@webiny/api-core 0.0.0-unstable.ac6ebf63c6 → 0.0.0-unstable.c27f4d8a31

package/features/security/apiKeys/UpdateApiKey/UpdateApiKeyUseCase.js

@@ -19,7 +19,7 @@ class UpdateApiKeyUseCaseImpl {
     }
     const validation = updateApiKeyInputSchema.safeParse(input);
     if (!validation.success) {
-      return Result.fail(new ApiKeyValidationError(validation.error.errors[0].message));
+      return Result.fail(new ApiKeyValidationError(validation.error.issues[0].message));
     }
     const existingResult = await this.repository.get(id);
     if (existingResult.isFail()) {

package/features/security/apiKeys/UpdateApiKey/UpdateApiKeyUseCase.js.map

@@ -1 +1 @@
-{"version":3,"names":["Result","UpdateApiKeyUseCase","UpdateApiKeyUseCaseAbstraction","ApiKeysRepository","IdentityContext","EventPublisher","updateApiKeyInputSchema","ApiKeyBeforeUpdateEvent","ApiKeyAfterUpdateEvent","ApiKeyNotAuthorizedError","ApiKeyValidationError","UpdateApiKeyUseCaseImpl","constructor","repository","identityContext","eventPublisher","execute","id","input","hasPermission","getPermission","fail","validation","safeParse","success","error","errors","message","existingResult","get","isFail","existingApiKey","value","updatedApiKey","data","publish","original","updated","result","update","ok","createImplementation","implementation","dependencies"],"sources":["UpdateApiKeyUseCase.ts"],"sourcesContent":["import { Result } from \"@webiny/feature/api\";\nimport { UpdateApiKeyUseCase as UpdateApiKeyUseCaseAbstraction } from \"./abstractions.js\";\nimport { ApiKeysRepository } from \"../shared/abstractions.js\";\nimport { IdentityContext } from \"../../IdentityContext/abstractions.js\";\nimport { EventPublisher } from \"~/features/eventPublisher/index.js\";\nimport { updateApiKeyInputSchema } from \"../shared/schemas.js\";\nimport { ApiKeyBeforeUpdateEvent, ApiKeyAfterUpdateEvent } from \"./events.js\";\nimport type { ApiKey, UpdateApiKeyInput } from \"../shared/types.js\";\nimport { ApiKeyNotAuthorizedError, ApiKeyValidationError } from \"../shared/errors.js\";\n\nclass UpdateApiKeyUseCaseImpl implements UpdateApiKeyUseCaseAbstraction.Interface {\n    private repository: ApiKeysRepository.Interface;\n    private identityContext: IdentityContext.Interface;\n    private eventPublisher: EventPublisher.Interface;\n\n    constructor(\n        repository: ApiKeysRepository.Interface,\n        identityContext: IdentityContext.Interface,\n        eventPublisher: EventPublisher.Interface\n    ) {\n        this.repository = repository;\n        this.identityContext = identityContext;\n        this.eventPublisher = eventPublisher;\n    }\n\n    async execute(\n        id: string,\n        input: UpdateApiKeyInput\n    ): Promise<Result<ApiKey, UpdateApiKeyUseCaseAbstraction.Error>> {\n        const hasPermission = await this.identityContext.getPermission(\"security.apiKey\");\n        if (!hasPermission) {\n            return Result.fail(new ApiKeyNotAuthorizedError());\n        }\n\n        const validation = updateApiKeyInputSchema.safeParse(input);\n        if (!validation.success) {\n            return Result.fail(new ApiKeyValidationError(validation.error.errors[0].message));\n        }\n\n        const existingResult = await this.repository.get(id);\n        if (existingResult.isFail()) {\n            return Result.fail(existingResult.error);\n        }\n\n        const existingApiKey = existingResult.value;\n\n        const updatedApiKey: ApiKey = {\n            ...existingApiKey,\n            ...validation.data\n        };\n\n        await this.eventPublisher.publish(\n            new ApiKeyBeforeUpdateEvent({\n                original: existingApiKey,\n                updated: updatedApiKey,\n                input: validation.data\n            })\n        );\n\n        const result = await this.repository.update(updatedApiKey);\n\n        if (result.isFail()) {\n            return Result.fail(result.error);\n        }\n\n        await this.eventPublisher.publish(\n            new ApiKeyAfterUpdateEvent({\n                original: existingApiKey,\n                updated: updatedApiKey,\n                input: validation.data\n            })\n        );\n\n        return Result.ok(updatedApiKey);\n    }\n}\n\nexport const UpdateApiKeyUseCase = UpdateApiKeyUseCaseAbstraction.createImplementation({\n    implementation: UpdateApiKeyUseCaseImpl,\n    dependencies: [ApiKeysRepository, IdentityContext, EventPublisher]\n});\n"],"mappings":"AAAA,SAASA,MAAM,QAAQ,qBAAqB;AAC5C,SAASC,mBAAmB,IAAIC,8BAA8B;AAC9D,SAASC,iBAAiB;AAC1B,SAASC,eAAe;AACxB,SAASC,cAAc;AACvB,SAASC,uBAAuB;AAChC,SAASC,uBAAuB,EAAEC,sBAAsB;AAExD,SAASC,wBAAwB,EAAEC,qBAAqB;AAExD,MAAMC,uBAAuB,CAAqD;EAK9EC,WAAWA,CACPC,UAAuC,EACvCC,eAA0C,EAC1CC,cAAwC,EAC1C;IACE,IAAI,CAACF,UAAU,GAAGA,UAAU;IAC5B,IAAI,CAACC,eAAe,GAAGA,eAAe;IACtC,IAAI,CAACC,cAAc,GAAGA,cAAc;EACxC;EAEA,MAAMC,OAAOA,CACTC,EAAU,EACVC,KAAwB,EACqC;IAC7D,MAAMC,aAAa,GAAG,MAAM,IAAI,CAACL,eAAe,CAACM,aAAa,CAAC,iBAAiB,CAAC;IACjF,IAAI,CAACD,aAAa,EAAE;MAChB,OAAOnB,MAAM,CAACqB,IAAI,CAAC,IAAIZ,wBAAwB,CAAC,CAAC,CAAC;IACtD;IAEA,MAAMa,UAAU,GAAGhB,uBAAuB,CAACiB,SAAS,CAACL,KAAK,CAAC;IAC3D,IAAI,CAACI,UAAU,CAACE,OAAO,EAAE;MACrB,OAAOxB,MAAM,CAACqB,IAAI,CAAC,IAAIX,qBAAqB,CAACY,UAAU,CAACG,KAAK,CAACC,MAAM,CAAC,CAAC,CAAC,CAACC,OAAO,CAAC,CAAC;IACrF;IAEA,MAAMC,cAAc,GAAG,MAAM,IAAI,CAACf,UAAU,CAACgB,GAAG,CAACZ,EAAE,CAAC;IACpD,IAAIW,cAAc,CAACE,MAAM,CAAC,CAAC,EAAE;MACzB,OAAO9B,MAAM,CAACqB,IAAI,CAACO,cAAc,CAACH,KAAK,CAAC;IAC5C;IAEA,MAAMM,cAAc,GAAGH,cAAc,CAACI,KAAK;IAE3C,MAAMC,aAAqB,GAAG;MAC1B,GAAGF,cAAc;MACjB,GAAGT,UAAU,CAACY;IAClB,CAAC;IAED,MAAM,IAAI,CAACnB,cAAc,CAACoB,OAAO,CAC7B,IAAI5B,uBAAuB,CAAC;MACxB6B,QAAQ,EAAEL,cAAc;MACxBM,OAAO,EAAEJ,aAAa;MACtBf,KAAK,EAAEI,UAAU,CAACY;IACtB,CAAC,CACL,CAAC;IAED,MAAMI,MAAM,GAAG,MAAM,IAAI,CAACzB,UAAU,CAAC0B,MAAM,CAACN,aAAa,CAAC;IAE1D,IAAIK,MAAM,CAACR,MAAM,CAAC,CAAC,EAAE;MACjB,OAAO9B,MAAM,CAACqB,IAAI,CAACiB,MAAM,CAACb,KAAK,CAAC;IACpC;IAEA,MAAM,IAAI,CAACV,cAAc,CAACoB,OAAO,CAC7B,IAAI3B,sBAAsB,CAAC;MACvB4B,QAAQ,EAAEL,cAAc;MACxBM,OAAO,EAAEJ,aAAa;MACtBf,KAAK,EAAEI,UAAU,CAACY;IACtB,CAAC,CACL,CAAC;IAED,OAAOlC,MAAM,CAACwC,EAAE,CAACP,aAAa,CAAC;EACnC;AACJ;AAEA,OAAO,MAAMhC,mBAAmB,GAAGC,8BAA8B,CAACuC,oBAAoB,CAAC;EACnFC,cAAc,EAAE/B,uBAAuB;EACvCgC,YAAY,EAAE,CAACxC,iBAAiB,EAAEC,eAAe,EAAEC,cAAc;AACrE,CAAC,CAAC","ignoreList":[]}
+{"version":3,"names":["Result","UpdateApiKeyUseCase","UpdateApiKeyUseCaseAbstraction","ApiKeysRepository","IdentityContext","EventPublisher","updateApiKeyInputSchema","ApiKeyBeforeUpdateEvent","ApiKeyAfterUpdateEvent","ApiKeyNotAuthorizedError","ApiKeyValidationError","UpdateApiKeyUseCaseImpl","constructor","repository","identityContext","eventPublisher","execute","id","input","hasPermission","getPermission","fail","validation","safeParse","success","error","issues","message","existingResult","get","isFail","existingApiKey","value","updatedApiKey","data","publish","original","updated","result","update","ok","createImplementation","implementation","dependencies"],"sources":["UpdateApiKeyUseCase.ts"],"sourcesContent":["import { Result } from \"@webiny/feature/api\";\nimport { UpdateApiKeyUseCase as UpdateApiKeyUseCaseAbstraction } from \"./abstractions.js\";\nimport { ApiKeysRepository } from \"../shared/abstractions.js\";\nimport { IdentityContext } from \"../../IdentityContext/abstractions.js\";\nimport { EventPublisher } from \"~/features/eventPublisher/index.js\";\nimport { updateApiKeyInputSchema } from \"../shared/schemas.js\";\nimport { ApiKeyBeforeUpdateEvent, ApiKeyAfterUpdateEvent } from \"./events.js\";\nimport type { ApiKey, UpdateApiKeyInput } from \"../shared/types.js\";\nimport { ApiKeyNotAuthorizedError, ApiKeyValidationError } from \"../shared/errors.js\";\n\nclass UpdateApiKeyUseCaseImpl implements UpdateApiKeyUseCaseAbstraction.Interface {\n    private repository: ApiKeysRepository.Interface;\n    private identityContext: IdentityContext.Interface;\n    private eventPublisher: EventPublisher.Interface;\n\n    constructor(\n        repository: ApiKeysRepository.Interface,\n        identityContext: IdentityContext.Interface,\n        eventPublisher: EventPublisher.Interface\n    ) {\n        this.repository = repository;\n        this.identityContext = identityContext;\n        this.eventPublisher = eventPublisher;\n    }\n\n    async execute(\n        id: string,\n        input: UpdateApiKeyInput\n    ): Promise<Result<ApiKey, UpdateApiKeyUseCaseAbstraction.Error>> {\n        const hasPermission = await this.identityContext.getPermission(\"security.apiKey\");\n        if (!hasPermission) {\n            return Result.fail(new ApiKeyNotAuthorizedError());\n        }\n\n        const validation = updateApiKeyInputSchema.safeParse(input);\n        if (!validation.success) {\n            return Result.fail(new ApiKeyValidationError(validation.error.issues[0].message));\n        }\n\n        const existingResult = await this.repository.get(id);\n        if (existingResult.isFail()) {\n            return Result.fail(existingResult.error);\n        }\n\n        const existingApiKey = existingResult.value;\n\n        const updatedApiKey: ApiKey = {\n            ...existingApiKey,\n            ...validation.data\n        };\n\n        await this.eventPublisher.publish(\n            new ApiKeyBeforeUpdateEvent({\n                original: existingApiKey,\n                updated: updatedApiKey,\n                input: validation.data\n            })\n        );\n\n        const result = await this.repository.update(updatedApiKey);\n\n        if (result.isFail()) {\n            return Result.fail(result.error);\n        }\n\n        await this.eventPublisher.publish(\n            new ApiKeyAfterUpdateEvent({\n                original: existingApiKey,\n                updated: updatedApiKey,\n                input: validation.data\n            })\n        );\n\n        return Result.ok(updatedApiKey);\n    }\n}\n\nexport const UpdateApiKeyUseCase = UpdateApiKeyUseCaseAbstraction.createImplementation({\n    implementation: UpdateApiKeyUseCaseImpl,\n    dependencies: [ApiKeysRepository, IdentityContext, EventPublisher]\n});\n"],"mappings":"AAAA,SAASA,MAAM,QAAQ,qBAAqB;AAC5C,SAASC,mBAAmB,IAAIC,8BAA8B;AAC9D,SAASC,iBAAiB;AAC1B,SAASC,eAAe;AACxB,SAASC,cAAc;AACvB,SAASC,uBAAuB;AAChC,SAASC,uBAAuB,EAAEC,sBAAsB;AAExD,SAASC,wBAAwB,EAAEC,qBAAqB;AAExD,MAAMC,uBAAuB,CAAqD;EAK9EC,WAAWA,CACPC,UAAuC,EACvCC,eAA0C,EAC1CC,cAAwC,EAC1C;IACE,IAAI,CAACF,UAAU,GAAGA,UAAU;IAC5B,IAAI,CAACC,eAAe,GAAGA,eAAe;IACtC,IAAI,CAACC,cAAc,GAAGA,cAAc;EACxC;EAEA,MAAMC,OAAOA,CACTC,EAAU,EACVC,KAAwB,EACqC;IAC7D,MAAMC,aAAa,GAAG,MAAM,IAAI,CAACL,eAAe,CAACM,aAAa,CAAC,iBAAiB,CAAC;IACjF,IAAI,CAACD,aAAa,EAAE;MAChB,OAAOnB,MAAM,CAACqB,IAAI,CAAC,IAAIZ,wBAAwB,CAAC,CAAC,CAAC;IACtD;IAEA,MAAMa,UAAU,GAAGhB,uBAAuB,CAACiB,SAAS,CAACL,KAAK,CAAC;IAC3D,IAAI,CAACI,UAAU,CAACE,OAAO,EAAE;MACrB,OAAOxB,MAAM,CAACqB,IAAI,CAAC,IAAIX,qBAAqB,CAACY,UAAU,CAACG,KAAK,CAACC,MAAM,CAAC,CAAC,CAAC,CAACC,OAAO,CAAC,CAAC;IACrF;IAEA,MAAMC,cAAc,GAAG,MAAM,IAAI,CAACf,UAAU,CAACgB,GAAG,CAACZ,EAAE,CAAC;IACpD,IAAIW,cAAc,CAACE,MAAM,CAAC,CAAC,EAAE;MACzB,OAAO9B,MAAM,CAACqB,IAAI,CAACO,cAAc,CAACH,KAAK,CAAC;IAC5C;IAEA,MAAMM,cAAc,GAAGH,cAAc,CAACI,KAAK;IAE3C,MAAMC,aAAqB,GAAG;MAC1B,GAAGF,cAAc;MACjB,GAAGT,UAAU,CAACY;IAClB,CAAC;IAED,MAAM,IAAI,CAACnB,cAAc,CAACoB,OAAO,CAC7B,IAAI5B,uBAAuB,CAAC;MACxB6B,QAAQ,EAAEL,cAAc;MACxBM,OAAO,EAAEJ,aAAa;MACtBf,KAAK,EAAEI,UAAU,CAACY;IACtB,CAAC,CACL,CAAC;IAED,MAAMI,MAAM,GAAG,MAAM,IAAI,CAACzB,UAAU,CAAC0B,MAAM,CAACN,aAAa,CAAC;IAE1D,IAAIK,MAAM,CAACR,MAAM,CAAC,CAAC,EAAE;MACjB,OAAO9B,MAAM,CAACqB,IAAI,CAACiB,MAAM,CAACb,KAAK,CAAC;IACpC;IAEA,MAAM,IAAI,CAACV,cAAc,CAACoB,OAAO,CAC7B,IAAI3B,sBAAsB,CAAC;MACvB4B,QAAQ,EAAEL,cAAc;MACxBM,OAAO,EAAEJ,aAAa;MACtBf,KAAK,EAAEI,UAAU,CAACY;IACtB,CAAC,CACL,CAAC;IAED,OAAOlC,MAAM,CAACwC,EAAE,CAACP,aAAa,CAAC;EACnC;AACJ;AAEA,OAAO,MAAMhC,mBAAmB,GAAGC,8BAA8B,CAACuC,oBAAoB,CAAC;EACnFC,cAAc,EAAE/B,uBAAuB;EACvCgC,YAAY,EAAE,CAACxC,iBAAiB,EAAEC,eAAe,EAAEC,cAAc;AACrE,CAAC,CAAC","ignoreList":[]}

package/features/security/apiKeys/UpdateApiKey/events.d.ts

@@ -5,8 +5,8 @@ export declare class ApiKeyBeforeUpdateEvent extends DomainEvent<ApiKeyBeforeUpd
     eventType: "apiKey.beforeUpdate";
     getHandlerAbstraction(): import("@webiny/di").Abstraction<IEventHandler<ApiKeyBeforeUpdateEvent>>;
 }
-export declare const ApiKeyBeforeUpdateHandler: import("@webiny/di").Abstraction<IEventHandler<ApiKeyBeforeUpdateEvent>>;
-export declare namespace ApiKeyBeforeUpdateHandler {
+export declare const ApiKeyBeforeUpdateEventHandler: import("@webiny/di").Abstraction<IEventHandler<ApiKeyBeforeUpdateEvent>>;
+export declare namespace ApiKeyBeforeUpdateEventHandler {
     type Interface = IEventHandler<ApiKeyBeforeUpdateEvent>;
     type Event = ApiKeyBeforeUpdateEvent;
 }
@@ -14,8 +14,8 @@ export declare class ApiKeyAfterUpdateEvent extends DomainEvent<ApiKeyAfterUpdat
     eventType: "apiKey.afterUpdate";
     getHandlerAbstraction(): import("@webiny/di").Abstraction<IEventHandler<ApiKeyAfterUpdateEvent>>;
 }
-export declare const ApiKeyAfterUpdateHandler: import("@webiny/di").Abstraction<IEventHandler<ApiKeyAfterUpdateEvent>>;
-export declare namespace ApiKeyAfterUpdateHandler {
+export declare const ApiKeyAfterUpdateEventHandler: import("@webiny/di").Abstraction<IEventHandler<ApiKeyAfterUpdateEvent>>;
+export declare namespace ApiKeyAfterUpdateEventHandler {
     type Interface = IEventHandler<ApiKeyAfterUpdateEvent>;
     type Event = ApiKeyAfterUpdateEvent;
 }

package/features/security/apiKeys/UpdateApiKey/events.js

@@ -3,16 +3,16 @@ import { DomainEvent } from "../../../eventPublisher/index.js";
 export class ApiKeyBeforeUpdateEvent extends DomainEvent {
   eventType = "apiKey.beforeUpdate";
   getHandlerAbstraction() {
-    return ApiKeyBeforeUpdateHandler;
+    return ApiKeyBeforeUpdateEventHandler;
   }
 }
-export const ApiKeyBeforeUpdateHandler = createAbstraction("ApiKeyBeforeUpdateHandler");
+export const ApiKeyBeforeUpdateEventHandler = createAbstraction("ApiKeyBeforeUpdateEventHandler");
 export class ApiKeyAfterUpdateEvent extends DomainEvent {
   eventType = "apiKey.afterUpdate";
   getHandlerAbstraction() {
-    return ApiKeyAfterUpdateHandler;
+    return ApiKeyAfterUpdateEventHandler;
   }
 }
-export const ApiKeyAfterUpdateHandler = createAbstraction("ApiKeyAfterUpdateHandler");
+export const ApiKeyAfterUpdateEventHandler = createAbstraction("ApiKeyAfterUpdateEventHandler");
 
 //# sourceMappingURL=events.js.map

package/features/security/apiKeys/UpdateApiKey/events.js.map

@@ -1 +1 @@
-{"version":3,"names":["createAbstraction","DomainEvent","ApiKeyBeforeUpdateEvent","eventType","getHandlerAbstraction","ApiKeyBeforeUpdateHandler","ApiKeyAfterUpdateEvent","ApiKeyAfterUpdateHandler"],"sources":["events.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport { DomainEvent } from \"~/features/eventPublisher/index.js\";\nimport type { IEventHandler } from \"~/features/eventPublisher/index.js\";\nimport type { ApiKeyBeforeUpdatePayload, ApiKeyAfterUpdatePayload } from \"./abstractions.js\";\n\nexport class ApiKeyBeforeUpdateEvent extends DomainEvent<ApiKeyBeforeUpdatePayload> {\n    eventType = \"apiKey.beforeUpdate\" as const;\n\n    getHandlerAbstraction() {\n        return ApiKeyBeforeUpdateHandler;\n    }\n}\n\nexport const ApiKeyBeforeUpdateHandler = createAbstraction<IEventHandler<ApiKeyBeforeUpdateEvent>>(\n    \"ApiKeyBeforeUpdateHandler\"\n);\n\nexport namespace ApiKeyBeforeUpdateHandler {\n    export type Interface = IEventHandler<ApiKeyBeforeUpdateEvent>;\n    export type Event = ApiKeyBeforeUpdateEvent;\n}\n\nexport class ApiKeyAfterUpdateEvent extends DomainEvent<ApiKeyAfterUpdatePayload> {\n    eventType = \"apiKey.afterUpdate\" as const;\n\n    getHandlerAbstraction() {\n        return ApiKeyAfterUpdateHandler;\n    }\n}\n\nexport const ApiKeyAfterUpdateHandler = createAbstraction<IEventHandler<ApiKeyAfterUpdateEvent>>(\n    \"ApiKeyAfterUpdateHandler\"\n);\n\nexport namespace ApiKeyAfterUpdateHandler {\n    export type Interface = IEventHandler<ApiKeyAfterUpdateEvent>;\n    export type Event = ApiKeyAfterUpdateEvent;\n}\n"],"mappings":"AAAA,SAASA,iBAAiB,QAAQ,qBAAqB;AACvD,SAASC,WAAW;AAIpB,OAAO,MAAMC,uBAAuB,SAASD,WAAW,CAA4B;EAChFE,SAAS,GAAG,qBAAqB;EAEjCC,qBAAqBA,CAAA,EAAG;IACpB,OAAOC,yBAAyB;EACpC;AACJ;AAEA,OAAO,MAAMA,yBAAyB,GAAGL,iBAAiB,CACtD,2BACJ,CAAC;AAOD,OAAO,MAAMM,sBAAsB,SAASL,WAAW,CAA2B;EAC9EE,SAAS,GAAG,oBAAoB;EAEhCC,qBAAqBA,CAAA,EAAG;IACpB,OAAOG,wBAAwB;EACnC;AACJ;AAEA,OAAO,MAAMA,wBAAwB,GAAGP,iBAAiB,CACrD,0BACJ,CAAC","ignoreList":[]}
+{"version":3,"names":["createAbstraction","DomainEvent","ApiKeyBeforeUpdateEvent","eventType","getHandlerAbstraction","ApiKeyBeforeUpdateEventHandler","ApiKeyAfterUpdateEvent","ApiKeyAfterUpdateEventHandler"],"sources":["events.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport { DomainEvent } from \"~/features/eventPublisher/index.js\";\nimport type { IEventHandler } from \"~/features/eventPublisher/index.js\";\nimport type { ApiKeyBeforeUpdatePayload, ApiKeyAfterUpdatePayload } from \"./abstractions.js\";\n\nexport class ApiKeyBeforeUpdateEvent extends DomainEvent<ApiKeyBeforeUpdatePayload> {\n    eventType = \"apiKey.beforeUpdate\" as const;\n\n    getHandlerAbstraction() {\n        return ApiKeyBeforeUpdateEventHandler;\n    }\n}\n\nexport const ApiKeyBeforeUpdateEventHandler = createAbstraction<\n    IEventHandler<ApiKeyBeforeUpdateEvent>\n>(\"ApiKeyBeforeUpdateEventHandler\");\n\nexport namespace ApiKeyBeforeUpdateEventHandler {\n    export type Interface = IEventHandler<ApiKeyBeforeUpdateEvent>;\n    export type Event = ApiKeyBeforeUpdateEvent;\n}\n\nexport class ApiKeyAfterUpdateEvent extends DomainEvent<ApiKeyAfterUpdatePayload> {\n    eventType = \"apiKey.afterUpdate\" as const;\n\n    getHandlerAbstraction() {\n        return ApiKeyAfterUpdateEventHandler;\n    }\n}\n\nexport const ApiKeyAfterUpdateEventHandler = createAbstraction<\n    IEventHandler<ApiKeyAfterUpdateEvent>\n>(\"ApiKeyAfterUpdateEventHandler\");\n\nexport namespace ApiKeyAfterUpdateEventHandler {\n    export type Interface = IEventHandler<ApiKeyAfterUpdateEvent>;\n    export type Event = ApiKeyAfterUpdateEvent;\n}\n"],"mappings":"AAAA,SAASA,iBAAiB,QAAQ,qBAAqB;AACvD,SAASC,WAAW;AAIpB,OAAO,MAAMC,uBAAuB,SAASD,WAAW,CAA4B;EAChFE,SAAS,GAAG,qBAAqB;EAEjCC,qBAAqBA,CAAA,EAAG;IACpB,OAAOC,8BAA8B;EACzC;AACJ;AAEA,OAAO,MAAMA,8BAA8B,GAAGL,iBAAiB,CAE7D,gCAAgC,CAAC;AAOnC,OAAO,MAAMM,sBAAsB,SAASL,WAAW,CAA2B;EAC9EE,SAAS,GAAG,oBAAoB;EAEhCC,qBAAqBA,CAAA,EAAG;IACpB,OAAOG,6BAA6B;EACxC;AACJ;AAEA,OAAO,MAAMA,6BAA6B,GAAGP,iBAAiB,CAE5D,+BAA+B,CAAC","ignoreList":[]}

package/features/security/apiKeys/shared/schemas.d.ts

@@ -5,87 +5,26 @@ export declare const createApiKeyInputSchema: z.ZodObject<{
     description: z.ZodString;
     permissions: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodObject<{
         name: z.ZodString;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        name: z.ZodString;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        name: z.ZodString;
-    }, z.ZodTypeAny, "passthrough">>, "many">>>;
-}, "strip", z.ZodTypeAny, {
-    permissions: z.objectOutputType<{
-        name: z.ZodString;
-    }, z.ZodTypeAny, "passthrough">[];
-    name: string;
-    description: string;
-    slug: string;
-}, {
-    name: string;
-    description: string;
-    slug: string;
-    permissions?: z.objectInputType<{
-        name: z.ZodString;
-    }, z.ZodTypeAny, "passthrough">[] | undefined;
-}>;
+    }, z.core.$loose>>>>;
+}, z.core.$strip>;
 export declare const updateApiKeyInputSchema: z.ZodObject<{
     name: z.ZodOptional<z.ZodString>;
     description: z.ZodOptional<z.ZodString>;
     permissions: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodObject<{
         name: z.ZodString;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        name: z.ZodString;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        name: z.ZodString;
-    }, z.ZodTypeAny, "passthrough">>, "many">>>;
-}, "strip", z.ZodTypeAny, {
-    permissions: z.objectOutputType<{
-        name: z.ZodString;
-    }, z.ZodTypeAny, "passthrough">[];
-    name?: string | undefined;
-    description?: string | undefined;
-}, {
-    permissions?: z.objectInputType<{
-        name: z.ZodString;
-    }, z.ZodTypeAny, "passthrough">[] | undefined;
-    name?: string | undefined;
-    description?: string | undefined;
-}>;
+    }, z.core.$loose>>>>;
+}, z.core.$strip>;
 export declare const listApiKeysInputSchema: z.ZodObject<{
     where: z.ZodOptional<z.ZodObject<{
         name: z.ZodOptional<z.ZodString>;
         name_contains: z.ZodOptional<z.ZodString>;
         description: z.ZodOptional<z.ZodString>;
         description_contains: z.ZodOptional<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
-        name?: string | undefined;
-        description?: string | undefined;
-        name_contains?: string | undefined;
-        description_contains?: string | undefined;
-    }, {
-        name?: string | undefined;
-        description?: string | undefined;
-        name_contains?: string | undefined;
-        description_contains?: string | undefined;
-    }>>;
+    }, z.core.$strip>>;
     limit: z.ZodOptional<z.ZodNumber>;
     after: z.ZodOptional<z.ZodString>;
-    sort: z.ZodOptional<z.ZodArray<z.ZodEnum<["createdOn_ASC", "createdOn_DESC"]>, "many">>;
-}, "strip", z.ZodTypeAny, {
-    sort?: ("createdOn_ASC" | "createdOn_DESC")[] | undefined;
-    where?: {
-        name?: string | undefined;
-        description?: string | undefined;
-        name_contains?: string | undefined;
-        description_contains?: string | undefined;
-    } | undefined;
-    limit?: number | undefined;
-    after?: string | undefined;
-}, {
-    sort?: ("createdOn_ASC" | "createdOn_DESC")[] | undefined;
-    where?: {
-        name?: string | undefined;
-        description?: string | undefined;
-        name_contains?: string | undefined;
-        description_contains?: string | undefined;
-    } | undefined;
-    limit?: number | undefined;
-    after?: string | undefined;
-}>;
+    sort: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        createdOn_ASC: "createdOn_ASC";
+        createdOn_DESC: "createdOn_DESC";
+    }>>>;
+}, z.core.$strip>;

package/features/security/apiKeys/shared/schemas.js

@@ -3,16 +3,16 @@ export const createApiKeyInputSchema = z.object({
   name: z.string().min(1),
   slug: z.string().min(1),
   description: z.string(),
-  permissions: z.array(z.object({
+  permissions: z.array(z.looseObject({
     name: z.string()
-  }).passthrough()).optional().default([])
+  })).optional().default([])
 });
 export const updateApiKeyInputSchema = z.object({
   name: z.string().min(1).optional(),
   description: z.string().optional(),
-  permissions: z.array(z.object({
+  permissions: z.array(z.looseObject({
     name: z.string()
-  }).passthrough()).optional().default([])
+  })).optional().default([])
 });
 export const listApiKeysInputSchema = z.object({
   where: z.object({

package/features/security/apiKeys/shared/schemas.js.map

@@ -1 +1 @@
-{"version":3,"names":["z","createApiKeyInputSchema","object","name","string","min","slug","description","permissions","array","passthrough","optional","default","updateApiKeyInputSchema","listApiKeysInputSchema","where","name_contains","description_contains","limit","number","int","positive","max","after","sort","enum"],"sources":["schemas.ts"],"sourcesContent":["import { z } from \"zod\";\n\nexport const createApiKeyInputSchema = z.object({\n    name: z.string().min(1),\n    slug: z.string().min(1),\n    description: z.string(),\n    permissions: z\n        .array(z.object({ name: z.string() }).passthrough())\n        .optional()\n        .default([])\n});\n\nexport const updateApiKeyInputSchema = z.object({\n    name: z.string().min(1).optional(),\n    description: z.string().optional(),\n    permissions: z\n        .array(z.object({ name: z.string() }).passthrough())\n        .optional()\n        .default([])\n});\n\nexport const listApiKeysInputSchema = z.object({\n    where: z\n        .object({\n            name: z.string().optional(),\n            name_contains: z.string().optional(),\n            description: z.string().optional(),\n            description_contains: z.string().optional()\n        })\n        .optional(),\n    limit: z.number().int().positive().max(100).optional(),\n    after: z.string().optional(),\n    sort: z.array(z.enum([\"createdOn_ASC\", \"createdOn_DESC\"])).optional()\n});\n"],"mappings":"AAAA,SAASA,CAAC,QAAQ,KAAK;AAEvB,OAAO,MAAMC,uBAAuB,GAAGD,CAAC,CAACE,MAAM,CAAC;EAC5CC,IAAI,EAAEH,CAAC,CAACI,MAAM,CAAC,CAAC,CAACC,GAAG,CAAC,CAAC,CAAC;EACvBC,IAAI,EAAEN,CAAC,CAACI,MAAM,CAAC,CAAC,CAACC,GAAG,CAAC,CAAC,CAAC;EACvBE,WAAW,EAAEP,CAAC,CAACI,MAAM,CAAC,CAAC;EACvBI,WAAW,EAAER,CAAC,CACTS,KAAK,CAACT,CAAC,CAACE,MAAM,CAAC;IAAEC,IAAI,EAAEH,CAAC,CAACI,MAAM,CAAC;EAAE,CAAC,CAAC,CAACM,WAAW,CAAC,CAAC,CAAC,CACnDC,QAAQ,CAAC,CAAC,CACVC,OAAO,CAAC,EAAE;AACnB,CAAC,CAAC;AAEF,OAAO,MAAMC,uBAAuB,GAAGb,CAAC,CAACE,MAAM,CAAC;EAC5CC,IAAI,EAAEH,CAAC,CAACI,MAAM,CAAC,CAAC,CAACC,GAAG,CAAC,CAAC,CAAC,CAACM,QAAQ,CAAC,CAAC;EAClCJ,WAAW,EAAEP,CAAC,CAACI,MAAM,CAAC,CAAC,CAACO,QAAQ,CAAC,CAAC;EAClCH,WAAW,EAAER,CAAC,CACTS,KAAK,CAACT,CAAC,CAACE,MAAM,CAAC;IAAEC,IAAI,EAAEH,CAAC,CAACI,MAAM,CAAC;EAAE,CAAC,CAAC,CAACM,WAAW,CAAC,CAAC,CAAC,CACnDC,QAAQ,CAAC,CAAC,CACVC,OAAO,CAAC,EAAE;AACnB,CAAC,CAAC;AAEF,OAAO,MAAME,sBAAsB,GAAGd,CAAC,CAACE,MAAM,CAAC;EAC3Ca,KAAK,EAAEf,CAAC,CACHE,MAAM,CAAC;IACJC,IAAI,EAAEH,CAAC,CAACI,MAAM,CAAC,CAAC,CAACO,QAAQ,CAAC,CAAC;IAC3BK,aAAa,EAAEhB,CAAC,CAACI,MAAM,CAAC,CAAC,CAACO,QAAQ,CAAC,CAAC;IACpCJ,WAAW,EAAEP,CAAC,CAACI,MAAM,CAAC,CAAC,CAACO,QAAQ,CAAC,CAAC;IAClCM,oBAAoB,EAAEjB,CAAC,CAACI,MAAM,CAAC,CAAC,CAACO,QAAQ,CAAC;EAC9C,CAAC,CAAC,CACDA,QAAQ,CAAC,CAAC;EACfO,KAAK,EAAElB,CAAC,CAACmB,MAAM,CAAC,CAAC,CAACC,GAAG,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC,CAACC,GAAG,CAAC,GAAG,CAAC,CAACX,QAAQ,CAAC,CAAC;EACtDY,KAAK,EAAEvB,CAAC,CAACI,MAAM,CAAC,CAAC,CAACO,QAAQ,CAAC,CAAC;EAC5Ba,IAAI,EAAExB,CAAC,CAACS,KAAK,CAACT,CAAC,CAACyB,IAAI,CAAC,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAACd,QAAQ,CAAC;AACxE,CAAC,CAAC","ignoreList":[]}
+{"version":3,"names":["z","createApiKeyInputSchema","object","name","string","min","slug","description","permissions","array","looseObject","optional","default","updateApiKeyInputSchema","listApiKeysInputSchema","where","name_contains","description_contains","limit","number","int","positive","max","after","sort","enum"],"sources":["schemas.ts"],"sourcesContent":["import { z } from \"zod\";\n\nexport const createApiKeyInputSchema = z.object({\n    name: z.string().min(1),\n    slug: z.string().min(1),\n    description: z.string(),\n    permissions: z\n        .array(z.looseObject({ name: z.string() }))\n        .optional()\n        .default([])\n});\n\nexport const updateApiKeyInputSchema = z.object({\n    name: z.string().min(1).optional(),\n    description: z.string().optional(),\n    permissions: z\n        .array(z.looseObject({ name: z.string() }))\n        .optional()\n        .default([])\n});\n\nexport const listApiKeysInputSchema = z.object({\n    where: z\n        .object({\n            name: z.string().optional(),\n            name_contains: z.string().optional(),\n            description: z.string().optional(),\n            description_contains: z.string().optional()\n        })\n        .optional(),\n    limit: z.number().int().positive().max(100).optional(),\n    after: z.string().optional(),\n    sort: z.array(z.enum([\"createdOn_ASC\", \"createdOn_DESC\"])).optional()\n});\n"],"mappings":"AAAA,SAASA,CAAC,QAAQ,KAAK;AAEvB,OAAO,MAAMC,uBAAuB,GAAGD,CAAC,CAACE,MAAM,CAAC;EAC5CC,IAAI,EAAEH,CAAC,CAACI,MAAM,CAAC,CAAC,CAACC,GAAG,CAAC,CAAC,CAAC;EACvBC,IAAI,EAAEN,CAAC,CAACI,MAAM,CAAC,CAAC,CAACC,GAAG,CAAC,CAAC,CAAC;EACvBE,WAAW,EAAEP,CAAC,CAACI,MAAM,CAAC,CAAC;EACvBI,WAAW,EAAER,CAAC,CACTS,KAAK,CAACT,CAAC,CAACU,WAAW,CAAC;IAAEP,IAAI,EAAEH,CAAC,CAACI,MAAM,CAAC;EAAE,CAAC,CAAC,CAAC,CAC1CO,QAAQ,CAAC,CAAC,CACVC,OAAO,CAAC,EAAE;AACnB,CAAC,CAAC;AAEF,OAAO,MAAMC,uBAAuB,GAAGb,CAAC,CAACE,MAAM,CAAC;EAC5CC,IAAI,EAAEH,CAAC,CAACI,MAAM,CAAC,CAAC,CAACC,GAAG,CAAC,CAAC,CAAC,CAACM,QAAQ,CAAC,CAAC;EAClCJ,WAAW,EAAEP,CAAC,CAACI,MAAM,CAAC,CAAC,CAACO,QAAQ,CAAC,CAAC;EAClCH,WAAW,EAAER,CAAC,CACTS,KAAK,CAACT,CAAC,CAACU,WAAW,CAAC;IAAEP,IAAI,EAAEH,CAAC,CAACI,MAAM,CAAC;EAAE,CAAC,CAAC,CAAC,CAC1CO,QAAQ,CAAC,CAAC,CACVC,OAAO,CAAC,EAAE;AACnB,CAAC,CAAC;AAEF,OAAO,MAAME,sBAAsB,GAAGd,CAAC,CAACE,MAAM,CAAC;EAC3Ca,KAAK,EAAEf,CAAC,CACHE,MAAM,CAAC;IACJC,IAAI,EAAEH,CAAC,CAACI,MAAM,CAAC,CAAC,CAACO,QAAQ,CAAC,CAAC;IAC3BK,aAAa,EAAEhB,CAAC,CAACI,MAAM,CAAC,CAAC,CAACO,QAAQ,CAAC,CAAC;IACpCJ,WAAW,EAAEP,CAAC,CAACI,MAAM,CAAC,CAAC,CAACO,QAAQ,CAAC,CAAC;IAClCM,oBAAoB,EAAEjB,CAAC,CAACI,MAAM,CAAC,CAAC,CAACO,QAAQ,CAAC;EAC9C,CAAC,CAAC,CACDA,QAAQ,CAAC,CAAC;EACfO,KAAK,EAAElB,CAAC,CAACmB,MAAM,CAAC,CAAC,CAACC,GAAG,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC,CAACC,GAAG,CAAC,GAAG,CAAC,CAACX,QAAQ,CAAC,CAAC;EACtDY,KAAK,EAAEvB,CAAC,CAACI,MAAM,CAAC,CAAC,CAACO,QAAQ,CAAC,CAAC;EAC5Ba,IAAI,EAAExB,CAAC,CAACS,KAAK,CAACT,CAAC,CAACyB,IAAI,CAAC,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAACd,QAAQ,CAAC;AACxE,CAAC,CAAC","ignoreList":[]}

package/features/security/authentication/AuthenticationContext/SetIdTokenCookie.d.ts

@@ -1,7 +1,7 @@
 import { Reply } from "@webiny/handler";
-import { AfterAuthenticationHandler } from "../../../../features/security/authentication/AuthenticationContext/index.js";
+import { AfterAuthenticationEventHandler } from "../../../../features/security/authentication/AuthenticationContext/index.js";
 import { AuthenticationContext } from "../../../../features/security/authentication/AuthenticationContext/index.js";
-declare class SetIdTokenCookieImpl implements AfterAuthenticationHandler.Interface {
+declare class SetIdTokenCookieImpl implements AfterAuthenticationEventHandler.Interface {
     private authenticationContext;
     private reply;
     constructor(authenticationContext: AuthenticationContext.Interface, reply: Reply.Interface);

package/features/security/authentication/AuthenticationContext/SetIdTokenCookie.js

@@ -1,7 +1,7 @@
 import jwt from "jsonwebtoken";
 import { createImplementation } from "@webiny/feature/api";
 import { Reply } from "@webiny/handler";
-import { AfterAuthenticationHandler } from "./index.js";
+import { AfterAuthenticationEventHandler } from "./index.js";
 import { AuthenticationContext } from "./index.js";
 const get24HoursFromNow = () => {
   const oneHour = 1000 * 60 * 60;
@@ -44,7 +44,7 @@ class SetIdTokenCookieImpl {
   }
 }
 export const SetIdTokenCookie = createImplementation({
-  abstraction: AfterAuthenticationHandler,
+  abstraction: AfterAuthenticationEventHandler,
   implementation: SetIdTokenCookieImpl,
   dependencies: [AuthenticationContext, Reply]
 });

package/features/security/authentication/AuthenticationContext/SetIdTokenCookie.js.map

@@ -1 +1 @@
-{"version":3,"names":["jwt","createImplementation","Reply","AfterAuthenticationHandler","AuthenticationContext","get24HoursFromNow","oneHour","Date","getTime","toDate","timestamp","SetIdTokenCookieImpl","constructor","authenticationContext","reply","handle","token","getAuthToken","tokenData","decode","json","expiresOn","exp","setCookie","path","expires","sameSite","secure","httpOnly","header","SetIdTokenCookie","abstraction","implementation","dependencies"],"sources":["SetIdTokenCookie.ts"],"sourcesContent":["import jwt from \"jsonwebtoken\";\nimport { createImplementation } from \"@webiny/feature/api\";\nimport { Reply } from \"@webiny/handler\";\nimport { AfterAuthenticationHandler } from \"~/features/security/authentication/AuthenticationContext/index.js\";\nimport { AuthenticationContext } from \"~/features/security/authentication/AuthenticationContext/index.js\";\n\nconst get24HoursFromNow = () => {\n    const oneHour = 1000 * 60 * 60;\n    return new Date(new Date().getTime() + oneHour * 24);\n};\n\nconst toDate = (timestamp: number | undefined) => {\n    return timestamp ? new Date(timestamp * 1000) : get24HoursFromNow();\n};\n\nclass SetIdTokenCookieImpl implements AfterAuthenticationHandler.Interface {\n    constructor(\n        private authenticationContext: AuthenticationContext.Interface,\n        private reply: Reply.Interface\n    ) {}\n\n    async handle(): Promise<void> {\n        const token = this.authenticationContext.getAuthToken();\n\n        if (!token) {\n            return;\n        }\n\n        // Attempt to acquire expiration from the token; fall back to \"expire in 24 hours\".\n        // In most cases the token will be a JWT token, but it can also be a custom token, or an API key.\n        const tokenData = jwt.decode(token, { json: true });\n        const expiresOn = tokenData ? toDate(tokenData.exp) : get24HoursFromNow();\n\n        // @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie\n        this.reply.setCookie(\"wby-id-token\", token, {\n            path: \"/\",\n            expires: expiresOn,\n            // Allow this cookie to be sent with cross-origin requests.\n            sameSite: \"none\",\n            // Only send this cookie to the server when HTTPS is used.\n            // NOTE: `https` requirement is ignored for `localhost.\n            secure: true,\n            // Forbids JavaScript from accessing the cookie.\n            httpOnly: true\n        });\n\n        this.reply.header(\"cache-control\", `no-cache=\"Set-Cookie\"`);\n    }\n}\n\nexport const SetIdTokenCookie = createImplementation({\n    abstraction: AfterAuthenticationHandler,\n    implementation: SetIdTokenCookieImpl,\n    dependencies: [AuthenticationContext, Reply]\n});\n"],"mappings":"AAAA,OAAOA,GAAG,MAAM,cAAc;AAC9B,SAASC,oBAAoB,QAAQ,qBAAqB;AAC1D,SAASC,KAAK,QAAQ,iBAAiB;AACvC,SAASC,0BAA0B;AACnC,SAASC,qBAAqB;AAE9B,MAAMC,iBAAiB,GAAGA,CAAA,KAAM;EAC5B,MAAMC,OAAO,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE;EAC9B,OAAO,IAAIC,IAAI,CAAC,IAAIA,IAAI,CAAC,CAAC,CAACC,OAAO,CAAC,CAAC,GAAGF,OAAO,GAAG,EAAE,CAAC;AACxD,CAAC;AAED,MAAMG,MAAM,GAAIC,SAA6B,IAAK;EAC9C,OAAOA,SAAS,GAAG,IAAIH,IAAI,CAACG,SAAS,GAAG,IAAI,CAAC,GAAGL,iBAAiB,CAAC,CAAC;AACvE,CAAC;AAED,MAAMM,oBAAoB,CAAiD;EACvEC,WAAWA,CACCC,qBAAsD,EACtDC,KAAsB,EAChC;IAAA,KAFUD,qBAAsD,GAAtDA,qBAAsD;IAAA,KACtDC,KAAsB,GAAtBA,KAAsB;EAC/B;EAEH,MAAMC,MAAMA,CAAA,EAAkB;IAC1B,MAAMC,KAAK,GAAG,IAAI,CAACH,qBAAqB,CAACI,YAAY,CAAC,CAAC;IAEvD,IAAI,CAACD,KAAK,EAAE;MACR;IACJ;;IAEA;IACA;IACA,MAAME,SAAS,GAAGlB,GAAG,CAACmB,MAAM,CAACH,KAAK,EAAE;MAAEI,IAAI,EAAE;IAAK,CAAC,CAAC;IACnD,MAAMC,SAAS,GAAGH,SAAS,GAAGT,MAAM,CAACS,SAAS,CAACI,GAAG,CAAC,GAAGjB,iBAAiB,CAAC,CAAC;;IAEzE;IACA,IAAI,CAACS,KAAK,CAACS,SAAS,CAAC,cAAc,EAAEP,KAAK,EAAE;MACxCQ,IAAI,EAAE,GAAG;MACTC,OAAO,EAAEJ,SAAS;MAClB;MACAK,QAAQ,EAAE,MAAM;MAChB;MACA;MACAC,MAAM,EAAE,IAAI;MACZ;MACAC,QAAQ,EAAE;IACd,CAAC,CAAC;IAEF,IAAI,CAACd,KAAK,CAACe,MAAM,CAAC,eAAe,EAAE,uBAAuB,CAAC;EAC/D;AACJ;AAEA,OAAO,MAAMC,gBAAgB,GAAG7B,oBAAoB,CAAC;EACjD8B,WAAW,EAAE5B,0BAA0B;EACvC6B,cAAc,EAAErB,oBAAoB;EACpCsB,YAAY,EAAE,CAAC7B,qBAAqB,EAAEF,KAAK;AAC/C,CAAC,CAAC","ignoreList":[]}
+{"version":3,"names":["jwt","createImplementation","Reply","AfterAuthenticationEventHandler","AuthenticationContext","get24HoursFromNow","oneHour","Date","getTime","toDate","timestamp","SetIdTokenCookieImpl","constructor","authenticationContext","reply","handle","token","getAuthToken","tokenData","decode","json","expiresOn","exp","setCookie","path","expires","sameSite","secure","httpOnly","header","SetIdTokenCookie","abstraction","implementation","dependencies"],"sources":["SetIdTokenCookie.ts"],"sourcesContent":["import jwt from \"jsonwebtoken\";\nimport { createImplementation } from \"@webiny/feature/api\";\nimport { Reply } from \"@webiny/handler\";\nimport { AfterAuthenticationEventHandler } from \"~/features/security/authentication/AuthenticationContext/index.js\";\nimport { AuthenticationContext } from \"~/features/security/authentication/AuthenticationContext/index.js\";\n\nconst get24HoursFromNow = () => {\n    const oneHour = 1000 * 60 * 60;\n    return new Date(new Date().getTime() + oneHour * 24);\n};\n\nconst toDate = (timestamp: number | undefined) => {\n    return timestamp ? new Date(timestamp * 1000) : get24HoursFromNow();\n};\n\nclass SetIdTokenCookieImpl implements AfterAuthenticationEventHandler.Interface {\n    constructor(\n        private authenticationContext: AuthenticationContext.Interface,\n        private reply: Reply.Interface\n    ) {}\n\n    async handle(): Promise<void> {\n        const token = this.authenticationContext.getAuthToken();\n\n        if (!token) {\n            return;\n        }\n\n        // Attempt to acquire expiration from the token; fall back to \"expire in 24 hours\".\n        // In most cases the token will be a JWT token, but it can also be a custom token, or an API key.\n        const tokenData = jwt.decode(token, { json: true });\n        const expiresOn = tokenData ? toDate(tokenData.exp) : get24HoursFromNow();\n\n        // @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie\n        this.reply.setCookie(\"wby-id-token\", token, {\n            path: \"/\",\n            expires: expiresOn,\n            // Allow this cookie to be sent with cross-origin requests.\n            sameSite: \"none\",\n            // Only send this cookie to the server when HTTPS is used.\n            // NOTE: `https` requirement is ignored for `localhost.\n            secure: true,\n            // Forbids JavaScript from accessing the cookie.\n            httpOnly: true\n        });\n\n        this.reply.header(\"cache-control\", `no-cache=\"Set-Cookie\"`);\n    }\n}\n\nexport const SetIdTokenCookie = createImplementation({\n    abstraction: AfterAuthenticationEventHandler,\n    implementation: SetIdTokenCookieImpl,\n    dependencies: [AuthenticationContext, Reply]\n});\n"],"mappings":"AAAA,OAAOA,GAAG,MAAM,cAAc;AAC9B,SAASC,oBAAoB,QAAQ,qBAAqB;AAC1D,SAASC,KAAK,QAAQ,iBAAiB;AACvC,SAASC,+BAA+B;AACxC,SAASC,qBAAqB;AAE9B,MAAMC,iBAAiB,GAAGA,CAAA,KAAM;EAC5B,MAAMC,OAAO,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE;EAC9B,OAAO,IAAIC,IAAI,CAAC,IAAIA,IAAI,CAAC,CAAC,CAACC,OAAO,CAAC,CAAC,GAAGF,OAAO,GAAG,EAAE,CAAC;AACxD,CAAC;AAED,MAAMG,MAAM,GAAIC,SAA6B,IAAK;EAC9C,OAAOA,SAAS,GAAG,IAAIH,IAAI,CAACG,SAAS,GAAG,IAAI,CAAC,GAAGL,iBAAiB,CAAC,CAAC;AACvE,CAAC;AAED,MAAMM,oBAAoB,CAAsD;EAC5EC,WAAWA,CACCC,qBAAsD,EACtDC,KAAsB,EAChC;IAAA,KAFUD,qBAAsD,GAAtDA,qBAAsD;IAAA,KACtDC,KAAsB,GAAtBA,KAAsB;EAC/B;EAEH,MAAMC,MAAMA,CAAA,EAAkB;IAC1B,MAAMC,KAAK,GAAG,IAAI,CAACH,qBAAqB,CAACI,YAAY,CAAC,CAAC;IAEvD,IAAI,CAACD,KAAK,EAAE;MACR;IACJ;;IAEA;IACA;IACA,MAAME,SAAS,GAAGlB,GAAG,CAACmB,MAAM,CAACH,KAAK,EAAE;MAAEI,IAAI,EAAE;IAAK,CAAC,CAAC;IACnD,MAAMC,SAAS,GAAGH,SAAS,GAAGT,MAAM,CAACS,SAAS,CAACI,GAAG,CAAC,GAAGjB,iBAAiB,CAAC,CAAC;;IAEzE;IACA,IAAI,CAACS,KAAK,CAACS,SAAS,CAAC,cAAc,EAAEP,KAAK,EAAE;MACxCQ,IAAI,EAAE,GAAG;MACTC,OAAO,EAAEJ,SAAS;MAClB;MACAK,QAAQ,EAAE,MAAM;MAChB;MACA;MACAC,MAAM,EAAE,IAAI;MACZ;MACAC,QAAQ,EAAE;IACd,CAAC,CAAC;IAEF,IAAI,CAACd,KAAK,CAACe,MAAM,CAAC,eAAe,EAAE,uBAAuB,CAAC;EAC/D;AACJ;AAEA,OAAO,MAAMC,gBAAgB,GAAG7B,oBAAoB,CAAC;EACjD8B,WAAW,EAAE5B,+BAA+B;EAC5C6B,cAAc,EAAErB,oBAAoB;EACpCsB,YAAY,EAAE,CAAC7B,qBAAqB,EAAEF,KAAK;AAC/C,CAAC,CAAC","ignoreList":[]}

package/features/security/authentication/AuthenticationContext/events.d.ts

@@ -8,8 +8,8 @@ export declare class BeforeAuthenticationEvent extends DomainEvent<BeforeAuthent
     eventType: "authentication.beforeAuthentication";
     getHandlerAbstraction(): import("@webiny/di").Abstraction<IEventHandler<BeforeAuthenticationEvent>>;
 }
-export declare const BeforeAuthenticationHandler: import("@webiny/di").Abstraction<IEventHandler<BeforeAuthenticationEvent>>;
-export declare namespace BeforeAuthenticationHandler {
+export declare const BeforeAuthenticationEventHandler: import("@webiny/di").Abstraction<IEventHandler<BeforeAuthenticationEvent>>;
+export declare namespace BeforeAuthenticationEventHandler {
     type Interface = IEventHandler<BeforeAuthenticationEvent>;
     type Event = BeforeAuthenticationEvent;
 }
@@ -21,8 +21,8 @@ export declare class AfterAuthenticationEvent extends DomainEvent<AfterAuthentic
     eventType: "authentication.afterAuthentication";
     getHandlerAbstraction(): import("@webiny/di").Abstraction<IEventHandler<AfterAuthenticationEvent>>;
 }
-export declare const AfterAuthenticationHandler: import("@webiny/di").Abstraction<IEventHandler<AfterAuthenticationEvent>>;
-export declare namespace AfterAuthenticationHandler {
+export declare const AfterAuthenticationEventHandler: import("@webiny/di").Abstraction<IEventHandler<AfterAuthenticationEvent>>;
+export declare namespace AfterAuthenticationEventHandler {
     type Interface = IEventHandler<AfterAuthenticationEvent>;
     type Event = AfterAuthenticationEvent;
 }

package/features/security/authentication/AuthenticationContext/events.js

@@ -3,16 +3,16 @@ import { createAbstraction } from "@webiny/feature/api";
 export class BeforeAuthenticationEvent extends DomainEvent {
   eventType = "authentication.beforeAuthentication";
   getHandlerAbstraction() {
-    return BeforeAuthenticationHandler;
+    return BeforeAuthenticationEventHandler;
   }
 }
-export const BeforeAuthenticationHandler = createAbstraction("BeforeAuthenticationHandler");
+export const BeforeAuthenticationEventHandler = createAbstraction("BeforeAuthenticationEventHandler");
 export class AfterAuthenticationEvent extends DomainEvent {
   eventType = "authentication.afterAuthentication";
   getHandlerAbstraction() {
-    return AfterAuthenticationHandler;
+    return AfterAuthenticationEventHandler;
   }
 }
-export const AfterAuthenticationHandler = createAbstraction("AfterAuthenticationHandler");
+export const AfterAuthenticationEventHandler = createAbstraction("AfterAuthenticationEventHandler");
 
 //# sourceMappingURL=events.js.map

package/features/security/authentication/AuthenticationContext/events.js.map

@@ -1 +1 @@
-{"version":3,"names":["DomainEvent","createAbstraction","BeforeAuthenticationEvent","eventType","getHandlerAbstraction","BeforeAuthenticationHandler","AfterAuthenticationEvent","AfterAuthenticationHandler"],"sources":["events.ts"],"sourcesContent":["import { DomainEvent } from \"~/features/eventPublisher/index.js\";\nimport { createAbstraction } from \"@webiny/feature/api\";\nimport type { IEventHandler } from \"~/features/eventPublisher/index.js\";\nimport type { Identity } from \"~/features/security/IdentityContext/Identity.js\";\n\nexport interface BeforeAuthenticationPayload {\n    token: string;\n}\n\nexport class BeforeAuthenticationEvent extends DomainEvent<BeforeAuthenticationPayload> {\n    eventType = \"authentication.beforeAuthentication\" as const;\n\n    getHandlerAbstraction() {\n        return BeforeAuthenticationHandler;\n    }\n}\n\nexport const BeforeAuthenticationHandler = createAbstraction<\n    IEventHandler<BeforeAuthenticationEvent>\n>(\"BeforeAuthenticationHandler\");\n\nexport namespace BeforeAuthenticationHandler {\n    export type Interface = IEventHandler<BeforeAuthenticationEvent>;\n    export type Event = BeforeAuthenticationEvent;\n}\n\nexport interface AfterAuthenticationPayload {\n    identity: Identity;\n    token: string;\n}\n\nexport class AfterAuthenticationEvent extends DomainEvent<AfterAuthenticationPayload> {\n    eventType = \"authentication.afterAuthentication\" as const;\n\n    getHandlerAbstraction() {\n        return AfterAuthenticationHandler;\n    }\n}\n\nexport const AfterAuthenticationHandler = createAbstraction<\n    IEventHandler<AfterAuthenticationEvent>\n>(\"AfterAuthenticationHandler\");\n\nexport namespace AfterAuthenticationHandler {\n    export type Interface = IEventHandler<AfterAuthenticationEvent>;\n    export type Event = AfterAuthenticationEvent;\n}\n"],"mappings":"AAAA,SAASA,WAAW;AACpB,SAASC,iBAAiB,QAAQ,qBAAqB;AAQvD,OAAO,MAAMC,yBAAyB,SAASF,WAAW,CAA8B;EACpFG,SAAS,GAAG,qCAAqC;EAEjDC,qBAAqBA,CAAA,EAAG;IACpB,OAAOC,2BAA2B;EACtC;AACJ;AAEA,OAAO,MAAMA,2BAA2B,GAAGJ,iBAAiB,CAE1D,6BAA6B,CAAC;AAYhC,OAAO,MAAMK,wBAAwB,SAASN,WAAW,CAA6B;EAClFG,SAAS,GAAG,oCAAoC;EAEhDC,qBAAqBA,CAAA,EAAG;IACpB,OAAOG,0BAA0B;EACrC;AACJ;AAEA,OAAO,MAAMA,0BAA0B,GAAGN,iBAAiB,CAEzD,4BAA4B,CAAC","ignoreList":[]}
+{"version":3,"names":["DomainEvent","createAbstraction","BeforeAuthenticationEvent","eventType","getHandlerAbstraction","BeforeAuthenticationEventHandler","AfterAuthenticationEvent","AfterAuthenticationEventHandler"],"sources":["events.ts"],"sourcesContent":["import { DomainEvent } from \"~/features/eventPublisher/index.js\";\nimport { createAbstraction } from \"@webiny/feature/api\";\nimport type { IEventHandler } from \"~/features/eventPublisher/index.js\";\nimport type { Identity } from \"~/features/security/IdentityContext/Identity.js\";\n\nexport interface BeforeAuthenticationPayload {\n    token: string;\n}\n\nexport class BeforeAuthenticationEvent extends DomainEvent<BeforeAuthenticationPayload> {\n    eventType = \"authentication.beforeAuthentication\" as const;\n\n    getHandlerAbstraction() {\n        return BeforeAuthenticationEventHandler;\n    }\n}\n\nexport const BeforeAuthenticationEventHandler = createAbstraction<\n    IEventHandler<BeforeAuthenticationEvent>\n>(\"BeforeAuthenticationEventHandler\");\n\nexport namespace BeforeAuthenticationEventHandler {\n    export type Interface = IEventHandler<BeforeAuthenticationEvent>;\n    export type Event = BeforeAuthenticationEvent;\n}\n\nexport interface AfterAuthenticationPayload {\n    identity: Identity;\n    token: string;\n}\n\nexport class AfterAuthenticationEvent extends DomainEvent<AfterAuthenticationPayload> {\n    eventType = \"authentication.afterAuthentication\" as const;\n\n    getHandlerAbstraction() {\n        return AfterAuthenticationEventHandler;\n    }\n}\n\nexport const AfterAuthenticationEventHandler = createAbstraction<\n    IEventHandler<AfterAuthenticationEvent>\n>(\"AfterAuthenticationEventHandler\");\n\nexport namespace AfterAuthenticationEventHandler {\n    export type Interface = IEventHandler<AfterAuthenticationEvent>;\n    export type Event = AfterAuthenticationEvent;\n}\n"],"mappings":"AAAA,SAASA,WAAW;AACpB,SAASC,iBAAiB,QAAQ,qBAAqB;AAQvD,OAAO,MAAMC,yBAAyB,SAASF,WAAW,CAA8B;EACpFG,SAAS,GAAG,qCAAqC;EAEjDC,qBAAqBA,CAAA,EAAG;IACpB,OAAOC,gCAAgC;EAC3C;AACJ;AAEA,OAAO,MAAMA,gCAAgC,GAAGJ,iBAAiB,CAE/D,kCAAkC,CAAC;AAYrC,OAAO,MAAMK,wBAAwB,SAASN,WAAW,CAA6B;EAClFG,SAAS,GAAG,oCAAoC;EAEhDC,qBAAqBA,CAAA,EAAG;IACpB,OAAOG,+BAA+B;EAC1C;AACJ;AAEA,OAAO,MAAMA,+BAA+B,GAAGN,iBAAiB,CAE9D,iCAAiC,CAAC","ignoreList":[]}

package/features/security/login/abstractions.d.ts

@@ -8,8 +8,8 @@ export declare class AfterLoginEvent extends DomainEvent<AfterLoginPayload> {
     eventType: "login.afterLogin";
     getHandlerAbstraction(): import("@webiny/di").Abstraction<IEventHandler<AfterLoginEvent>>;
 }
-export declare const AfterLoginHandler: import("@webiny/di").Abstraction<IEventHandler<AfterLoginEvent>>;
-export declare namespace AfterLoginHandler {
+export declare const AfterLoginEventHandler: import("@webiny/di").Abstraction<IEventHandler<AfterLoginEvent>>;
+export declare namespace AfterLoginEventHandler {
     type Interface = IEventHandler<AfterLoginEvent>;
     type Event = AfterLoginEvent;
 }

package/features/security/login/abstractions.js

@@ -3,9 +3,9 @@ import { createAbstraction } from "@webiny/feature/api";
 export class AfterLoginEvent extends DomainEvent {
   eventType = "login.afterLogin";
   getHandlerAbstraction() {
-    return AfterLoginHandler;
+    return AfterLoginEventHandler;
   }
 }
-export const AfterLoginHandler = createAbstraction("AfterLoginHandler");
+export const AfterLoginEventHandler = createAbstraction("AfterLoginEventHandler");
 
 //# sourceMappingURL=abstractions.js.map

package/features/security/login/abstractions.js.map

@@ -1 +1 @@
-{"version":3,"names":["DomainEvent","createAbstraction","AfterLoginEvent","eventType","getHandlerAbstraction","AfterLoginHandler"],"sources":["abstractions.ts"],"sourcesContent":["import { DomainEvent } from \"~/features/eventPublisher/index.js\";\nimport type { IEventHandler } from \"~/features/eventPublisher/index.js\";\nimport { createAbstraction } from \"@webiny/feature/api\";\nimport { Identity } from \"~/features/security/IdentityContext/index.js\";\n\nexport interface AfterLoginPayload {\n    identity: Identity;\n}\n\nexport class AfterLoginEvent extends DomainEvent<AfterLoginPayload> {\n    eventType = \"login.afterLogin\" as const;\n\n    getHandlerAbstraction() {\n        return AfterLoginHandler;\n    }\n}\n\nexport const AfterLoginHandler =\n    createAbstraction<IEventHandler<AfterLoginEvent>>(\"AfterLoginHandler\");\n\nexport namespace AfterLoginHandler {\n    export type Interface = IEventHandler<AfterLoginEvent>;\n    export type Event = AfterLoginEvent;\n}\n"],"mappings":"AAAA,SAASA,WAAW;AAEpB,SAASC,iBAAiB,QAAQ,qBAAqB;AAOvD,OAAO,MAAMC,eAAe,SAASF,WAAW,CAAoB;EAChEG,SAAS,GAAG,kBAAkB;EAE9BC,qBAAqBA,CAAA,EAAG;IACpB,OAAOC,iBAAiB;EAC5B;AACJ;AAEA,OAAO,MAAMA,iBAAiB,GAC1BJ,iBAAiB,CAAiC,mBAAmB,CAAC","ignoreList":[]}
+{"version":3,"names":["DomainEvent","createAbstraction","AfterLoginEvent","eventType","getHandlerAbstraction","AfterLoginEventHandler"],"sources":["abstractions.ts"],"sourcesContent":["import { DomainEvent } from \"~/features/eventPublisher/index.js\";\nimport type { IEventHandler } from \"~/features/eventPublisher/index.js\";\nimport { createAbstraction } from \"@webiny/feature/api\";\nimport { Identity } from \"~/features/security/IdentityContext/index.js\";\n\nexport interface AfterLoginPayload {\n    identity: Identity;\n}\n\nexport class AfterLoginEvent extends DomainEvent<AfterLoginPayload> {\n    eventType = \"login.afterLogin\" as const;\n\n    getHandlerAbstraction() {\n        return AfterLoginEventHandler;\n    }\n}\n\nexport const AfterLoginEventHandler =\n    createAbstraction<IEventHandler<AfterLoginEvent>>(\"AfterLoginEventHandler\");\n\nexport namespace AfterLoginEventHandler {\n    export type Interface = IEventHandler<AfterLoginEvent>;\n    export type Event = AfterLoginEvent;\n}\n"],"mappings":"AAAA,SAASA,WAAW;AAEpB,SAASC,iBAAiB,QAAQ,qBAAqB;AAOvD,OAAO,MAAMC,eAAe,SAASF,WAAW,CAAoB;EAChEG,SAAS,GAAG,kBAAkB;EAE9BC,qBAAqBA,CAAA,EAAG;IACpB,OAAOC,sBAAsB;EACjC;AACJ;AAEA,OAAO,MAAMA,sBAAsB,GAC/BJ,iBAAiB,CAAiC,wBAAwB,CAAC","ignoreList":[]}

package/features/security/permissions/createPermissions.d.ts

@@ -0,0 +1,8 @@
+import type { PermissionSchemaConfig } from "./types.js";
+import type { Permissions } from "./types.js";
+export declare function createPermissions<const S extends PermissionSchemaConfig>(schema: S): {
+    Abstraction: import("@webiny/di").Abstraction<Permissions<S>>;
+    Implementation: import("@webiny/di").Constructor<Permissions<S>> & {
+        __abstraction: import("@webiny/di").Abstraction<Permissions<S>>;
+    };
+};

package/features/security/permissions/createPermissions.js

@@ -0,0 +1,240 @@
+import { createAbstraction } from "@webiny/feature/api";
+import { IdentityContext } from "../IdentityContext/index.js";
+function buildEntityMap(schema) {
+  const map = new Map();
+  for (const entity of schema.entities ?? []) {
+    const actions = new Set();
+    for (const action of entity.actions ?? []) {
+      actions.add(action.name);
+    }
+    map.set(entity.id, {
+      permission: entity.permission,
+      actions,
+      hasOwn: entity.scopes.includes("own")
+    });
+  }
+  return map;
+}
+function getEntity(entityMap, entityId) {
+  const entity = entityMap.get(entityId);
+  if (!entity) {
+    throw new Error(`Unknown entity "${entityId}" in permission schema.`);
+  }
+  return entity;
+}
+export function createPermissions(schema) {
+  const entityMap = buildEntityMap(schema);
+  const fullAccessName = `${schema.prefix}.*`;
+  class SchemaPermissions {
+    constructor(identityContext) {
+      this.identityContext = identityContext;
+    }
+    async canAccess(entityId, item) {
+      if (await this.identityContext.hasFullAccess()) {
+        return true;
+      }
+      if (await this.hasFullSchemaAccess()) {
+        return true;
+      }
+      const entity = getEntity(entityMap, entityId);
+      const permissions = await this.getEntityPermissions(entity.permission);
+      if (!permissions.length) {
+        return false;
+      }
+      // No item — just check entity-level access.
+      if (item === undefined) {
+        return true;
+      }
+      // Item provided — if all permissions require own, verify ownership.
+      const ownOnly = !permissions.some(p => !p.own);
+      if (!ownOnly) {
+        return true;
+      }
+      const identity = this.identityContext.getIdentity();
+      return item.createdBy?.id === identity.id;
+    }
+    async onlyOwnRecords(entityId) {
+      if (await this.identityContext.hasFullAccess()) {
+        return false;
+      }
+      if (await this.hasFullSchemaAccess()) {
+        return false;
+      }
+      const entity = getEntity(entityMap, entityId);
+      const permissions = await this.getEntityPermissions(entity.permission);
+      if (!permissions.length) {
+        return false;
+      }
+      return !permissions.some(p => !p.own);
+    }
+    async canRead(entityId) {
+      if (await this.identityContext.hasFullAccess()) {
+        return true;
+      }
+      if (await this.hasFullSchemaAccess()) {
+        return true;
+      }
+      const entity = getEntity(entityMap, entityId);
+      const permissions = await this.getEntityPermissions(entity.permission);
+      if (!permissions.length) {
+        return false;
+      }
+      return permissions.some(permission => {
+        if (typeof permission.rwd !== "string") {
+          return true;
+        }
+        return permission.rwd.includes("r");
+      });
+    }
+    async canCreate(entityId) {
+      if (await this.identityContext.hasFullAccess()) {
+        return true;
+      }
+      if (await this.hasFullSchemaAccess()) {
+        return true;
+      }
+      const entity = getEntity(entityMap, entityId);
+      const permissions = await this.getEntityPermissions(entity.permission);
+      if (!permissions.length) {
+        return false;
+      }
+      return permissions.some(permission => {
+        if (typeof permission.rwd !== "string") {
+          return true;
+        }
+        return permission.rwd.includes("w");
+      });
+    }
+    async canEdit(entityId, item) {
+      if (await this.identityContext.hasFullAccess()) {
+        return true;
+      }
+      if (await this.hasFullSchemaAccess()) {
+        return true;
+      }
+      const entity = getEntity(entityMap, entityId);
+      const permissions = await this.getEntityPermissions(entity.permission);
+      if (!permissions.length) {
+        return false;
+      }
+      const identity = this.identityContext.getIdentity();
+      return permissions.some(permission => {
+        if (permission.own) {
+          // No item provided (new/unsaved) — allow access.
+          if (!item?.createdBy) {
+            return true;
+          }
+          return item.createdBy.id === identity.id;
+        }
+        if (typeof permission.rwd !== "string") {
+          return true;
+        }
+        return permission.rwd.includes("w");
+      });
+    }
+    async canDelete(entityId, item) {
+      if (await this.identityContext.hasFullAccess()) {
+        return true;
+      }
+      if (await this.hasFullSchemaAccess()) {
+        return true;
+      }
+      const entity = getEntity(entityMap, entityId);
+      const permissions = await this.getEntityPermissions(entity.permission);
+      if (!permissions.length) {
+        return false;
+      }
+      const identity = this.identityContext.getIdentity();
+      return permissions.some(permission => {
+        if (permission.own) {
+          return item?.createdBy?.id === identity.id;
+        }
+        if (typeof permission.rwd !== "string") {
+          return true;
+        }
+        return permission.rwd.includes("d");
+      });
+    }
+    async canPublish(entityId) {
+      if (await this.identityContext.hasFullAccess()) {
+        return true;
+      }
+      if (await this.hasFullSchemaAccess()) {
+        return true;
+      }
+      const entity = getEntity(entityMap, entityId);
+      const permissions = await this.getEntityPermissions(entity.permission);
+      if (!permissions.length) {
+        return false;
+      }
+      return permissions.some(permission => {
+        return permission.pw?.includes("p");
+      });
+    }
+    async canUnpublish(entityId) {
+      if (await this.identityContext.hasFullAccess()) {
+        return true;
+      }
+      if (await this.hasFullSchemaAccess()) {
+        return true;
+      }
+      const entity = getEntity(entityMap, entityId);
+      const permissions = await this.getEntityPermissions(entity.permission);
+      if (!permissions.length) {
+        return false;
+      }
+      return permissions.some(permission => {
+        return permission.pw?.includes("u");
+      });
+    }
+    async canAction(action, entityId) {
+      if (await this.identityContext.hasFullAccess()) {
+        return true;
+      }
+      if (await this.hasFullSchemaAccess()) {
+        return true;
+      }
+      const entity = getEntity(entityMap, entityId);
+      const permissions = await this.getEntityPermissions(entity.permission);
+      if (!permissions.length) {
+        return false;
+      }
+      return permissions.some(permission => {
+        return permission[action] === true;
+      });
+    }
+    async getEntityPermissions(entityPermission) {
+      const permissions = await this.identityContext.getPermissions(entityPermission);
+      if (permissions.length) {
+        return permissions;
+      }
+      // Fall back to the schema wildcard (e.g. "test.*") — its flags apply to all entities.
+      const wildcard = await this.identityContext.getPermission(fullAccessName);
+      return wildcard ? [wildcard] : [];
+    }
+    async hasFullSchemaAccess() {
+      const permission = await this.identityContext.getPermission(fullAccessName);
+      if (!permission) {
+        return false;
+      }
+      // Only treat as full access if the permission has no `rwd` flag.
+      // A permission like { name: "wb.*", rwd: "r" } should NOT grant full access.
+      const keys = Object.keys(permission).filter(k => k !== "name");
+      const hasRwd = keys.includes("rwd");
+
+      // It's full-access only if there's no `rwd` flag.
+      return !hasRwd;
+    }
+  }
+  const Abstraction = createAbstraction(`${schema.prefix}:Permissions`);
+  const Implementation = Abstraction.createImplementation({
+    implementation: SchemaPermissions,
+    dependencies: [IdentityContext]
+  });
+  return {
+    Abstraction,
+    Implementation
+  };
+}
+
+//# sourceMappingURL=createPermissions.js.map