@webiny/api-core 0.0.0-unstable.e622468070 → 0.0.0-unstable.e6f0dc8ca7

package/features/security/login/abstractions.d.ts

@@ -8,8 +8,9 @@ export declare class AfterLoginEvent extends DomainEvent<AfterLoginPayload> {
     eventType: "login.afterLogin";
     getHandlerAbstraction(): import("@webiny/di").Abstraction<IEventHandler<AfterLoginEvent>>;
 }
-export declare const AfterLoginHandler: import("@webiny/di").Abstraction<IEventHandler<AfterLoginEvent>>;
-export declare namespace AfterLoginHandler {
+/** Hook into login lifecycle after a user logs in. */
+export declare const AfterLoginEventHandler: import("@webiny/di").Abstraction<IEventHandler<AfterLoginEvent>>;
+export declare namespace AfterLoginEventHandler {
     type Interface = IEventHandler<AfterLoginEvent>;
     type Event = AfterLoginEvent;
 }

package/features/security/login/abstractions.js

@@ -3,9 +3,11 @@ import { createAbstraction } from "@webiny/feature/api";
 export class AfterLoginEvent extends DomainEvent {
   eventType = "login.afterLogin";
   getHandlerAbstraction() {
-    return AfterLoginHandler;
+    return AfterLoginEventHandler;
   }
 }
-export const AfterLoginHandler = createAbstraction("AfterLoginHandler");
+
+/** Hook into login lifecycle after a user logs in. */
+export const AfterLoginEventHandler = createAbstraction("AfterLoginEventHandler");
 
 //# sourceMappingURL=abstractions.js.map

package/features/security/login/abstractions.js.map

@@ -1 +1 @@
-{"version":3,"names":["DomainEvent","createAbstraction","AfterLoginEvent","eventType","getHandlerAbstraction","AfterLoginHandler"],"sources":["abstractions.ts"],"sourcesContent":["import { DomainEvent } from \"~/features/eventPublisher/index.js\";\nimport type { IEventHandler } from \"~/features/eventPublisher/index.js\";\nimport { createAbstraction } from \"@webiny/feature/api\";\nimport { Identity } from \"~/features/security/IdentityContext/index.js\";\n\nexport interface AfterLoginPayload {\n    identity: Identity;\n}\n\nexport class AfterLoginEvent extends DomainEvent<AfterLoginPayload> {\n    eventType = \"login.afterLogin\" as const;\n\n    getHandlerAbstraction() {\n        return AfterLoginHandler;\n    }\n}\n\nexport const AfterLoginHandler =\n    createAbstraction<IEventHandler<AfterLoginEvent>>(\"AfterLoginHandler\");\n\nexport namespace AfterLoginHandler {\n    export type Interface = IEventHandler<AfterLoginEvent>;\n    export type Event = AfterLoginEvent;\n}\n"],"mappings":"AAAA,SAASA,WAAW;AAEpB,SAASC,iBAAiB,QAAQ,qBAAqB;AAOvD,OAAO,MAAMC,eAAe,SAASF,WAAW,CAAoB;EAChEG,SAAS,GAAG,kBAAkB;EAE9BC,qBAAqBA,CAAA,EAAG;IACpB,OAAOC,iBAAiB;EAC5B;AACJ;AAEA,OAAO,MAAMA,iBAAiB,GAC1BJ,iBAAiB,CAAiC,mBAAmB,CAAC","ignoreList":[]}
+{"version":3,"names":["DomainEvent","createAbstraction","AfterLoginEvent","eventType","getHandlerAbstraction","AfterLoginEventHandler"],"sources":["abstractions.ts"],"sourcesContent":["import { DomainEvent } from \"~/features/eventPublisher/index.js\";\nimport type { IEventHandler } from \"~/features/eventPublisher/index.js\";\nimport { createAbstraction } from \"@webiny/feature/api\";\nimport { Identity } from \"~/features/security/IdentityContext/index.js\";\n\nexport interface AfterLoginPayload {\n    identity: Identity;\n}\n\nexport class AfterLoginEvent extends DomainEvent<AfterLoginPayload> {\n    eventType = \"login.afterLogin\" as const;\n\n    getHandlerAbstraction() {\n        return AfterLoginEventHandler;\n    }\n}\n\n/** Hook into login lifecycle after a user logs in. */\nexport const AfterLoginEventHandler =\n    createAbstraction<IEventHandler<AfterLoginEvent>>(\"AfterLoginEventHandler\");\n\nexport namespace AfterLoginEventHandler {\n    export type Interface = IEventHandler<AfterLoginEvent>;\n    export type Event = AfterLoginEvent;\n}\n"],"mappings":"AAAA,SAASA,WAAW;AAEpB,SAASC,iBAAiB,QAAQ,qBAAqB;AAOvD,OAAO,MAAMC,eAAe,SAASF,WAAW,CAAoB;EAChEG,SAAS,GAAG,kBAAkB;EAE9BC,qBAAqBA,CAAA,EAAG;IACpB,OAAOC,sBAAsB;EACjC;AACJ;;AAEA;AACA,OAAO,MAAMA,sBAAsB,GAC/BJ,iBAAiB,CAAiC,wBAAwB,CAAC","ignoreList":[]}

package/features/security/permissions/createPermissionSchema.d.ts

@@ -0,0 +1,2 @@
+import type { PermissionSchemaConfig } from "./types.js";
+export declare function createPermissionSchema<const T extends PermissionSchemaConfig>(config: T): T;

package/features/security/permissions/createPermissionSchema.js

@@ -0,0 +1,8 @@
+export function createPermissionSchema(config) {
+  return {
+    ...config,
+    entities: config.entities ?? []
+  };
+}
+
+//# sourceMappingURL=createPermissionSchema.js.map

package/features/security/permissions/createPermissionSchema.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createPermissionSchema","config","entities"],"sources":["createPermissionSchema.ts"],"sourcesContent":["import type { PermissionSchemaConfig } from \"./types.js\";\n\nexport function createPermissionSchema<const T extends PermissionSchemaConfig>(config: T): T {\n    return {\n        ...config,\n        entities: config.entities ?? []\n    };\n}\n"],"mappings":"AAEA,OAAO,SAASA,sBAAsBA,CAAyCC,MAAS,EAAK;EACzF,OAAO;IACH,GAAGA,MAAM;IACTC,QAAQ,EAAED,MAAM,CAACC,QAAQ,IAAI;EACjC,CAAC;AACL","ignoreList":[]}

package/features/security/permissions/createPermissions.d.ts

@@ -0,0 +1,8 @@
+import type { Abstraction } from "@webiny/di";
+import type { PermissionSchemaConfig } from "./types.js";
+import type { Permissions } from "./types.js";
+export declare function createPermissionsAbstraction<const S extends PermissionSchemaConfig>(schema: S): Abstraction<Permissions<S>>;
+export declare function createPermissionsFeature<const S extends PermissionSchemaConfig>(schema: S, abstraction: Abstraction<Permissions<S>>): {
+    name: string;
+    register(container: import("@webiny/di").Container): void;
+};

package/features/security/permissions/createPermissions.js

@@ -0,0 +1,250 @@
+import { createAbstraction } from "@webiny/feature/api";
+import { createFeature } from "@webiny/feature/api";
+import { IdentityContext } from "../IdentityContext/index.js";
+function buildEntityMap(schema) {
+  const map = new Map();
+  for (const entity of schema.entities ?? []) {
+    const actions = new Set();
+    for (const action of entity.actions ?? []) {
+      actions.add(action.name);
+    }
+    map.set(entity.id, {
+      permission: entity.permission,
+      actions,
+      hasOwn: entity.scopes.includes("own")
+    });
+  }
+  return map;
+}
+function getEntity(entityMap, entityId) {
+  const entity = entityMap.get(entityId);
+  if (!entity) {
+    throw new Error(`Unknown entity "${entityId}" in permission schema.`);
+  }
+  return entity;
+}
+class SchemaPermissions {
+  constructor(schema, identityContext) {
+    this.entityMap = buildEntityMap(schema);
+    this.fullAccessName = `${schema.prefix}.*`;
+    this.identityContext = identityContext;
+  }
+  async canAccess(entityId, item) {
+    if (await this.identityContext.hasFullAccess()) {
+      return true;
+    }
+    if (await this.hasFullSchemaAccess()) {
+      return true;
+    }
+    const entity = getEntity(this.entityMap, entityId);
+    const permissions = await this.getEntityPermissions(entity.permission);
+    if (!permissions.length) {
+      return false;
+    }
+    // No item — just check entity-level access.
+    if (item === undefined) {
+      return true;
+    }
+    // Item provided — if all permissions require own, verify ownership.
+    const ownOnly = !permissions.some(p => !p.own);
+    if (!ownOnly) {
+      return true;
+    }
+    const identity = this.identityContext.getIdentity();
+    return item.createdBy?.id === identity.id;
+  }
+  async onlyOwnRecords(entityId) {
+    if (await this.identityContext.hasFullAccess()) {
+      return false;
+    }
+    if (await this.hasFullSchemaAccess()) {
+      return false;
+    }
+    const entity = getEntity(this.entityMap, entityId);
+    const permissions = await this.getEntityPermissions(entity.permission);
+    if (!permissions.length) {
+      return false;
+    }
+    return !permissions.some(p => !p.own);
+  }
+  async canRead(entityId) {
+    if (await this.identityContext.hasFullAccess()) {
+      return true;
+    }
+    if (await this.hasFullSchemaAccess()) {
+      return true;
+    }
+    const entity = getEntity(this.entityMap, entityId);
+    const permissions = await this.getEntityPermissions(entity.permission);
+    if (!permissions.length) {
+      return false;
+    }
+    return permissions.some(permission => {
+      if (typeof permission.rwd !== "string") {
+        return true;
+      }
+      return permission.rwd.includes("r");
+    });
+  }
+  async canCreate(entityId) {
+    if (await this.identityContext.hasFullAccess()) {
+      return true;
+    }
+    if (await this.hasFullSchemaAccess()) {
+      return true;
+    }
+    const entity = getEntity(this.entityMap, entityId);
+    const permissions = await this.getEntityPermissions(entity.permission);
+    if (!permissions.length) {
+      return false;
+    }
+    return permissions.some(permission => {
+      if (typeof permission.rwd !== "string") {
+        return true;
+      }
+      return permission.rwd.includes("w");
+    });
+  }
+  async canEdit(entityId, item) {
+    if (await this.identityContext.hasFullAccess()) {
+      return true;
+    }
+    if (await this.hasFullSchemaAccess()) {
+      return true;
+    }
+    const entity = getEntity(this.entityMap, entityId);
+    const permissions = await this.getEntityPermissions(entity.permission);
+    if (!permissions.length) {
+      return false;
+    }
+    const identity = this.identityContext.getIdentity();
+    return permissions.some(permission => {
+      if (permission.own) {
+        // No item provided (new/unsaved) — allow access.
+        if (!item?.createdBy) {
+          return true;
+        }
+        return item.createdBy.id === identity.id;
+      }
+      if (typeof permission.rwd !== "string") {
+        return true;
+      }
+      return permission.rwd.includes("w");
+    });
+  }
+  async canDelete(entityId, item) {
+    if (await this.identityContext.hasFullAccess()) {
+      return true;
+    }
+    if (await this.hasFullSchemaAccess()) {
+      return true;
+    }
+    const entity = getEntity(this.entityMap, entityId);
+    const permissions = await this.getEntityPermissions(entity.permission);
+    if (!permissions.length) {
+      return false;
+    }
+    const identity = this.identityContext.getIdentity();
+    return permissions.some(permission => {
+      if (permission.own) {
+        return item?.createdBy?.id === identity.id;
+      }
+      if (typeof permission.rwd !== "string") {
+        return true;
+      }
+      return permission.rwd.includes("d");
+    });
+  }
+  async canPublish(entityId) {
+    if (await this.identityContext.hasFullAccess()) {
+      return true;
+    }
+    if (await this.hasFullSchemaAccess()) {
+      return true;
+    }
+    const entity = getEntity(this.entityMap, entityId);
+    const permissions = await this.getEntityPermissions(entity.permission);
+    if (!permissions.length) {
+      return false;
+    }
+    return permissions.some(permission => {
+      return permission.pw?.includes("p");
+    });
+  }
+  async canUnpublish(entityId) {
+    if (await this.identityContext.hasFullAccess()) {
+      return true;
+    }
+    if (await this.hasFullSchemaAccess()) {
+      return true;
+    }
+    const entity = getEntity(this.entityMap, entityId);
+    const permissions = await this.getEntityPermissions(entity.permission);
+    if (!permissions.length) {
+      return false;
+    }
+    return permissions.some(permission => {
+      return permission.pw?.includes("u");
+    });
+  }
+  async canAction(action, entityId) {
+    if (await this.identityContext.hasFullAccess()) {
+      return true;
+    }
+    if (await this.hasFullSchemaAccess()) {
+      return true;
+    }
+    const entity = getEntity(this.entityMap, entityId);
+    const permissions = await this.getEntityPermissions(entity.permission);
+    if (!permissions.length) {
+      return false;
+    }
+    return permissions.some(permission => {
+      return permission[action] === true;
+    });
+  }
+  async getEntityPermissions(entityPermission) {
+    const permissions = await this.identityContext.getPermissions(entityPermission);
+    if (permissions.length) {
+      return permissions;
+    }
+    // Fall back to the schema wildcard (e.g. "test.*") — its flags apply to all entities.
+    const wildcard = await this.identityContext.getPermission(this.fullAccessName);
+    return wildcard ? [wildcard] : [];
+  }
+  async hasFullSchemaAccess() {
+    const permission = await this.identityContext.getPermission(this.fullAccessName);
+    if (!permission) {
+      return false;
+    }
+    // Only treat as full access if the permission has no `rwd` flag.
+    // A permission like { name: "wb.*", rwd: "r" } should NOT grant full access.
+    const keys = Object.keys(permission).filter(k => k !== "name");
+    const hasRwd = keys.includes("rwd");
+
+    // It's full-access only if there's no `rwd` flag.
+    return !hasRwd;
+  }
+}
+export function createPermissionsAbstraction(schema) {
+  return createAbstraction(`${schema.prefix}:Permissions`);
+}
+export function createPermissionsFeature(schema, abstraction) {
+  class PermissionsImpl extends SchemaPermissions {
+    constructor(identityContext) {
+      super(schema, identityContext);
+    }
+  }
+  const Implementation = abstraction.createImplementation({
+    implementation: PermissionsImpl,
+    dependencies: [IdentityContext]
+  });
+  return createFeature({
+    name: `${schema.prefix}:Permissions`,
+    register(container) {
+      container.register(Implementation);
+    }
+  });
+}
+
+//# sourceMappingURL=createPermissions.js.map

package/features/security/permissions/createPermissions.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createAbstraction","createFeature","IdentityContext","buildEntityMap","schema","map","Map","entity","entities","actions","Set","action","add","name","set","id","permission","hasOwn","scopes","includes","getEntity","entityMap","entityId","get","Error","SchemaPermissions","constructor","identityContext","fullAccessName","prefix","canAccess","item","hasFullAccess","hasFullSchemaAccess","permissions","getEntityPermissions","length","undefined","ownOnly","some","p","own","identity","getIdentity","createdBy","onlyOwnRecords","canRead","rwd","canCreate","canEdit","canDelete","canPublish","pw","canUnpublish","canAction","entityPermission","getPermissions","wildcard","getPermission","keys","Object","filter","k","hasRwd","createPermissionsAbstraction","createPermissionsFeature","abstraction","PermissionsImpl","Implementation","createImplementation","implementation","dependencies","register","container"],"sources":["createPermissions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport { createFeature } from \"@webiny/feature/api\";\nimport { IdentityContext } from \"~/features/security/IdentityContext/index.js\";\nimport type { Abstraction } from \"@webiny/di\";\nimport type { PermissionSchemaConfig } from \"./types.js\";\nimport type { OwnableItem } from \"./types.js\";\nimport type { Permissions } from \"./types.js\";\n\ninterface EntityLookup {\n    permission: string;\n    actions: Set<string>;\n    hasOwn: boolean;\n}\n\nfunction buildEntityMap(schema: PermissionSchemaConfig): Map<string, EntityLookup> {\n    const map = new Map<string, EntityLookup>();\n    for (const entity of schema.entities ?? []) {\n        const actions = new Set<string>();\n        for (const action of entity.actions ?? []) {\n            actions.add(action.name);\n        }\n        map.set(entity.id, {\n            permission: entity.permission,\n            actions,\n            hasOwn: entity.scopes.includes(\"own\")\n        });\n    }\n    return map;\n}\n\nfunction getEntity(entityMap: Map<string, EntityLookup>, entityId: string): EntityLookup {\n    const entity = entityMap.get(entityId);\n    if (!entity) {\n        throw new Error(`Unknown entity \"${entityId}\" in permission schema.`);\n    }\n    return entity;\n}\n\nclass SchemaPermissions<S extends PermissionSchemaConfig> {\n    private readonly entityMap: Map<string, EntityLookup>;\n    private readonly fullAccessName: string;\n    private readonly identityContext: IdentityContext.Interface;\n\n    constructor(schema: S, identityContext: IdentityContext.Interface) {\n        this.entityMap = buildEntityMap(schema);\n        this.fullAccessName = `${schema.prefix}.*`;\n        this.identityContext = identityContext;\n    }\n\n    async canAccess(entityId: string, item?: OwnableItem): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        // No item — just check entity-level access.\n        if (item === undefined) {\n            return true;\n        }\n        // Item provided — if all permissions require own, verify ownership.\n        const ownOnly = !permissions.some(p => !p.own);\n        if (!ownOnly) {\n            return true;\n        }\n        const identity = this.identityContext.getIdentity();\n        return item.createdBy?.id === identity.id;\n    }\n\n    async onlyOwnRecords(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return false;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return false;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return !permissions.some(p => !p.own);\n    }\n\n    async canRead(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"r\");\n        });\n    }\n\n    async canCreate(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"w\");\n        });\n    }\n\n    async canEdit(entityId: string, item?: OwnableItem): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        const identity = this.identityContext.getIdentity();\n        return permissions.some(permission => {\n            if (permission.own) {\n                // No item provided (new/unsaved) — allow access.\n                if (!item?.createdBy) {\n                    return true;\n                }\n                return item.createdBy.id === identity.id;\n            }\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"w\");\n        });\n    }\n\n    async canDelete(entityId: string, item?: OwnableItem): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        const identity = this.identityContext.getIdentity();\n        return permissions.some(permission => {\n            if (permission.own) {\n                return item?.createdBy?.id === identity.id;\n            }\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"d\");\n        });\n    }\n\n    async canPublish(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission.pw?.includes(\"p\");\n        });\n    }\n\n    async canUnpublish(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission.pw?.includes(\"u\");\n        });\n    }\n\n    async canAction(action: string, entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission[action] === true;\n        });\n    }\n\n    private async getEntityPermissions(entityPermission: string): Promise<any[]> {\n        const permissions = await this.identityContext.getPermissions(entityPermission);\n        if (permissions.length) {\n            return permissions;\n        }\n        // Fall back to the schema wildcard (e.g. \"test.*\") — its flags apply to all entities.\n        const wildcard = await this.identityContext.getPermission(this.fullAccessName);\n        return wildcard ? [wildcard] : [];\n    }\n\n    private async hasFullSchemaAccess(): Promise<boolean> {\n        const permission = await this.identityContext.getPermission(this.fullAccessName);\n        if (!permission) {\n            return false;\n        }\n        // Only treat as full access if the permission has no `rwd` flag.\n        // A permission like { name: \"wb.*\", rwd: \"r\" } should NOT grant full access.\n        const keys = Object.keys(permission).filter(k => k !== \"name\");\n\n        const hasRwd = keys.includes(\"rwd\");\n\n        // It's full-access only if there's no `rwd` flag.\n        return !hasRwd;\n    }\n}\n\nexport function createPermissionsAbstraction<const S extends PermissionSchemaConfig>(schema: S) {\n    return createAbstraction<Permissions<S>>(`${schema.prefix}:Permissions`);\n}\n\nexport function createPermissionsFeature<const S extends PermissionSchemaConfig>(\n    schema: S,\n    abstraction: Abstraction<Permissions<S>>\n) {\n    class PermissionsImpl extends SchemaPermissions<S> {\n        constructor(identityContext: IdentityContext.Interface) {\n            super(schema, identityContext);\n        }\n    }\n\n    const Implementation = abstraction.createImplementation({\n        implementation: PermissionsImpl,\n        dependencies: [IdentityContext]\n    } as any);\n\n    return createFeature({\n        name: `${schema.prefix}:Permissions`,\n        register(container) {\n            container.register(Implementation);\n        }\n    });\n}\n"],"mappings":"AAAA,SAASA,iBAAiB,QAAQ,qBAAqB;AACvD,SAASC,aAAa,QAAQ,qBAAqB;AACnD,SAASC,eAAe;AAYxB,SAASC,cAAcA,CAACC,MAA8B,EAA6B;EAC/E,MAAMC,GAAG,GAAG,IAAIC,GAAG,CAAuB,CAAC;EAC3C,KAAK,MAAMC,MAAM,IAAIH,MAAM,CAACI,QAAQ,IAAI,EAAE,EAAE;IACxC,MAAMC,OAAO,GAAG,IAAIC,GAAG,CAAS,CAAC;IACjC,KAAK,MAAMC,MAAM,IAAIJ,MAAM,CAACE,OAAO,IAAI,EAAE,EAAE;MACvCA,OAAO,CAACG,GAAG,CAACD,MAAM,CAACE,IAAI,CAAC;IAC5B;IACAR,GAAG,CAACS,GAAG,CAACP,MAAM,CAACQ,EAAE,EAAE;MACfC,UAAU,EAAET,MAAM,CAACS,UAAU;MAC7BP,OAAO;MACPQ,MAAM,EAAEV,MAAM,CAACW,MAAM,CAACC,QAAQ,CAAC,KAAK;IACxC,CAAC,CAAC;EACN;EACA,OAAOd,GAAG;AACd;AAEA,SAASe,SAASA,CAACC,SAAoC,EAAEC,QAAgB,EAAgB;EACrF,MAAMf,MAAM,GAAGc,SAAS,CAACE,GAAG,CAACD,QAAQ,CAAC;EACtC,IAAI,CAACf,MAAM,EAAE;IACT,MAAM,IAAIiB,KAAK,CAAC,mBAAmBF,QAAQ,yBAAyB,CAAC;EACzE;EACA,OAAOf,MAAM;AACjB;AAEA,MAAMkB,iBAAiB,CAAmC;EAKtDC,WAAWA,CAACtB,MAAS,EAAEuB,eAA0C,EAAE;IAC/D,IAAI,CAACN,SAAS,GAAGlB,cAAc,CAACC,MAAM,CAAC;IACvC,IAAI,CAACwB,cAAc,GAAG,GAAGxB,MAAM,CAACyB,MAAM,IAAI;IAC1C,IAAI,CAACF,eAAe,GAAGA,eAAe;EAC1C;EAEA,MAAMG,SAASA,CAACR,QAAgB,EAAES,IAAkB,EAAoB;IACpE,IAAI,MAAM,IAAI,CAACJ,eAAe,CAACK,aAAa,CAAC,CAAC,EAAE;MAC5C,OAAO,IAAI;IACf;IACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;MAClC,OAAO,IAAI;IACf;IACA,MAAM1B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMY,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC5B,MAAM,CAACS,UAAU,CAAC;IACtE,IAAI,CAACkB,WAAW,CAACE,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA;IACA,IAAIL,IAAI,KAAKM,SAAS,EAAE;MACpB,OAAO,IAAI;IACf;IACA;IACA,MAAMC,OAAO,GAAG,CAACJ,WAAW,CAACK,IAAI,CAACC,CAAC,IAAI,CAACA,CAAC,CAACC,GAAG,CAAC;IAC9C,IAAI,CAACH,OAAO,EAAE;MACV,OAAO,IAAI;IACf;IACA,MAAMI,QAAQ,GAAG,IAAI,CAACf,eAAe,CAACgB,WAAW,CAAC,CAAC;IACnD,OAAOZ,IAAI,CAACa,SAAS,EAAE7B,EAAE,KAAK2B,QAAQ,CAAC3B,EAAE;EAC7C;EAEA,MAAM8B,cAAcA,CAACvB,QAAgB,EAAoB;IACrD,IAAI,MAAM,IAAI,CAACK,eAAe,CAACK,aAAa,CAAC,CAAC,EAAE;MAC5C,OAAO,KAAK;IAChB;IACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;MAClC,OAAO,KAAK;IAChB;IACA,MAAM1B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMY,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC5B,MAAM,CAACS,UAAU,CAAC;IACtE,IAAI,CAACkB,WAAW,CAACE,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAO,CAACF,WAAW,CAACK,IAAI,CAACC,CAAC,IAAI,CAACA,CAAC,CAACC,GAAG,CAAC;EACzC;EAEA,MAAMK,OAAOA,CAACxB,QAAgB,EAAoB;IAC9C,IAAI,MAAM,IAAI,CAACK,eAAe,CAACK,aAAa,CAAC,CAAC,EAAE;MAC5C,OAAO,IAAI;IACf;IACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;MAClC,OAAO,IAAI;IACf;IACA,MAAM1B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMY,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC5B,MAAM,CAACS,UAAU,CAAC;IACtE,IAAI,CAACkB,WAAW,CAACE,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAOF,WAAW,CAACK,IAAI,CAACvB,UAAU,IAAI;MAClC,IAAI,OAAOA,UAAU,CAAC+B,GAAG,KAAK,QAAQ,EAAE;QACpC,OAAO,IAAI;MACf;MACA,OAAO/B,UAAU,CAAC+B,GAAG,CAAC5B,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN;EAEA,MAAM6B,SAASA,CAAC1B,QAAgB,EAAoB;IAChD,IAAI,MAAM,IAAI,CAACK,eAAe,CAACK,aAAa,CAAC,CAAC,EAAE;MAC5C,OAAO,IAAI;IACf;IACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;MAClC,OAAO,IAAI;IACf;IACA,MAAM1B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMY,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC5B,MAAM,CAACS,UAAU,CAAC;IACtE,IAAI,CAACkB,WAAW,CAACE,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAOF,WAAW,CAACK,IAAI,CAACvB,UAAU,IAAI;MAClC,IAAI,OAAOA,UAAU,CAAC+B,GAAG,KAAK,QAAQ,EAAE;QACpC,OAAO,IAAI;MACf;MACA,OAAO/B,UAAU,CAAC+B,GAAG,CAAC5B,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN;EAEA,MAAM8B,OAAOA,CAAC3B,QAAgB,EAAES,IAAkB,EAAoB;IAClE,IAAI,MAAM,IAAI,CAACJ,eAAe,CAACK,aAAa,CAAC,CAAC,EAAE;MAC5C,OAAO,IAAI;IACf;IACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;MAClC,OAAO,IAAI;IACf;IACA,MAAM1B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMY,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC5B,MAAM,CAACS,UAAU,CAAC;IACtE,IAAI,CAACkB,WAAW,CAACE,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,MAAMM,QAAQ,GAAG,IAAI,CAACf,eAAe,CAACgB,WAAW,CAAC,CAAC;IACnD,OAAOT,WAAW,CAACK,IAAI,CAACvB,UAAU,IAAI;MAClC,IAAIA,UAAU,CAACyB,GAAG,EAAE;QAChB;QACA,IAAI,CAACV,IAAI,EAAEa,SAAS,EAAE;UAClB,OAAO,IAAI;QACf;QACA,OAAOb,IAAI,CAACa,SAAS,CAAC7B,EAAE,KAAK2B,QAAQ,CAAC3B,EAAE;MAC5C;MACA,IAAI,OAAOC,UAAU,CAAC+B,GAAG,KAAK,QAAQ,EAAE;QACpC,OAAO,IAAI;MACf;MACA,OAAO/B,UAAU,CAAC+B,GAAG,CAAC5B,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN;EAEA,MAAM+B,SAASA,CAAC5B,QAAgB,EAAES,IAAkB,EAAoB;IACpE,IAAI,MAAM,IAAI,CAACJ,eAAe,CAACK,aAAa,CAAC,CAAC,EAAE;MAC5C,OAAO,IAAI;IACf;IACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;MAClC,OAAO,IAAI;IACf;IACA,MAAM1B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMY,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC5B,MAAM,CAACS,UAAU,CAAC;IACtE,IAAI,CAACkB,WAAW,CAACE,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,MAAMM,QAAQ,GAAG,IAAI,CAACf,eAAe,CAACgB,WAAW,CAAC,CAAC;IACnD,OAAOT,WAAW,CAACK,IAAI,CAACvB,UAAU,IAAI;MAClC,IAAIA,UAAU,CAACyB,GAAG,EAAE;QAChB,OAAOV,IAAI,EAAEa,SAAS,EAAE7B,EAAE,KAAK2B,QAAQ,CAAC3B,EAAE;MAC9C;MACA,IAAI,OAAOC,UAAU,CAAC+B,GAAG,KAAK,QAAQ,EAAE;QACpC,OAAO,IAAI;MACf;MACA,OAAO/B,UAAU,CAAC+B,GAAG,CAAC5B,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN;EAEA,MAAMgC,UAAUA,CAAC7B,QAAgB,EAAoB;IACjD,IAAI,MAAM,IAAI,CAACK,eAAe,CAACK,aAAa,CAAC,CAAC,EAAE;MAC5C,OAAO,IAAI;IACf;IACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;MAClC,OAAO,IAAI;IACf;IACA,MAAM1B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMY,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC5B,MAAM,CAACS,UAAU,CAAC;IACtE,IAAI,CAACkB,WAAW,CAACE,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAOF,WAAW,CAACK,IAAI,CAACvB,UAAU,IAAI;MAClC,OAAOA,UAAU,CAACoC,EAAE,EAAEjC,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN;EAEA,MAAMkC,YAAYA,CAAC/B,QAAgB,EAAoB;IACnD,IAAI,MAAM,IAAI,CAACK,eAAe,CAACK,aAAa,CAAC,CAAC,EAAE;MAC5C,OAAO,IAAI;IACf;IACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;MAClC,OAAO,IAAI;IACf;IACA,MAAM1B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMY,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC5B,MAAM,CAACS,UAAU,CAAC;IACtE,IAAI,CAACkB,WAAW,CAACE,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAOF,WAAW,CAACK,IAAI,CAACvB,UAAU,IAAI;MAClC,OAAOA,UAAU,CAACoC,EAAE,EAAEjC,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN;EAEA,MAAMmC,SAASA,CAAC3C,MAAc,EAAEW,QAAgB,EAAoB;IAChE,IAAI,MAAM,IAAI,CAACK,eAAe,CAACK,aAAa,CAAC,CAAC,EAAE;MAC5C,OAAO,IAAI;IACf;IACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;MAClC,OAAO,IAAI;IACf;IACA,MAAM1B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMY,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC5B,MAAM,CAACS,UAAU,CAAC;IACtE,IAAI,CAACkB,WAAW,CAACE,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAOF,WAAW,CAACK,IAAI,CAACvB,UAAU,IAAI;MAClC,OAAOA,UAAU,CAACL,MAAM,CAAC,KAAK,IAAI;IACtC,CAAC,CAAC;EACN;EAEA,MAAcwB,oBAAoBA,CAACoB,gBAAwB,EAAkB;IACzE,MAAMrB,WAAW,GAAG,MAAM,IAAI,CAACP,eAAe,CAAC6B,cAAc,CAACD,gBAAgB,CAAC;IAC/E,IAAIrB,WAAW,CAACE,MAAM,EAAE;MACpB,OAAOF,WAAW;IACtB;IACA;IACA,MAAMuB,QAAQ,GAAG,MAAM,IAAI,CAAC9B,eAAe,CAAC+B,aAAa,CAAC,IAAI,CAAC9B,cAAc,CAAC;IAC9E,OAAO6B,QAAQ,GAAG,CAACA,QAAQ,CAAC,GAAG,EAAE;EACrC;EAEA,MAAcxB,mBAAmBA,CAAA,EAAqB;IAClD,MAAMjB,UAAU,GAAG,MAAM,IAAI,CAACW,eAAe,CAAC+B,aAAa,CAAC,IAAI,CAAC9B,cAAc,CAAC;IAChF,IAAI,CAACZ,UAAU,EAAE;MACb,OAAO,KAAK;IAChB;IACA;IACA;IACA,MAAM2C,IAAI,GAAGC,MAAM,CAACD,IAAI,CAAC3C,UAAU,CAAC,CAAC6C,MAAM,CAACC,CAAC,IAAIA,CAAC,KAAK,MAAM,CAAC;IAE9D,MAAMC,MAAM,GAAGJ,IAAI,CAACxC,QAAQ,CAAC,KAAK,CAAC;;IAEnC;IACA,OAAO,CAAC4C,MAAM;EAClB;AACJ;AAEA,OAAO,SAASC,4BAA4BA,CAAyC5D,MAAS,EAAE;EAC5F,OAAOJ,iBAAiB,CAAiB,GAAGI,MAAM,CAACyB,MAAM,cAAc,CAAC;AAC5E;AAEA,OAAO,SAASoC,wBAAwBA,CACpC7D,MAAS,EACT8D,WAAwC,EAC1C;EACE,MAAMC,eAAe,SAAS1C,iBAAiB,CAAI;IAC/CC,WAAWA,CAACC,eAA0C,EAAE;MACpD,KAAK,CAACvB,MAAM,EAAEuB,eAAe,CAAC;IAClC;EACJ;EAEA,MAAMyC,cAAc,GAAGF,WAAW,CAACG,oBAAoB,CAAC;IACpDC,cAAc,EAAEH,eAAe;IAC/BI,YAAY,EAAE,CAACrE,eAAe;EAClC,CAAQ,CAAC;EAET,OAAOD,aAAa,CAAC;IACjBY,IAAI,EAAE,GAAGT,MAAM,CAACyB,MAAM,cAAc;IACpC2C,QAAQA,CAACC,SAAS,EAAE;MAChBA,SAAS,CAACD,QAAQ,CAACJ,cAAc,CAAC;IACtC;EACJ,CAAC,CAAC;AACN","ignoreList":[]}

package/features/security/permissions/index.d.ts

@@ -0,0 +1,3 @@
+export { createPermissionSchema } from "./createPermissionSchema.js";
+export { createPermissionsAbstraction, createPermissionsFeature } from "./createPermissions.js";
+export type { ActionDefinition, EntityDefinition, PermissionSchemaConfig, OwnableItem, Permissions, AllEntityIds, RwdEntityId, PwEntityId, CustomActionNames } from "./types.js";

package/features/security/permissions/index.js

@@ -0,0 +1,4 @@
+export { createPermissionSchema } from "./createPermissionSchema.js";
+export { createPermissionsAbstraction, createPermissionsFeature } from "./createPermissions.js";
+
+//# sourceMappingURL=index.js.map

package/features/security/permissions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createPermissionSchema","createPermissionsAbstraction","createPermissionsFeature"],"sources":["index.ts"],"sourcesContent":["export { createPermissionSchema } from \"./createPermissionSchema.js\";\nexport { createPermissionsAbstraction, createPermissionsFeature } from \"./createPermissions.js\";\nexport type {\n    ActionDefinition,\n    EntityDefinition,\n    PermissionSchemaConfig,\n    OwnableItem,\n    Permissions,\n    AllEntityIds,\n    RwdEntityId,\n    PwEntityId,\n    CustomActionNames\n} from \"./types.js\";\n"],"mappings":"AAAA,SAASA,sBAAsB;AAC/B,SAASC,4BAA4B,EAAEC,wBAAwB","ignoreList":[]}

package/features/security/permissions/types.d.ts

@@ -0,0 +1,137 @@
+/**
+ * An action definition on an entity.
+ *
+ * Built-in actions:
+ * - `{ name: "rwd" }` — read/write/delete (serialized as joined string, e.g. "rw")
+ * - `{ name: "pw" }` — publish/unpublish (serialized as joined string, e.g. "pu")
+ *
+ * Custom actions:
+ * - `{ name: "install" }` — boolean flag (serialized as `install: true`)
+ */
+export interface ActionDefinition {
+    /** Key on the permission object (e.g. "rwd", "pw", "install"). */
+    name: string;
+    /** Display label for the UI. Required for custom actions; ignored for built-in "rwd"/"pw". */
+    label?: string;
+}
+/**
+ * Defines an entity within a permission schema.
+ */
+export interface EntityDefinition {
+    /** Unique ID, used for form field naming: ${id}AccessScope, ${id}RWD, etc. */
+    id: string;
+    /** Display title for the UI renderer (e.g. "Files", "Settings"). */
+    title?: string;
+    /** Permission name emitted for this entity (e.g. "fm.file"). */
+    permission: string;
+    /** Available access scopes. */
+    scopes: readonly ("full" | "own")[];
+    /** Action definitions for this entity. */
+    actions?: readonly ActionDefinition[];
+    /** Dependency on another entity. */
+    dependsOn?: {
+        /** ID of parent entity. */
+        entity: string;
+        /** Required action character (e.g. "r"). */
+        requires: string;
+    };
+}
+/**
+ * Configuration for creating a permission schema.
+ */
+export interface PermissionSchemaConfig {
+    /** Permission prefix — used to filter permissions from the array. */
+    prefix: string;
+    /**
+     * Full access configuration.
+     * - `true` — emits `{ name: "${prefix}.*" }`.
+     * - `{ ...extras }` — emits `{ name: "${prefix}.*", ...extras }`.
+     */
+    fullAccess: boolean | {
+        [key: string]: any;
+    };
+    /** Entity definitions (optional — simple apps have none). */
+    entities?: readonly EntityDefinition[];
+}
+/**
+ * Item that may have an owner (used for own-scope permission checks).
+ */
+export interface OwnableItem {
+    createdBy?: {
+        id: string;
+    } | null;
+}
+/**
+ * Extract the union of entity definitions from a schema config type.
+ */
+type EntitiesOf<S extends PermissionSchemaConfig> = S extends {
+    entities: ReadonlyArray<infer E extends EntityDefinition>;
+} ? E : never;
+/**
+ * Extract entity IDs whose actions array contains an action with the given name.
+ */
+type EntityIdWithAction<S extends PermissionSchemaConfig, A extends string> = {
+    [K in EntitiesOf<S> as K extends {
+        actions: ReadonlyArray<infer Act>;
+    } ? Act extends {
+        name: A;
+    } ? K["id"] : never : never]: never;
+} extends infer M ? keyof M & string : never;
+/**
+ * All entity IDs in the schema.
+ */
+export type AllEntityIds<S extends PermissionSchemaConfig> = EntitiesOf<S>["id"];
+/**
+ * Entity IDs that have the "rwd" action.
+ */
+export type RwdEntityId<S extends PermissionSchemaConfig> = EntityIdWithAction<S, "rwd">;
+/**
+ * Entity IDs that have the "pw" action.
+ */
+export type PwEntityId<S extends PermissionSchemaConfig> = EntityIdWithAction<S, "pw">;
+/**
+ * Custom (non-builtin) action names across all entities.
+ */
+export type CustomActionNames<S extends PermissionSchemaConfig> = Exclude<EntitiesOf<S> extends {
+    actions: ReadonlyArray<infer Act extends ActionDefinition>;
+} ? Act["name"] : never, "rwd" | "pw">;
+/**
+ * Typed permissions interface for a given schema.
+ *
+ * When the schema has literal entity types, methods are narrowed to only accept valid entity IDs.
+ * When the schema is dynamically typed, all methods accept `string`.
+ */
+export type Permissions<S extends PermissionSchemaConfig> = string extends AllEntityIds<S> ? PermissionsUntyped : PermissionsTyped<S>;
+export interface PermissionsUntyped {
+    canAccess(entityId: string, item?: OwnableItem): Promise<boolean>;
+    onlyOwnRecords(entityId: string): Promise<boolean>;
+    canRead(entityId: string): Promise<boolean>;
+    canCreate(entityId: string): Promise<boolean>;
+    canEdit(entityId: string, item?: OwnableItem): Promise<boolean>;
+    canDelete(entityId: string, item?: OwnableItem): Promise<boolean>;
+    canPublish(entityId: string): Promise<boolean>;
+    canUnpublish(entityId: string): Promise<boolean>;
+    canAction(action: string, entityId: string): Promise<boolean>;
+}
+export type PermissionsTyped<S extends PermissionSchemaConfig> = {
+    canAccess(entityId: AllEntityIds<S>, item?: OwnableItem): Promise<boolean>;
+    onlyOwnRecords(entityId: AllEntityIds<S>): Promise<boolean>;
+    canAction(action: CustomActionNames<S> extends never ? string : CustomActionNames<S>, entityId: AllEntityIds<S>): Promise<boolean>;
+} & ([RwdEntityId<S>] extends [never] ? {
+    canRead(entityId: string): Promise<boolean>;
+    canCreate(entityId: string): Promise<boolean>;
+    canEdit(entityId: string, item?: OwnableItem): Promise<boolean>;
+    canDelete(entityId: string, item?: OwnableItem): Promise<boolean>;
+} : {
+    canRead(entityId: RwdEntityId<S>): Promise<boolean>;
+    canCreate(entityId: RwdEntityId<S>): Promise<boolean>;
+    canEdit(entityId: RwdEntityId<S>, item?: OwnableItem): Promise<boolean>;
+    canDelete(entityId: RwdEntityId<S>, item?: OwnableItem): Promise<boolean>;
+}) & ([PwEntityId<S>] extends [never] ? {
+    canPublish(entityId: string): Promise<boolean>;
+    canUnpublish(entityId: string): Promise<boolean>;
+} : {
+    canPublish(entityId: PwEntityId<S>): Promise<boolean>;
+    canUnpublish(entityId: PwEntityId<S>): Promise<boolean>;
+});
+export {};

package/features/security/permissions/types.js

@@ -0,0 +1,3 @@
+export {};
+
+//# sourceMappingURL=types.js.map

package/features/security/permissions/types.js.map

@@ -0,0 +1 @@
+{"version":3,"names":[],"sources":["types.ts"],"sourcesContent":["/**\n * An action definition on an entity.\n *\n * Built-in actions:\n * - `{ name: \"rwd\" }` — read/write/delete (serialized as joined string, e.g. \"rw\")\n * - `{ name: \"pw\" }` — publish/unpublish (serialized as joined string, e.g. \"pu\")\n *\n * Custom actions:\n * - `{ name: \"install\" }` — boolean flag (serialized as `install: true`)\n */\nexport interface ActionDefinition {\n    /** Key on the permission object (e.g. \"rwd\", \"pw\", \"install\"). */\n    name: string;\n    /** Display label for the UI. Required for custom actions; ignored for built-in \"rwd\"/\"pw\". */\n    label?: string;\n}\n\n/**\n * Defines an entity within a permission schema.\n */\nexport interface EntityDefinition {\n    /** Unique ID, used for form field naming: ${id}AccessScope, ${id}RWD, etc. */\n    id: string;\n    /** Display title for the UI renderer (e.g. \"Files\", \"Settings\"). */\n    title?: string;\n    /** Permission name emitted for this entity (e.g. \"fm.file\"). */\n    permission: string;\n    /** Available access scopes. */\n    scopes: readonly (\"full\" | \"own\")[];\n    /** Action definitions for this entity. */\n    actions?: readonly ActionDefinition[];\n    /** Dependency on another entity. */\n    dependsOn?: {\n        /** ID of parent entity. */\n        entity: string;\n        /** Required action character (e.g. \"r\"). */\n        requires: string;\n    };\n}\n\n/**\n * Configuration for creating a permission schema.\n */\nexport interface PermissionSchemaConfig {\n    /** Permission prefix — used to filter permissions from the array. */\n    prefix: string;\n    /**\n     * Full access configuration.\n     * - `true` — emits `{ name: \"${prefix}.*\" }`.\n     * - `{ ...extras }` — emits `{ name: \"${prefix}.*\", ...extras }`.\n     */\n    fullAccess: boolean | { [key: string]: any };\n    /** Entity definitions (optional — simple apps have none). */\n    entities?: readonly EntityDefinition[];\n}\n\n/**\n * Item that may have an owner (used for own-scope permission checks).\n */\nexport interface OwnableItem {\n    createdBy?: { id: string } | null;\n}\n\n/**\n * Extract the union of entity definitions from a schema config type.\n */\ntype EntitiesOf<S extends PermissionSchemaConfig> = S extends {\n    entities: ReadonlyArray<infer E extends EntityDefinition>;\n}\n    ? E\n    : never;\n\n/**\n * Extract entity IDs whose actions array contains an action with the given name.\n */\ntype EntityIdWithAction<S extends PermissionSchemaConfig, A extends string> = {\n    [K in EntitiesOf<S> as K extends { actions: ReadonlyArray<infer Act> }\n        ? Act extends { name: A }\n            ? K[\"id\"]\n            : never\n        : never]: never;\n} extends infer M\n    ? keyof M & string\n    : never;\n\n/**\n * All entity IDs in the schema.\n */\nexport type AllEntityIds<S extends PermissionSchemaConfig> = EntitiesOf<S>[\"id\"];\n\n/**\n * Entity IDs that have the \"rwd\" action.\n */\nexport type RwdEntityId<S extends PermissionSchemaConfig> = EntityIdWithAction<S, \"rwd\">;\n\n/**\n * Entity IDs that have the \"pw\" action.\n */\nexport type PwEntityId<S extends PermissionSchemaConfig> = EntityIdWithAction<S, \"pw\">;\n\n/**\n * Custom (non-builtin) action names across all entities.\n */\nexport type CustomActionNames<S extends PermissionSchemaConfig> = Exclude<\n    EntitiesOf<S> extends { actions: ReadonlyArray<infer Act extends ActionDefinition> }\n        ? Act[\"name\"]\n        : never,\n    \"rwd\" | \"pw\"\n>;\n\n/**\n * Typed permissions interface for a given schema.\n *\n * When the schema has literal entity types, methods are narrowed to only accept valid entity IDs.\n * When the schema is dynamically typed, all methods accept `string`.\n */\nexport type Permissions<S extends PermissionSchemaConfig> =\n    string extends AllEntityIds<S> ? PermissionsUntyped : PermissionsTyped<S>;\n\nexport interface PermissionsUntyped {\n    canAccess(entityId: string, item?: OwnableItem): Promise<boolean>;\n    onlyOwnRecords(entityId: string): Promise<boolean>;\n    canRead(entityId: string): Promise<boolean>;\n    canCreate(entityId: string): Promise<boolean>;\n    canEdit(entityId: string, item?: OwnableItem): Promise<boolean>;\n    canDelete(entityId: string, item?: OwnableItem): Promise<boolean>;\n    canPublish(entityId: string): Promise<boolean>;\n    canUnpublish(entityId: string): Promise<boolean>;\n    canAction(action: string, entityId: string): Promise<boolean>;\n}\n\nexport type PermissionsTyped<S extends PermissionSchemaConfig> = {\n    canAccess(entityId: AllEntityIds<S>, item?: OwnableItem): Promise<boolean>;\n    onlyOwnRecords(entityId: AllEntityIds<S>): Promise<boolean>;\n    canAction(\n        action: CustomActionNames<S> extends never ? string : CustomActionNames<S>,\n        entityId: AllEntityIds<S>\n    ): Promise<boolean>;\n} & ([RwdEntityId<S>] extends [never]\n    ? {\n          canRead(entityId: string): Promise<boolean>;\n          canCreate(entityId: string): Promise<boolean>;\n          canEdit(entityId: string, item?: OwnableItem): Promise<boolean>;\n          canDelete(entityId: string, item?: OwnableItem): Promise<boolean>;\n      }\n    : {\n          canRead(entityId: RwdEntityId<S>): Promise<boolean>;\n          canCreate(entityId: RwdEntityId<S>): Promise<boolean>;\n          canEdit(entityId: RwdEntityId<S>, item?: OwnableItem): Promise<boolean>;\n          canDelete(entityId: RwdEntityId<S>, item?: OwnableItem): Promise<boolean>;\n      }) &\n    ([PwEntityId<S>] extends [never]\n        ? {\n              canPublish(entityId: string): Promise<boolean>;\n              canUnpublish(entityId: string): Promise<boolean>;\n          }\n        : {\n              canPublish(entityId: PwEntityId<S>): Promise<boolean>;\n              canUnpublish(entityId: PwEntityId<S>): Promise<boolean>;\n          });\n"],"mappings":"","ignoreList":[]}

package/features/security/roles/CreateRole/CreateRoleUseCase.d.ts

@@ -1,16 +1,14 @@
 import { Result } from "@webiny/feature/api";
-import { TenantContext } from "../../../../features/tenancy/TenantContext/index.js";
 import { EventPublisher } from "../../../../features/eventPublisher/index.js";
 import { CreateRoleUseCase as UseCaseAbstraction } from "./abstractions.js";
 import { RolesRepository } from "../shared/abstractions.js";
 import { IdentityContext } from "../../IdentityContext/abstractions.js";
 import type { Role, CreateRoleInput } from "../shared/types.js";
 declare class CreateRoleUseCaseImpl implements UseCaseAbstraction.Interface {
-    private tenantContext;
     private identityContext;
     private eventPublisher;
     private repository;
-    constructor(tenantContext: TenantContext.Interface, identityContext: IdentityContext.Interface, eventPublisher: EventPublisher.Interface, repository: RolesRepository.Interface);
+    constructor(identityContext: IdentityContext.Interface, eventPublisher: EventPublisher.Interface, repository: RolesRepository.Interface);
     execute(input: CreateRoleInput): Promise<Result<Role, UseCaseAbstraction.Error>>;
 }
 export declare const CreateRoleUseCase: import("@webiny/di").Implementation<typeof CreateRoleUseCaseImpl>;

package/features/security/roles/CreateRole/CreateRoleUseCase.js

@@ -1,7 +1,6 @@
 import { mdbid } from "@webiny/utils";
 import { createImplementation } from "@webiny/feature/api";
 import { Result } from "@webiny/feature/api";
-import { TenantContext } from "../../../tenancy/TenantContext/index.js";
 import { EventPublisher } from "../../../eventPublisher/index.js";
 import { CreateRoleUseCase as UseCaseAbstraction } from "./abstractions.js";
 import { RolesRepository } from "../shared/abstractions.js";
@@ -10,8 +9,7 @@ import { createRoleValidation } from "./schema.js";
 import { RoleBeforeCreateEvent, RoleAfterCreateEvent } from "./events.js";
 import { NotAuthorizedError, RoleExistsError, RoleValidationError } from "../shared/errors.js";
 class CreateRoleUseCaseImpl {
-  constructor(tenantContext, identityContext, eventPublisher, repository) {
-    this.tenantContext = tenantContext;
+  constructor(identityContext, eventPublisher, repository) {
     this.identityContext = identityContext;
     this.eventPublisher = eventPublisher;
     this.repository = repository;
@@ -23,9 +21,8 @@ class CreateRoleUseCaseImpl {
     }
     const validation = createRoleValidation.safeParse(input);
     if (!validation.success) {
-      return Result.fail(new RoleValidationError(validation.error.errors[0].message));
+      return Result.fail(new RoleValidationError(validation.error.issues[0].message));
     }
-    const tenant = this.tenantContext.getTenant();
     const identity = this.identityContext.getIdentity();
     const data = validation.data;
 
@@ -43,7 +40,6 @@ class CreateRoleUseCaseImpl {
       description: data.description,
       permissions: data.permissions,
       system: input.system || false,
-      tenant: tenant.id,
       createdOn: new Date().toISOString(),
       createdBy: {
         id: identity.id,
@@ -70,7 +66,7 @@ class CreateRoleUseCaseImpl {
 export const CreateRoleUseCase = createImplementation({
   abstraction: UseCaseAbstraction,
   implementation: CreateRoleUseCaseImpl,
-  dependencies: [TenantContext, IdentityContext, EventPublisher, RolesRepository]
+  dependencies: [IdentityContext, EventPublisher, RolesRepository]
 });
 
 //# sourceMappingURL=CreateRoleUseCase.js.map

package/features/security/roles/CreateRole/CreateRoleUseCase.js.map

@@ -1 +1 @@
-{"version":3,"names":["mdbid","createImplementation","Result","TenantContext","EventPublisher","CreateRoleUseCase","UseCaseAbstraction","RolesRepository","IdentityContext","createRoleValidation","RoleBeforeCreateEvent","RoleAfterCreateEvent","NotAuthorizedError","RoleExistsError","RoleValidationError","CreateRoleUseCaseImpl","constructor","tenantContext","identityContext","eventPublisher","repository","execute","input","hasPermission","getPermission","fail","validation","safeParse","success","error","errors","message","tenant","getTenant","identity","getIdentity","data","existingRoleResult","get","slug","isOk","role","id","name","description","permissions","system","createdOn","Date","toISOString","createdBy","displayName","type","plugin","publish","result","create","isFail","ok","abstraction","implementation","dependencies"],"sources":["CreateRoleUseCase.ts"],"sourcesContent":["import { mdbid } from \"@webiny/utils\";\nimport { createImplementation } from \"@webiny/feature/api\";\nimport { Result } from \"@webiny/feature/api\";\nimport { TenantContext } from \"~/features/tenancy/TenantContext/index.js\";\nimport { EventPublisher } from \"~/features/eventPublisher/index.js\";\nimport { CreateRoleUseCase as UseCaseAbstraction } from \"./abstractions.js\";\nimport { RolesRepository } from \"../shared/abstractions.js\";\nimport { IdentityContext } from \"../../IdentityContext/abstractions.js\";\nimport { createRoleValidation } from \"./schema.js\";\nimport { RoleBeforeCreateEvent, RoleAfterCreateEvent } from \"./events.js\";\nimport type { Role, CreateRoleInput } from \"../shared/types.js\";\nimport { NotAuthorizedError, RoleExistsError, RoleValidationError } from \"../shared/errors.js\";\n\nclass CreateRoleUseCaseImpl implements UseCaseAbstraction.Interface {\n    constructor(\n        private tenantContext: TenantContext.Interface,\n        private identityContext: IdentityContext.Interface,\n        private eventPublisher: EventPublisher.Interface,\n        private repository: RolesRepository.Interface\n    ) {}\n\n    async execute(input: CreateRoleInput): Promise<Result<Role, UseCaseAbstraction.Error>> {\n        const hasPermission = await this.identityContext.getPermission(\"security.role\");\n\n        if (!hasPermission) {\n            return Result.fail(new NotAuthorizedError());\n        }\n\n        const validation = createRoleValidation.safeParse(input);\n        if (!validation.success) {\n            return Result.fail(new RoleValidationError(validation.error.errors[0].message));\n        }\n\n        const tenant = this.tenantContext.getTenant();\n        const identity = this.identityContext.getIdentity();\n        const data = validation.data;\n\n        // Check if role with same slug already exists\n        const existingRoleResult = await this.repository.get({ slug: data.slug });\n        if (existingRoleResult.isOk()) {\n            return Result.fail(new RoleExistsError(data.slug));\n        }\n\n        const role: Role = {\n            id: mdbid(),\n            name: data.name,\n            slug: data.slug,\n            description: data.description,\n            permissions: data.permissions,\n            system: input.system || false,\n            tenant: tenant.id,\n            createdOn: new Date().toISOString(),\n            createdBy: {\n                id: identity.id,\n                displayName: identity.displayName,\n                type: identity.type\n            },\n            plugin: false\n        };\n\n        await this.eventPublisher.publish(\n            new RoleBeforeCreateEvent({ role, input: validation.data })\n        );\n\n        const result = await this.repository.create(role);\n\n        if (result.isFail()) {\n            return Result.fail(result.error);\n        }\n\n        await this.eventPublisher.publish(\n            new RoleAfterCreateEvent({ role, input: validation.data })\n        );\n\n        return Result.ok(role);\n    }\n}\n\nexport const CreateRoleUseCase = createImplementation({\n    abstraction: UseCaseAbstraction,\n    implementation: CreateRoleUseCaseImpl,\n    dependencies: [TenantContext, IdentityContext, EventPublisher, RolesRepository]\n});\n"],"mappings":"AAAA,SAASA,KAAK,QAAQ,eAAe;AACrC,SAASC,oBAAoB,QAAQ,qBAAqB;AAC1D,SAASC,MAAM,QAAQ,qBAAqB;AAC5C,SAASC,aAAa;AACtB,SAASC,cAAc;AACvB,SAASC,iBAAiB,IAAIC,kBAAkB;AAChD,SAASC,eAAe;AACxB,SAASC,eAAe;AACxB,SAASC,oBAAoB;AAC7B,SAASC,qBAAqB,EAAEC,oBAAoB;AAEpD,SAASC,kBAAkB,EAAEC,eAAe,EAAEC,mBAAmB;AAEjE,MAAMC,qBAAqB,CAAyC;EAChEC,WAAWA,CACCC,aAAsC,EACtCC,eAA0C,EAC1CC,cAAwC,EACxCC,UAAqC,EAC/C;IAAA,KAJUH,aAAsC,GAAtCA,aAAsC;IAAA,KACtCC,eAA0C,GAA1CA,eAA0C;IAAA,KAC1CC,cAAwC,GAAxCA,cAAwC;IAAA,KACxCC,UAAqC,GAArCA,UAAqC;EAC9C;EAEH,MAAMC,OAAOA,CAACC,KAAsB,EAAmD;IACnF,MAAMC,aAAa,GAAG,MAAM,IAAI,CAACL,eAAe,CAACM,aAAa,CAAC,eAAe,CAAC;IAE/E,IAAI,CAACD,aAAa,EAAE;MAChB,OAAOrB,MAAM,CAACuB,IAAI,CAAC,IAAIb,kBAAkB,CAAC,CAAC,CAAC;IAChD;IAEA,MAAMc,UAAU,GAAGjB,oBAAoB,CAACkB,SAAS,CAACL,KAAK,CAAC;IACxD,IAAI,CAACI,UAAU,CAACE,OAAO,EAAE;MACrB,OAAO1B,MAAM,CAACuB,IAAI,CAAC,IAAIX,mBAAmB,CAACY,UAAU,CAACG,KAAK,CAACC,MAAM,CAAC,CAAC,CAAC,CAACC,OAAO,CAAC,CAAC;IACnF;IAEA,MAAMC,MAAM,GAAG,IAAI,CAACf,aAAa,CAACgB,SAAS,CAAC,CAAC;IAC7C,MAAMC,QAAQ,GAAG,IAAI,CAAChB,eAAe,CAACiB,WAAW,CAAC,CAAC;IACnD,MAAMC,IAAI,GAAGV,UAAU,CAACU,IAAI;;IAE5B;IACA,MAAMC,kBAAkB,GAAG,MAAM,IAAI,CAACjB,UAAU,CAACkB,GAAG,CAAC;MAAEC,IAAI,EAAEH,IAAI,CAACG;IAAK,CAAC,CAAC;IACzE,IAAIF,kBAAkB,CAACG,IAAI,CAAC,CAAC,EAAE;MAC3B,OAAOtC,MAAM,CAACuB,IAAI,CAAC,IAAIZ,eAAe,CAACuB,IAAI,CAACG,IAAI,CAAC,CAAC;IACtD;IAEA,MAAME,IAAU,GAAG;MACfC,EAAE,EAAE1C,KAAK,CAAC,CAAC;MACX2C,IAAI,EAAEP,IAAI,CAACO,IAAI;MACfJ,IAAI,EAAEH,IAAI,CAACG,IAAI;MACfK,WAAW,EAAER,IAAI,CAACQ,WAAW;MAC7BC,WAAW,EAAET,IAAI,CAACS,WAAW;MAC7BC,MAAM,EAAExB,KAAK,CAACwB,MAAM,IAAI,KAAK;MAC7Bd,MAAM,EAAEA,MAAM,CAACU,EAAE;MACjBK,SAAS,EAAE,IAAIC,IAAI,CAAC,CAAC,CAACC,WAAW,CAAC,CAAC;MACnCC,SAAS,EAAE;QACPR,EAAE,EAAER,QAAQ,CAACQ,EAAE;QACfS,WAAW,EAAEjB,QAAQ,CAACiB,WAAW;QACjCC,IAAI,EAAElB,QAAQ,CAACkB;MACnB,CAAC;MACDC,MAAM,EAAE;IACZ,CAAC;IAED,MAAM,IAAI,CAAClC,cAAc,CAACmC,OAAO,CAC7B,IAAI5C,qBAAqB,CAAC;MAAE+B,IAAI;MAAEnB,KAAK,EAAEI,UAAU,CAACU;IAAK,CAAC,CAC9D,CAAC;IAED,MAAMmB,MAAM,GAAG,MAAM,IAAI,CAACnC,UAAU,CAACoC,MAAM,CAACf,IAAI,CAAC;IAEjD,IAAIc,MAAM,CAACE,MAAM,CAAC,CAAC,EAAE;MACjB,OAAOvD,MAAM,CAACuB,IAAI,CAAC8B,MAAM,CAAC1B,KAAK,CAAC;IACpC;IAEA,MAAM,IAAI,CAACV,cAAc,CAACmC,OAAO,CAC7B,IAAI3C,oBAAoB,CAAC;MAAE8B,IAAI;MAAEnB,KAAK,EAAEI,UAAU,CAACU;IAAK,CAAC,CAC7D,CAAC;IAED,OAAOlC,MAAM,CAACwD,EAAE,CAACjB,IAAI,CAAC;EAC1B;AACJ;AAEA,OAAO,MAAMpC,iBAAiB,GAAGJ,oBAAoB,CAAC;EAClD0D,WAAW,EAAErD,kBAAkB;EAC/BsD,cAAc,EAAE7C,qBAAqB;EACrC8C,YAAY,EAAE,CAAC1D,aAAa,EAAEK,eAAe,EAAEJ,cAAc,EAAEG,eAAe;AAClF,CAAC,CAAC","ignoreList":[]}
+{"version":3,"names":["mdbid","createImplementation","Result","EventPublisher","CreateRoleUseCase","UseCaseAbstraction","RolesRepository","IdentityContext","createRoleValidation","RoleBeforeCreateEvent","RoleAfterCreateEvent","NotAuthorizedError","RoleExistsError","RoleValidationError","CreateRoleUseCaseImpl","constructor","identityContext","eventPublisher","repository","execute","input","hasPermission","getPermission","fail","validation","safeParse","success","error","issues","message","identity","getIdentity","data","existingRoleResult","get","slug","isOk","role","id","name","description","permissions","system","createdOn","Date","toISOString","createdBy","displayName","type","plugin","publish","result","create","isFail","ok","abstraction","implementation","dependencies"],"sources":["CreateRoleUseCase.ts"],"sourcesContent":["import { mdbid } from \"@webiny/utils\";\nimport { createImplementation } from \"@webiny/feature/api\";\nimport { Result } from \"@webiny/feature/api\";\nimport { EventPublisher } from \"~/features/eventPublisher/index.js\";\nimport { CreateRoleUseCase as UseCaseAbstraction } from \"./abstractions.js\";\nimport { RolesRepository } from \"../shared/abstractions.js\";\nimport { IdentityContext } from \"../../IdentityContext/abstractions.js\";\nimport { createRoleValidation } from \"./schema.js\";\nimport { RoleBeforeCreateEvent, RoleAfterCreateEvent } from \"./events.js\";\nimport type { Role, CreateRoleInput } from \"../shared/types.js\";\nimport { NotAuthorizedError, RoleExistsError, RoleValidationError } from \"../shared/errors.js\";\n\nclass CreateRoleUseCaseImpl implements UseCaseAbstraction.Interface {\n    constructor(\n        private identityContext: IdentityContext.Interface,\n        private eventPublisher: EventPublisher.Interface,\n        private repository: RolesRepository.Interface\n    ) {}\n\n    async execute(input: CreateRoleInput): Promise<Result<Role, UseCaseAbstraction.Error>> {\n        const hasPermission = await this.identityContext.getPermission(\"security.role\");\n\n        if (!hasPermission) {\n            return Result.fail(new NotAuthorizedError());\n        }\n\n        const validation = createRoleValidation.safeParse(input);\n        if (!validation.success) {\n            return Result.fail(new RoleValidationError(validation.error.issues[0].message));\n        }\n\n        const identity = this.identityContext.getIdentity();\n        const data = validation.data;\n\n        // Check if role with same slug already exists\n        const existingRoleResult = await this.repository.get({ slug: data.slug });\n        if (existingRoleResult.isOk()) {\n            return Result.fail(new RoleExistsError(data.slug));\n        }\n\n        const role: Role = {\n            id: mdbid(),\n            name: data.name,\n            slug: data.slug,\n            description: data.description,\n            permissions: data.permissions,\n            system: input.system || false,\n            createdOn: new Date().toISOString(),\n            createdBy: {\n                id: identity.id,\n                displayName: identity.displayName,\n                type: identity.type\n            },\n            plugin: false\n        };\n\n        await this.eventPublisher.publish(\n            new RoleBeforeCreateEvent({ role, input: validation.data })\n        );\n\n        const result = await this.repository.create(role);\n\n        if (result.isFail()) {\n            return Result.fail(result.error);\n        }\n\n        await this.eventPublisher.publish(\n            new RoleAfterCreateEvent({ role, input: validation.data })\n        );\n\n        return Result.ok(role);\n    }\n}\n\nexport const CreateRoleUseCase = createImplementation({\n    abstraction: UseCaseAbstraction,\n    implementation: CreateRoleUseCaseImpl,\n    dependencies: [IdentityContext, EventPublisher, RolesRepository]\n});\n"],"mappings":"AAAA,SAASA,KAAK,QAAQ,eAAe;AACrC,SAASC,oBAAoB,QAAQ,qBAAqB;AAC1D,SAASC,MAAM,QAAQ,qBAAqB;AAC5C,SAASC,cAAc;AACvB,SAASC,iBAAiB,IAAIC,kBAAkB;AAChD,SAASC,eAAe;AACxB,SAASC,eAAe;AACxB,SAASC,oBAAoB;AAC7B,SAASC,qBAAqB,EAAEC,oBAAoB;AAEpD,SAASC,kBAAkB,EAAEC,eAAe,EAAEC,mBAAmB;AAEjE,MAAMC,qBAAqB,CAAyC;EAChEC,WAAWA,CACCC,eAA0C,EAC1CC,cAAwC,EACxCC,UAAqC,EAC/C;IAAA,KAHUF,eAA0C,GAA1CA,eAA0C;IAAA,KAC1CC,cAAwC,GAAxCA,cAAwC;IAAA,KACxCC,UAAqC,GAArCA,UAAqC;EAC9C;EAEH,MAAMC,OAAOA,CAACC,KAAsB,EAAmD;IACnF,MAAMC,aAAa,GAAG,MAAM,IAAI,CAACL,eAAe,CAACM,aAAa,CAAC,eAAe,CAAC;IAE/E,IAAI,CAACD,aAAa,EAAE;MAChB,OAAOnB,MAAM,CAACqB,IAAI,CAAC,IAAIZ,kBAAkB,CAAC,CAAC,CAAC;IAChD;IAEA,MAAMa,UAAU,GAAGhB,oBAAoB,CAACiB,SAAS,CAACL,KAAK,CAAC;IACxD,IAAI,CAACI,UAAU,CAACE,OAAO,EAAE;MACrB,OAAOxB,MAAM,CAACqB,IAAI,CAAC,IAAIV,mBAAmB,CAACW,UAAU,CAACG,KAAK,CAACC,MAAM,CAAC,CAAC,CAAC,CAACC,OAAO,CAAC,CAAC;IACnF;IAEA,MAAMC,QAAQ,GAAG,IAAI,CAACd,eAAe,CAACe,WAAW,CAAC,CAAC;IACnD,MAAMC,IAAI,GAAGR,UAAU,CAACQ,IAAI;;IAE5B;IACA,MAAMC,kBAAkB,GAAG,MAAM,IAAI,CAACf,UAAU,CAACgB,GAAG,CAAC;MAAEC,IAAI,EAAEH,IAAI,CAACG;IAAK,CAAC,CAAC;IACzE,IAAIF,kBAAkB,CAACG,IAAI,CAAC,CAAC,EAAE;MAC3B,OAAOlC,MAAM,CAACqB,IAAI,CAAC,IAAIX,eAAe,CAACoB,IAAI,CAACG,IAAI,CAAC,CAAC;IACtD;IAEA,MAAME,IAAU,GAAG;MACfC,EAAE,EAAEtC,KAAK,CAAC,CAAC;MACXuC,IAAI,EAAEP,IAAI,CAACO,IAAI;MACfJ,IAAI,EAAEH,IAAI,CAACG,IAAI;MACfK,WAAW,EAAER,IAAI,CAACQ,WAAW;MAC7BC,WAAW,EAAET,IAAI,CAACS,WAAW;MAC7BC,MAAM,EAAEtB,KAAK,CAACsB,MAAM,IAAI,KAAK;MAC7BC,SAAS,EAAE,IAAIC,IAAI,CAAC,CAAC,CAACC,WAAW,CAAC,CAAC;MACnCC,SAAS,EAAE;QACPR,EAAE,EAAER,QAAQ,CAACQ,EAAE;QACfS,WAAW,EAAEjB,QAAQ,CAACiB,WAAW;QACjCC,IAAI,EAAElB,QAAQ,CAACkB;MACnB,CAAC;MACDC,MAAM,EAAE;IACZ,CAAC;IAED,MAAM,IAAI,CAAChC,cAAc,CAACiC,OAAO,CAC7B,IAAIzC,qBAAqB,CAAC;MAAE4B,IAAI;MAAEjB,KAAK,EAAEI,UAAU,CAACQ;IAAK,CAAC,CAC9D,CAAC;IAED,MAAMmB,MAAM,GAAG,MAAM,IAAI,CAACjC,UAAU,CAACkC,MAAM,CAACf,IAAI,CAAC;IAEjD,IAAIc,MAAM,CAACE,MAAM,CAAC,CAAC,EAAE;MACjB,OAAOnD,MAAM,CAACqB,IAAI,CAAC4B,MAAM,CAACxB,KAAK,CAAC;IACpC;IAEA,MAAM,IAAI,CAACV,cAAc,CAACiC,OAAO,CAC7B,IAAIxC,oBAAoB,CAAC;MAAE2B,IAAI;MAAEjB,KAAK,EAAEI,UAAU,CAACQ;IAAK,CAAC,CAC7D,CAAC;IAED,OAAO9B,MAAM,CAACoD,EAAE,CAACjB,IAAI,CAAC;EAC1B;AACJ;AAEA,OAAO,MAAMjC,iBAAiB,GAAGH,oBAAoB,CAAC;EAClDsD,WAAW,EAAElD,kBAAkB;EAC/BmD,cAAc,EAAE1C,qBAAqB;EACrC2C,YAAY,EAAE,CAAClD,eAAe,EAAEJ,cAAc,EAAEG,eAAe;AACnE,CAAC,CAAC","ignoreList":[]}

package/features/security/roles/CreateRole/abstractions.d.ts

@@ -11,6 +11,7 @@ type CreateRoleError = ICreateRoleErrors[keyof ICreateRoleErrors] | RolesReposit
 export interface ICreateRole {
     execute(input: CreateRoleInput): Promise<Result<Role, CreateRoleError>>;
 }
+/** Create a new security role. */
 export declare const CreateRoleUseCase: import("@webiny/di").Abstraction<ICreateRole>;
 export declare namespace CreateRoleUseCase {
     type Interface = ICreateRole;