@webiny/api-core 0.0.0-unstable.e2758ee1cf → 0.0.0-unstable.e6f0dc8ca7

package/features/security/permissions/createPermissions.js

@@ -1,4 +1,5 @@
 import { createAbstraction } from "@webiny/feature/api";
+import { createFeature } from "@webiny/feature/api";
 import { IdentityContext } from "../IdentityContext/index.js";
 function buildEntityMap(schema) {
   const map = new Map();
@@ -22,219 +23,228 @@ function getEntity(entityMap, entityId) {
   }
   return entity;
 }
-export function createPermissions(schema) {
-  const entityMap = buildEntityMap(schema);
-  const fullAccessName = `${schema.prefix}.*`;
-  class SchemaPermissions {
-    constructor(identityContext) {
-      this.identityContext = identityContext;
+class SchemaPermissions {
+  constructor(schema, identityContext) {
+    this.entityMap = buildEntityMap(schema);
+    this.fullAccessName = `${schema.prefix}.*`;
+    this.identityContext = identityContext;
+  }
+  async canAccess(entityId, item) {
+    if (await this.identityContext.hasFullAccess()) {
+      return true;
     }
-    async canAccess(entityId, item) {
-      if (await this.identityContext.hasFullAccess()) {
-        return true;
-      }
-      if (await this.hasFullSchemaAccess()) {
-        return true;
-      }
-      const entity = getEntity(entityMap, entityId);
-      const permissions = await this.getEntityPermissions(entity.permission);
-      if (!permissions.length) {
-        return false;
-      }
-      // No item — just check entity-level access.
-      if (item === undefined) {
-        return true;
-      }
-      // Item provided — if all permissions require own, verify ownership.
-      const ownOnly = !permissions.some(p => !p.own);
-      if (!ownOnly) {
-        return true;
-      }
-      const identity = this.identityContext.getIdentity();
-      return item.createdBy?.id === identity.id;
+    if (await this.hasFullSchemaAccess()) {
+      return true;
     }
-    async onlyOwnRecords(entityId) {
-      if (await this.identityContext.hasFullAccess()) {
-        return false;
-      }
-      if (await this.hasFullSchemaAccess()) {
-        return false;
-      }
-      const entity = getEntity(entityMap, entityId);
-      const permissions = await this.getEntityPermissions(entity.permission);
-      if (!permissions.length) {
-        return false;
-      }
-      return !permissions.some(p => !p.own);
+    const entity = getEntity(this.entityMap, entityId);
+    const permissions = await this.getEntityPermissions(entity.permission);
+    if (!permissions.length) {
+      return false;
     }
-    async canRead(entityId) {
-      if (await this.identityContext.hasFullAccess()) {
-        return true;
-      }
-      if (await this.hasFullSchemaAccess()) {
-        return true;
-      }
-      const entity = getEntity(entityMap, entityId);
-      const permissions = await this.getEntityPermissions(entity.permission);
-      if (!permissions.length) {
-        return false;
-      }
-      return permissions.some(permission => {
-        if (typeof permission.rwd !== "string") {
-          return true;
-        }
-        return permission.rwd.includes("r");
-      });
+    // No item — just check entity-level access.
+    if (item === undefined) {
+      return true;
     }
-    async canCreate(entityId) {
-      if (await this.identityContext.hasFullAccess()) {
-        return true;
-      }
-      if (await this.hasFullSchemaAccess()) {
-        return true;
-      }
-      const entity = getEntity(entityMap, entityId);
-      const permissions = await this.getEntityPermissions(entity.permission);
-      if (!permissions.length) {
-        return false;
-      }
-      return permissions.some(permission => {
-        if (typeof permission.rwd !== "string") {
-          return true;
-        }
-        return permission.rwd.includes("w");
-      });
+    // Item provided — if all permissions require own, verify ownership.
+    const ownOnly = !permissions.some(p => !p.own);
+    if (!ownOnly) {
+      return true;
     }
-    async canEdit(entityId, item) {
-      if (await this.identityContext.hasFullAccess()) {
-        return true;
-      }
-      if (await this.hasFullSchemaAccess()) {
-        return true;
-      }
-      const entity = getEntity(entityMap, entityId);
-      const permissions = await this.getEntityPermissions(entity.permission);
-      if (!permissions.length) {
-        return false;
-      }
-      const identity = this.identityContext.getIdentity();
-      return permissions.some(permission => {
-        if (permission.own) {
-          // No item provided (new/unsaved) — allow access.
-          if (!item?.createdBy) {
-            return true;
-          }
-          return item.createdBy.id === identity.id;
-        }
-        if (typeof permission.rwd !== "string") {
-          return true;
-        }
-        return permission.rwd.includes("w");
-      });
+    const identity = this.identityContext.getIdentity();
+    return item.createdBy?.id === identity.id;
+  }
+  async onlyOwnRecords(entityId) {
+    if (await this.identityContext.hasFullAccess()) {
+      return false;
+    }
+    if (await this.hasFullSchemaAccess()) {
+      return false;
+    }
+    const entity = getEntity(this.entityMap, entityId);
+    const permissions = await this.getEntityPermissions(entity.permission);
+    if (!permissions.length) {
+      return false;
+    }
+    return !permissions.some(p => !p.own);
+  }
+  async canRead(entityId) {
+    if (await this.identityContext.hasFullAccess()) {
+      return true;
+    }
+    if (await this.hasFullSchemaAccess()) {
+      return true;
     }
-    async canDelete(entityId, item) {
-      if (await this.identityContext.hasFullAccess()) {
+    const entity = getEntity(this.entityMap, entityId);
+    const permissions = await this.getEntityPermissions(entity.permission);
+    if (!permissions.length) {
+      return false;
+    }
+    return permissions.some(permission => {
+      if (typeof permission.rwd !== "string") {
         return true;
       }
-      if (await this.hasFullSchemaAccess()) {
+      return permission.rwd.includes("r");
+    });
+  }
+  async canCreate(entityId) {
+    if (await this.identityContext.hasFullAccess()) {
+      return true;
+    }
+    if (await this.hasFullSchemaAccess()) {
+      return true;
+    }
+    const entity = getEntity(this.entityMap, entityId);
+    const permissions = await this.getEntityPermissions(entity.permission);
+    if (!permissions.length) {
+      return false;
+    }
+    return permissions.some(permission => {
+      if (typeof permission.rwd !== "string") {
         return true;
       }
-      const entity = getEntity(entityMap, entityId);
-      const permissions = await this.getEntityPermissions(entity.permission);
-      if (!permissions.length) {
-        return false;
-      }
-      const identity = this.identityContext.getIdentity();
-      return permissions.some(permission => {
-        if (permission.own) {
-          return item?.createdBy?.id === identity.id;
-        }
-        if (typeof permission.rwd !== "string") {
+      return permission.rwd.includes("w");
+    });
+  }
+  async canEdit(entityId, item) {
+    if (await this.identityContext.hasFullAccess()) {
+      return true;
+    }
+    if (await this.hasFullSchemaAccess()) {
+      return true;
+    }
+    const entity = getEntity(this.entityMap, entityId);
+    const permissions = await this.getEntityPermissions(entity.permission);
+    if (!permissions.length) {
+      return false;
+    }
+    const identity = this.identityContext.getIdentity();
+    return permissions.some(permission => {
+      if (permission.own) {
+        // No item provided (new/unsaved) — allow access.
+        if (!item?.createdBy) {
           return true;
         }
-        return permission.rwd.includes("d");
-      });
-    }
-    async canPublish(entityId) {
-      if (await this.identityContext.hasFullAccess()) {
-        return true;
+        return item.createdBy.id === identity.id;
       }
-      if (await this.hasFullSchemaAccess()) {
+      if (typeof permission.rwd !== "string") {
         return true;
       }
-      const entity = getEntity(entityMap, entityId);
-      const permissions = await this.getEntityPermissions(entity.permission);
-      if (!permissions.length) {
-        return false;
-      }
-      return permissions.some(permission => {
-        return permission.pw?.includes("p");
-      });
+      return permission.rwd.includes("w");
+    });
+  }
+  async canDelete(entityId, item) {
+    if (await this.identityContext.hasFullAccess()) {
+      return true;
     }
-    async canUnpublish(entityId) {
-      if (await this.identityContext.hasFullAccess()) {
-        return true;
-      }
-      if (await this.hasFullSchemaAccess()) {
-        return true;
-      }
-      const entity = getEntity(entityMap, entityId);
-      const permissions = await this.getEntityPermissions(entity.permission);
-      if (!permissions.length) {
-        return false;
-      }
-      return permissions.some(permission => {
-        return permission.pw?.includes("u");
-      });
+    if (await this.hasFullSchemaAccess()) {
+      return true;
     }
-    async canAction(action, entityId) {
-      if (await this.identityContext.hasFullAccess()) {
-        return true;
+    const entity = getEntity(this.entityMap, entityId);
+    const permissions = await this.getEntityPermissions(entity.permission);
+    if (!permissions.length) {
+      return false;
+    }
+    const identity = this.identityContext.getIdentity();
+    return permissions.some(permission => {
+      if (permission.own) {
+        return item?.createdBy?.id === identity.id;
       }
-      if (await this.hasFullSchemaAccess()) {
+      if (typeof permission.rwd !== "string") {
         return true;
       }
-      const entity = getEntity(entityMap, entityId);
-      const permissions = await this.getEntityPermissions(entity.permission);
-      if (!permissions.length) {
-        return false;
-      }
-      return permissions.some(permission => {
-        return permission[action] === true;
-      });
-    }
-    async getEntityPermissions(entityPermission) {
-      const permissions = await this.identityContext.getPermissions(entityPermission);
-      if (permissions.length) {
-        return permissions;
-      }
-      // Fall back to the schema wildcard (e.g. "test.*") — its flags apply to all entities.
-      const wildcard = await this.identityContext.getPermission(fullAccessName);
-      return wildcard ? [wildcard] : [];
-    }
-    async hasFullSchemaAccess() {
-      const permission = await this.identityContext.getPermission(fullAccessName);
-      if (!permission) {
-        return false;
-      }
-      // Only treat as full access if the permission has no `rwd` flag.
-      // A permission like { name: "wb.*", rwd: "r" } should NOT grant full access.
-      const keys = Object.keys(permission).filter(k => k !== "name");
-      const hasRwd = keys.includes("rwd");
+      return permission.rwd.includes("d");
+    });
+  }
+  async canPublish(entityId) {
+    if (await this.identityContext.hasFullAccess()) {
+      return true;
+    }
+    if (await this.hasFullSchemaAccess()) {
+      return true;
+    }
+    const entity = getEntity(this.entityMap, entityId);
+    const permissions = await this.getEntityPermissions(entity.permission);
+    if (!permissions.length) {
+      return false;
+    }
+    return permissions.some(permission => {
+      return permission.pw?.includes("p");
+    });
+  }
+  async canUnpublish(entityId) {
+    if (await this.identityContext.hasFullAccess()) {
+      return true;
+    }
+    if (await this.hasFullSchemaAccess()) {
+      return true;
+    }
+    const entity = getEntity(this.entityMap, entityId);
+    const permissions = await this.getEntityPermissions(entity.permission);
+    if (!permissions.length) {
+      return false;
+    }
+    return permissions.some(permission => {
+      return permission.pw?.includes("u");
+    });
+  }
+  async canAction(action, entityId) {
+    if (await this.identityContext.hasFullAccess()) {
+      return true;
+    }
+    if (await this.hasFullSchemaAccess()) {
+      return true;
+    }
+    const entity = getEntity(this.entityMap, entityId);
+    const permissions = await this.getEntityPermissions(entity.permission);
+    if (!permissions.length) {
+      return false;
+    }
+    return permissions.some(permission => {
+      return permission[action] === true;
+    });
+  }
+  async getEntityPermissions(entityPermission) {
+    const permissions = await this.identityContext.getPermissions(entityPermission);
+    if (permissions.length) {
+      return permissions;
+    }
+    // Fall back to the schema wildcard (e.g. "test.*") — its flags apply to all entities.
+    const wildcard = await this.identityContext.getPermission(this.fullAccessName);
+    return wildcard ? [wildcard] : [];
+  }
+  async hasFullSchemaAccess() {
+    const permission = await this.identityContext.getPermission(this.fullAccessName);
+    if (!permission) {
+      return false;
+    }
+    // Only treat as full access if the permission has no `rwd` flag.
+    // A permission like { name: "wb.*", rwd: "r" } should NOT grant full access.
+    const keys = Object.keys(permission).filter(k => k !== "name");
+    const hasRwd = keys.includes("rwd");
 
-      // It's full-access only if there's no `rwd` flag.
-      return !hasRwd;
+    // It's full-access only if there's no `rwd` flag.
+    return !hasRwd;
+  }
+}
+export function createPermissionsAbstraction(schema) {
+  return createAbstraction(`${schema.prefix}:Permissions`);
+}
+export function createPermissionsFeature(schema, abstraction) {
+  class PermissionsImpl extends SchemaPermissions {
+    constructor(identityContext) {
+      super(schema, identityContext);
     }
   }
-  const Abstraction = createAbstraction(`${schema.prefix}:Permissions`);
-  const Implementation = Abstraction.createImplementation({
-    implementation: SchemaPermissions,
+  const Implementation = abstraction.createImplementation({
+    implementation: PermissionsImpl,
     dependencies: [IdentityContext]
   });
-  return {
-    Abstraction,
-    Implementation
-  };
+  return createFeature({
+    name: `${schema.prefix}:Permissions`,
+    register(container) {
+      container.register(Implementation);
+    }
+  });
 }
 
 //# sourceMappingURL=createPermissions.js.map

package/features/security/permissions/createPermissions.js.map

@@ -1 +1 @@
-{"version":3,"names":["createAbstraction","IdentityContext","buildEntityMap","schema","map","Map","entity","entities","actions","Set","action","add","name","set","id","permission","hasOwn","scopes","includes","getEntity","entityMap","entityId","get","Error","createPermissions","fullAccessName","prefix","SchemaPermissions","constructor","identityContext","canAccess","item","hasFullAccess","hasFullSchemaAccess","permissions","getEntityPermissions","length","undefined","ownOnly","some","p","own","identity","getIdentity","createdBy","onlyOwnRecords","canRead","rwd","canCreate","canEdit","canDelete","canPublish","pw","canUnpublish","canAction","entityPermission","getPermissions","wildcard","getPermission","keys","Object","filter","k","hasRwd","Abstraction","Implementation","createImplementation","implementation","dependencies"],"sources":["createPermissions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport { IdentityContext } from \"~/features/security/IdentityContext/index.js\";\nimport type { PermissionSchemaConfig } from \"./types.js\";\nimport type { OwnableItem } from \"./types.js\";\nimport type { Permissions } from \"./types.js\";\n\ninterface EntityLookup {\n    permission: string;\n    actions: Set<string>;\n    hasOwn: boolean;\n}\n\nfunction buildEntityMap(schema: PermissionSchemaConfig): Map<string, EntityLookup> {\n    const map = new Map<string, EntityLookup>();\n    for (const entity of schema.entities ?? []) {\n        const actions = new Set<string>();\n        for (const action of entity.actions ?? []) {\n            actions.add(action.name);\n        }\n        map.set(entity.id, {\n            permission: entity.permission,\n            actions,\n            hasOwn: entity.scopes.includes(\"own\")\n        });\n    }\n    return map;\n}\n\nfunction getEntity(entityMap: Map<string, EntityLookup>, entityId: string): EntityLookup {\n    const entity = entityMap.get(entityId);\n    if (!entity) {\n        throw new Error(`Unknown entity \"${entityId}\" in permission schema.`);\n    }\n    return entity;\n}\n\nexport function createPermissions<const S extends PermissionSchemaConfig>(schema: S) {\n    const entityMap = buildEntityMap(schema);\n    const fullAccessName = `${schema.prefix}.*`;\n\n    class SchemaPermissions {\n        constructor(private identityContext: IdentityContext.Interface) {}\n\n        async canAccess(entityId: string, item?: OwnableItem): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            // No item — just check entity-level access.\n            if (item === undefined) {\n                return true;\n            }\n            // Item provided — if all permissions require own, verify ownership.\n            const ownOnly = !permissions.some(p => !p.own);\n            if (!ownOnly) {\n                return true;\n            }\n            const identity = this.identityContext.getIdentity();\n            return item.createdBy?.id === identity.id;\n        }\n\n        async onlyOwnRecords(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return false;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return false;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return !permissions.some(p => !p.own);\n        }\n\n        async canRead(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                if (typeof permission.rwd !== \"string\") {\n                    return true;\n                }\n                return permission.rwd.includes(\"r\");\n            });\n        }\n\n        async canCreate(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                if (typeof permission.rwd !== \"string\") {\n                    return true;\n                }\n                return permission.rwd.includes(\"w\");\n            });\n        }\n\n        async canEdit(entityId: string, item?: OwnableItem): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            const identity = this.identityContext.getIdentity();\n            return permissions.some(permission => {\n                if (permission.own) {\n                    // No item provided (new/unsaved) — allow access.\n                    if (!item?.createdBy) {\n                        return true;\n                    }\n                    return item.createdBy.id === identity.id;\n                }\n                if (typeof permission.rwd !== \"string\") {\n                    return true;\n                }\n                return permission.rwd.includes(\"w\");\n            });\n        }\n\n        async canDelete(entityId: string, item?: OwnableItem): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            const identity = this.identityContext.getIdentity();\n            return permissions.some(permission => {\n                if (permission.own) {\n                    return item?.createdBy?.id === identity.id;\n                }\n                if (typeof permission.rwd !== \"string\") {\n                    return true;\n                }\n                return permission.rwd.includes(\"d\");\n            });\n        }\n\n        async canPublish(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                return permission.pw?.includes(\"p\");\n            });\n        }\n\n        async canUnpublish(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                return permission.pw?.includes(\"u\");\n            });\n        }\n\n        async canAction(action: string, entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                return permission[action] === true;\n            });\n        }\n\n        private async getEntityPermissions(entityPermission: string): Promise<any[]> {\n            const permissions = await this.identityContext.getPermissions(entityPermission);\n            if (permissions.length) {\n                return permissions;\n            }\n            // Fall back to the schema wildcard (e.g. \"test.*\") — its flags apply to all entities.\n            const wildcard = await this.identityContext.getPermission(fullAccessName);\n            return wildcard ? [wildcard] : [];\n        }\n\n        private async hasFullSchemaAccess(): Promise<boolean> {\n            const permission = await this.identityContext.getPermission(fullAccessName);\n            if (!permission) {\n                return false;\n            }\n            // Only treat as full access if the permission has no `rwd` flag.\n            // A permission like { name: \"wb.*\", rwd: \"r\" } should NOT grant full access.\n            const keys = Object.keys(permission).filter(k => k !== \"name\");\n\n            const hasRwd = keys.includes(\"rwd\");\n\n            // It's full-access only if there's no `rwd` flag.\n            return !hasRwd;\n        }\n    }\n\n    const Abstraction = createAbstraction<Permissions<S>>(`${schema.prefix}:Permissions`);\n\n    const Implementation = Abstraction.createImplementation({\n        implementation: SchemaPermissions,\n        dependencies: [IdentityContext]\n    } as any);\n\n    return { Abstraction, Implementation };\n}\n"],"mappings":"AAAA,SAASA,iBAAiB,QAAQ,qBAAqB;AACvD,SAASC,eAAe;AAWxB,SAASC,cAAcA,CAACC,MAA8B,EAA6B;EAC/E,MAAMC,GAAG,GAAG,IAAIC,GAAG,CAAuB,CAAC;EAC3C,KAAK,MAAMC,MAAM,IAAIH,MAAM,CAACI,QAAQ,IAAI,EAAE,EAAE;IACxC,MAAMC,OAAO,GAAG,IAAIC,GAAG,CAAS,CAAC;IACjC,KAAK,MAAMC,MAAM,IAAIJ,MAAM,CAACE,OAAO,IAAI,EAAE,EAAE;MACvCA,OAAO,CAACG,GAAG,CAACD,MAAM,CAACE,IAAI,CAAC;IAC5B;IACAR,GAAG,CAACS,GAAG,CAACP,MAAM,CAACQ,EAAE,EAAE;MACfC,UAAU,EAAET,MAAM,CAACS,UAAU;MAC7BP,OAAO;MACPQ,MAAM,EAAEV,MAAM,CAACW,MAAM,CAACC,QAAQ,CAAC,KAAK;IACxC,CAAC,CAAC;EACN;EACA,OAAOd,GAAG;AACd;AAEA,SAASe,SAASA,CAACC,SAAoC,EAAEC,QAAgB,EAAgB;EACrF,MAAMf,MAAM,GAAGc,SAAS,CAACE,GAAG,CAACD,QAAQ,CAAC;EACtC,IAAI,CAACf,MAAM,EAAE;IACT,MAAM,IAAIiB,KAAK,CAAC,mBAAmBF,QAAQ,yBAAyB,CAAC;EACzE;EACA,OAAOf,MAAM;AACjB;AAEA,OAAO,SAASkB,iBAAiBA,CAAyCrB,MAAS,EAAE;EACjF,MAAMiB,SAAS,GAAGlB,cAAc,CAACC,MAAM,CAAC;EACxC,MAAMsB,cAAc,GAAG,GAAGtB,MAAM,CAACuB,MAAM,IAAI;EAE3C,MAAMC,iBAAiB,CAAC;IACpBC,WAAWA,CAASC,eAA0C,EAAE;MAAA,KAA5CA,eAA0C,GAA1CA,eAA0C;IAAG;IAEjE,MAAMC,SAASA,CAACT,QAAgB,EAAEU,IAAkB,EAAoB;MACpE,IAAI,MAAM,IAAI,CAACF,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA;MACA,IAAIL,IAAI,KAAKM,SAAS,EAAE;QACpB,OAAO,IAAI;MACf;MACA;MACA,MAAMC,OAAO,GAAG,CAACJ,WAAW,CAACK,IAAI,CAACC,CAAC,IAAI,CAACA,CAAC,CAACC,GAAG,CAAC;MAC9C,IAAI,CAACH,OAAO,EAAE;QACV,OAAO,IAAI;MACf;MACA,MAAMI,QAAQ,GAAG,IAAI,CAACb,eAAe,CAACc,WAAW,CAAC,CAAC;MACnD,OAAOZ,IAAI,CAACa,SAAS,EAAE9B,EAAE,KAAK4B,QAAQ,CAAC5B,EAAE;IAC7C;IAEA,MAAM+B,cAAcA,CAACxB,QAAgB,EAAoB;MACrD,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,KAAK;MAChB;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,KAAK;MAChB;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAO,CAACF,WAAW,CAACK,IAAI,CAACC,CAAC,IAAI,CAACA,CAAC,CAACC,GAAG,CAAC;IACzC;IAEA,MAAMK,OAAOA,CAACzB,QAAgB,EAAoB;MAC9C,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,IAAI,OAAOA,UAAU,CAACgC,GAAG,KAAK,QAAQ,EAAE;UACpC,OAAO,IAAI;QACf;QACA,OAAOhC,UAAU,CAACgC,GAAG,CAAC7B,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAM8B,SAASA,CAAC3B,QAAgB,EAAoB;MAChD,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,IAAI,OAAOA,UAAU,CAACgC,GAAG,KAAK,QAAQ,EAAE;UACpC,OAAO,IAAI;QACf;QACA,OAAOhC,UAAU,CAACgC,GAAG,CAAC7B,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAM+B,OAAOA,CAAC5B,QAAgB,EAAEU,IAAkB,EAAoB;MAClE,IAAI,MAAM,IAAI,CAACF,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,MAAMM,QAAQ,GAAG,IAAI,CAACb,eAAe,CAACc,WAAW,CAAC,CAAC;MACnD,OAAOT,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,IAAIA,UAAU,CAAC0B,GAAG,EAAE;UAChB;UACA,IAAI,CAACV,IAAI,EAAEa,SAAS,EAAE;YAClB,OAAO,IAAI;UACf;UACA,OAAOb,IAAI,CAACa,SAAS,CAAC9B,EAAE,KAAK4B,QAAQ,CAAC5B,EAAE;QAC5C;QACA,IAAI,OAAOC,UAAU,CAACgC,GAAG,KAAK,QAAQ,EAAE;UACpC,OAAO,IAAI;QACf;QACA,OAAOhC,UAAU,CAACgC,GAAG,CAAC7B,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAMgC,SAASA,CAAC7B,QAAgB,EAAEU,IAAkB,EAAoB;MACpE,IAAI,MAAM,IAAI,CAACF,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,MAAMM,QAAQ,GAAG,IAAI,CAACb,eAAe,CAACc,WAAW,CAAC,CAAC;MACnD,OAAOT,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,IAAIA,UAAU,CAAC0B,GAAG,EAAE;UAChB,OAAOV,IAAI,EAAEa,SAAS,EAAE9B,EAAE,KAAK4B,QAAQ,CAAC5B,EAAE;QAC9C;QACA,IAAI,OAAOC,UAAU,CAACgC,GAAG,KAAK,QAAQ,EAAE;UACpC,OAAO,IAAI;QACf;QACA,OAAOhC,UAAU,CAACgC,GAAG,CAAC7B,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAMiC,UAAUA,CAAC9B,QAAgB,EAAoB;MACjD,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,OAAOA,UAAU,CAACqC,EAAE,EAAElC,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAMmC,YAAYA,CAAChC,QAAgB,EAAoB;MACnD,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,OAAOA,UAAU,CAACqC,EAAE,EAAElC,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAMoC,SAASA,CAAC5C,MAAc,EAAEW,QAAgB,EAAoB;MAChE,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,OAAOA,UAAU,CAACL,MAAM,CAAC,KAAK,IAAI;MACtC,CAAC,CAAC;IACN;IAEA,MAAcyB,oBAAoBA,CAACoB,gBAAwB,EAAkB;MACzE,MAAMrB,WAAW,GAAG,MAAM,IAAI,CAACL,eAAe,CAAC2B,cAAc,CAACD,gBAAgB,CAAC;MAC/E,IAAIrB,WAAW,CAACE,MAAM,EAAE;QACpB,OAAOF,WAAW;MACtB;MACA;MACA,MAAMuB,QAAQ,GAAG,MAAM,IAAI,CAAC5B,eAAe,CAAC6B,aAAa,CAACjC,cAAc,CAAC;MACzE,OAAOgC,QAAQ,GAAG,CAACA,QAAQ,CAAC,GAAG,EAAE;IACrC;IAEA,MAAcxB,mBAAmBA,CAAA,EAAqB;MAClD,MAAMlB,UAAU,GAAG,MAAM,IAAI,CAACc,eAAe,CAAC6B,aAAa,CAACjC,cAAc,CAAC;MAC3E,IAAI,CAACV,UAAU,EAAE;QACb,OAAO,KAAK;MAChB;MACA;MACA;MACA,MAAM4C,IAAI,GAAGC,MAAM,CAACD,IAAI,CAAC5C,UAAU,CAAC,CAAC8C,MAAM,CAACC,CAAC,IAAIA,CAAC,KAAK,MAAM,CAAC;MAE9D,MAAMC,MAAM,GAAGJ,IAAI,CAACzC,QAAQ,CAAC,KAAK,CAAC;;MAEnC;MACA,OAAO,CAAC6C,MAAM;IAClB;EACJ;EAEA,MAAMC,WAAW,GAAGhE,iBAAiB,CAAiB,GAAGG,MAAM,CAACuB,MAAM,cAAc,CAAC;EAErF,MAAMuC,cAAc,GAAGD,WAAW,CAACE,oBAAoB,CAAC;IACpDC,cAAc,EAAExC,iBAAiB;IACjCyC,YAAY,EAAE,CAACnE,eAAe;EAClC,CAAQ,CAAC;EAET,OAAO;IAAE+D,WAAW;IAAEC;EAAe,CAAC;AAC1C","ignoreList":[]}
+{"version":3,"names":["createAbstraction","createFeature","IdentityContext","buildEntityMap","schema","map","Map","entity","entities","actions","Set","action","add","name","set","id","permission","hasOwn","scopes","includes","getEntity","entityMap","entityId","get","Error","SchemaPermissions","constructor","identityContext","fullAccessName","prefix","canAccess","item","hasFullAccess","hasFullSchemaAccess","permissions","getEntityPermissions","length","undefined","ownOnly","some","p","own","identity","getIdentity","createdBy","onlyOwnRecords","canRead","rwd","canCreate","canEdit","canDelete","canPublish","pw","canUnpublish","canAction","entityPermission","getPermissions","wildcard","getPermission","keys","Object","filter","k","hasRwd","createPermissionsAbstraction","createPermissionsFeature","abstraction","PermissionsImpl","Implementation","createImplementation","implementation","dependencies","register","container"],"sources":["createPermissions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport { createFeature } from \"@webiny/feature/api\";\nimport { IdentityContext } from \"~/features/security/IdentityContext/index.js\";\nimport type { Abstraction } from \"@webiny/di\";\nimport type { PermissionSchemaConfig } from \"./types.js\";\nimport type { OwnableItem } from \"./types.js\";\nimport type { Permissions } from \"./types.js\";\n\ninterface EntityLookup {\n    permission: string;\n    actions: Set<string>;\n    hasOwn: boolean;\n}\n\nfunction buildEntityMap(schema: PermissionSchemaConfig): Map<string, EntityLookup> {\n    const map = new Map<string, EntityLookup>();\n    for (const entity of schema.entities ?? []) {\n        const actions = new Set<string>();\n        for (const action of entity.actions ?? []) {\n            actions.add(action.name);\n        }\n        map.set(entity.id, {\n            permission: entity.permission,\n            actions,\n            hasOwn: entity.scopes.includes(\"own\")\n        });\n    }\n    return map;\n}\n\nfunction getEntity(entityMap: Map<string, EntityLookup>, entityId: string): EntityLookup {\n    const entity = entityMap.get(entityId);\n    if (!entity) {\n        throw new Error(`Unknown entity \"${entityId}\" in permission schema.`);\n    }\n    return entity;\n}\n\nclass SchemaPermissions<S extends PermissionSchemaConfig> {\n    private readonly entityMap: Map<string, EntityLookup>;\n    private readonly fullAccessName: string;\n    private readonly identityContext: IdentityContext.Interface;\n\n    constructor(schema: S, identityContext: IdentityContext.Interface) {\n        this.entityMap = buildEntityMap(schema);\n        this.fullAccessName = `${schema.prefix}.*`;\n        this.identityContext = identityContext;\n    }\n\n    async canAccess(entityId: string, item?: OwnableItem): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        // No item — just check entity-level access.\n        if (item === undefined) {\n            return true;\n        }\n        // Item provided — if all permissions require own, verify ownership.\n        const ownOnly = !permissions.some(p => !p.own);\n        if (!ownOnly) {\n            return true;\n        }\n        const identity = this.identityContext.getIdentity();\n        return item.createdBy?.id === identity.id;\n    }\n\n    async onlyOwnRecords(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return false;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return false;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return !permissions.some(p => !p.own);\n    }\n\n    async canRead(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"r\");\n        });\n    }\n\n    async canCreate(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"w\");\n        });\n    }\n\n    async canEdit(entityId: string, item?: OwnableItem): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        const identity = this.identityContext.getIdentity();\n        return permissions.some(permission => {\n            if (permission.own) {\n                // No item provided (new/unsaved) — allow access.\n                if (!item?.createdBy) {\n                    return true;\n                }\n                return item.createdBy.id === identity.id;\n            }\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"w\");\n        });\n    }\n\n    async canDelete(entityId: string, item?: OwnableItem): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        const identity = this.identityContext.getIdentity();\n        return permissions.some(permission => {\n            if (permission.own) {\n                return item?.createdBy?.id === identity.id;\n            }\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"d\");\n        });\n    }\n\n    async canPublish(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission.pw?.includes(\"p\");\n        });\n    }\n\n    async canUnpublish(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission.pw?.includes(\"u\");\n        });\n    }\n\n    async canAction(action: string, entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission[action] === true;\n        });\n    }\n\n    private async getEntityPermissions(entityPermission: string): Promise<any[]> {\n        const permissions = await this.identityContext.getPermissions(entityPermission);\n        if (permissions.length) {\n            return permissions;\n        }\n        // Fall back to the schema wildcard (e.g. \"test.*\") — its flags apply to all entities.\n        const wildcard = await this.identityContext.getPermission(this.fullAccessName);\n        return wildcard ? [wildcard] : [];\n    }\n\n    private async hasFullSchemaAccess(): Promise<boolean> {\n        const permission = await this.identityContext.getPermission(this.fullAccessName);\n        if (!permission) {\n            return false;\n        }\n        // Only treat as full access if the permission has no `rwd` flag.\n        // A permission like { name: \"wb.*\", rwd: \"r\" } should NOT grant full access.\n        const keys = Object.keys(permission).filter(k => k !== \"name\");\n\n        const hasRwd = keys.includes(\"rwd\");\n\n        // It's full-access only if there's no `rwd` flag.\n        return !hasRwd;\n    }\n}\n\nexport function createPermissionsAbstraction<const S extends PermissionSchemaConfig>(schema: S) {\n    return createAbstraction<Permissions<S>>(`${schema.prefix}:Permissions`);\n}\n\nexport function createPermissionsFeature<const S extends PermissionSchemaConfig>(\n    schema: S,\n    abstraction: Abstraction<Permissions<S>>\n) {\n    class PermissionsImpl extends SchemaPermissions<S> {\n        constructor(identityContext: IdentityContext.Interface) {\n            super(schema, identityContext);\n        }\n    }\n\n    const Implementation = abstraction.createImplementation({\n        implementation: PermissionsImpl,\n        dependencies: [IdentityContext]\n    } as any);\n\n    return createFeature({\n        name: `${schema.prefix}:Permissions`,\n        register(container) {\n            container.register(Implementation);\n        }\n    });\n}\n"],"mappings":"AAAA,SAASA,iBAAiB,QAAQ,qBAAqB;AACvD,SAASC,aAAa,QAAQ,qBAAqB;AACnD,SAASC,eAAe;AAYxB,SAASC,cAAcA,CAACC,MAA8B,EAA6B;EAC/E,MAAMC,GAAG,GAAG,IAAIC,GAAG,CAAuB,CAAC;EAC3C,KAAK,MAAMC,MAAM,IAAIH,MAAM,CAACI,QAAQ,IAAI,EAAE,EAAE;IACxC,MAAMC,OAAO,GAAG,IAAIC,GAAG,CAAS,CAAC;IACjC,KAAK,MAAMC,MAAM,IAAIJ,MAAM,CAACE,OAAO,IAAI,EAAE,EAAE;MACvCA,OAAO,CAACG,GAAG,CAACD,MAAM,CAACE,IAAI,CAAC;IAC5B;IACAR,GAAG,CAACS,GAAG,CAACP,MAAM,CAACQ,EAAE,EAAE;MACfC,UAAU,EAAET,MAAM,CAACS,UAAU;MAC7BP,OAAO;MACPQ,MAAM,EAAEV,MAAM,CAACW,MAAM,CAACC,QAAQ,CAAC,KAAK;IACxC,CAAC,CAAC;EACN;EACA,OAAOd,GAAG;AACd;AAEA,SAASe,SAASA,CAACC,SAAoC,EAAEC,QAAgB,EAAgB;EACrF,MAAMf,MAAM,GAAGc,SAAS,CAACE,GAAG,CAACD,QAAQ,CAAC;EACtC,IAAI,CAACf,MAAM,EAAE;IACT,MAAM,IAAIiB,KAAK,CAAC,mBAAmBF,QAAQ,yBAAyB,CAAC;EACzE;EACA,OAAOf,MAAM;AACjB;AAEA,MAAMkB,iBAAiB,CAAmC;EAKtDC,WAAWA,CAACtB,MAAS,EAAEuB,eAA0C,EAAE;IAC/D,IAAI,CAACN,SAAS,GAAGlB,cAAc,CAACC,MAAM,CAAC;IACvC,IAAI,CAACwB,cAAc,GAAG,GAAGxB,MAAM,CAACyB,MAAM,IAAI;IAC1C,IAAI,CAACF,eAAe,GAAGA,eAAe;EAC1C;EAEA,MAAMG,SAASA,CAACR,QAAgB,EAAES,IAAkB,EAAoB;IACpE,IAAI,MAAM,IAAI,CAACJ,eAAe,CAACK,aAAa,CAAC,CAAC,EAAE;MAC5C,OAAO,IAAI;IACf;IACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;MAClC,OAAO,IAAI;IACf;IACA,MAAM1B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMY,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC5B,MAAM,CAACS,UAAU,CAAC;IACtE,IAAI,CAACkB,WAAW,CAACE,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA;IACA,IAAIL,IAAI,KAAKM,SAAS,EAAE;MACpB,OAAO,IAAI;IACf;IACA;IACA,MAAMC,OAAO,GAAG,CAACJ,WAAW,CAACK,IAAI,CAACC,CAAC,IAAI,CAACA,CAAC,CAACC,GAAG,CAAC;IAC9C,IAAI,CAACH,OAAO,EAAE;MACV,OAAO,IAAI;IACf;IACA,MAAMI,QAAQ,GAAG,IAAI,CAACf,eAAe,CAACgB,WAAW,CAAC,CAAC;IACnD,OAAOZ,IAAI,CAACa,SAAS,EAAE7B,EAAE,KAAK2B,QAAQ,CAAC3B,EAAE;EAC7C;EAEA,MAAM8B,cAAcA,CAACvB,QAAgB,EAAoB;IACrD,IAAI,MAAM,IAAI,CAACK,eAAe,CAACK,aAAa,CAAC,CAAC,EAAE;MAC5C,OAAO,KAAK;IAChB;IACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;MAClC,OAAO,KAAK;IAChB;IACA,MAAM1B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMY,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC5B,MAAM,CAACS,UAAU,CAAC;IACtE,IAAI,CAACkB,WAAW,CAACE,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAO,CAACF,WAAW,CAACK,IAAI,CAACC,CAAC,IAAI,CAACA,CAAC,CAACC,GAAG,CAAC;EACzC;EAEA,MAAMK,OAAOA,CAACxB,QAAgB,EAAoB;IAC9C,IAAI,MAAM,IAAI,CAACK,eAAe,CAACK,aAAa,CAAC,CAAC,EAAE;MAC5C,OAAO,IAAI;IACf;IACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;MAClC,OAAO,IAAI;IACf;IACA,MAAM1B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMY,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC5B,MAAM,CAACS,UAAU,CAAC;IACtE,IAAI,CAACkB,WAAW,CAACE,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAOF,WAAW,CAACK,IAAI,CAACvB,UAAU,IAAI;MAClC,IAAI,OAAOA,UAAU,CAAC+B,GAAG,KAAK,QAAQ,EAAE;QACpC,OAAO,IAAI;MACf;MACA,OAAO/B,UAAU,CAAC+B,GAAG,CAAC5B,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN;EAEA,MAAM6B,SAASA,CAAC1B,QAAgB,EAAoB;IAChD,IAAI,MAAM,IAAI,CAACK,eAAe,CAACK,aAAa,CAAC,CAAC,EAAE;MAC5C,OAAO,IAAI;IACf;IACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;MAClC,OAAO,IAAI;IACf;IACA,MAAM1B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMY,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC5B,MAAM,CAACS,UAAU,CAAC;IACtE,IAAI,CAACkB,WAAW,CAACE,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAOF,WAAW,CAACK,IAAI,CAACvB,UAAU,IAAI;MAClC,IAAI,OAAOA,UAAU,CAAC+B,GAAG,KAAK,QAAQ,EAAE;QACpC,OAAO,IAAI;MACf;MACA,OAAO/B,UAAU,CAAC+B,GAAG,CAAC5B,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN;EAEA,MAAM8B,OAAOA,CAAC3B,QAAgB,EAAES,IAAkB,EAAoB;IAClE,IAAI,MAAM,IAAI,CAACJ,eAAe,CAACK,aAAa,CAAC,CAAC,EAAE;MAC5C,OAAO,IAAI;IACf;IACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;MAClC,OAAO,IAAI;IACf;IACA,MAAM1B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMY,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC5B,MAAM,CAACS,UAAU,CAAC;IACtE,IAAI,CAACkB,WAAW,CAACE,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,MAAMM,QAAQ,GAAG,IAAI,CAACf,eAAe,CAACgB,WAAW,CAAC,CAAC;IACnD,OAAOT,WAAW,CAACK,IAAI,CAACvB,UAAU,IAAI;MAClC,IAAIA,UAAU,CAACyB,GAAG,EAAE;QAChB;QACA,IAAI,CAACV,IAAI,EAAEa,SAAS,EAAE;UAClB,OAAO,IAAI;QACf;QACA,OAAOb,IAAI,CAACa,SAAS,CAAC7B,EAAE,KAAK2B,QAAQ,CAAC3B,EAAE;MAC5C;MACA,IAAI,OAAOC,UAAU,CAAC+B,GAAG,KAAK,QAAQ,EAAE;QACpC,OAAO,IAAI;MACf;MACA,OAAO/B,UAAU,CAAC+B,GAAG,CAAC5B,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN;EAEA,MAAM+B,SAASA,CAAC5B,QAAgB,EAAES,IAAkB,EAAoB;IACpE,IAAI,MAAM,IAAI,CAACJ,eAAe,CAACK,aAAa,CAAC,CAAC,EAAE;MAC5C,OAAO,IAAI;IACf;IACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;MAClC,OAAO,IAAI;IACf;IACA,MAAM1B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMY,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC5B,MAAM,CAACS,UAAU,CAAC;IACtE,IAAI,CAACkB,WAAW,CAACE,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,MAAMM,QAAQ,GAAG,IAAI,CAACf,eAAe,CAACgB,WAAW,CAAC,CAAC;IACnD,OAAOT,WAAW,CAACK,IAAI,CAACvB,UAAU,IAAI;MAClC,IAAIA,UAAU,CAACyB,GAAG,EAAE;QAChB,OAAOV,IAAI,EAAEa,SAAS,EAAE7B,EAAE,KAAK2B,QAAQ,CAAC3B,EAAE;MAC9C;MACA,IAAI,OAAOC,UAAU,CAAC+B,GAAG,KAAK,QAAQ,EAAE;QACpC,OAAO,IAAI;MACf;MACA,OAAO/B,UAAU,CAAC+B,GAAG,CAAC5B,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN;EAEA,MAAMgC,UAAUA,CAAC7B,QAAgB,EAAoB;IACjD,IAAI,MAAM,IAAI,CAACK,eAAe,CAACK,aAAa,CAAC,CAAC,EAAE;MAC5C,OAAO,IAAI;IACf;IACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;MAClC,OAAO,IAAI;IACf;IACA,MAAM1B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMY,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC5B,MAAM,CAACS,UAAU,CAAC;IACtE,IAAI,CAACkB,WAAW,CAACE,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAOF,WAAW,CAACK,IAAI,CAACvB,UAAU,IAAI;MAClC,OAAOA,UAAU,CAACoC,EAAE,EAAEjC,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN;EAEA,MAAMkC,YAAYA,CAAC/B,QAAgB,EAAoB;IACnD,IAAI,MAAM,IAAI,CAACK,eAAe,CAACK,aAAa,CAAC,CAAC,EAAE;MAC5C,OAAO,IAAI;IACf;IACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;MAClC,OAAO,IAAI;IACf;IACA,MAAM1B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMY,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC5B,MAAM,CAACS,UAAU,CAAC;IACtE,IAAI,CAACkB,WAAW,CAACE,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAOF,WAAW,CAACK,IAAI,CAACvB,UAAU,IAAI;MAClC,OAAOA,UAAU,CAACoC,EAAE,EAAEjC,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN;EAEA,MAAMmC,SAASA,CAAC3C,MAAc,EAAEW,QAAgB,EAAoB;IAChE,IAAI,MAAM,IAAI,CAACK,eAAe,CAACK,aAAa,CAAC,CAAC,EAAE;MAC5C,OAAO,IAAI;IACf;IACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;MAClC,OAAO,IAAI;IACf;IACA,MAAM1B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMY,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC5B,MAAM,CAACS,UAAU,CAAC;IACtE,IAAI,CAACkB,WAAW,CAACE,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAOF,WAAW,CAACK,IAAI,CAACvB,UAAU,IAAI;MAClC,OAAOA,UAAU,CAACL,MAAM,CAAC,KAAK,IAAI;IACtC,CAAC,CAAC;EACN;EAEA,MAAcwB,oBAAoBA,CAACoB,gBAAwB,EAAkB;IACzE,MAAMrB,WAAW,GAAG,MAAM,IAAI,CAACP,eAAe,CAAC6B,cAAc,CAACD,gBAAgB,CAAC;IAC/E,IAAIrB,WAAW,CAACE,MAAM,EAAE;MACpB,OAAOF,WAAW;IACtB;IACA;IACA,MAAMuB,QAAQ,GAAG,MAAM,IAAI,CAAC9B,eAAe,CAAC+B,aAAa,CAAC,IAAI,CAAC9B,cAAc,CAAC;IAC9E,OAAO6B,QAAQ,GAAG,CAACA,QAAQ,CAAC,GAAG,EAAE;EACrC;EAEA,MAAcxB,mBAAmBA,CAAA,EAAqB;IAClD,MAAMjB,UAAU,GAAG,MAAM,IAAI,CAACW,eAAe,CAAC+B,aAAa,CAAC,IAAI,CAAC9B,cAAc,CAAC;IAChF,IAAI,CAACZ,UAAU,EAAE;MACb,OAAO,KAAK;IAChB;IACA;IACA;IACA,MAAM2C,IAAI,GAAGC,MAAM,CAACD,IAAI,CAAC3C,UAAU,CAAC,CAAC6C,MAAM,CAACC,CAAC,IAAIA,CAAC,KAAK,MAAM,CAAC;IAE9D,MAAMC,MAAM,GAAGJ,IAAI,CAACxC,QAAQ,CAAC,KAAK,CAAC;;IAEnC;IACA,OAAO,CAAC4C,MAAM;EAClB;AACJ;AAEA,OAAO,SAASC,4BAA4BA,CAAyC5D,MAAS,EAAE;EAC5F,OAAOJ,iBAAiB,CAAiB,GAAGI,MAAM,CAACyB,MAAM,cAAc,CAAC;AAC5E;AAEA,OAAO,SAASoC,wBAAwBA,CACpC7D,MAAS,EACT8D,WAAwC,EAC1C;EACE,MAAMC,eAAe,SAAS1C,iBAAiB,CAAI;IAC/CC,WAAWA,CAACC,eAA0C,EAAE;MACpD,KAAK,CAACvB,MAAM,EAAEuB,eAAe,CAAC;IAClC;EACJ;EAEA,MAAMyC,cAAc,GAAGF,WAAW,CAACG,oBAAoB,CAAC;IACpDC,cAAc,EAAEH,eAAe;IAC/BI,YAAY,EAAE,CAACrE,eAAe;EAClC,CAAQ,CAAC;EAET,OAAOD,aAAa,CAAC;IACjBY,IAAI,EAAE,GAAGT,MAAM,CAACyB,MAAM,cAAc;IACpC2C,QAAQA,CAACC,SAAS,EAAE;MAChBA,SAAS,CAACD,QAAQ,CAACJ,cAAc,CAAC;IACtC;EACJ,CAAC,CAAC;AACN","ignoreList":[]}

package/features/security/permissions/index.d.ts

@@ -1,2 +1,3 @@
-export { createPermissions } from "./createPermissions.js";
+export { createPermissionSchema } from "./createPermissionSchema.js";
+export { createPermissionsAbstraction, createPermissionsFeature } from "./createPermissions.js";
 export type { ActionDefinition, EntityDefinition, PermissionSchemaConfig, OwnableItem, Permissions, AllEntityIds, RwdEntityId, PwEntityId, CustomActionNames } from "./types.js";

package/features/security/permissions/index.js

@@ -1,3 +1,4 @@
-export { createPermissions } from "./createPermissions.js";
+export { createPermissionSchema } from "./createPermissionSchema.js";
+export { createPermissionsAbstraction, createPermissionsFeature } from "./createPermissions.js";
 
 //# sourceMappingURL=index.js.map

package/features/security/permissions/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["createPermissions"],"sources":["index.ts"],"sourcesContent":["export { createPermissions } from \"./createPermissions.js\";\nexport type {\n    ActionDefinition,\n    EntityDefinition,\n    PermissionSchemaConfig,\n    OwnableItem,\n    Permissions,\n    AllEntityIds,\n    RwdEntityId,\n    PwEntityId,\n    CustomActionNames\n} from \"./types.js\";\n"],"mappings":"AAAA,SAASA,iBAAiB","ignoreList":[]}
+{"version":3,"names":["createPermissionSchema","createPermissionsAbstraction","createPermissionsFeature"],"sources":["index.ts"],"sourcesContent":["export { createPermissionSchema } from \"./createPermissionSchema.js\";\nexport { createPermissionsAbstraction, createPermissionsFeature } from \"./createPermissions.js\";\nexport type {\n    ActionDefinition,\n    EntityDefinition,\n    PermissionSchemaConfig,\n    OwnableItem,\n    Permissions,\n    AllEntityIds,\n    RwdEntityId,\n    PwEntityId,\n    CustomActionNames\n} from \"./types.js\";\n"],"mappings":"AAAA,SAASA,sBAAsB;AAC/B,SAASC,4BAA4B,EAAEC,wBAAwB","ignoreList":[]}

package/features/security/roles/CreateRole/CreateRoleUseCase.d.ts

@@ -1,16 +1,14 @@
 import { Result } from "@webiny/feature/api";
-import { TenantContext } from "../../../../features/tenancy/TenantContext/index.js";
 import { EventPublisher } from "../../../../features/eventPublisher/index.js";
 import { CreateRoleUseCase as UseCaseAbstraction } from "./abstractions.js";
 import { RolesRepository } from "../shared/abstractions.js";
 import { IdentityContext } from "../../IdentityContext/abstractions.js";
 import type { Role, CreateRoleInput } from "../shared/types.js";
 declare class CreateRoleUseCaseImpl implements UseCaseAbstraction.Interface {
-    private tenantContext;
     private identityContext;
     private eventPublisher;
     private repository;
-    constructor(tenantContext: TenantContext.Interface, identityContext: IdentityContext.Interface, eventPublisher: EventPublisher.Interface, repository: RolesRepository.Interface);
+    constructor(identityContext: IdentityContext.Interface, eventPublisher: EventPublisher.Interface, repository: RolesRepository.Interface);
     execute(input: CreateRoleInput): Promise<Result<Role, UseCaseAbstraction.Error>>;
 }
 export declare const CreateRoleUseCase: import("@webiny/di").Implementation<typeof CreateRoleUseCaseImpl>;

package/features/security/roles/CreateRole/CreateRoleUseCase.js

@@ -1,7 +1,6 @@
 import { mdbid } from "@webiny/utils";
 import { createImplementation } from "@webiny/feature/api";
 import { Result } from "@webiny/feature/api";
-import { TenantContext } from "../../../tenancy/TenantContext/index.js";
 import { EventPublisher } from "../../../eventPublisher/index.js";
 import { CreateRoleUseCase as UseCaseAbstraction } from "./abstractions.js";
 import { RolesRepository } from "../shared/abstractions.js";
@@ -10,8 +9,7 @@ import { createRoleValidation } from "./schema.js";
 import { RoleBeforeCreateEvent, RoleAfterCreateEvent } from "./events.js";
 import { NotAuthorizedError, RoleExistsError, RoleValidationError } from "../shared/errors.js";
 class CreateRoleUseCaseImpl {
-  constructor(tenantContext, identityContext, eventPublisher, repository) {
-    this.tenantContext = tenantContext;
+  constructor(identityContext, eventPublisher, repository) {
     this.identityContext = identityContext;
     this.eventPublisher = eventPublisher;
     this.repository = repository;
@@ -23,9 +21,8 @@ class CreateRoleUseCaseImpl {
     }
     const validation = createRoleValidation.safeParse(input);
     if (!validation.success) {
-      return Result.fail(new RoleValidationError(validation.error.errors[0].message));
+      return Result.fail(new RoleValidationError(validation.error.issues[0].message));
     }
-    const tenant = this.tenantContext.getTenant();
     const identity = this.identityContext.getIdentity();
     const data = validation.data;
 
@@ -43,7 +40,6 @@ class CreateRoleUseCaseImpl {
       description: data.description,
       permissions: data.permissions,
       system: input.system || false,
-      tenant: tenant.id,
       createdOn: new Date().toISOString(),
       createdBy: {
         id: identity.id,
@@ -70,7 +66,7 @@ class CreateRoleUseCaseImpl {
 export const CreateRoleUseCase = createImplementation({
   abstraction: UseCaseAbstraction,
   implementation: CreateRoleUseCaseImpl,
-  dependencies: [TenantContext, IdentityContext, EventPublisher, RolesRepository]
+  dependencies: [IdentityContext, EventPublisher, RolesRepository]
 });
 
 //# sourceMappingURL=CreateRoleUseCase.js.map

package/features/security/roles/CreateRole/CreateRoleUseCase.js.map

@@ -1 +1 @@
-{"version":3,"names":["mdbid","createImplementation","Result","TenantContext","EventPublisher","CreateRoleUseCase","UseCaseAbstraction","RolesRepository","IdentityContext","createRoleValidation","RoleBeforeCreateEvent","RoleAfterCreateEvent","NotAuthorizedError","RoleExistsError","RoleValidationError","CreateRoleUseCaseImpl","constructor","tenantContext","identityContext","eventPublisher","repository","execute","input","hasPermission","getPermission","fail","validation","safeParse","success","error","errors","message","tenant","getTenant","identity","getIdentity","data","existingRoleResult","get","slug","isOk","role","id","name","description","permissions","system","createdOn","Date","toISOString","createdBy","displayName","type","plugin","publish","result","create","isFail","ok","abstraction","implementation","dependencies"],"sources":["CreateRoleUseCase.ts"],"sourcesContent":["import { mdbid } from \"@webiny/utils\";\nimport { createImplementation } from \"@webiny/feature/api\";\nimport { Result } from \"@webiny/feature/api\";\nimport { TenantContext } from \"~/features/tenancy/TenantContext/index.js\";\nimport { EventPublisher } from \"~/features/eventPublisher/index.js\";\nimport { CreateRoleUseCase as UseCaseAbstraction } from \"./abstractions.js\";\nimport { RolesRepository } from \"../shared/abstractions.js\";\nimport { IdentityContext } from \"../../IdentityContext/abstractions.js\";\nimport { createRoleValidation } from \"./schema.js\";\nimport { RoleBeforeCreateEvent, RoleAfterCreateEvent } from \"./events.js\";\nimport type { Role, CreateRoleInput } from \"../shared/types.js\";\nimport { NotAuthorizedError, RoleExistsError, RoleValidationError } from \"../shared/errors.js\";\n\nclass CreateRoleUseCaseImpl implements UseCaseAbstraction.Interface {\n    constructor(\n        private tenantContext: TenantContext.Interface,\n        private identityContext: IdentityContext.Interface,\n        private eventPublisher: EventPublisher.Interface,\n        private repository: RolesRepository.Interface\n    ) {}\n\n    async execute(input: CreateRoleInput): Promise<Result<Role, UseCaseAbstraction.Error>> {\n        const hasPermission = await this.identityContext.getPermission(\"security.role\");\n\n        if (!hasPermission) {\n            return Result.fail(new NotAuthorizedError());\n        }\n\n        const validation = createRoleValidation.safeParse(input);\n        if (!validation.success) {\n            return Result.fail(new RoleValidationError(validation.error.errors[0].message));\n        }\n\n        const tenant = this.tenantContext.getTenant();\n        const identity = this.identityContext.getIdentity();\n        const data = validation.data;\n\n        // Check if role with same slug already exists\n        const existingRoleResult = await this.repository.get({ slug: data.slug });\n        if (existingRoleResult.isOk()) {\n            return Result.fail(new RoleExistsError(data.slug));\n        }\n\n        const role: Role = {\n            id: mdbid(),\n            name: data.name,\n            slug: data.slug,\n            description: data.description,\n            permissions: data.permissions,\n            system: input.system || false,\n            tenant: tenant.id,\n            createdOn: new Date().toISOString(),\n            createdBy: {\n                id: identity.id,\n                displayName: identity.displayName,\n                type: identity.type\n            },\n            plugin: false\n        };\n\n        await this.eventPublisher.publish(\n            new RoleBeforeCreateEvent({ role, input: validation.data })\n        );\n\n        const result = await this.repository.create(role);\n\n        if (result.isFail()) {\n            return Result.fail(result.error);\n        }\n\n        await this.eventPublisher.publish(\n            new RoleAfterCreateEvent({ role, input: validation.data })\n        );\n\n        return Result.ok(role);\n    }\n}\n\nexport const CreateRoleUseCase = createImplementation({\n    abstraction: UseCaseAbstraction,\n    implementation: CreateRoleUseCaseImpl,\n    dependencies: [TenantContext, IdentityContext, EventPublisher, RolesRepository]\n});\n"],"mappings":"AAAA,SAASA,KAAK,QAAQ,eAAe;AACrC,SAASC,oBAAoB,QAAQ,qBAAqB;AAC1D,SAASC,MAAM,QAAQ,qBAAqB;AAC5C,SAASC,aAAa;AACtB,SAASC,cAAc;AACvB,SAASC,iBAAiB,IAAIC,kBAAkB;AAChD,SAASC,eAAe;AACxB,SAASC,eAAe;AACxB,SAASC,oBAAoB;AAC7B,SAASC,qBAAqB,EAAEC,oBAAoB;AAEpD,SAASC,kBAAkB,EAAEC,eAAe,EAAEC,mBAAmB;AAEjE,MAAMC,qBAAqB,CAAyC;EAChEC,WAAWA,CACCC,aAAsC,EACtCC,eAA0C,EAC1CC,cAAwC,EACxCC,UAAqC,EAC/C;IAAA,KAJUH,aAAsC,GAAtCA,aAAsC;IAAA,KACtCC,eAA0C,GAA1CA,eAA0C;IAAA,KAC1CC,cAAwC,GAAxCA,cAAwC;IAAA,KACxCC,UAAqC,GAArCA,UAAqC;EAC9C;EAEH,MAAMC,OAAOA,CAACC,KAAsB,EAAmD;IACnF,MAAMC,aAAa,GAAG,MAAM,IAAI,CAACL,eAAe,CAACM,aAAa,CAAC,eAAe,CAAC;IAE/E,IAAI,CAACD,aAAa,EAAE;MAChB,OAAOrB,MAAM,CAACuB,IAAI,CAAC,IAAIb,kBAAkB,CAAC,CAAC,CAAC;IAChD;IAEA,MAAMc,UAAU,GAAGjB,oBAAoB,CAACkB,SAAS,CAACL,KAAK,CAAC;IACxD,IAAI,CAACI,UAAU,CAACE,OAAO,EAAE;MACrB,OAAO1B,MAAM,CAACuB,IAAI,CAAC,IAAIX,mBAAmB,CAACY,UAAU,CAACG,KAAK,CAACC,MAAM,CAAC,CAAC,CAAC,CAACC,OAAO,CAAC,CAAC;IACnF;IAEA,MAAMC,MAAM,GAAG,IAAI,CAACf,aAAa,CAACgB,SAAS,CAAC,CAAC;IAC7C,MAAMC,QAAQ,GAAG,IAAI,CAAChB,eAAe,CAACiB,WAAW,CAAC,CAAC;IACnD,MAAMC,IAAI,GAAGV,UAAU,CAACU,IAAI;;IAE5B;IACA,MAAMC,kBAAkB,GAAG,MAAM,IAAI,CAACjB,UAAU,CAACkB,GAAG,CAAC;MAAEC,IAAI,EAAEH,IAAI,CAACG;IAAK,CAAC,CAAC;IACzE,IAAIF,kBAAkB,CAACG,IAAI,CAAC,CAAC,EAAE;MAC3B,OAAOtC,MAAM,CAACuB,IAAI,CAAC,IAAIZ,eAAe,CAACuB,IAAI,CAACG,IAAI,CAAC,CAAC;IACtD;IAEA,MAAME,IAAU,GAAG;MACfC,EAAE,EAAE1C,KAAK,CAAC,CAAC;MACX2C,IAAI,EAAEP,IAAI,CAACO,IAAI;MACfJ,IAAI,EAAEH,IAAI,CAACG,IAAI;MACfK,WAAW,EAAER,IAAI,CAACQ,WAAW;MAC7BC,WAAW,EAAET,IAAI,CAACS,WAAW;MAC7BC,MAAM,EAAExB,KAAK,CAACwB,MAAM,IAAI,KAAK;MAC7Bd,MAAM,EAAEA,MAAM,CAACU,EAAE;MACjBK,SAAS,EAAE,IAAIC,IAAI,CAAC,CAAC,CAACC,WAAW,CAAC,CAAC;MACnCC,SAAS,EAAE;QACPR,EAAE,EAAER,QAAQ,CAACQ,EAAE;QACfS,WAAW,EAAEjB,QAAQ,CAACiB,WAAW;QACjCC,IAAI,EAAElB,QAAQ,CAACkB;MACnB,CAAC;MACDC,MAAM,EAAE;IACZ,CAAC;IAED,MAAM,IAAI,CAAClC,cAAc,CAACmC,OAAO,CAC7B,IAAI5C,qBAAqB,CAAC;MAAE+B,IAAI;MAAEnB,KAAK,EAAEI,UAAU,CAACU;IAAK,CAAC,CAC9D,CAAC;IAED,MAAMmB,MAAM,GAAG,MAAM,IAAI,CAACnC,UAAU,CAACoC,MAAM,CAACf,IAAI,CAAC;IAEjD,IAAIc,MAAM,CAACE,MAAM,CAAC,CAAC,EAAE;MACjB,OAAOvD,MAAM,CAACuB,IAAI,CAAC8B,MAAM,CAAC1B,KAAK,CAAC;IACpC;IAEA,MAAM,IAAI,CAACV,cAAc,CAACmC,OAAO,CAC7B,IAAI3C,oBAAoB,CAAC;MAAE8B,IAAI;MAAEnB,KAAK,EAAEI,UAAU,CAACU;IAAK,CAAC,CAC7D,CAAC;IAED,OAAOlC,MAAM,CAACwD,EAAE,CAACjB,IAAI,CAAC;EAC1B;AACJ;AAEA,OAAO,MAAMpC,iBAAiB,GAAGJ,oBAAoB,CAAC;EAClD0D,WAAW,EAAErD,kBAAkB;EAC/BsD,cAAc,EAAE7C,qBAAqB;EACrC8C,YAAY,EAAE,CAAC1D,aAAa,EAAEK,eAAe,EAAEJ,cAAc,EAAEG,eAAe;AAClF,CAAC,CAAC","ignoreList":[]}
+{"version":3,"names":["mdbid","createImplementation","Result","EventPublisher","CreateRoleUseCase","UseCaseAbstraction","RolesRepository","IdentityContext","createRoleValidation","RoleBeforeCreateEvent","RoleAfterCreateEvent","NotAuthorizedError","RoleExistsError","RoleValidationError","CreateRoleUseCaseImpl","constructor","identityContext","eventPublisher","repository","execute","input","hasPermission","getPermission","fail","validation","safeParse","success","error","issues","message","identity","getIdentity","data","existingRoleResult","get","slug","isOk","role","id","name","description","permissions","system","createdOn","Date","toISOString","createdBy","displayName","type","plugin","publish","result","create","isFail","ok","abstraction","implementation","dependencies"],"sources":["CreateRoleUseCase.ts"],"sourcesContent":["import { mdbid } from \"@webiny/utils\";\nimport { createImplementation } from \"@webiny/feature/api\";\nimport { Result } from \"@webiny/feature/api\";\nimport { EventPublisher } from \"~/features/eventPublisher/index.js\";\nimport { CreateRoleUseCase as UseCaseAbstraction } from \"./abstractions.js\";\nimport { RolesRepository } from \"../shared/abstractions.js\";\nimport { IdentityContext } from \"../../IdentityContext/abstractions.js\";\nimport { createRoleValidation } from \"./schema.js\";\nimport { RoleBeforeCreateEvent, RoleAfterCreateEvent } from \"./events.js\";\nimport type { Role, CreateRoleInput } from \"../shared/types.js\";\nimport { NotAuthorizedError, RoleExistsError, RoleValidationError } from \"../shared/errors.js\";\n\nclass CreateRoleUseCaseImpl implements UseCaseAbstraction.Interface {\n    constructor(\n        private identityContext: IdentityContext.Interface,\n        private eventPublisher: EventPublisher.Interface,\n        private repository: RolesRepository.Interface\n    ) {}\n\n    async execute(input: CreateRoleInput): Promise<Result<Role, UseCaseAbstraction.Error>> {\n        const hasPermission = await this.identityContext.getPermission(\"security.role\");\n\n        if (!hasPermission) {\n            return Result.fail(new NotAuthorizedError());\n        }\n\n        const validation = createRoleValidation.safeParse(input);\n        if (!validation.success) {\n            return Result.fail(new RoleValidationError(validation.error.issues[0].message));\n        }\n\n        const identity = this.identityContext.getIdentity();\n        const data = validation.data;\n\n        // Check if role with same slug already exists\n        const existingRoleResult = await this.repository.get({ slug: data.slug });\n        if (existingRoleResult.isOk()) {\n            return Result.fail(new RoleExistsError(data.slug));\n        }\n\n        const role: Role = {\n            id: mdbid(),\n            name: data.name,\n            slug: data.slug,\n            description: data.description,\n            permissions: data.permissions,\n            system: input.system || false,\n            createdOn: new Date().toISOString(),\n            createdBy: {\n                id: identity.id,\n                displayName: identity.displayName,\n                type: identity.type\n            },\n            plugin: false\n        };\n\n        await this.eventPublisher.publish(\n            new RoleBeforeCreateEvent({ role, input: validation.data })\n        );\n\n        const result = await this.repository.create(role);\n\n        if (result.isFail()) {\n            return Result.fail(result.error);\n        }\n\n        await this.eventPublisher.publish(\n            new RoleAfterCreateEvent({ role, input: validation.data })\n        );\n\n        return Result.ok(role);\n    }\n}\n\nexport const CreateRoleUseCase = createImplementation({\n    abstraction: UseCaseAbstraction,\n    implementation: CreateRoleUseCaseImpl,\n    dependencies: [IdentityContext, EventPublisher, RolesRepository]\n});\n"],"mappings":"AAAA,SAASA,KAAK,QAAQ,eAAe;AACrC,SAASC,oBAAoB,QAAQ,qBAAqB;AAC1D,SAASC,MAAM,QAAQ,qBAAqB;AAC5C,SAASC,cAAc;AACvB,SAASC,iBAAiB,IAAIC,kBAAkB;AAChD,SAASC,eAAe;AACxB,SAASC,eAAe;AACxB,SAASC,oBAAoB;AAC7B,SAASC,qBAAqB,EAAEC,oBAAoB;AAEpD,SAASC,kBAAkB,EAAEC,eAAe,EAAEC,mBAAmB;AAEjE,MAAMC,qBAAqB,CAAyC;EAChEC,WAAWA,CACCC,eAA0C,EAC1CC,cAAwC,EACxCC,UAAqC,EAC/C;IAAA,KAHUF,eAA0C,GAA1CA,eAA0C;IAAA,KAC1CC,cAAwC,GAAxCA,cAAwC;IAAA,KACxCC,UAAqC,GAArCA,UAAqC;EAC9C;EAEH,MAAMC,OAAOA,CAACC,KAAsB,EAAmD;IACnF,MAAMC,aAAa,GAAG,MAAM,IAAI,CAACL,eAAe,CAACM,aAAa,CAAC,eAAe,CAAC;IAE/E,IAAI,CAACD,aAAa,EAAE;MAChB,OAAOnB,MAAM,CAACqB,IAAI,CAAC,IAAIZ,kBAAkB,CAAC,CAAC,CAAC;IAChD;IAEA,MAAMa,UAAU,GAAGhB,oBAAoB,CAACiB,SAAS,CAACL,KAAK,CAAC;IACxD,IAAI,CAACI,UAAU,CAACE,OAAO,EAAE;MACrB,OAAOxB,MAAM,CAACqB,IAAI,CAAC,IAAIV,mBAAmB,CAACW,UAAU,CAACG,KAAK,CAACC,MAAM,CAAC,CAAC,CAAC,CAACC,OAAO,CAAC,CAAC;IACnF;IAEA,MAAMC,QAAQ,GAAG,IAAI,CAACd,eAAe,CAACe,WAAW,CAAC,CAAC;IACnD,MAAMC,IAAI,GAAGR,UAAU,CAACQ,IAAI;;IAE5B;IACA,MAAMC,kBAAkB,GAAG,MAAM,IAAI,CAACf,UAAU,CAACgB,GAAG,CAAC;MAAEC,IAAI,EAAEH,IAAI,CAACG;IAAK,CAAC,CAAC;IACzE,IAAIF,kBAAkB,CAACG,IAAI,CAAC,CAAC,EAAE;MAC3B,OAAOlC,MAAM,CAACqB,IAAI,CAAC,IAAIX,eAAe,CAACoB,IAAI,CAACG,IAAI,CAAC,CAAC;IACtD;IAEA,MAAME,IAAU,GAAG;MACfC,EAAE,EAAEtC,KAAK,CAAC,CAAC;MACXuC,IAAI,EAAEP,IAAI,CAACO,IAAI;MACfJ,IAAI,EAAEH,IAAI,CAACG,IAAI;MACfK,WAAW,EAAER,IAAI,CAACQ,WAAW;MAC7BC,WAAW,EAAET,IAAI,CAACS,WAAW;MAC7BC,MAAM,EAAEtB,KAAK,CAACsB,MAAM,IAAI,KAAK;MAC7BC,SAAS,EAAE,IAAIC,IAAI,CAAC,CAAC,CAACC,WAAW,CAAC,CAAC;MACnCC,SAAS,EAAE;QACPR,EAAE,EAAER,QAAQ,CAACQ,EAAE;QACfS,WAAW,EAAEjB,QAAQ,CAACiB,WAAW;QACjCC,IAAI,EAAElB,QAAQ,CAACkB;MACnB,CAAC;MACDC,MAAM,EAAE;IACZ,CAAC;IAED,MAAM,IAAI,CAAChC,cAAc,CAACiC,OAAO,CAC7B,IAAIzC,qBAAqB,CAAC;MAAE4B,IAAI;MAAEjB,KAAK,EAAEI,UAAU,CAACQ;IAAK,CAAC,CAC9D,CAAC;IAED,MAAMmB,MAAM,GAAG,MAAM,IAAI,CAACjC,UAAU,CAACkC,MAAM,CAACf,IAAI,CAAC;IAEjD,IAAIc,MAAM,CAACE,MAAM,CAAC,CAAC,EAAE;MACjB,OAAOnD,MAAM,CAACqB,IAAI,CAAC4B,MAAM,CAACxB,KAAK,CAAC;IACpC;IAEA,MAAM,IAAI,CAACV,cAAc,CAACiC,OAAO,CAC7B,IAAIxC,oBAAoB,CAAC;MAAE2B,IAAI;MAAEjB,KAAK,EAAEI,UAAU,CAACQ;IAAK,CAAC,CAC7D,CAAC;IAED,OAAO9B,MAAM,CAACoD,EAAE,CAACjB,IAAI,CAAC;EAC1B;AACJ;AAEA,OAAO,MAAMjC,iBAAiB,GAAGH,oBAAoB,CAAC;EAClDsD,WAAW,EAAElD,kBAAkB;EAC/BmD,cAAc,EAAE1C,qBAAqB;EACrC2C,YAAY,EAAE,CAAClD,eAAe,EAAEJ,cAAc,EAAEG,eAAe;AACnE,CAAC,CAAC","ignoreList":[]}