/idp/feature.js\";\nimport { KeyValueStoreFeature } from \"~/features/keyValueStore/feature.js\";\nimport { BuildParamsFeature } from \"~/features/buildParams/feature.js\";\n\nexport const ApiCoreFeature = createFeature({\n    name: \"ApiCore\",\n    register(container: Container, config: ApiCoreStorageOperations) {\n        // Register features\n        LoggerFeature.register(container);\n        EventPublisherFeature.register(container);\n        BuildParamsFeature.register(container);\n        TenancyFeature.register(container, config.tenancyStorageOperations);\n        SecurityFeature.register(container, config.securityStorageOperations);\n        AdminUsersFeature.register(container, config.usersStorageOperations);\n        KeyValueStoreFeature.register(container, config.keyValueStorageOperations);\n        SystemFeature.register(container);\n        IdpAuthenticatorFeature.register(container);\n    }\n});\n"],"mappings":"AAAA,SAASA,aAAa,QAAQ,qBAAqB;AAEnD,SAASC,qBAAqB;AAC9B,SAASC,aAAa;AACtB,SAASC,eAAe;AACxB,SAASC,aAAa;AACtB,SAASC,cAAc;AACvB,SAASC,iBAAiB;AAE1B,SAASC,uBAAuB;AAChC,SAASC,oBAAoB;AAC7B,SAASC,kBAAkB;AAE3B,OAAO,MAAMC,cAAc,GAAGV,aAAa,CAAC;EACxCW,IAAI,EAAE,SAAS;EACfC,QAAQA,CAACC,SAAoB,EAAEC,MAAgC,EAAE;IAC7D;IACAZ,aAAa,CAACU,QAAQ,CAACC,SAAS,CAAC;IACjCZ,qBAAqB,CAACW,QAAQ,CAACC,SAAS,CAAC;IACzCJ,kBAAkB,CAACG,QAAQ,CAACC,SAAS,CAAC;IACtCR,cAAc,CAACO,QAAQ,CAACC,SAAS,EAAEC,MAAM,CAACC,wBAAwB,CAAC;IACnEZ,eAAe,CAACS,QAAQ,CAACC,SAAS,EAAEC,MAAM,CAACE,yBAAyB,CAAC;IACrEV,iBAAiB,CAACM,QAAQ,CAACC,SAAS,EAAEC,MAAM,CAACG,sBAAsB,CAAC;IACpET,oBAAoB,CAACI,QAAQ,CAACC,SAAS,EAAEC,MAAM,CAACI,yBAAyB,CAAC;IAC1Ed,aAAa,CAACQ,QAAQ,CAACC,SAAS,CAAC;IACjCN,uBAAuB,CAACK,QAAQ,CAACC,SAAS,CAAC;EAC/C;AACJ,CAAC,CAAC","ignoreList":[]}
+{"version":3,"names":["createFeature","EventPublisherFeature","LoggerFeature","SecurityFeature","SystemFeature","TenancyFeature","AdminUsersFeature","IdpAuthenticatorFeature","KeyValueStoreFeature","BuildParamsFeature","FeatureFlagsFeature","ApiCoreFeature","name","register","container","config","tenancyStorageOperations","securityStorageOperations","usersStorageOperations","keyValueStorageOperations"],"sources":["ApiCoreFeature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { Container } from \"@webiny/di\";\nimport { EventPublisherFeature } from \"~/features/eventPublisher/feature.js\";\nimport { LoggerFeature } from \"~/features/logger/feature.js\";\nimport { SecurityFeature } from \"~/features/security/SecurityFeature.js\";\nimport { SystemFeature } from \"~/features/system/SystemFeature.js\";\nimport { TenancyFeature } from \"./features/tenancy/TenancyFeature.js\";\nimport { AdminUsersFeature } from \"~/features/users/AdminUsersFeature.js\";\nimport type { ApiCoreStorageOperations } from \"~/types/core.js\";\nimport { IdpAuthenticatorFeature } from \"~/idp/feature.js\";\nimport { KeyValueStoreFeature } from \"~/features/keyValueStore/feature.js\";\nimport { BuildParamsFeature } from \"~/features/buildParams/feature.js\";\nimport { FeatureFlagsFeature } from \"~/features/featureFlags/feature.js\";\n\nexport const ApiCoreFeature = createFeature({\n    name: \"ApiCore\",\n    register(container: Container, config: ApiCoreStorageOperations) {\n        // Register features\n        LoggerFeature.register(container);\n        EventPublisherFeature.register(container);\n        BuildParamsFeature.register(container);\n        FeatureFlagsFeature.register(container);\n        TenancyFeature.register(container, config.tenancyStorageOperations);\n        SecurityFeature.register(container, config.securityStorageOperations);\n        AdminUsersFeature.register(container, config.usersStorageOperations);\n        KeyValueStoreFeature.register(container, config.keyValueStorageOperations);\n        SystemFeature.register(container);\n        IdpAuthenticatorFeature.register(container);\n    }\n});\n"],"mappings":"AAAA,SAASA,aAAa,QAAQ,qBAAqB;AAEnD,SAASC,qBAAqB;AAC9B,SAASC,aAAa;AACtB,SAASC,eAAe;AACxB,SAASC,aAAa;AACtB,SAASC,cAAc;AACvB,SAASC,iBAAiB;AAE1B,SAASC,uBAAuB;AAChC,SAASC,oBAAoB;AAC7B,SAASC,kBAAkB;AAC3B,SAASC,mBAAmB;AAE5B,OAAO,MAAMC,cAAc,GAAGX,aAAa,CAAC;EACxCY,IAAI,EAAE,SAAS;EACfC,QAAQA,CAACC,SAAoB,EAAEC,MAAgC,EAAE;IAC7D;IACAb,aAAa,CAACW,QAAQ,CAACC,SAAS,CAAC;IACjCb,qBAAqB,CAACY,QAAQ,CAACC,SAAS,CAAC;IACzCL,kBAAkB,CAACI,QAAQ,CAACC,SAAS,CAAC;IACtCJ,mBAAmB,CAACG,QAAQ,CAACC,SAAS,CAAC;IACvCT,cAAc,CAACQ,QAAQ,CAACC,SAAS,EAAEC,MAAM,CAACC,wBAAwB,CAAC;IACnEb,eAAe,CAACU,QAAQ,CAACC,SAAS,EAAEC,MAAM,CAACE,yBAAyB,CAAC;IACrEX,iBAAiB,CAACO,QAAQ,CAACC,SAAS,EAAEC,MAAM,CAACG,sBAAsB,CAAC;IACpEV,oBAAoB,CAACK,QAAQ,CAACC,SAAS,EAAEC,MAAM,CAACI,yBAAyB,CAAC;IAC1Ef,aAAa,CAACS,QAAQ,CAACC,SAAS,CAAC;IACjCP,uBAAuB,CAACM,QAAQ,CAACC,SAAS,CAAC;EAC/C;AACJ,CAAC,CAAC","ignoreList":[]}

package/exports/api/{buildParams.js → build-params.js}

@@ -1,3 +1,3 @@
 export { BuildParam, BuildParams } from "../../features/buildParams/index.js";
 
-//# sourceMappingURL=buildParams.js.map
+//# sourceMappingURL=build-params.js.map

package/exports/api/build-params.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["BuildParam","BuildParams"],"sources":["build-params.ts"],"sourcesContent":["export { BuildParam, BuildParams } from \"~/features/buildParams/index.js\";\n"],"mappings":"AAAA,SAASA,UAAU,EAAEC,WAAW","ignoreList":[]}

package/exports/api/{eventPublisher.js → event-publisher.js}

@@ -1,3 +1,3 @@
 export { DomainEvent, EventPublisher } from "../../features/eventPublisher/index.js";
 
-//# sourceMappingURL=eventPublisher.js.map
+//# sourceMappingURL=event-publisher.js.map

package/exports/api/event-publisher.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["DomainEvent","EventPublisher"],"sources":["event-publisher.ts"],"sourcesContent":["export { DomainEvent, EventPublisher } from \"~/features/eventPublisher/index.js\";\n"],"mappings":"AAAA,SAASA,WAAW,EAAEC,cAAc","ignoreList":[]}

package/exports/api/{keyValueStore.js → key-value-store.js}

@@ -1,3 +1,3 @@
 export { GlobalKeyValueStore, KeyValueStore } from "../../features/keyValueStore/index.js";
 
-//# sourceMappingURL=keyValueStore.js.map
+//# sourceMappingURL=key-value-store.js.map

package/exports/api/key-value-store.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["GlobalKeyValueStore","KeyValueStore"],"sources":["key-value-store.ts"],"sourcesContent":["export { GlobalKeyValueStore, KeyValueStore } from \"~/features/keyValueStore/index.js\";\n"],"mappings":"AAAA,SAASA,mBAAmB,EAAEC,aAAa","ignoreList":[]}

package/exports/api/security/{apiKey.js → api-key.js}

@@ -6,4 +6,4 @@ export { ListApiKeysUseCase } from "../../../features/security/apiKeys/ListApiKe
 export { ApiKeyAfterUpdateHandler, ApiKeyBeforeUpdateHandler, UpdateApiKeyUseCase } from "../../../features/security/apiKeys/UpdateApiKey/index.js";
 export { ApiKeyFactory } from "../../../features/security/apiKeys/shared/abstractions.js";
 
-//# sourceMappingURL=apiKey.js.map
+//# sourceMappingURL=api-key.js.map

package/exports/api/security/api-key.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["ApiKeyAfterCreateHandler","ApiKeyBeforeCreateHandler","CreateApiKeyUseCase","ApiKeyAfterDeleteHandler","ApiKeyBeforeDeleteHandler","DeleteApiKeyUseCase","GetApiKeyUseCase","GetApiKeyByTokenUseCase","ListApiKeysUseCase","ApiKeyAfterUpdateHandler","ApiKeyBeforeUpdateHandler","UpdateApiKeyUseCase","ApiKeyFactory"],"sources":["api-key.ts"],"sourcesContent":["export {\n    ApiKeyAfterCreateHandler,\n    ApiKeyBeforeCreateHandler,\n    CreateApiKeyUseCase\n} from \"~/features/security/apiKeys/CreateApiKey/index.js\";\n\nexport {\n    ApiKeyAfterDeleteHandler,\n    ApiKeyBeforeDeleteHandler,\n    DeleteApiKeyUseCase\n} from \"~/features/security/apiKeys/DeleteApiKey/index.js\";\n\nexport { GetApiKeyUseCase } from \"~/features/security/apiKeys/GetApiKey/index.js\";\nexport { GetApiKeyByTokenUseCase } from \"~/features/security/apiKeys/GetApiKeyByToken/index.js\";\nexport { ListApiKeysUseCase } from \"~/features/security/apiKeys/ListApiKeys/index.js\";\nexport {\n    ApiKeyAfterUpdateHandler,\n    ApiKeyBeforeUpdateHandler,\n    UpdateApiKeyUseCase\n} from \"~/features/security/apiKeys/UpdateApiKey/index.js\";\nexport { ApiKeyFactory } from \"~/features/security/apiKeys/shared/abstractions.js\";\n"],"mappings":"AAAA,SACIA,wBAAwB,EACxBC,yBAAyB,EACzBC,mBAAmB;AAGvB,SACIC,wBAAwB,EACxBC,yBAAyB,EACzBC,mBAAmB;AAGvB,SAASC,gBAAgB;AACzB,SAASC,uBAAuB;AAChC,SAASC,kBAAkB;AAC3B,SACIC,wBAAwB,EACxBC,yBAAyB,EACzBC,mBAAmB;AAEvB,SAASC,aAAa","ignoreList":[]}

package/features/featureFlags/FeatureFlags.d.ts

@@ -0,0 +1,12 @@
+import { FeatureFlags as FeatureFlagsAbstraction } from "./abstractions.js";
+import { BuildParams } from "../buildParams/abstractions.js";
+import { FeatureFlags as FeatureFlagsClass } from "@webiny/feature-flags";
+declare class FeatureFlagsImpl implements FeatureFlagsAbstraction.Interface {
+    private buildParams;
+    constructor(buildParams: BuildParams.Interface);
+    get(): FeatureFlagsClass;
+}
+export declare const FeatureFlags: typeof FeatureFlagsImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("./abstractions.js").IFeatureFlagsAbstraction>;
+};
+export {};

package/features/featureFlags/FeatureFlags.js

@@ -0,0 +1,18 @@
+import { FeatureFlags as FeatureFlagsAbstraction } from "./abstractions.js";
+import { BuildParams } from "../buildParams/abstractions.js";
+import { FeatureFlags as FeatureFlagsClass } from "@webiny/feature-flags";
+class FeatureFlagsImpl {
+  constructor(buildParams) {
+    this.buildParams = buildParams;
+  }
+  get() {
+    const raw = this.buildParams.get("FeatureFlags") ?? {};
+    return FeatureFlagsClass.fromDto(raw);
+  }
+}
+export const FeatureFlags = FeatureFlagsAbstraction.createImplementation({
+  implementation: FeatureFlagsImpl,
+  dependencies: [BuildParams]
+});
+
+//# sourceMappingURL=FeatureFlags.js.map

package/features/featureFlags/FeatureFlags.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["FeatureFlags","FeatureFlagsAbstraction","BuildParams","FeatureFlagsClass","FeatureFlagsImpl","constructor","buildParams","get","raw","fromDto","createImplementation","implementation","dependencies"],"sources":["FeatureFlags.ts"],"sourcesContent":["import { FeatureFlags as FeatureFlagsAbstraction } from \"./abstractions.js\";\nimport { BuildParams } from \"../buildParams/abstractions.js\";\nimport { FeatureFlags as FeatureFlagsClass } from \"@webiny/feature-flags\";\nimport type { IFeatureFlagsDto } from \"@webiny/feature-flags\";\n\nclass FeatureFlagsImpl implements FeatureFlagsAbstraction.Interface {\n    constructor(private buildParams: BuildParams.Interface) {}\n\n    get(): FeatureFlagsClass {\n        const raw = this.buildParams.get<IFeatureFlagsDto>(\"FeatureFlags\") ?? {};\n        return FeatureFlagsClass.fromDto(raw);\n    }\n}\n\nexport const FeatureFlags = FeatureFlagsAbstraction.createImplementation({\n    implementation: FeatureFlagsImpl,\n    dependencies: [BuildParams]\n});\n"],"mappings":"AAAA,SAASA,YAAY,IAAIC,uBAAuB;AAChD,SAASC,WAAW;AACpB,SAASF,YAAY,IAAIG,iBAAiB,QAAQ,uBAAuB;AAGzE,MAAMC,gBAAgB,CAA8C;EAChEC,WAAWA,CAASC,WAAkC,EAAE;IAAA,KAApCA,WAAkC,GAAlCA,WAAkC;EAAG;EAEzDC,GAAGA,CAAA,EAAsB;IACrB,MAAMC,GAAG,GAAG,IAAI,CAACF,WAAW,CAACC,GAAG,CAAmB,cAAc,CAAC,IAAI,CAAC,CAAC;IACxE,OAAOJ,iBAAiB,CAACM,OAAO,CAACD,GAAG,CAAC;EACzC;AACJ;AAEA,OAAO,MAAMR,YAAY,GAAGC,uBAAuB,CAACS,oBAAoB,CAAC;EACrEC,cAAc,EAAEP,gBAAgB;EAChCQ,YAAY,EAAE,CAACV,WAAW;AAC9B,CAAC,CAAC","ignoreList":[]}

package/features/featureFlags/abstractions.d.ts

@@ -0,0 +1,8 @@
+import { FeatureFlags as FeatureFlagsClass } from "@webiny/feature-flags";
+export interface IFeatureFlagsAbstraction {
+    get(): FeatureFlagsClass;
+}
+export declare const FeatureFlags: import("@webiny/di").Abstraction<IFeatureFlagsAbstraction>;
+export declare namespace FeatureFlags {
+    type Interface = IFeatureFlagsAbstraction;
+}

package/features/featureFlags/abstractions.js

@@ -0,0 +1,4 @@
+import { createAbstraction } from "@webiny/feature/api";
+export const FeatureFlags = createAbstraction("FeatureFlags");
+
+//# sourceMappingURL=abstractions.js.map

package/features/featureFlags/abstractions.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createAbstraction","FeatureFlags"],"sources":["abstractions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport { FeatureFlags as FeatureFlagsClass } from \"@webiny/feature-flags\";\n\nexport interface IFeatureFlagsAbstraction {\n    get(): FeatureFlagsClass;\n}\n\nexport const FeatureFlags = createAbstraction<IFeatureFlagsAbstraction>(\"FeatureFlags\");\n\nexport namespace FeatureFlags {\n    export type Interface = IFeatureFlagsAbstraction;\n}\n"],"mappings":"AAAA,SAASA,iBAAiB,QAAQ,qBAAqB;AAOvD,OAAO,MAAMC,YAAY,GAAGD,iBAAiB,CAA2B,cAAc,CAAC","ignoreList":[]}

package/features/featureFlags/feature.d.ts

@@ -0,0 +1 @@
+export declare const FeatureFlagsFeature: import("@webiny/feature/api/createFeature.js").FeatureDefinition<unknown>;

package/features/featureFlags/feature.js

@@ -0,0 +1,10 @@
+import { createFeature } from "@webiny/feature/api";
+import { FeatureFlags } from "./FeatureFlags.js";
+export const FeatureFlagsFeature = createFeature({
+  name: "FeatureFlags",
+  register(container) {
+    container.register(FeatureFlags);
+  }
+});
+
+//# sourceMappingURL=feature.js.map

package/features/featureFlags/feature.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createFeature","FeatureFlags","FeatureFlagsFeature","name","register","container"],"sources":["feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport type { Container } from \"@webiny/di\";\nimport { FeatureFlags } from \"./FeatureFlags.js\";\n\nexport const FeatureFlagsFeature = createFeature({\n    name: \"FeatureFlags\",\n    register(container: Container) {\n        container.register(FeatureFlags);\n    }\n});\n"],"mappings":"AAAA,SAASA,aAAa,QAAQ,qBAAqB;AAEnD,SAASC,YAAY;AAErB,OAAO,MAAMC,mBAAmB,GAAGF,aAAa,CAAC;EAC7CG,IAAI,EAAE,cAAc;EACpBC,QAAQA,CAACC,SAAoB,EAAE;IAC3BA,SAAS,CAACD,QAAQ,CAACH,YAAY,CAAC;EACpC;AACJ,CAAC,CAAC","ignoreList":[]}

package/features/security/IdentityContext/IdentityContext.js

@@ -1,5 +1,5 @@
 import { AsyncLocalStorage } from "async_hooks";
-import minimatch from "minimatch";
+import { minimatch } from "minimatch";
 import { createImplementation } from "@webiny/di";
 import { IdentityContext as Abstraction } from "./abstractions.js";
 import { AnonymousIdentity } from "./AnonymousIdentity.js";

package/features/security/IdentityContext/IdentityContext.js.map

@@ -1 +1 @@
-{"version":3,"names":["AsyncLocalStorage","minimatch","createImplementation","IdentityContext","Abstraction","AnonymousIdentity","AuthorizationContext","filterOutCustomWbyAppsPermissions","WcpContext","identityStorage","IdentityContextImpl","identity","constructor","authorizationContext","wcpContext","getIdentity","override","getStore","undefined","setIdentity","clearPermissionsCache","withIdentity","cb","run","withoutAuthorization","isAuthorizationEnabled","getPermission","name","permissions","listPermissions","exactMatch","find","p","patternMatch","getPermissions","filter","loadPermissions","applyAaclLogic","hasFullAccess","some","aaclEnabled","canUseAacl","teamsEnabled","canUseTeams","teams","abstraction","implementation","dependencies"],"sources":["IdentityContext.ts"],"sourcesContent":["import { AsyncLocalStorage } from \"async_hooks\";\nimport minimatch from \"minimatch\";\nimport { createImplementation } from \"@webiny/di\";\nimport { IdentityContext as Abstraction } from \"./abstractions.js\";\nimport { Identity } from \"./Identity.js\";\nimport { AnonymousIdentity } from \"./AnonymousIdentity.js\";\nimport { AuthorizationContext } from \"../authorization/AuthorizationContext/index.js\";\nimport { filterOutCustomWbyAppsPermissions } from \"../utils/filterOutCustomWbyAppsPermissions.js\";\nimport type { SecurityPermission } from \"~/types/security.js\";\nimport type { AaclPermission } from \"../../wcp/WcpContext/types.js\";\nimport { WcpContext } from \"../../wcp/WcpContext/index.js\";\n\nconst identityStorage = new AsyncLocalStorage<Identity | undefined>();\n\nclass IdentityContextImpl implements Abstraction.Interface {\n    private identity: Identity = new AnonymousIdentity();\n\n    constructor(\n        private authorizationContext: AuthorizationContext.Interface,\n        private wcpContext: WcpContext.Interface\n    ) {}\n\n    // ========================================================================\n    // Identity Methods\n    // ========================================================================\n\n    getIdentity(): Identity {\n        // Check for identity override first (from withIdentity())\n        const override = identityStorage.getStore();\n        if (override !== undefined) {\n            return override;\n        }\n        return this.identity;\n    }\n\n    setIdentity(identity: Identity | undefined): void {\n        // If undefined, set to anonymous identity\n        this.identity = identity ?? new AnonymousIdentity();\n\n        // Clear permissions cache when identity changes\n        this.authorizationContext.clearPermissionsCache();\n    }\n\n    withIdentity<T>(identity: Identity | undefined, cb: () => Promise<T>): Promise<T> {\n        return identityStorage.run(identity, cb);\n    }\n\n    // ========================================================================\n    // Authorization State Methods\n    // ========================================================================\n\n    withoutAuthorization<T>(cb: () => Promise<T>): Promise<T> {\n        return this.authorizationContext.withoutAuthorization(cb);\n    }\n\n    isAuthorizationEnabled(): boolean {\n        return this.authorizationContext.isAuthorizationEnabled();\n    }\n\n    // ========================================================================\n    // Permission Methods\n    // ========================================================================\n\n    async getPermission<TPermission extends SecurityPermission = SecurityPermission>(\n        name: string\n    ): Promise<TPermission | null> {\n        if (!this.isAuthorizationEnabled()) {\n            return { name: \"*\" } as TPermission;\n        }\n\n        const permissions = await this.listPermissions();\n\n        // Try exact match first\n        const exactMatch = permissions.find(p => p.name === name);\n        if (exactMatch) {\n            return exactMatch as TPermission;\n        }\n\n        // Try pattern matching\n        const patternMatch = permissions.find(p => minimatch(name, p.name));\n        if (patternMatch) {\n            return patternMatch as TPermission;\n        }\n\n        return null;\n    }\n\n    async getPermissions<TPermission extends SecurityPermission = SecurityPermission>(\n        name: string\n    ): Promise<TPermission[]> {\n        if (!this.isAuthorizationEnabled()) {\n            return [{ name: \"*\" }] as TPermission[];\n        }\n\n        const permissions = await this.listPermissions();\n\n        return permissions.filter(p => {\n            if (p.name === name) {\n                return true;\n            }\n            return minimatch(name, p.name);\n        }) as TPermission[];\n    }\n\n    async listPermissions(): Promise<SecurityPermission[]> {\n        const permissions = await this.authorizationContext.loadPermissions(this.getIdentity());\n        // TODO: extract this into a decorator\n        return this.applyAaclLogic(permissions);\n    }\n\n    async hasFullAccess(): Promise<boolean> {\n        const permissions = await this.listPermissions();\n        return permissions.some(p => p.name === \"*\");\n    }\n\n    // ========================================================================\n    // Private Helper Methods\n    // ========================================================================\n\n    private applyAaclLogic(permissions: SecurityPermission[]): SecurityPermission[] {\n        const aaclEnabled = this.wcpContext.canUseAacl();\n        const teamsEnabled = this.wcpContext.canUseTeams();\n\n        if (aaclEnabled) {\n            // Add AACL metadata permission\n            return [\n                ...permissions,\n                {\n                    name: \"aacl\",\n                    teams: teamsEnabled\n                } as AaclPermission\n            ];\n        }\n\n        // If AACL is not enabled, filter out custom Webiny apps permissions\n        return filterOutCustomWbyAppsPermissions(permissions);\n    }\n}\n\nexport const IdentityContext = createImplementation({\n    abstraction: Abstraction,\n    implementation: IdentityContextImpl,\n    dependencies: [AuthorizationContext, WcpContext]\n});\n"],"mappings":"AAAA,SAASA,iBAAiB,QAAQ,aAAa;AAC/C,OAAOC,SAAS,MAAM,WAAW;AACjC,SAASC,oBAAoB,QAAQ,YAAY;AACjD,SAASC,eAAe,IAAIC,WAAW;AAEvC,SAASC,iBAAiB;AAC1B,SAASC,oBAAoB;AAC7B,SAASC,iCAAiC;AAG1C,SAASC,UAAU;AAEnB,MAAMC,eAAe,GAAG,IAAIT,iBAAiB,CAAuB,CAAC;AAErE,MAAMU,mBAAmB,CAAkC;EAC/CC,QAAQ,GAAa,IAAIN,iBAAiB,CAAC,CAAC;EAEpDO,WAAWA,CACCC,oBAAoD,EACpDC,UAAgC,EAC1C;IAAA,KAFUD,oBAAoD,GAApDA,oBAAoD;IAAA,KACpDC,UAAgC,GAAhCA,UAAgC;EACzC;;EAEH;EACA;EACA;;EAEAC,WAAWA,CAAA,EAAa;IACpB;IACA,MAAMC,QAAQ,GAAGP,eAAe,CAACQ,QAAQ,CAAC,CAAC;IAC3C,IAAID,QAAQ,KAAKE,SAAS,EAAE;MACxB,OAAOF,QAAQ;IACnB;IACA,OAAO,IAAI,CAACL,QAAQ;EACxB;EAEAQ,WAAWA,CAACR,QAA8B,EAAQ;IAC9C;IACA,IAAI,CAACA,QAAQ,GAAGA,QAAQ,IAAI,IAAIN,iBAAiB,CAAC,CAAC;;IAEnD;IACA,IAAI,CAACQ,oBAAoB,CAACO,qBAAqB,CAAC,CAAC;EACrD;EAEAC,YAAYA,CAAIV,QAA8B,EAAEW,EAAoB,EAAc;IAC9E,OAAOb,eAAe,CAACc,GAAG,CAACZ,QAAQ,EAAEW,EAAE,CAAC;EAC5C;;EAEA;EACA;EACA;;EAEAE,oBAAoBA,CAAIF,EAAoB,EAAc;IACtD,OAAO,IAAI,CAACT,oBAAoB,CAACW,oBAAoB,CAACF,EAAE,CAAC;EAC7D;EAEAG,sBAAsBA,CAAA,EAAY;IAC9B,OAAO,IAAI,CAACZ,oBAAoB,CAACY,sBAAsB,CAAC,CAAC;EAC7D;;EAEA;EACA;EACA;;EAEA,MAAMC,aAAaA,CACfC,IAAY,EACe;IAC3B,IAAI,CAAC,IAAI,CAACF,sBAAsB,CAAC,CAAC,EAAE;MAChC,OAAO;QAAEE,IAAI,EAAE;MAAI,CAAC;IACxB;IAEA,MAAMC,WAAW,GAAG,MAAM,IAAI,CAACC,eAAe,CAAC,CAAC;;IAEhD;IACA,MAAMC,UAAU,GAAGF,WAAW,CAACG,IAAI,CAACC,CAAC,IAAIA,CAAC,CAACL,IAAI,KAAKA,IAAI,CAAC;IACzD,IAAIG,UAAU,EAAE;MACZ,OAAOA,UAAU;IACrB;;IAEA;IACA,MAAMG,YAAY,GAAGL,WAAW,CAACG,IAAI,CAACC,CAAC,IAAI/B,SAAS,CAAC0B,IAAI,EAAEK,CAAC,CAACL,IAAI,CAAC,CAAC;IACnE,IAAIM,YAAY,EAAE;MACd,OAAOA,YAAY;IACvB;IAEA,OAAO,IAAI;EACf;EAEA,MAAMC,cAAcA,CAChBP,IAAY,EACU;IACtB,IAAI,CAAC,IAAI,CAACF,sBAAsB,CAAC,CAAC,EAAE;MAChC,OAAO,CAAC;QAAEE,IAAI,EAAE;MAAI,CAAC,CAAC;IAC1B;IAEA,MAAMC,WAAW,GAAG,MAAM,IAAI,CAACC,eAAe,CAAC,CAAC;IAEhD,OAAOD,WAAW,CAACO,MAAM,CAACH,CAAC,IAAI;MAC3B,IAAIA,CAAC,CAACL,IAAI,KAAKA,IAAI,EAAE;QACjB,OAAO,IAAI;MACf;MACA,OAAO1B,SAAS,CAAC0B,IAAI,EAAEK,CAAC,CAACL,IAAI,CAAC;IAClC,CAAC,CAAC;EACN;EAEA,MAAME,eAAeA,CAAA,EAAkC;IACnD,MAAMD,WAAW,GAAG,MAAM,IAAI,CAACf,oBAAoB,CAACuB,eAAe,CAAC,IAAI,CAACrB,WAAW,CAAC,CAAC,CAAC;IACvF;IACA,OAAO,IAAI,CAACsB,cAAc,CAACT,WAAW,CAAC;EAC3C;EAEA,MAAMU,aAAaA,CAAA,EAAqB;IACpC,MAAMV,WAAW,GAAG,MAAM,IAAI,CAACC,eAAe,CAAC,CAAC;IAChD,OAAOD,WAAW,CAACW,IAAI,CAACP,CAAC,IAAIA,CAAC,CAACL,IAAI,KAAK,GAAG,CAAC;EAChD;;EAEA;EACA;EACA;;EAEQU,cAAcA,CAACT,WAAiC,EAAwB;IAC5E,MAAMY,WAAW,GAAG,IAAI,CAAC1B,UAAU,CAAC2B,UAAU,CAAC,CAAC;IAChD,MAAMC,YAAY,GAAG,IAAI,CAAC5B,UAAU,CAAC6B,WAAW,CAAC,CAAC;IAElD,IAAIH,WAAW,EAAE;MACb;MACA,OAAO,CACH,GAAGZ,WAAW,EACd;QACID,IAAI,EAAE,MAAM;QACZiB,KAAK,EAAEF;MACX,CAAC,CACJ;IACL;;IAEA;IACA,OAAOnC,iCAAiC,CAACqB,WAAW,CAAC;EACzD;AACJ;AAEA,OAAO,MAAMzB,eAAe,GAAGD,oBAAoB,CAAC;EAChD2C,WAAW,EAAEzC,WAAW;EACxB0C,cAAc,EAAEpC,mBAAmB;EACnCqC,YAAY,EAAE,CAACzC,oBAAoB,EAAEE,UAAU;AACnD,CAAC,CAAC","ignoreList":[]}
+{"version":3,"names":["AsyncLocalStorage","minimatch","createImplementation","IdentityContext","Abstraction","AnonymousIdentity","AuthorizationContext","filterOutCustomWbyAppsPermissions","WcpContext","identityStorage","IdentityContextImpl","identity","constructor","authorizationContext","wcpContext","getIdentity","override","getStore","undefined","setIdentity","clearPermissionsCache","withIdentity","cb","run","withoutAuthorization","isAuthorizationEnabled","getPermission","name","permissions","listPermissions","exactMatch","find","p","patternMatch","getPermissions","filter","loadPermissions","applyAaclLogic","hasFullAccess","some","aaclEnabled","canUseAacl","teamsEnabled","canUseTeams","teams","abstraction","implementation","dependencies"],"sources":["IdentityContext.ts"],"sourcesContent":["import { AsyncLocalStorage } from \"async_hooks\";\nimport { minimatch } from \"minimatch\";\nimport { createImplementation } from \"@webiny/di\";\nimport { IdentityContext as Abstraction } from \"./abstractions.js\";\nimport { Identity } from \"./Identity.js\";\nimport { AnonymousIdentity } from \"./AnonymousIdentity.js\";\nimport { AuthorizationContext } from \"../authorization/AuthorizationContext/index.js\";\nimport { filterOutCustomWbyAppsPermissions } from \"../utils/filterOutCustomWbyAppsPermissions.js\";\nimport type { SecurityPermission } from \"~/types/security.js\";\nimport type { AaclPermission } from \"../../wcp/WcpContext/types.js\";\nimport { WcpContext } from \"../../wcp/WcpContext/index.js\";\n\nconst identityStorage = new AsyncLocalStorage<Identity | undefined>();\n\nclass IdentityContextImpl implements Abstraction.Interface {\n    private identity: Identity = new AnonymousIdentity();\n\n    constructor(\n        private authorizationContext: AuthorizationContext.Interface,\n        private wcpContext: WcpContext.Interface\n    ) {}\n\n    // ========================================================================\n    // Identity Methods\n    // ========================================================================\n\n    getIdentity(): Identity {\n        // Check for identity override first (from withIdentity())\n        const override = identityStorage.getStore();\n        if (override !== undefined) {\n            return override;\n        }\n        return this.identity;\n    }\n\n    setIdentity(identity: Identity | undefined): void {\n        // If undefined, set to anonymous identity\n        this.identity = identity ?? new AnonymousIdentity();\n\n        // Clear permissions cache when identity changes\n        this.authorizationContext.clearPermissionsCache();\n    }\n\n    withIdentity<T>(identity: Identity | undefined, cb: () => Promise<T>): Promise<T> {\n        return identityStorage.run(identity, cb);\n    }\n\n    // ========================================================================\n    // Authorization State Methods\n    // ========================================================================\n\n    withoutAuthorization<T>(cb: () => Promise<T>): Promise<T> {\n        return this.authorizationContext.withoutAuthorization(cb);\n    }\n\n    isAuthorizationEnabled(): boolean {\n        return this.authorizationContext.isAuthorizationEnabled();\n    }\n\n    // ========================================================================\n    // Permission Methods\n    // ========================================================================\n\n    async getPermission<TPermission extends SecurityPermission = SecurityPermission>(\n        name: string\n    ): Promise<TPermission | null> {\n        if (!this.isAuthorizationEnabled()) {\n            return { name: \"*\" } as TPermission;\n        }\n\n        const permissions = await this.listPermissions();\n\n        // Try exact match first\n        const exactMatch = permissions.find(p => p.name === name);\n        if (exactMatch) {\n            return exactMatch as TPermission;\n        }\n\n        // Try pattern matching\n        const patternMatch = permissions.find(p => minimatch(name, p.name));\n        if (patternMatch) {\n            return patternMatch as TPermission;\n        }\n\n        return null;\n    }\n\n    async getPermissions<TPermission extends SecurityPermission = SecurityPermission>(\n        name: string\n    ): Promise<TPermission[]> {\n        if (!this.isAuthorizationEnabled()) {\n            return [{ name: \"*\" }] as TPermission[];\n        }\n\n        const permissions = await this.listPermissions();\n\n        return permissions.filter(p => {\n            if (p.name === name) {\n                return true;\n            }\n            return minimatch(name, p.name);\n        }) as TPermission[];\n    }\n\n    async listPermissions(): Promise<SecurityPermission[]> {\n        const permissions = await this.authorizationContext.loadPermissions(this.getIdentity());\n        // TODO: extract this into a decorator\n        return this.applyAaclLogic(permissions);\n    }\n\n    async hasFullAccess(): Promise<boolean> {\n        const permissions = await this.listPermissions();\n        return permissions.some(p => p.name === \"*\");\n    }\n\n    // ========================================================================\n    // Private Helper Methods\n    // ========================================================================\n\n    private applyAaclLogic(permissions: SecurityPermission[]): SecurityPermission[] {\n        const aaclEnabled = this.wcpContext.canUseAacl();\n        const teamsEnabled = this.wcpContext.canUseTeams();\n\n        if (aaclEnabled) {\n            // Add AACL metadata permission\n            return [\n                ...permissions,\n                {\n                    name: \"aacl\",\n                    teams: teamsEnabled\n                } as AaclPermission\n            ];\n        }\n\n        // If AACL is not enabled, filter out custom Webiny apps permissions\n        return filterOutCustomWbyAppsPermissions(permissions);\n    }\n}\n\nexport const IdentityContext = createImplementation({\n    abstraction: Abstraction,\n    implementation: IdentityContextImpl,\n    dependencies: [AuthorizationContext, WcpContext]\n});\n"],"mappings":"AAAA,SAASA,iBAAiB,QAAQ,aAAa;AAC/C,SAASC,SAAS,QAAQ,WAAW;AACrC,SAASC,oBAAoB,QAAQ,YAAY;AACjD,SAASC,eAAe,IAAIC,WAAW;AAEvC,SAASC,iBAAiB;AAC1B,SAASC,oBAAoB;AAC7B,SAASC,iCAAiC;AAG1C,SAASC,UAAU;AAEnB,MAAMC,eAAe,GAAG,IAAIT,iBAAiB,CAAuB,CAAC;AAErE,MAAMU,mBAAmB,CAAkC;EAC/CC,QAAQ,GAAa,IAAIN,iBAAiB,CAAC,CAAC;EAEpDO,WAAWA,CACCC,oBAAoD,EACpDC,UAAgC,EAC1C;IAAA,KAFUD,oBAAoD,GAApDA,oBAAoD;IAAA,KACpDC,UAAgC,GAAhCA,UAAgC;EACzC;;EAEH;EACA;EACA;;EAEAC,WAAWA,CAAA,EAAa;IACpB;IACA,MAAMC,QAAQ,GAAGP,eAAe,CAACQ,QAAQ,CAAC,CAAC;IAC3C,IAAID,QAAQ,KAAKE,SAAS,EAAE;MACxB,OAAOF,QAAQ;IACnB;IACA,OAAO,IAAI,CAACL,QAAQ;EACxB;EAEAQ,WAAWA,CAACR,QAA8B,EAAQ;IAC9C;IACA,IAAI,CAACA,QAAQ,GAAGA,QAAQ,IAAI,IAAIN,iBAAiB,CAAC,CAAC;;IAEnD;IACA,IAAI,CAACQ,oBAAoB,CAACO,qBAAqB,CAAC,CAAC;EACrD;EAEAC,YAAYA,CAAIV,QAA8B,EAAEW,EAAoB,EAAc;IAC9E,OAAOb,eAAe,CAACc,GAAG,CAACZ,QAAQ,EAAEW,EAAE,CAAC;EAC5C;;EAEA;EACA;EACA;;EAEAE,oBAAoBA,CAAIF,EAAoB,EAAc;IACtD,OAAO,IAAI,CAACT,oBAAoB,CAACW,oBAAoB,CAACF,EAAE,CAAC;EAC7D;EAEAG,sBAAsBA,CAAA,EAAY;IAC9B,OAAO,IAAI,CAACZ,oBAAoB,CAACY,sBAAsB,CAAC,CAAC;EAC7D;;EAEA;EACA;EACA;;EAEA,MAAMC,aAAaA,CACfC,IAAY,EACe;IAC3B,IAAI,CAAC,IAAI,CAACF,sBAAsB,CAAC,CAAC,EAAE;MAChC,OAAO;QAAEE,IAAI,EAAE;MAAI,CAAC;IACxB;IAEA,MAAMC,WAAW,GAAG,MAAM,IAAI,CAACC,eAAe,CAAC,CAAC;;IAEhD;IACA,MAAMC,UAAU,GAAGF,WAAW,CAACG,IAAI,CAACC,CAAC,IAAIA,CAAC,CAACL,IAAI,KAAKA,IAAI,CAAC;IACzD,IAAIG,UAAU,EAAE;MACZ,OAAOA,UAAU;IACrB;;IAEA;IACA,MAAMG,YAAY,GAAGL,WAAW,CAACG,IAAI,CAACC,CAAC,IAAI/B,SAAS,CAAC0B,IAAI,EAAEK,CAAC,CAACL,IAAI,CAAC,CAAC;IACnE,IAAIM,YAAY,EAAE;MACd,OAAOA,YAAY;IACvB;IAEA,OAAO,IAAI;EACf;EAEA,MAAMC,cAAcA,CAChBP,IAAY,EACU;IACtB,IAAI,CAAC,IAAI,CAACF,sBAAsB,CAAC,CAAC,EAAE;MAChC,OAAO,CAAC;QAAEE,IAAI,EAAE;MAAI,CAAC,CAAC;IAC1B;IAEA,MAAMC,WAAW,GAAG,MAAM,IAAI,CAACC,eAAe,CAAC,CAAC;IAEhD,OAAOD,WAAW,CAACO,MAAM,CAACH,CAAC,IAAI;MAC3B,IAAIA,CAAC,CAACL,IAAI,KAAKA,IAAI,EAAE;QACjB,OAAO,IAAI;MACf;MACA,OAAO1B,SAAS,CAAC0B,IAAI,EAAEK,CAAC,CAACL,IAAI,CAAC;IAClC,CAAC,CAAC;EACN;EAEA,MAAME,eAAeA,CAAA,EAAkC;IACnD,MAAMD,WAAW,GAAG,MAAM,IAAI,CAACf,oBAAoB,CAACuB,eAAe,CAAC,IAAI,CAACrB,WAAW,CAAC,CAAC,CAAC;IACvF;IACA,OAAO,IAAI,CAACsB,cAAc,CAACT,WAAW,CAAC;EAC3C;EAEA,MAAMU,aAAaA,CAAA,EAAqB;IACpC,MAAMV,WAAW,GAAG,MAAM,IAAI,CAACC,eAAe,CAAC,CAAC;IAChD,OAAOD,WAAW,CAACW,IAAI,CAACP,CAAC,IAAIA,CAAC,CAACL,IAAI,KAAK,GAAG,CAAC;EAChD;;EAEA;EACA;EACA;;EAEQU,cAAcA,CAACT,WAAiC,EAAwB;IAC5E,MAAMY,WAAW,GAAG,IAAI,CAAC1B,UAAU,CAAC2B,UAAU,CAAC,CAAC;IAChD,MAAMC,YAAY,GAAG,IAAI,CAAC5B,UAAU,CAAC6B,WAAW,CAAC,CAAC;IAElD,IAAIH,WAAW,EAAE;MACb;MACA,OAAO,CACH,GAAGZ,WAAW,EACd;QACID,IAAI,EAAE,MAAM;QACZiB,KAAK,EAAEF;MACX,CAAC,CACJ;IACL;;IAEA;IACA,OAAOnC,iCAAiC,CAACqB,WAAW,CAAC;EACzD;AACJ;AAEA,OAAO,MAAMzB,eAAe,GAAGD,oBAAoB,CAAC;EAChD2C,WAAW,EAAEzC,WAAW;EACxB0C,cAAc,EAAEpC,mBAAmB;EACnCqC,YAAY,EAAE,CAACzC,oBAAoB,EAAEE,UAAU;AACnD,CAAC,CAAC","ignoreList":[]}

package/features/security/permissions/createPermissions.d.ts

@@ -0,0 +1,8 @@
+import type { PermissionSchemaConfig } from "./types.js";
+import type { Permissions } from "./types.js";
+export declare function createPermissions<const S extends PermissionSchemaConfig>(schema: S): {
+    Abstraction: import("@webiny/di").Abstraction<Permissions<S>>;
+    Implementation: import("@webiny/di").Constructor<Permissions<S>> & {
+        __abstraction: import("@webiny/di").Abstraction<Permissions<S>>;
+    };
+};

package/features/security/permissions/createPermissions.js

@@ -0,0 +1,240 @@
+import { createAbstraction } from "@webiny/feature/api";
+import { IdentityContext } from "../IdentityContext/index.js";
+function buildEntityMap(schema) {
+  const map = new Map();
+  for (const entity of schema.entities ?? []) {
+    const actions = new Set();
+    for (const action of entity.actions ?? []) {
+      actions.add(action.name);
+    }
+    map.set(entity.id, {
+      permission: entity.permission,
+      actions,
+      hasOwn: entity.scopes.includes("own")
+    });
+  }
+  return map;
+}
+function getEntity(entityMap, entityId) {
+  const entity = entityMap.get(entityId);
+  if (!entity) {
+    throw new Error(`Unknown entity "${entityId}" in permission schema.`);
+  }
+  return entity;
+}
+export function createPermissions(schema) {
+  const entityMap = buildEntityMap(schema);
+  const fullAccessName = `${schema.prefix}.*`;
+  class SchemaPermissions {
+    constructor(identityContext) {
+      this.identityContext = identityContext;
+    }
+    async canAccess(entityId, item) {
+      if (await this.identityContext.hasFullAccess()) {
+        return true;
+      }
+      if (await this.hasFullSchemaAccess()) {
+        return true;
+      }
+      const entity = getEntity(entityMap, entityId);
+      const permissions = await this.getEntityPermissions(entity.permission);
+      if (!permissions.length) {
+        return false;
+      }
+      // No item — just check entity-level access.
+      if (item === undefined) {
+        return true;
+      }
+      // Item provided — if all permissions require own, verify ownership.
+      const ownOnly = !permissions.some(p => !p.own);
+      if (!ownOnly) {
+        return true;
+      }
+      const identity = this.identityContext.getIdentity();
+      return item.createdBy?.id === identity.id;
+    }
+    async onlyOwnRecords(entityId) {
+      if (await this.identityContext.hasFullAccess()) {
+        return false;
+      }
+      if (await this.hasFullSchemaAccess()) {
+        return false;
+      }
+      const entity = getEntity(entityMap, entityId);
+      const permissions = await this.getEntityPermissions(entity.permission);
+      if (!permissions.length) {
+        return false;
+      }
+      return !permissions.some(p => !p.own);
+    }
+    async canRead(entityId) {
+      if (await this.identityContext.hasFullAccess()) {
+        return true;
+      }
+      if (await this.hasFullSchemaAccess()) {
+        return true;
+      }
+      const entity = getEntity(entityMap, entityId);
+      const permissions = await this.getEntityPermissions(entity.permission);
+      if (!permissions.length) {
+        return false;
+      }
+      return permissions.some(permission => {
+        if (typeof permission.rwd !== "string") {
+          return true;
+        }
+        return permission.rwd.includes("r");
+      });
+    }
+    async canCreate(entityId) {
+      if (await this.identityContext.hasFullAccess()) {
+        return true;
+      }
+      if (await this.hasFullSchemaAccess()) {
+        return true;
+      }
+      const entity = getEntity(entityMap, entityId);
+      const permissions = await this.getEntityPermissions(entity.permission);
+      if (!permissions.length) {
+        return false;
+      }
+      return permissions.some(permission => {
+        if (typeof permission.rwd !== "string") {
+          return true;
+        }
+        return permission.rwd.includes("w");
+      });
+    }
+    async canEdit(entityId, item) {
+      if (await this.identityContext.hasFullAccess()) {
+        return true;
+      }
+      if (await this.hasFullSchemaAccess()) {
+        return true;
+      }
+      const entity = getEntity(entityMap, entityId);
+      const permissions = await this.getEntityPermissions(entity.permission);
+      if (!permissions.length) {
+        return false;
+      }
+      const identity = this.identityContext.getIdentity();
+      return permissions.some(permission => {
+        if (permission.own) {
+          // No item provided (new/unsaved) — allow access.
+          if (!item?.createdBy) {
+            return true;
+          }
+          return item.createdBy.id === identity.id;
+        }
+        if (typeof permission.rwd !== "string") {
+          return true;
+        }
+        return permission.rwd.includes("w");
+      });
+    }
+    async canDelete(entityId, item) {
+      if (await this.identityContext.hasFullAccess()) {
+        return true;
+      }
+      if (await this.hasFullSchemaAccess()) {
+        return true;
+      }
+      const entity = getEntity(entityMap, entityId);
+      const permissions = await this.getEntityPermissions(entity.permission);
+      if (!permissions.length) {
+        return false;
+      }
+      const identity = this.identityContext.getIdentity();
+      return permissions.some(permission => {
+        if (permission.own) {
+          return item?.createdBy?.id === identity.id;
+        }
+        if (typeof permission.rwd !== "string") {
+          return true;
+        }
+        return permission.rwd.includes("d");
+      });
+    }
+    async canPublish(entityId) {
+      if (await this.identityContext.hasFullAccess()) {
+        return true;
+      }
+      if (await this.hasFullSchemaAccess()) {
+        return true;
+      }
+      const entity = getEntity(entityMap, entityId);
+      const permissions = await this.getEntityPermissions(entity.permission);
+      if (!permissions.length) {
+        return false;
+      }
+      return permissions.some(permission => {
+        return permission.pw?.includes("p");
+      });
+    }
+    async canUnpublish(entityId) {
+      if (await this.identityContext.hasFullAccess()) {
+        return true;
+      }
+      if (await this.hasFullSchemaAccess()) {
+        return true;
+      }
+      const entity = getEntity(entityMap, entityId);
+      const permissions = await this.getEntityPermissions(entity.permission);
+      if (!permissions.length) {
+        return false;
+      }
+      return permissions.some(permission => {
+        return permission.pw?.includes("u");
+      });
+    }
+    async canAction(action, entityId) {
+      if (await this.identityContext.hasFullAccess()) {
+        return true;
+      }
+      if (await this.hasFullSchemaAccess()) {
+        return true;
+      }
+      const entity = getEntity(entityMap, entityId);
+      const permissions = await this.getEntityPermissions(entity.permission);
+      if (!permissions.length) {
+        return false;
+      }
+      return permissions.some(permission => {
+        return permission[action] === true;
+      });
+    }
+    async getEntityPermissions(entityPermission) {
+      const permissions = await this.identityContext.getPermissions(entityPermission);
+      if (permissions.length) {
+        return permissions;
+      }
+      // Fall back to the schema wildcard (e.g. "test.*") — its flags apply to all entities.
+      const wildcard = await this.identityContext.getPermission(fullAccessName);
+      return wildcard ? [wildcard] : [];
+    }
+    async hasFullSchemaAccess() {
+      const permission = await this.identityContext.getPermission(fullAccessName);
+      if (!permission) {
+        return false;
+      }
+      // Only treat as full access if the permission has no `rwd` flag.
+      // A permission like { name: "wb.*", rwd: "r" } should NOT grant full access.
+      const keys = Object.keys(permission).filter(k => k !== "name");
+      const hasRwd = keys.includes("rwd");
+
+      // It's full-access only if there's no `rwd` flag.
+      return !hasRwd;
+    }
+  }
+  const Abstraction = createAbstraction(`${schema.prefix}:Permissions`);
+  const Implementation = Abstraction.createImplementation({
+    implementation: SchemaPermissions,
+    dependencies: [IdentityContext]
+  });
+  return {
+    Abstraction,
+    Implementation
+  };
+}
+
+//# sourceMappingURL=createPermissions.js.map

package/features/security/permissions/createPermissions.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createAbstraction","IdentityContext","buildEntityMap","schema","map","Map","entity","entities","actions","Set","action","add","name","set","id","permission","hasOwn","scopes","includes","getEntity","entityMap","entityId","get","Error","createPermissions","fullAccessName","prefix","SchemaPermissions","constructor","identityContext","canAccess","item","hasFullAccess","hasFullSchemaAccess","permissions","getEntityPermissions","length","undefined","ownOnly","some","p","own","identity","getIdentity","createdBy","onlyOwnRecords","canRead","rwd","canCreate","canEdit","canDelete","canPublish","pw","canUnpublish","canAction","entityPermission","getPermissions","wildcard","getPermission","keys","Object","filter","k","hasRwd","Abstraction","Implementation","createImplementation","implementation","dependencies"],"sources":["createPermissions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport { IdentityContext } from \"~/features/security/IdentityContext/index.js\";\nimport type { PermissionSchemaConfig } from \"./types.js\";\nimport type { OwnableItem } from \"./types.js\";\nimport type { Permissions } from \"./types.js\";\n\ninterface EntityLookup {\n    permission: string;\n    actions: Set<string>;\n    hasOwn: boolean;\n}\n\nfunction buildEntityMap(schema: PermissionSchemaConfig): Map<string, EntityLookup> {\n    const map = new Map<string, EntityLookup>();\n    for (const entity of schema.entities ?? []) {\n        const actions = new Set<string>();\n        for (const action of entity.actions ?? []) {\n            actions.add(action.name);\n        }\n        map.set(entity.id, {\n            permission: entity.permission,\n            actions,\n            hasOwn: entity.scopes.includes(\"own\")\n        });\n    }\n    return map;\n}\n\nfunction getEntity(entityMap: Map<string, EntityLookup>, entityId: string): EntityLookup {\n    const entity = entityMap.get(entityId);\n    if (!entity) {\n        throw new Error(`Unknown entity \"${entityId}\" in permission schema.`);\n    }\n    return entity;\n}\n\nexport function createPermissions<const S extends PermissionSchemaConfig>(schema: S) {\n    const entityMap = buildEntityMap(schema);\n    const fullAccessName = `${schema.prefix}.*`;\n\n    class SchemaPermissions {\n        constructor(private identityContext: IdentityContext.Interface) {}\n\n        async canAccess(entityId: string, item?: OwnableItem): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            // No item — just check entity-level access.\n            if (item === undefined) {\n                return true;\n            }\n            // Item provided — if all permissions require own, verify ownership.\n            const ownOnly = !permissions.some(p => !p.own);\n            if (!ownOnly) {\n                return true;\n            }\n            const identity = this.identityContext.getIdentity();\n            return item.createdBy?.id === identity.id;\n        }\n\n        async onlyOwnRecords(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return false;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return false;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return !permissions.some(p => !p.own);\n        }\n\n        async canRead(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                if (typeof permission.rwd !== \"string\") {\n                    return true;\n                }\n                return permission.rwd.includes(\"r\");\n            });\n        }\n\n        async canCreate(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                if (typeof permission.rwd !== \"string\") {\n                    return true;\n                }\n                return permission.rwd.includes(\"w\");\n            });\n        }\n\n        async canEdit(entityId: string, item?: OwnableItem): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            const identity = this.identityContext.getIdentity();\n            return permissions.some(permission => {\n                if (permission.own) {\n                    // No item provided (new/unsaved) — allow access.\n                    if (!item?.createdBy) {\n                        return true;\n                    }\n                    return item.createdBy.id === identity.id;\n                }\n                if (typeof permission.rwd !== \"string\") {\n                    return true;\n                }\n                return permission.rwd.includes(\"w\");\n            });\n        }\n\n        async canDelete(entityId: string, item?: OwnableItem): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            const identity = this.identityContext.getIdentity();\n            return permissions.some(permission => {\n                if (permission.own) {\n                    return item?.createdBy?.id === identity.id;\n                }\n                if (typeof permission.rwd !== \"string\") {\n                    return true;\n                }\n                return permission.rwd.includes(\"d\");\n            });\n        }\n\n        async canPublish(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                return permission.pw?.includes(\"p\");\n            });\n        }\n\n        async canUnpublish(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                return permission.pw?.includes(\"u\");\n            });\n        }\n\n        async canAction(action: string, entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                return permission[action] === true;\n            });\n        }\n\n        private async getEntityPermissions(entityPermission: string): Promise<any[]> {\n            const permissions = await this.identityContext.getPermissions(entityPermission);\n            if (permissions.length) {\n                return permissions;\n            }\n            // Fall back to the schema wildcard (e.g. \"test.*\") — its flags apply to all entities.\n            const wildcard = await this.identityContext.getPermission(fullAccessName);\n            return wildcard ? [wildcard] : [];\n        }\n\n        private async hasFullSchemaAccess(): Promise<boolean> {\n            const permission = await this.identityContext.getPermission(fullAccessName);\n            if (!permission) {\n                return false;\n            }\n            // Only treat as full access if the permission has no `rwd` flag.\n            // A permission like { name: \"wb.*\", rwd: \"r\" } should NOT grant full access.\n            const keys = Object.keys(permission).filter(k => k !== \"name\");\n\n            const hasRwd = keys.includes(\"rwd\");\n\n            // It's full-access only if there's no `rwd` flag.\n            return !hasRwd;\n        }\n    }\n\n    const Abstraction = createAbstraction<Permissions<S>>(`${schema.prefix}:Permissions`);\n\n    const Implementation = Abstraction.createImplementation({\n        implementation: SchemaPermissions,\n        dependencies: [IdentityContext]\n    } as any);\n\n    return { Abstraction, Implementation };\n}\n"],"mappings":"AAAA,SAASA,iBAAiB,QAAQ,qBAAqB;AACvD,SAASC,eAAe;AAWxB,SAASC,cAAcA,CAACC,MAA8B,EAA6B;EAC/E,MAAMC,GAAG,GAAG,IAAIC,GAAG,CAAuB,CAAC;EAC3C,KAAK,MAAMC,MAAM,IAAIH,MAAM,CAACI,QAAQ,IAAI,EAAE,EAAE;IACxC,MAAMC,OAAO,GAAG,IAAIC,GAAG,CAAS,CAAC;IACjC,KAAK,MAAMC,MAAM,IAAIJ,MAAM,CAACE,OAAO,IAAI,EAAE,EAAE;MACvCA,OAAO,CAACG,GAAG,CAACD,MAAM,CAACE,IAAI,CAAC;IAC5B;IACAR,GAAG,CAACS,GAAG,CAACP,MAAM,CAACQ,EAAE,EAAE;MACfC,UAAU,EAAET,MAAM,CAACS,UAAU;MAC7BP,OAAO;MACPQ,MAAM,EAAEV,MAAM,CAACW,MAAM,CAACC,QAAQ,CAAC,KAAK;IACxC,CAAC,CAAC;EACN;EACA,OAAOd,GAAG;AACd;AAEA,SAASe,SAASA,CAACC,SAAoC,EAAEC,QAAgB,EAAgB;EACrF,MAAMf,MAAM,GAAGc,SAAS,CAACE,GAAG,CAACD,QAAQ,CAAC;EACtC,IAAI,CAACf,MAAM,EAAE;IACT,MAAM,IAAIiB,KAAK,CAAC,mBAAmBF,QAAQ,yBAAyB,CAAC;EACzE;EACA,OAAOf,MAAM;AACjB;AAEA,OAAO,SAASkB,iBAAiBA,CAAyCrB,MAAS,EAAE;EACjF,MAAMiB,SAAS,GAAGlB,cAAc,CAACC,MAAM,CAAC;EACxC,MAAMsB,cAAc,GAAG,GAAGtB,MAAM,CAACuB,MAAM,IAAI;EAE3C,MAAMC,iBAAiB,CAAC;IACpBC,WAAWA,CAASC,eAA0C,EAAE;MAAA,KAA5CA,eAA0C,GAA1CA,eAA0C;IAAG;IAEjE,MAAMC,SAASA,CAACT,QAAgB,EAAEU,IAAkB,EAAoB;MACpE,IAAI,MAAM,IAAI,CAACF,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA;MACA,IAAIL,IAAI,KAAKM,SAAS,EAAE;QACpB,OAAO,IAAI;MACf;MACA;MACA,MAAMC,OAAO,GAAG,CAACJ,WAAW,CAACK,IAAI,CAACC,CAAC,IAAI,CAACA,CAAC,CAACC,GAAG,CAAC;MAC9C,IAAI,CAACH,OAAO,EAAE;QACV,OAAO,IAAI;MACf;MACA,MAAMI,QAAQ,GAAG,IAAI,CAACb,eAAe,CAACc,WAAW,CAAC,CAAC;MACnD,OAAOZ,IAAI,CAACa,SAAS,EAAE9B,EAAE,KAAK4B,QAAQ,CAAC5B,EAAE;IAC7C;IAEA,MAAM+B,cAAcA,CAACxB,QAAgB,EAAoB;MACrD,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,KAAK;MAChB;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,KAAK;MAChB;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAO,CAACF,WAAW,CAACK,IAAI,CAACC,CAAC,IAAI,CAACA,CAAC,CAACC,GAAG,CAAC;IACzC;IAEA,MAAMK,OAAOA,CAACzB,QAAgB,EAAoB;MAC9C,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,IAAI,OAAOA,UAAU,CAACgC,GAAG,KAAK,QAAQ,EAAE;UACpC,OAAO,IAAI;QACf;QACA,OAAOhC,UAAU,CAACgC,GAAG,CAAC7B,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAM8B,SAASA,CAAC3B,QAAgB,EAAoB;MAChD,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,IAAI,OAAOA,UAAU,CAACgC,GAAG,KAAK,QAAQ,EAAE;UACpC,OAAO,IAAI;QACf;QACA,OAAOhC,UAAU,CAACgC,GAAG,CAAC7B,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAM+B,OAAOA,CAAC5B,QAAgB,EAAEU,IAAkB,EAAoB;MAClE,IAAI,MAAM,IAAI,CAACF,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,MAAMM,QAAQ,GAAG,IAAI,CAACb,eAAe,CAACc,WAAW,CAAC,CAAC;MACnD,OAAOT,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,IAAIA,UAAU,CAAC0B,GAAG,EAAE;UAChB;UACA,IAAI,CAACV,IAAI,EAAEa,SAAS,EAAE;YAClB,OAAO,IAAI;UACf;UACA,OAAOb,IAAI,CAACa,SAAS,CAAC9B,EAAE,KAAK4B,QAAQ,CAAC5B,EAAE;QAC5C;QACA,IAAI,OAAOC,UAAU,CAACgC,GAAG,KAAK,QAAQ,EAAE;UACpC,OAAO,IAAI;QACf;QACA,OAAOhC,UAAU,CAACgC,GAAG,CAAC7B,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAMgC,SAASA,CAAC7B,QAAgB,EAAEU,IAAkB,EAAoB;MACpE,IAAI,MAAM,IAAI,CAACF,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,MAAMM,QAAQ,GAAG,IAAI,CAACb,eAAe,CAACc,WAAW,CAAC,CAAC;MACnD,OAAOT,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,IAAIA,UAAU,CAAC0B,GAAG,EAAE;UAChB,OAAOV,IAAI,EAAEa,SAAS,EAAE9B,EAAE,KAAK4B,QAAQ,CAAC5B,EAAE;QAC9C;QACA,IAAI,OAAOC,UAAU,CAACgC,GAAG,KAAK,QAAQ,EAAE;UACpC,OAAO,IAAI;QACf;QACA,OAAOhC,UAAU,CAACgC,GAAG,CAAC7B,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAMiC,UAAUA,CAAC9B,QAAgB,EAAoB;MACjD,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,OAAOA,UAAU,CAACqC,EAAE,EAAElC,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAMmC,YAAYA,CAAChC,QAAgB,EAAoB;MACnD,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,OAAOA,UAAU,CAACqC,EAAE,EAAElC,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAMoC,SAASA,CAAC5C,MAAc,EAAEW,QAAgB,EAAoB;MAChE,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,OAAOA,UAAU,CAACL,MAAM,CAAC,KAAK,IAAI;MACtC,CAAC,CAAC;IACN;IAEA,MAAcyB,oBAAoBA,CAACoB,gBAAwB,EAAkB;MACzE,MAAMrB,WAAW,GAAG,MAAM,IAAI,CAACL,eAAe,CAAC2B,cAAc,CAACD,gBAAgB,CAAC;MAC/E,IAAIrB,WAAW,CAACE,MAAM,EAAE;QACpB,OAAOF,WAAW;MACtB;MACA;MACA,MAAMuB,QAAQ,GAAG,MAAM,IAAI,CAAC5B,eAAe,CAAC6B,aAAa,CAACjC,cAAc,CAAC;MACzE,OAAOgC,QAAQ,GAAG,CAACA,QAAQ,CAAC,GAAG,EAAE;IACrC;IAEA,MAAcxB,mBAAmBA,CAAA,EAAqB;MAClD,MAAMlB,UAAU,GAAG,MAAM,IAAI,CAACc,eAAe,CAAC6B,aAAa,CAACjC,cAAc,CAAC;MAC3E,IAAI,CAACV,UAAU,EAAE;QACb,OAAO,KAAK;MAChB;MACA;MACA;MACA,MAAM4C,IAAI,GAAGC,MAAM,CAACD,IAAI,CAAC5C,UAAU,CAAC,CAAC8C,MAAM,CAACC,CAAC,IAAIA,CAAC,KAAK,MAAM,CAAC;MAE9D,MAAMC,MAAM,GAAGJ,IAAI,CAACzC,QAAQ,CAAC,KAAK,CAAC;;MAEnC;MACA,OAAO,CAAC6C,MAAM;IAClB;EACJ;EAEA,MAAMC,WAAW,GAAGhE,iBAAiB,CAAiB,GAAGG,MAAM,CAACuB,MAAM,cAAc,CAAC;EAErF,MAAMuC,cAAc,GAAGD,WAAW,CAACE,oBAAoB,CAAC;IACpDC,cAAc,EAAExC,iBAAiB;IACjCyC,YAAY,EAAE,CAACnE,eAAe;EAClC,CAAQ,CAAC;EAET,OAAO;IAAE+D,WAAW;IAAEC;EAAe,CAAC;AAC1C","ignoreList":[]}

package/features/security/permissions/index.d.ts

@@ -0,0 +1,2 @@
+export { createPermissions } from "./createPermissions.js";
+export type { ActionDefinition, EntityDefinition, PermissionSchemaConfig, OwnableItem, Permissions, AllEntityIds, RwdEntityId, PwEntityId, CustomActionNames } from "./types.js";

package/features/security/permissions/index.js

@@ -0,0 +1,3 @@
+export { createPermissions } from "./createPermissions.js";
+
+//# sourceMappingURL=index.js.map

package/features/security/permissions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createPermissions"],"sources":["index.ts"],"sourcesContent":["export { createPermissions } from \"./createPermissions.js\";\nexport type {\n    ActionDefinition,\n    EntityDefinition,\n    PermissionSchemaConfig,\n    OwnableItem,\n    Permissions,\n    AllEntityIds,\n    RwdEntityId,\n    PwEntityId,\n    CustomActionNames\n} from \"./types.js\";\n"],"mappings":"AAAA,SAASA,iBAAiB","ignoreList":[]}