@webiny/api-core 6.0.0-rc.1 → 6.0.0-rc.3

package/ApiCoreFeature.js

@@ -8,6 +8,7 @@ import { AdminUsersFeature } from "./features/users/AdminUsersFeature.js";
 import { IdpAuthenticatorFeature } from "./idp/feature.js";
 import { KeyValueStoreFeature } from "./features/keyValueStore/feature.js";
 import { BuildParamsFeature } from "./features/buildParams/feature.js";
+import { FeatureFlagsFeature } from "./features/featureFlags/feature.js";
 export const ApiCoreFeature = createFeature({
   name: "ApiCore",
   register(container, config) {
@@ -15,6 +16,7 @@ export const ApiCoreFeature = createFeature({
     LoggerFeature.register(container);
     EventPublisherFeature.register(container);
     BuildParamsFeature.register(container);
+    FeatureFlagsFeature.register(container);
     TenancyFeature.register(container, config.tenancyStorageOperations);
     SecurityFeature.register(container, config.securityStorageOperations);
     AdminUsersFeature.register(container, config.usersStorageOperations);

package/ApiCoreFeature.js.map

@@ -1 +1 @@
-{"version":3,"names":["createFeature","EventPublisherFeature","LoggerFeature","SecurityFeature","SystemFeature","TenancyFeature","AdminUsersFeature","IdpAuthenticatorFeature","KeyValueStoreFeature","BuildParamsFeature","ApiCoreFeature","name","register","container","config","tenancyStorageOperations","securityStorageOperations","usersStorageOperations","keyValueStorageOperations"],"sources":["ApiCoreFeature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { Container } from \"@webiny/di\";\nimport { EventPublisherFeature } from \"~/features/eventPublisher/feature.js\";\nimport { LoggerFeature } from \"~/features/logger/feature.js\";\nimport { SecurityFeature } from \"~/features/security/SecurityFeature.js\";\nimport { SystemFeature } from \"~/features/system/SystemFeature.js\";\nimport { TenancyFeature } from \"./features/tenancy/TenancyFeature.js\";\nimport { AdminUsersFeature } from \"~/features/users/AdminUsersFeature.js\";\nimport type { ApiCoreStorageOperations } from \"~/types/core.js\";\nimport { IdpAuthenticatorFeature } from \"~/idp/feature.js\";\nimport { KeyValueStoreFeature } from \"~/features/keyValueStore/feature.js\";\nimport { BuildParamsFeature } from \"~/features/buildParams/feature.js\";\n\nexport const ApiCoreFeature = createFeature({\n    name: \"ApiCore\",\n    register(container: Container, config: ApiCoreStorageOperations) {\n        // Register features\n        LoggerFeature.register(container);\n        EventPublisherFeature.register(container);\n        BuildParamsFeature.register(container);\n        TenancyFeature.register(container, config.tenancyStorageOperations);\n        SecurityFeature.register(container, config.securityStorageOperations);\n        AdminUsersFeature.register(container, config.usersStorageOperations);\n        KeyValueStoreFeature.register(container, config.keyValueStorageOperations);\n        SystemFeature.register(container);\n        IdpAuthenticatorFeature.register(container);\n    }\n});\n"],"mappings":"AAAA,SAASA,aAAa,QAAQ,qBAAqB;AAEnD,SAASC,qBAAqB;AAC9B,SAASC,aAAa;AACtB,SAASC,eAAe;AACxB,SAASC,aAAa;AACtB,SAASC,cAAc;AACvB,SAASC,iBAAiB;AAE1B,SAASC,uBAAuB;AAChC,SAASC,oBAAoB;AAC7B,SAASC,kBAAkB;AAE3B,OAAO,MAAMC,cAAc,GAAGV,aAAa,CAAC;EACxCW,IAAI,EAAE,SAAS;EACfC,QAAQA,CAACC,SAAoB,EAAEC,MAAgC,EAAE;IAC7D;IACAZ,aAAa,CAACU,QAAQ,CAACC,SAAS,CAAC;IACjCZ,qBAAqB,CAACW,QAAQ,CAACC,SAAS,CAAC;IACzCJ,kBAAkB,CAACG,QAAQ,CAACC,SAAS,CAAC;IACtCR,cAAc,CAACO,QAAQ,CAACC,SAAS,EAAEC,MAAM,CAACC,wBAAwB,CAAC;IACnEZ,eAAe,CAACS,QAAQ,CAACC,SAAS,EAAEC,MAAM,CAACE,yBAAyB,CAAC;IACrEV,iBAAiB,CAACM,QAAQ,CAACC,SAAS,EAAEC,MAAM,CAACG,sBAAsB,CAAC;IACpET,oBAAoB,CAACI,QAAQ,CAACC,SAAS,EAAEC,MAAM,CAACI,yBAAyB,CAAC;IAC1Ed,aAAa,CAACQ,QAAQ,CAACC,SAAS,CAAC;IACjCN,uBAAuB,CAACK,QAAQ,CAACC,SAAS,CAAC;EAC/C;AACJ,CAAC,CAAC","ignoreList":[]}
+{"version":3,"names":["createFeature","EventPublisherFeature","LoggerFeature","SecurityFeature","SystemFeature","TenancyFeature","AdminUsersFeature","IdpAuthenticatorFeature","KeyValueStoreFeature","BuildParamsFeature","FeatureFlagsFeature","ApiCoreFeature","name","register","container","config","tenancyStorageOperations","securityStorageOperations","usersStorageOperations","keyValueStorageOperations"],"sources":["ApiCoreFeature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { Container } from \"@webiny/di\";\nimport { EventPublisherFeature } from \"~/features/eventPublisher/feature.js\";\nimport { LoggerFeature } from \"~/features/logger/feature.js\";\nimport { SecurityFeature } from \"~/features/security/SecurityFeature.js\";\nimport { SystemFeature } from \"~/features/system/SystemFeature.js\";\nimport { TenancyFeature } from \"./features/tenancy/TenancyFeature.js\";\nimport { AdminUsersFeature } from \"~/features/users/AdminUsersFeature.js\";\nimport type { ApiCoreStorageOperations } from \"~/types/core.js\";\nimport { IdpAuthenticatorFeature } from \"~/idp/feature.js\";\nimport { KeyValueStoreFeature } from \"~/features/keyValueStore/feature.js\";\nimport { BuildParamsFeature } from \"~/features/buildParams/feature.js\";\nimport { FeatureFlagsFeature } from \"~/features/featureFlags/feature.js\";\n\nexport const ApiCoreFeature = createFeature({\n    name: \"ApiCore\",\n    register(container: Container, config: ApiCoreStorageOperations) {\n        // Register features\n        LoggerFeature.register(container);\n        EventPublisherFeature.register(container);\n        BuildParamsFeature.register(container);\n        FeatureFlagsFeature.register(container);\n        TenancyFeature.register(container, config.tenancyStorageOperations);\n        SecurityFeature.register(container, config.securityStorageOperations);\n        AdminUsersFeature.register(container, config.usersStorageOperations);\n        KeyValueStoreFeature.register(container, config.keyValueStorageOperations);\n        SystemFeature.register(container);\n        IdpAuthenticatorFeature.register(container);\n    }\n});\n"],"mappings":"AAAA,SAASA,aAAa,QAAQ,qBAAqB;AAEnD,SAASC,qBAAqB;AAC9B,SAASC,aAAa;AACtB,SAASC,eAAe;AACxB,SAASC,aAAa;AACtB,SAASC,cAAc;AACvB,SAASC,iBAAiB;AAE1B,SAASC,uBAAuB;AAChC,SAASC,oBAAoB;AAC7B,SAASC,kBAAkB;AAC3B,SAASC,mBAAmB;AAE5B,OAAO,MAAMC,cAAc,GAAGX,aAAa,CAAC;EACxCY,IAAI,EAAE,SAAS;EACfC,QAAQA,CAACC,SAAoB,EAAEC,MAAgC,EAAE;IAC7D;IACAb,aAAa,CAACW,QAAQ,CAACC,SAAS,CAAC;IACjCb,qBAAqB,CAACY,QAAQ,CAACC,SAAS,CAAC;IACzCL,kBAAkB,CAACI,QAAQ,CAACC,SAAS,CAAC;IACtCJ,mBAAmB,CAACG,QAAQ,CAACC,SAAS,CAAC;IACvCT,cAAc,CAACQ,QAAQ,CAACC,SAAS,EAAEC,MAAM,CAACC,wBAAwB,CAAC;IACnEb,eAAe,CAACU,QAAQ,CAACC,SAAS,EAAEC,MAAM,CAACE,yBAAyB,CAAC;IACrEX,iBAAiB,CAACO,QAAQ,CAACC,SAAS,EAAEC,MAAM,CAACG,sBAAsB,CAAC;IACpEV,oBAAoB,CAACK,QAAQ,CAACC,SAAS,EAAEC,MAAM,CAACI,yBAAyB,CAAC;IAC1Ef,aAAa,CAACS,QAAQ,CAACC,SAAS,CAAC;IACjCP,uBAAuB,CAACM,QAAQ,CAACC,SAAS,CAAC;EAC/C;AACJ,CAAC,CAAC","ignoreList":[]}

package/features/featureFlags/FeatureFlags.d.ts

@@ -0,0 +1,12 @@
+import { FeatureFlags as FeatureFlagsAbstraction } from "./abstractions.js";
+import { BuildParams } from "../buildParams/abstractions.js";
+import { FeatureFlags as FeatureFlagsClass } from "@webiny/feature-flags";
+declare class FeatureFlagsImpl implements FeatureFlagsAbstraction.Interface {
+    private buildParams;
+    constructor(buildParams: BuildParams.Interface);
+    get(): FeatureFlagsClass;
+}
+export declare const FeatureFlags: typeof FeatureFlagsImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("./abstractions.js").IFeatureFlagsAbstraction>;
+};
+export {};

package/features/featureFlags/FeatureFlags.js

@@ -0,0 +1,18 @@
+import { FeatureFlags as FeatureFlagsAbstraction } from "./abstractions.js";
+import { BuildParams } from "../buildParams/abstractions.js";
+import { FeatureFlags as FeatureFlagsClass } from "@webiny/feature-flags";
+class FeatureFlagsImpl {
+  constructor(buildParams) {
+    this.buildParams = buildParams;
+  }
+  get() {
+    const raw = this.buildParams.get("FeatureFlags") ?? {};
+    return FeatureFlagsClass.fromDto(raw);
+  }
+}
+export const FeatureFlags = FeatureFlagsAbstraction.createImplementation({
+  implementation: FeatureFlagsImpl,
+  dependencies: [BuildParams]
+});
+
+//# sourceMappingURL=FeatureFlags.js.map

package/features/featureFlags/FeatureFlags.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["FeatureFlags","FeatureFlagsAbstraction","BuildParams","FeatureFlagsClass","FeatureFlagsImpl","constructor","buildParams","get","raw","fromDto","createImplementation","implementation","dependencies"],"sources":["FeatureFlags.ts"],"sourcesContent":["import { FeatureFlags as FeatureFlagsAbstraction } from \"./abstractions.js\";\nimport { BuildParams } from \"../buildParams/abstractions.js\";\nimport { FeatureFlags as FeatureFlagsClass } from \"@webiny/feature-flags\";\nimport type { IFeatureFlagsDto } from \"@webiny/feature-flags\";\n\nclass FeatureFlagsImpl implements FeatureFlagsAbstraction.Interface {\n    constructor(private buildParams: BuildParams.Interface) {}\n\n    get(): FeatureFlagsClass {\n        const raw = this.buildParams.get<IFeatureFlagsDto>(\"FeatureFlags\") ?? {};\n        return FeatureFlagsClass.fromDto(raw);\n    }\n}\n\nexport const FeatureFlags = FeatureFlagsAbstraction.createImplementation({\n    implementation: FeatureFlagsImpl,\n    dependencies: [BuildParams]\n});\n"],"mappings":"AAAA,SAASA,YAAY,IAAIC,uBAAuB;AAChD,SAASC,WAAW;AACpB,SAASF,YAAY,IAAIG,iBAAiB,QAAQ,uBAAuB;AAGzE,MAAMC,gBAAgB,CAA8C;EAChEC,WAAWA,CAASC,WAAkC,EAAE;IAAA,KAApCA,WAAkC,GAAlCA,WAAkC;EAAG;EAEzDC,GAAGA,CAAA,EAAsB;IACrB,MAAMC,GAAG,GAAG,IAAI,CAACF,WAAW,CAACC,GAAG,CAAmB,cAAc,CAAC,IAAI,CAAC,CAAC;IACxE,OAAOJ,iBAAiB,CAACM,OAAO,CAACD,GAAG,CAAC;EACzC;AACJ;AAEA,OAAO,MAAMR,YAAY,GAAGC,uBAAuB,CAACS,oBAAoB,CAAC;EACrEC,cAAc,EAAEP,gBAAgB;EAChCQ,YAAY,EAAE,CAACV,WAAW;AAC9B,CAAC,CAAC","ignoreList":[]}

package/features/featureFlags/abstractions.d.ts

@@ -0,0 +1,8 @@
+import { FeatureFlags as FeatureFlagsClass } from "@webiny/feature-flags";
+export interface IFeatureFlagsAbstraction {
+    get(): FeatureFlagsClass;
+}
+export declare const FeatureFlags: import("@webiny/di").Abstraction<IFeatureFlagsAbstraction>;
+export declare namespace FeatureFlags {
+    type Interface = IFeatureFlagsAbstraction;
+}

package/features/featureFlags/abstractions.js

@@ -0,0 +1,4 @@
+import { createAbstraction } from "@webiny/feature/api";
+export const FeatureFlags = createAbstraction("FeatureFlags");
+
+//# sourceMappingURL=abstractions.js.map

package/features/featureFlags/abstractions.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createAbstraction","FeatureFlags"],"sources":["abstractions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport { FeatureFlags as FeatureFlagsClass } from \"@webiny/feature-flags\";\n\nexport interface IFeatureFlagsAbstraction {\n    get(): FeatureFlagsClass;\n}\n\nexport const FeatureFlags = createAbstraction<IFeatureFlagsAbstraction>(\"FeatureFlags\");\n\nexport namespace FeatureFlags {\n    export type Interface = IFeatureFlagsAbstraction;\n}\n"],"mappings":"AAAA,SAASA,iBAAiB,QAAQ,qBAAqB;AAOvD,OAAO,MAAMC,YAAY,GAAGD,iBAAiB,CAA2B,cAAc,CAAC","ignoreList":[]}

package/features/featureFlags/feature.d.ts

@@ -0,0 +1 @@
+export declare const FeatureFlagsFeature: import("@webiny/feature/api/createFeature.js").FeatureDefinition<unknown>;

package/features/featureFlags/feature.js

@@ -0,0 +1,10 @@
+import { createFeature } from "@webiny/feature/api";
+import { FeatureFlags } from "./FeatureFlags.js";
+export const FeatureFlagsFeature = createFeature({
+  name: "FeatureFlags",
+  register(container) {
+    container.register(FeatureFlags);
+  }
+});
+
+//# sourceMappingURL=feature.js.map

package/features/featureFlags/feature.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createFeature","FeatureFlags","FeatureFlagsFeature","name","register","container"],"sources":["feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport type { Container } from \"@webiny/di\";\nimport { FeatureFlags } from \"./FeatureFlags.js\";\n\nexport const FeatureFlagsFeature = createFeature({\n    name: \"FeatureFlags\",\n    register(container: Container) {\n        container.register(FeatureFlags);\n    }\n});\n"],"mappings":"AAAA,SAASA,aAAa,QAAQ,qBAAqB;AAEnD,SAASC,YAAY;AAErB,OAAO,MAAMC,mBAAmB,GAAGF,aAAa,CAAC;EAC7CG,IAAI,EAAE,cAAc;EACpBC,QAAQA,CAACC,SAAoB,EAAE;IAC3BA,SAAS,CAACD,QAAQ,CAACH,YAAY,CAAC;EACpC;AACJ,CAAC,CAAC","ignoreList":[]}

package/features/security/permissions/createPermissions.js

@@ -24,6 +24,7 @@ function getEntity(entityMap, entityId) {
 }
 export function createPermissions(schema) {
   const entityMap = buildEntityMap(schema);
+  const fullAccessName = `${schema.prefix}.*`;
   class SchemaPermissions {
     constructor(identityContext) {
       this.identityContext = identityContext;
@@ -36,7 +37,7 @@ export function createPermissions(schema) {
         return true;
       }
       const entity = getEntity(entityMap, entityId);
-      const permissions = await this.identityContext.getPermissions(entity.permission);
+      const permissions = await this.getEntityPermissions(entity.permission);
       if (!permissions.length) {
         return false;
       }
@@ -60,7 +61,7 @@ export function createPermissions(schema) {
         return false;
       }
       const entity = getEntity(entityMap, entityId);
-      const permissions = await this.identityContext.getPermissions(entity.permission);
+      const permissions = await this.getEntityPermissions(entity.permission);
       if (!permissions.length) {
         return false;
       }
@@ -74,7 +75,7 @@ export function createPermissions(schema) {
         return true;
       }
       const entity = getEntity(entityMap, entityId);
-      const permissions = await this.identityContext.getPermissions(entity.permission);
+      const permissions = await this.getEntityPermissions(entity.permission);
       if (!permissions.length) {
         return false;
       }
@@ -93,7 +94,7 @@ export function createPermissions(schema) {
         return true;
       }
       const entity = getEntity(entityMap, entityId);
-      const permissions = await this.identityContext.getPermissions(entity.permission);
+      const permissions = await this.getEntityPermissions(entity.permission);
       if (!permissions.length) {
         return false;
       }
@@ -112,7 +113,7 @@ export function createPermissions(schema) {
         return true;
       }
       const entity = getEntity(entityMap, entityId);
-      const permissions = await this.identityContext.getPermissions(entity.permission);
+      const permissions = await this.getEntityPermissions(entity.permission);
       if (!permissions.length) {
         return false;
       }
@@ -139,7 +140,7 @@ export function createPermissions(schema) {
         return true;
       }
       const entity = getEntity(entityMap, entityId);
-      const permissions = await this.identityContext.getPermissions(entity.permission);
+      const permissions = await this.getEntityPermissions(entity.permission);
       if (!permissions.length) {
         return false;
       }
@@ -162,7 +163,7 @@ export function createPermissions(schema) {
         return true;
       }
       const entity = getEntity(entityMap, entityId);
-      const permissions = await this.identityContext.getPermissions(entity.permission);
+      const permissions = await this.getEntityPermissions(entity.permission);
       if (!permissions.length) {
         return false;
       }
@@ -178,7 +179,7 @@ export function createPermissions(schema) {
         return true;
       }
       const entity = getEntity(entityMap, entityId);
-      const permissions = await this.identityContext.getPermissions(entity.permission);
+      const permissions = await this.getEntityPermissions(entity.permission);
       if (!permissions.length) {
         return false;
       }
@@ -194,7 +195,7 @@ export function createPermissions(schema) {
         return true;
       }
       const entity = getEntity(entityMap, entityId);
-      const permissions = await this.identityContext.getPermissions(entity.permission);
+      const permissions = await this.getEntityPermissions(entity.permission);
       if (!permissions.length) {
         return false;
       }
@@ -202,9 +203,27 @@ export function createPermissions(schema) {
         return permission[action] === true;
       });
     }
+    async getEntityPermissions(entityPermission) {
+      const permissions = await this.identityContext.getPermissions(entityPermission);
+      if (permissions.length) {
+        return permissions;
+      }
+      // Fall back to the schema wildcard (e.g. "test.*") — its flags apply to all entities.
+      const wildcard = await this.identityContext.getPermission(fullAccessName);
+      return wildcard ? [wildcard] : [];
+    }
     async hasFullSchemaAccess() {
-      const permission = await this.identityContext.getPermission(schema.fullAccess.name);
-      return permission !== null;
+      const permission = await this.identityContext.getPermission(fullAccessName);
+      if (!permission) {
+        return false;
+      }
+      // Only treat as full access if the permission has no `rwd` flag.
+      // A permission like { name: "wb.*", rwd: "r" } should NOT grant full access.
+      const keys = Object.keys(permission).filter(k => k !== "name");
+      const hasRwd = keys.includes("rwd");
+
+      // It's full-access only if there's no `rwd` flag.
+      return !hasRwd;
     }
   }
   const Abstraction = createAbstraction(`${schema.prefix}:Permissions`);

package/features/security/permissions/createPermissions.js.map

@@ -1 +1 @@
-{"version":3,"names":["createAbstraction","IdentityContext","buildEntityMap","schema","map","Map","entity","entities","actions","Set","action","add","name","set","id","permission","hasOwn","scopes","includes","getEntity","entityMap","entityId","get","Error","createPermissions","SchemaPermissions","constructor","identityContext","canAccess","item","hasFullAccess","hasFullSchemaAccess","permissions","getPermissions","length","undefined","ownOnly","some","p","own","identity","getIdentity","createdBy","onlyOwnRecords","canRead","rwd","canCreate","canEdit","canDelete","canPublish","pw","canUnpublish","canAction","getPermission","fullAccess","Abstraction","prefix","Implementation","createImplementation","implementation","dependencies"],"sources":["createPermissions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport { IdentityContext } from \"~/features/security/IdentityContext/index.js\";\nimport type { PermissionSchemaConfig } from \"./types.js\";\nimport type { OwnableItem } from \"./types.js\";\nimport type { Permissions } from \"./types.js\";\n\ninterface EntityLookup {\n    permission: string;\n    actions: Set<string>;\n    hasOwn: boolean;\n}\n\nfunction buildEntityMap(schema: PermissionSchemaConfig): Map<string, EntityLookup> {\n    const map = new Map<string, EntityLookup>();\n    for (const entity of schema.entities ?? []) {\n        const actions = new Set<string>();\n        for (const action of entity.actions ?? []) {\n            actions.add(action.name);\n        }\n        map.set(entity.id, {\n            permission: entity.permission,\n            actions,\n            hasOwn: entity.scopes.includes(\"own\")\n        });\n    }\n    return map;\n}\n\nfunction getEntity(entityMap: Map<string, EntityLookup>, entityId: string): EntityLookup {\n    const entity = entityMap.get(entityId);\n    if (!entity) {\n        throw new Error(`Unknown entity \"${entityId}\" in permission schema.`);\n    }\n    return entity;\n}\n\nexport function createPermissions<const S extends PermissionSchemaConfig>(schema: S) {\n    const entityMap = buildEntityMap(schema);\n\n    class SchemaPermissions {\n        constructor(private identityContext: IdentityContext.Interface) {}\n\n        async canAccess(entityId: string, item?: OwnableItem): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.identityContext.getPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            // No item — just check entity-level access.\n            if (item === undefined) {\n                return true;\n            }\n            // Item provided — if all permissions require own, verify ownership.\n            const ownOnly = !permissions.some(p => !p.own);\n            if (!ownOnly) {\n                return true;\n            }\n            const identity = this.identityContext.getIdentity();\n            return item.createdBy?.id === identity.id;\n        }\n\n        async onlyOwnRecords(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return false;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return false;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.identityContext.getPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return !permissions.some(p => !p.own);\n        }\n\n        async canRead(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.identityContext.getPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                if (typeof permission.rwd !== \"string\") {\n                    return true;\n                }\n                return permission.rwd.includes(\"r\");\n            });\n        }\n\n        async canCreate(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.identityContext.getPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                if (typeof permission.rwd !== \"string\") {\n                    return true;\n                }\n                return permission.rwd.includes(\"w\");\n            });\n        }\n\n        async canEdit(entityId: string, item?: OwnableItem): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.identityContext.getPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            const identity = this.identityContext.getIdentity();\n            return permissions.some(permission => {\n                if (permission.own) {\n                    // No item provided (new/unsaved) — allow access.\n                    if (!item?.createdBy) {\n                        return true;\n                    }\n                    return item.createdBy.id === identity.id;\n                }\n                if (typeof permission.rwd !== \"string\") {\n                    return true;\n                }\n                return permission.rwd.includes(\"w\");\n            });\n        }\n\n        async canDelete(entityId: string, item?: OwnableItem): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.identityContext.getPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            const identity = this.identityContext.getIdentity();\n            return permissions.some(permission => {\n                if (permission.own) {\n                    return item?.createdBy?.id === identity.id;\n                }\n                if (typeof permission.rwd !== \"string\") {\n                    return true;\n                }\n                return permission.rwd.includes(\"d\");\n            });\n        }\n\n        async canPublish(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.identityContext.getPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                return permission.pw?.includes(\"p\");\n            });\n        }\n\n        async canUnpublish(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.identityContext.getPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                return permission.pw?.includes(\"u\");\n            });\n        }\n\n        async canAction(action: string, entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.identityContext.getPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                return permission[action] === true;\n            });\n        }\n\n        private async hasFullSchemaAccess(): Promise<boolean> {\n            const permission = await this.identityContext.getPermission(schema.fullAccess.name);\n            return permission !== null;\n        }\n    }\n\n    const Abstraction = createAbstraction<Permissions<S>>(`${schema.prefix}:Permissions`);\n\n    const Implementation = Abstraction.createImplementation({\n        implementation: SchemaPermissions,\n        dependencies: [IdentityContext]\n    } as any);\n\n    return { Abstraction, Implementation };\n}\n"],"mappings":"AAAA,SAASA,iBAAiB,QAAQ,qBAAqB;AACvD,SAASC,eAAe;AAWxB,SAASC,cAAcA,CAACC,MAA8B,EAA6B;EAC/E,MAAMC,GAAG,GAAG,IAAIC,GAAG,CAAuB,CAAC;EAC3C,KAAK,MAAMC,MAAM,IAAIH,MAAM,CAACI,QAAQ,IAAI,EAAE,EAAE;IACxC,MAAMC,OAAO,GAAG,IAAIC,GAAG,CAAS,CAAC;IACjC,KAAK,MAAMC,MAAM,IAAIJ,MAAM,CAACE,OAAO,IAAI,EAAE,EAAE;MACvCA,OAAO,CAACG,GAAG,CAACD,MAAM,CAACE,IAAI,CAAC;IAC5B;IACAR,GAAG,CAACS,GAAG,CAACP,MAAM,CAACQ,EAAE,EAAE;MACfC,UAAU,EAAET,MAAM,CAACS,UAAU;MAC7BP,OAAO;MACPQ,MAAM,EAAEV,MAAM,CAACW,MAAM,CAACC,QAAQ,CAAC,KAAK;IACxC,CAAC,CAAC;EACN;EACA,OAAOd,GAAG;AACd;AAEA,SAASe,SAASA,CAACC,SAAoC,EAAEC,QAAgB,EAAgB;EACrF,MAAMf,MAAM,GAAGc,SAAS,CAACE,GAAG,CAACD,QAAQ,CAAC;EACtC,IAAI,CAACf,MAAM,EAAE;IACT,MAAM,IAAIiB,KAAK,CAAC,mBAAmBF,QAAQ,yBAAyB,CAAC;EACzE;EACA,OAAOf,MAAM;AACjB;AAEA,OAAO,SAASkB,iBAAiBA,CAAyCrB,MAAS,EAAE;EACjF,MAAMiB,SAAS,GAAGlB,cAAc,CAACC,MAAM,CAAC;EAExC,MAAMsB,iBAAiB,CAAC;IACpBC,WAAWA,CAASC,eAA0C,EAAE;MAAA,KAA5CA,eAA0C,GAA1CA,eAA0C;IAAG;IAEjE,MAAMC,SAASA,CAACP,QAAgB,EAAEQ,IAAkB,EAAoB;MACpE,IAAI,MAAM,IAAI,CAACF,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAMzB,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMW,WAAW,GAAG,MAAM,IAAI,CAACL,eAAe,CAACM,cAAc,CAAC3B,MAAM,CAACS,UAAU,CAAC;MAChF,IAAI,CAACiB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA;MACA,IAAIL,IAAI,KAAKM,SAAS,EAAE;QACpB,OAAO,IAAI;MACf;MACA;MACA,MAAMC,OAAO,GAAG,CAACJ,WAAW,CAACK,IAAI,CAACC,CAAC,IAAI,CAACA,CAAC,CAACC,GAAG,CAAC;MAC9C,IAAI,CAACH,OAAO,EAAE;QACV,OAAO,IAAI;MACf;MACA,MAAMI,QAAQ,GAAG,IAAI,CAACb,eAAe,CAACc,WAAW,CAAC,CAAC;MACnD,OAAOZ,IAAI,CAACa,SAAS,EAAE5B,EAAE,KAAK0B,QAAQ,CAAC1B,EAAE;IAC7C;IAEA,MAAM6B,cAAcA,CAACtB,QAAgB,EAAoB;MACrD,IAAI,MAAM,IAAI,CAACM,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,KAAK;MAChB;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,KAAK;MAChB;MACA,MAAMzB,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMW,WAAW,GAAG,MAAM,IAAI,CAACL,eAAe,CAACM,cAAc,CAAC3B,MAAM,CAACS,UAAU,CAAC;MAChF,IAAI,CAACiB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAO,CAACF,WAAW,CAACK,IAAI,CAACC,CAAC,IAAI,CAACA,CAAC,CAACC,GAAG,CAAC;IACzC;IAEA,MAAMK,OAAOA,CAACvB,QAAgB,EAAoB;MAC9C,IAAI,MAAM,IAAI,CAACM,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAMzB,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMW,WAAW,GAAG,MAAM,IAAI,CAACL,eAAe,CAACM,cAAc,CAAC3B,MAAM,CAACS,UAAU,CAAC;MAChF,IAAI,CAACiB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACtB,UAAU,IAAI;QAClC,IAAI,OAAOA,UAAU,CAAC8B,GAAG,KAAK,QAAQ,EAAE;UACpC,OAAO,IAAI;QACf;QACA,OAAO9B,UAAU,CAAC8B,GAAG,CAAC3B,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAM4B,SAASA,CAACzB,QAAgB,EAAoB;MAChD,IAAI,MAAM,IAAI,CAACM,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAMzB,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMW,WAAW,GAAG,MAAM,IAAI,CAACL,eAAe,CAACM,cAAc,CAAC3B,MAAM,CAACS,UAAU,CAAC;MAChF,IAAI,CAACiB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACtB,UAAU,IAAI;QAClC,IAAI,OAAOA,UAAU,CAAC8B,GAAG,KAAK,QAAQ,EAAE;UACpC,OAAO,IAAI;QACf;QACA,OAAO9B,UAAU,CAAC8B,GAAG,CAAC3B,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAM6B,OAAOA,CAAC1B,QAAgB,EAAEQ,IAAkB,EAAoB;MAClE,IAAI,MAAM,IAAI,CAACF,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAMzB,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMW,WAAW,GAAG,MAAM,IAAI,CAACL,eAAe,CAACM,cAAc,CAAC3B,MAAM,CAACS,UAAU,CAAC;MAChF,IAAI,CAACiB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,MAAMM,QAAQ,GAAG,IAAI,CAACb,eAAe,CAACc,WAAW,CAAC,CAAC;MACnD,OAAOT,WAAW,CAACK,IAAI,CAACtB,UAAU,IAAI;QAClC,IAAIA,UAAU,CAACwB,GAAG,EAAE;UAChB;UACA,IAAI,CAACV,IAAI,EAAEa,SAAS,EAAE;YAClB,OAAO,IAAI;UACf;UACA,OAAOb,IAAI,CAACa,SAAS,CAAC5B,EAAE,KAAK0B,QAAQ,CAAC1B,EAAE;QAC5C;QACA,IAAI,OAAOC,UAAU,CAAC8B,GAAG,KAAK,QAAQ,EAAE;UACpC,OAAO,IAAI;QACf;QACA,OAAO9B,UAAU,CAAC8B,GAAG,CAAC3B,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAM8B,SAASA,CAAC3B,QAAgB,EAAEQ,IAAkB,EAAoB;MACpE,IAAI,MAAM,IAAI,CAACF,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAMzB,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMW,WAAW,GAAG,MAAM,IAAI,CAACL,eAAe,CAACM,cAAc,CAAC3B,MAAM,CAACS,UAAU,CAAC;MAChF,IAAI,CAACiB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,MAAMM,QAAQ,GAAG,IAAI,CAACb,eAAe,CAACc,WAAW,CAAC,CAAC;MACnD,OAAOT,WAAW,CAACK,IAAI,CAACtB,UAAU,IAAI;QAClC,IAAIA,UAAU,CAACwB,GAAG,EAAE;UAChB,OAAOV,IAAI,EAAEa,SAAS,EAAE5B,EAAE,KAAK0B,QAAQ,CAAC1B,EAAE;QAC9C;QACA,IAAI,OAAOC,UAAU,CAAC8B,GAAG,KAAK,QAAQ,EAAE;UACpC,OAAO,IAAI;QACf;QACA,OAAO9B,UAAU,CAAC8B,GAAG,CAAC3B,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAM+B,UAAUA,CAAC5B,QAAgB,EAAoB;MACjD,IAAI,MAAM,IAAI,CAACM,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAMzB,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMW,WAAW,GAAG,MAAM,IAAI,CAACL,eAAe,CAACM,cAAc,CAAC3B,MAAM,CAACS,UAAU,CAAC;MAChF,IAAI,CAACiB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACtB,UAAU,IAAI;QAClC,OAAOA,UAAU,CAACmC,EAAE,EAAEhC,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAMiC,YAAYA,CAAC9B,QAAgB,EAAoB;MACnD,IAAI,MAAM,IAAI,CAACM,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAMzB,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMW,WAAW,GAAG,MAAM,IAAI,CAACL,eAAe,CAACM,cAAc,CAAC3B,MAAM,CAACS,UAAU,CAAC;MAChF,IAAI,CAACiB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACtB,UAAU,IAAI;QAClC,OAAOA,UAAU,CAACmC,EAAE,EAAEhC,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAMkC,SAASA,CAAC1C,MAAc,EAAEW,QAAgB,EAAoB;MAChE,IAAI,MAAM,IAAI,CAACM,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAMzB,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMW,WAAW,GAAG,MAAM,IAAI,CAACL,eAAe,CAACM,cAAc,CAAC3B,MAAM,CAACS,UAAU,CAAC;MAChF,IAAI,CAACiB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACtB,UAAU,IAAI;QAClC,OAAOA,UAAU,CAACL,MAAM,CAAC,KAAK,IAAI;MACtC,CAAC,CAAC;IACN;IAEA,MAAcqB,mBAAmBA,CAAA,EAAqB;MAClD,MAAMhB,UAAU,GAAG,MAAM,IAAI,CAACY,eAAe,CAAC0B,aAAa,CAAClD,MAAM,CAACmD,UAAU,CAAC1C,IAAI,CAAC;MACnF,OAAOG,UAAU,KAAK,IAAI;IAC9B;EACJ;EAEA,MAAMwC,WAAW,GAAGvD,iBAAiB,CAAiB,GAAGG,MAAM,CAACqD,MAAM,cAAc,CAAC;EAErF,MAAMC,cAAc,GAAGF,WAAW,CAACG,oBAAoB,CAAC;IACpDC,cAAc,EAAElC,iBAAiB;IACjCmC,YAAY,EAAE,CAAC3D,eAAe;EAClC,CAAQ,CAAC;EAET,OAAO;IAAEsD,WAAW;IAAEE;EAAe,CAAC;AAC1C","ignoreList":[]}
+{"version":3,"names":["createAbstraction","IdentityContext","buildEntityMap","schema","map","Map","entity","entities","actions","Set","action","add","name","set","id","permission","hasOwn","scopes","includes","getEntity","entityMap","entityId","get","Error","createPermissions","fullAccessName","prefix","SchemaPermissions","constructor","identityContext","canAccess","item","hasFullAccess","hasFullSchemaAccess","permissions","getEntityPermissions","length","undefined","ownOnly","some","p","own","identity","getIdentity","createdBy","onlyOwnRecords","canRead","rwd","canCreate","canEdit","canDelete","canPublish","pw","canUnpublish","canAction","entityPermission","getPermissions","wildcard","getPermission","keys","Object","filter","k","hasRwd","Abstraction","Implementation","createImplementation","implementation","dependencies"],"sources":["createPermissions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport { IdentityContext } from \"~/features/security/IdentityContext/index.js\";\nimport type { PermissionSchemaConfig } from \"./types.js\";\nimport type { OwnableItem } from \"./types.js\";\nimport type { Permissions } from \"./types.js\";\n\ninterface EntityLookup {\n    permission: string;\n    actions: Set<string>;\n    hasOwn: boolean;\n}\n\nfunction buildEntityMap(schema: PermissionSchemaConfig): Map<string, EntityLookup> {\n    const map = new Map<string, EntityLookup>();\n    for (const entity of schema.entities ?? []) {\n        const actions = new Set<string>();\n        for (const action of entity.actions ?? []) {\n            actions.add(action.name);\n        }\n        map.set(entity.id, {\n            permission: entity.permission,\n            actions,\n            hasOwn: entity.scopes.includes(\"own\")\n        });\n    }\n    return map;\n}\n\nfunction getEntity(entityMap: Map<string, EntityLookup>, entityId: string): EntityLookup {\n    const entity = entityMap.get(entityId);\n    if (!entity) {\n        throw new Error(`Unknown entity \"${entityId}\" in permission schema.`);\n    }\n    return entity;\n}\n\nexport function createPermissions<const S extends PermissionSchemaConfig>(schema: S) {\n    const entityMap = buildEntityMap(schema);\n    const fullAccessName = `${schema.prefix}.*`;\n\n    class SchemaPermissions {\n        constructor(private identityContext: IdentityContext.Interface) {}\n\n        async canAccess(entityId: string, item?: OwnableItem): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            // No item — just check entity-level access.\n            if (item === undefined) {\n                return true;\n            }\n            // Item provided — if all permissions require own, verify ownership.\n            const ownOnly = !permissions.some(p => !p.own);\n            if (!ownOnly) {\n                return true;\n            }\n            const identity = this.identityContext.getIdentity();\n            return item.createdBy?.id === identity.id;\n        }\n\n        async onlyOwnRecords(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return false;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return false;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return !permissions.some(p => !p.own);\n        }\n\n        async canRead(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                if (typeof permission.rwd !== \"string\") {\n                    return true;\n                }\n                return permission.rwd.includes(\"r\");\n            });\n        }\n\n        async canCreate(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                if (typeof permission.rwd !== \"string\") {\n                    return true;\n                }\n                return permission.rwd.includes(\"w\");\n            });\n        }\n\n        async canEdit(entityId: string, item?: OwnableItem): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            const identity = this.identityContext.getIdentity();\n            return permissions.some(permission => {\n                if (permission.own) {\n                    // No item provided (new/unsaved) — allow access.\n                    if (!item?.createdBy) {\n                        return true;\n                    }\n                    return item.createdBy.id === identity.id;\n                }\n                if (typeof permission.rwd !== \"string\") {\n                    return true;\n                }\n                return permission.rwd.includes(\"w\");\n            });\n        }\n\n        async canDelete(entityId: string, item?: OwnableItem): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            const identity = this.identityContext.getIdentity();\n            return permissions.some(permission => {\n                if (permission.own) {\n                    return item?.createdBy?.id === identity.id;\n                }\n                if (typeof permission.rwd !== \"string\") {\n                    return true;\n                }\n                return permission.rwd.includes(\"d\");\n            });\n        }\n\n        async canPublish(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                return permission.pw?.includes(\"p\");\n            });\n        }\n\n        async canUnpublish(entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                return permission.pw?.includes(\"u\");\n            });\n        }\n\n        async canAction(action: string, entityId: string): Promise<boolean> {\n            if (await this.identityContext.hasFullAccess()) {\n                return true;\n            }\n            if (await this.hasFullSchemaAccess()) {\n                return true;\n            }\n            const entity = getEntity(entityMap, entityId);\n            const permissions = await this.getEntityPermissions(entity.permission);\n            if (!permissions.length) {\n                return false;\n            }\n            return permissions.some(permission => {\n                return permission[action] === true;\n            });\n        }\n\n        private async getEntityPermissions(entityPermission: string): Promise<any[]> {\n            const permissions = await this.identityContext.getPermissions(entityPermission);\n            if (permissions.length) {\n                return permissions;\n            }\n            // Fall back to the schema wildcard (e.g. \"test.*\") — its flags apply to all entities.\n            const wildcard = await this.identityContext.getPermission(fullAccessName);\n            return wildcard ? [wildcard] : [];\n        }\n\n        private async hasFullSchemaAccess(): Promise<boolean> {\n            const permission = await this.identityContext.getPermission(fullAccessName);\n            if (!permission) {\n                return false;\n            }\n            // Only treat as full access if the permission has no `rwd` flag.\n            // A permission like { name: \"wb.*\", rwd: \"r\" } should NOT grant full access.\n            const keys = Object.keys(permission).filter(k => k !== \"name\");\n\n            const hasRwd = keys.includes(\"rwd\");\n\n            // It's full-access only if there's no `rwd` flag.\n            return !hasRwd;\n        }\n    }\n\n    const Abstraction = createAbstraction<Permissions<S>>(`${schema.prefix}:Permissions`);\n\n    const Implementation = Abstraction.createImplementation({\n        implementation: SchemaPermissions,\n        dependencies: [IdentityContext]\n    } as any);\n\n    return { Abstraction, Implementation };\n}\n"],"mappings":"AAAA,SAASA,iBAAiB,QAAQ,qBAAqB;AACvD,SAASC,eAAe;AAWxB,SAASC,cAAcA,CAACC,MAA8B,EAA6B;EAC/E,MAAMC,GAAG,GAAG,IAAIC,GAAG,CAAuB,CAAC;EAC3C,KAAK,MAAMC,MAAM,IAAIH,MAAM,CAACI,QAAQ,IAAI,EAAE,EAAE;IACxC,MAAMC,OAAO,GAAG,IAAIC,GAAG,CAAS,CAAC;IACjC,KAAK,MAAMC,MAAM,IAAIJ,MAAM,CAACE,OAAO,IAAI,EAAE,EAAE;MACvCA,OAAO,CAACG,GAAG,CAACD,MAAM,CAACE,IAAI,CAAC;IAC5B;IACAR,GAAG,CAACS,GAAG,CAACP,MAAM,CAACQ,EAAE,EAAE;MACfC,UAAU,EAAET,MAAM,CAACS,UAAU;MAC7BP,OAAO;MACPQ,MAAM,EAAEV,MAAM,CAACW,MAAM,CAACC,QAAQ,CAAC,KAAK;IACxC,CAAC,CAAC;EACN;EACA,OAAOd,GAAG;AACd;AAEA,SAASe,SAASA,CAACC,SAAoC,EAAEC,QAAgB,EAAgB;EACrF,MAAMf,MAAM,GAAGc,SAAS,CAACE,GAAG,CAACD,QAAQ,CAAC;EACtC,IAAI,CAACf,MAAM,EAAE;IACT,MAAM,IAAIiB,KAAK,CAAC,mBAAmBF,QAAQ,yBAAyB,CAAC;EACzE;EACA,OAAOf,MAAM;AACjB;AAEA,OAAO,SAASkB,iBAAiBA,CAAyCrB,MAAS,EAAE;EACjF,MAAMiB,SAAS,GAAGlB,cAAc,CAACC,MAAM,CAAC;EACxC,MAAMsB,cAAc,GAAG,GAAGtB,MAAM,CAACuB,MAAM,IAAI;EAE3C,MAAMC,iBAAiB,CAAC;IACpBC,WAAWA,CAASC,eAA0C,EAAE;MAAA,KAA5CA,eAA0C,GAA1CA,eAA0C;IAAG;IAEjE,MAAMC,SAASA,CAACT,QAAgB,EAAEU,IAAkB,EAAoB;MACpE,IAAI,MAAM,IAAI,CAACF,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA;MACA,IAAIL,IAAI,KAAKM,SAAS,EAAE;QACpB,OAAO,IAAI;MACf;MACA;MACA,MAAMC,OAAO,GAAG,CAACJ,WAAW,CAACK,IAAI,CAACC,CAAC,IAAI,CAACA,CAAC,CAACC,GAAG,CAAC;MAC9C,IAAI,CAACH,OAAO,EAAE;QACV,OAAO,IAAI;MACf;MACA,MAAMI,QAAQ,GAAG,IAAI,CAACb,eAAe,CAACc,WAAW,CAAC,CAAC;MACnD,OAAOZ,IAAI,CAACa,SAAS,EAAE9B,EAAE,KAAK4B,QAAQ,CAAC5B,EAAE;IAC7C;IAEA,MAAM+B,cAAcA,CAACxB,QAAgB,EAAoB;MACrD,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,KAAK;MAChB;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,KAAK;MAChB;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAO,CAACF,WAAW,CAACK,IAAI,CAACC,CAAC,IAAI,CAACA,CAAC,CAACC,GAAG,CAAC;IACzC;IAEA,MAAMK,OAAOA,CAACzB,QAAgB,EAAoB;MAC9C,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,IAAI,OAAOA,UAAU,CAACgC,GAAG,KAAK,QAAQ,EAAE;UACpC,OAAO,IAAI;QACf;QACA,OAAOhC,UAAU,CAACgC,GAAG,CAAC7B,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAM8B,SAASA,CAAC3B,QAAgB,EAAoB;MAChD,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,IAAI,OAAOA,UAAU,CAACgC,GAAG,KAAK,QAAQ,EAAE;UACpC,OAAO,IAAI;QACf;QACA,OAAOhC,UAAU,CAACgC,GAAG,CAAC7B,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAM+B,OAAOA,CAAC5B,QAAgB,EAAEU,IAAkB,EAAoB;MAClE,IAAI,MAAM,IAAI,CAACF,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,MAAMM,QAAQ,GAAG,IAAI,CAACb,eAAe,CAACc,WAAW,CAAC,CAAC;MACnD,OAAOT,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,IAAIA,UAAU,CAAC0B,GAAG,EAAE;UAChB;UACA,IAAI,CAACV,IAAI,EAAEa,SAAS,EAAE;YAClB,OAAO,IAAI;UACf;UACA,OAAOb,IAAI,CAACa,SAAS,CAAC9B,EAAE,KAAK4B,QAAQ,CAAC5B,EAAE;QAC5C;QACA,IAAI,OAAOC,UAAU,CAACgC,GAAG,KAAK,QAAQ,EAAE;UACpC,OAAO,IAAI;QACf;QACA,OAAOhC,UAAU,CAACgC,GAAG,CAAC7B,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAMgC,SAASA,CAAC7B,QAAgB,EAAEU,IAAkB,EAAoB;MACpE,IAAI,MAAM,IAAI,CAACF,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,MAAMM,QAAQ,GAAG,IAAI,CAACb,eAAe,CAACc,WAAW,CAAC,CAAC;MACnD,OAAOT,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,IAAIA,UAAU,CAAC0B,GAAG,EAAE;UAChB,OAAOV,IAAI,EAAEa,SAAS,EAAE9B,EAAE,KAAK4B,QAAQ,CAAC5B,EAAE;QAC9C;QACA,IAAI,OAAOC,UAAU,CAACgC,GAAG,KAAK,QAAQ,EAAE;UACpC,OAAO,IAAI;QACf;QACA,OAAOhC,UAAU,CAACgC,GAAG,CAAC7B,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAMiC,UAAUA,CAAC9B,QAAgB,EAAoB;MACjD,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,OAAOA,UAAU,CAACqC,EAAE,EAAElC,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAMmC,YAAYA,CAAChC,QAAgB,EAAoB;MACnD,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,OAAOA,UAAU,CAACqC,EAAE,EAAElC,QAAQ,CAAC,GAAG,CAAC;MACvC,CAAC,CAAC;IACN;IAEA,MAAMoC,SAASA,CAAC5C,MAAc,EAAEW,QAAgB,EAAoB;MAChE,IAAI,MAAM,IAAI,CAACQ,eAAe,CAACG,aAAa,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;MACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;QAClC,OAAO,IAAI;MACf;MACA,MAAM3B,MAAM,GAAGa,SAAS,CAACC,SAAS,EAAEC,QAAQ,CAAC;MAC7C,MAAMa,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC7B,MAAM,CAACS,UAAU,CAAC;MACtE,IAAI,CAACmB,WAAW,CAACE,MAAM,EAAE;QACrB,OAAO,KAAK;MAChB;MACA,OAAOF,WAAW,CAACK,IAAI,CAACxB,UAAU,IAAI;QAClC,OAAOA,UAAU,CAACL,MAAM,CAAC,KAAK,IAAI;MACtC,CAAC,CAAC;IACN;IAEA,MAAcyB,oBAAoBA,CAACoB,gBAAwB,EAAkB;MACzE,MAAMrB,WAAW,GAAG,MAAM,IAAI,CAACL,eAAe,CAAC2B,cAAc,CAACD,gBAAgB,CAAC;MAC/E,IAAIrB,WAAW,CAACE,MAAM,EAAE;QACpB,OAAOF,WAAW;MACtB;MACA;MACA,MAAMuB,QAAQ,GAAG,MAAM,IAAI,CAAC5B,eAAe,CAAC6B,aAAa,CAACjC,cAAc,CAAC;MACzE,OAAOgC,QAAQ,GAAG,CAACA,QAAQ,CAAC,GAAG,EAAE;IACrC;IAEA,MAAcxB,mBAAmBA,CAAA,EAAqB;MAClD,MAAMlB,UAAU,GAAG,MAAM,IAAI,CAACc,eAAe,CAAC6B,aAAa,CAACjC,cAAc,CAAC;MAC3E,IAAI,CAACV,UAAU,EAAE;QACb,OAAO,KAAK;MAChB;MACA;MACA;MACA,MAAM4C,IAAI,GAAGC,MAAM,CAACD,IAAI,CAAC5C,UAAU,CAAC,CAAC8C,MAAM,CAACC,CAAC,IAAIA,CAAC,KAAK,MAAM,CAAC;MAE9D,MAAMC,MAAM,GAAGJ,IAAI,CAACzC,QAAQ,CAAC,KAAK,CAAC;;MAEnC;MACA,OAAO,CAAC6C,MAAM;IAClB;EACJ;EAEA,MAAMC,WAAW,GAAGhE,iBAAiB,CAAiB,GAAGG,MAAM,CAACuB,MAAM,cAAc,CAAC;EAErF,MAAMuC,cAAc,GAAGD,WAAW,CAACE,oBAAoB,CAAC;IACpDC,cAAc,EAAExC,iBAAiB;IACjCyC,YAAY,EAAE,CAACnE,eAAe;EAClC,CAAQ,CAAC;EAET,OAAO;IAAE+D,WAAW;IAAEC;EAAe,CAAC;AAC1C","ignoreList":[]}

package/features/security/permissions/types.d.ts

@@ -42,9 +42,12 @@ export interface EntityDefinition {
 export interface PermissionSchemaConfig {
     /** Permission prefix — used to filter permissions from the array. */
     prefix: string;
-    /** Permission object emitted on "full access". All properties are spread onto the permission. */
-    fullAccess: {
-        name: string;
+    /**
+     * Full access configuration.
+     * - `true` — emits `{ name: "${prefix}.*" }`.
+     * - `{ ...extras }` — emits `{ name: "${prefix}.*", ...extras }`.
+     */
+    fullAccess: boolean | {
         [key: string]: any;
     };
     /** Entity definitions (optional — simple apps have none). */

package/features/security/permissions/types.js.map

@@ -1 +1 @@
-{"version":3,"names":[],"sources":["types.ts"],"sourcesContent":["/**\n * An action definition on an entity.\n *\n * Built-in actions:\n * - `{ name: \"rwd\" }` — read/write/delete (serialized as joined string, e.g. \"rw\")\n * - `{ name: \"pw\" }` — publish/unpublish (serialized as joined string, e.g. \"pu\")\n *\n * Custom actions:\n * - `{ name: \"install\" }` — boolean flag (serialized as `install: true`)\n */\nexport interface ActionDefinition {\n    /** Key on the permission object (e.g. \"rwd\", \"pw\", \"install\"). */\n    name: string;\n    /** Display label for the UI. Required for custom actions; ignored for built-in \"rwd\"/\"pw\". */\n    label?: string;\n}\n\n/**\n * Defines an entity within a permission schema.\n */\nexport interface EntityDefinition {\n    /** Unique ID, used for form field naming: ${id}AccessScope, ${id}RWD, etc. */\n    id: string;\n    /** Display title for the UI renderer (e.g. \"Files\", \"Settings\"). */\n    title?: string;\n    /** Permission name emitted for this entity (e.g. \"fm.file\"). */\n    permission: string;\n    /** Available access scopes. */\n    scopes: readonly (\"full\" | \"own\")[];\n    /** Action definitions for this entity. */\n    actions?: readonly ActionDefinition[];\n    /** Dependency on another entity. */\n    dependsOn?: {\n        /** ID of parent entity. */\n        entity: string;\n        /** Required action character (e.g. \"r\"). */\n        requires: string;\n    };\n}\n\n/**\n * Configuration for creating a permission schema.\n */\nexport interface PermissionSchemaConfig {\n    /** Permission prefix — used to filter permissions from the array. */\n    prefix: string;\n    /** Permission object emitted on \"full access\". All properties are spread onto the permission. */\n    fullAccess: { name: string; [key: string]: any };\n    /** Entity definitions (optional — simple apps have none). */\n    entities?: readonly EntityDefinition[];\n}\n\n/**\n * Item that may have an owner (used for own-scope permission checks).\n */\nexport interface OwnableItem {\n    createdBy?: { id: string } | null;\n}\n\n/**\n * Extract the union of entity definitions from a schema config type.\n */\ntype EntitiesOf<S extends PermissionSchemaConfig> = S extends {\n    entities: ReadonlyArray<infer E extends EntityDefinition>;\n}\n    ? E\n    : never;\n\n/**\n * Extract entity IDs whose actions array contains an action with the given name.\n */\ntype EntityIdWithAction<S extends PermissionSchemaConfig, A extends string> = {\n    [K in EntitiesOf<S> as K extends { actions: ReadonlyArray<infer Act> }\n        ? Act extends { name: A }\n            ? K[\"id\"]\n            : never\n        : never]: never;\n} extends infer M\n    ? keyof M & string\n    : never;\n\n/**\n * All entity IDs in the schema.\n */\nexport type AllEntityIds<S extends PermissionSchemaConfig> = EntitiesOf<S>[\"id\"];\n\n/**\n * Entity IDs that have the \"rwd\" action.\n */\nexport type RwdEntityId<S extends PermissionSchemaConfig> = EntityIdWithAction<S, \"rwd\">;\n\n/**\n * Entity IDs that have the \"pw\" action.\n */\nexport type PwEntityId<S extends PermissionSchemaConfig> = EntityIdWithAction<S, \"pw\">;\n\n/**\n * Custom (non-builtin) action names across all entities.\n */\nexport type CustomActionNames<S extends PermissionSchemaConfig> = Exclude<\n    EntitiesOf<S> extends { actions: ReadonlyArray<infer Act extends ActionDefinition> }\n        ? Act[\"name\"]\n        : never,\n    \"rwd\" | \"pw\"\n>;\n\n/**\n * Typed permissions interface for a given schema.\n *\n * When the schema has literal entity types, methods are narrowed to only accept valid entity IDs.\n * When the schema is dynamically typed, all methods accept `string`.\n */\nexport type Permissions<S extends PermissionSchemaConfig> =\n    string extends AllEntityIds<S> ? PermissionsUntyped : PermissionsTyped<S>;\n\nexport interface PermissionsUntyped {\n    canAccess(entityId: string, item?: OwnableItem): Promise<boolean>;\n    onlyOwnRecords(entityId: string): Promise<boolean>;\n    canRead(entityId: string): Promise<boolean>;\n    canCreate(entityId: string): Promise<boolean>;\n    canEdit(entityId: string, item?: OwnableItem): Promise<boolean>;\n    canDelete(entityId: string, item?: OwnableItem): Promise<boolean>;\n    canPublish(entityId: string): Promise<boolean>;\n    canUnpublish(entityId: string): Promise<boolean>;\n    canAction(action: string, entityId: string): Promise<boolean>;\n}\n\nexport type PermissionsTyped<S extends PermissionSchemaConfig> = {\n    canAccess(entityId: AllEntityIds<S>, item?: OwnableItem): Promise<boolean>;\n    onlyOwnRecords(entityId: AllEntityIds<S>): Promise<boolean>;\n    canAction(\n        action: CustomActionNames<S> extends never ? string : CustomActionNames<S>,\n        entityId: AllEntityIds<S>\n    ): Promise<boolean>;\n} & ([RwdEntityId<S>] extends [never]\n    ? {\n          canRead(entityId: string): Promise<boolean>;\n          canCreate(entityId: string): Promise<boolean>;\n          canEdit(entityId: string, item?: OwnableItem): Promise<boolean>;\n          canDelete(entityId: string, item?: OwnableItem): Promise<boolean>;\n      }\n    : {\n          canRead(entityId: RwdEntityId<S>): Promise<boolean>;\n          canCreate(entityId: RwdEntityId<S>): Promise<boolean>;\n          canEdit(entityId: RwdEntityId<S>, item?: OwnableItem): Promise<boolean>;\n          canDelete(entityId: RwdEntityId<S>, item?: OwnableItem): Promise<boolean>;\n      }) &\n    ([PwEntityId<S>] extends [never]\n        ? {\n              canPublish(entityId: string): Promise<boolean>;\n              canUnpublish(entityId: string): Promise<boolean>;\n          }\n        : {\n              canPublish(entityId: PwEntityId<S>): Promise<boolean>;\n              canUnpublish(entityId: PwEntityId<S>): Promise<boolean>;\n          });\n"],"mappings":"","ignoreList":[]}
+{"version":3,"names":[],"sources":["types.ts"],"sourcesContent":["/**\n * An action definition on an entity.\n *\n * Built-in actions:\n * - `{ name: \"rwd\" }` — read/write/delete (serialized as joined string, e.g. \"rw\")\n * - `{ name: \"pw\" }` — publish/unpublish (serialized as joined string, e.g. \"pu\")\n *\n * Custom actions:\n * - `{ name: \"install\" }` — boolean flag (serialized as `install: true`)\n */\nexport interface ActionDefinition {\n    /** Key on the permission object (e.g. \"rwd\", \"pw\", \"install\"). */\n    name: string;\n    /** Display label for the UI. Required for custom actions; ignored for built-in \"rwd\"/\"pw\". */\n    label?: string;\n}\n\n/**\n * Defines an entity within a permission schema.\n */\nexport interface EntityDefinition {\n    /** Unique ID, used for form field naming: ${id}AccessScope, ${id}RWD, etc. */\n    id: string;\n    /** Display title for the UI renderer (e.g. \"Files\", \"Settings\"). */\n    title?: string;\n    /** Permission name emitted for this entity (e.g. \"fm.file\"). */\n    permission: string;\n    /** Available access scopes. */\n    scopes: readonly (\"full\" | \"own\")[];\n    /** Action definitions for this entity. */\n    actions?: readonly ActionDefinition[];\n    /** Dependency on another entity. */\n    dependsOn?: {\n        /** ID of parent entity. */\n        entity: string;\n        /** Required action character (e.g. \"r\"). */\n        requires: string;\n    };\n}\n\n/**\n * Configuration for creating a permission schema.\n */\nexport interface PermissionSchemaConfig {\n    /** Permission prefix — used to filter permissions from the array. */\n    prefix: string;\n    /**\n     * Full access configuration.\n     * - `true` — emits `{ name: \"${prefix}.*\" }`.\n     * - `{ ...extras }` — emits `{ name: \"${prefix}.*\", ...extras }`.\n     */\n    fullAccess: boolean | { [key: string]: any };\n    /** Entity definitions (optional — simple apps have none). */\n    entities?: readonly EntityDefinition[];\n}\n\n/**\n * Item that may have an owner (used for own-scope permission checks).\n */\nexport interface OwnableItem {\n    createdBy?: { id: string } | null;\n}\n\n/**\n * Extract the union of entity definitions from a schema config type.\n */\ntype EntitiesOf<S extends PermissionSchemaConfig> = S extends {\n    entities: ReadonlyArray<infer E extends EntityDefinition>;\n}\n    ? E\n    : never;\n\n/**\n * Extract entity IDs whose actions array contains an action with the given name.\n */\ntype EntityIdWithAction<S extends PermissionSchemaConfig, A extends string> = {\n    [K in EntitiesOf<S> as K extends { actions: ReadonlyArray<infer Act> }\n        ? Act extends { name: A }\n            ? K[\"id\"]\n            : never\n        : never]: never;\n} extends infer M\n    ? keyof M & string\n    : never;\n\n/**\n * All entity IDs in the schema.\n */\nexport type AllEntityIds<S extends PermissionSchemaConfig> = EntitiesOf<S>[\"id\"];\n\n/**\n * Entity IDs that have the \"rwd\" action.\n */\nexport type RwdEntityId<S extends PermissionSchemaConfig> = EntityIdWithAction<S, \"rwd\">;\n\n/**\n * Entity IDs that have the \"pw\" action.\n */\nexport type PwEntityId<S extends PermissionSchemaConfig> = EntityIdWithAction<S, \"pw\">;\n\n/**\n * Custom (non-builtin) action names across all entities.\n */\nexport type CustomActionNames<S extends PermissionSchemaConfig> = Exclude<\n    EntitiesOf<S> extends { actions: ReadonlyArray<infer Act extends ActionDefinition> }\n        ? Act[\"name\"]\n        : never,\n    \"rwd\" | \"pw\"\n>;\n\n/**\n * Typed permissions interface for a given schema.\n *\n * When the schema has literal entity types, methods are narrowed to only accept valid entity IDs.\n * When the schema is dynamically typed, all methods accept `string`.\n */\nexport type Permissions<S extends PermissionSchemaConfig> =\n    string extends AllEntityIds<S> ? PermissionsUntyped : PermissionsTyped<S>;\n\nexport interface PermissionsUntyped {\n    canAccess(entityId: string, item?: OwnableItem): Promise<boolean>;\n    onlyOwnRecords(entityId: string): Promise<boolean>;\n    canRead(entityId: string): Promise<boolean>;\n    canCreate(entityId: string): Promise<boolean>;\n    canEdit(entityId: string, item?: OwnableItem): Promise<boolean>;\n    canDelete(entityId: string, item?: OwnableItem): Promise<boolean>;\n    canPublish(entityId: string): Promise<boolean>;\n    canUnpublish(entityId: string): Promise<boolean>;\n    canAction(action: string, entityId: string): Promise<boolean>;\n}\n\nexport type PermissionsTyped<S extends PermissionSchemaConfig> = {\n    canAccess(entityId: AllEntityIds<S>, item?: OwnableItem): Promise<boolean>;\n    onlyOwnRecords(entityId: AllEntityIds<S>): Promise<boolean>;\n    canAction(\n        action: CustomActionNames<S> extends never ? string : CustomActionNames<S>,\n        entityId: AllEntityIds<S>\n    ): Promise<boolean>;\n} & ([RwdEntityId<S>] extends [never]\n    ? {\n          canRead(entityId: string): Promise<boolean>;\n          canCreate(entityId: string): Promise<boolean>;\n          canEdit(entityId: string, item?: OwnableItem): Promise<boolean>;\n          canDelete(entityId: string, item?: OwnableItem): Promise<boolean>;\n      }\n    : {\n          canRead(entityId: RwdEntityId<S>): Promise<boolean>;\n          canCreate(entityId: RwdEntityId<S>): Promise<boolean>;\n          canEdit(entityId: RwdEntityId<S>, item?: OwnableItem): Promise<boolean>;\n          canDelete(entityId: RwdEntityId<S>, item?: OwnableItem): Promise<boolean>;\n      }) &\n    ([PwEntityId<S>] extends [never]\n        ? {\n              canPublish(entityId: string): Promise<boolean>;\n              canUnpublish(entityId: string): Promise<boolean>;\n          }\n        : {\n              canPublish(entityId: PwEntityId<S>): Promise<boolean>;\n              canUnpublish(entityId: PwEntityId<S>): Promise<boolean>;\n          });\n"],"mappings":"","ignoreList":[]}

package/features/wcp/WcpContext/WcpContext.d.ts

@@ -12,6 +12,7 @@ export declare class WcpContextImpl implements WcpContext.Interface {
     private updateTenants;
     getRawLicense(): DecryptedWcpProjectLicense | null;
     getProject(): WcpProject | null;
+    getProjectWithFeatureFlags(): WcpProject | null;
     getProjectEnvironment(): WcpProjectEnvironment | null;
     getProjectLicense(): ILicense;
     canUseFeature(wcpFeatureId: keyof typeof WCP_FEATURE_LABEL): boolean;
@@ -23,6 +24,7 @@ export declare class WcpContextImpl implements WcpContext.Interface {
     canUseRecordLocking(): boolean;
     canUseFileManagerThreatDetection(): boolean;
     canUseWorkflows(): boolean;
+    canUseHcmsFieldPermissions(): boolean;
     ensureCanUseFeature(wcpFeatureId: keyof typeof WCP_FEATURE_LABEL): void;
     incrementSeats(): Promise<void>;
     decrementSeats(): Promise<void>;

package/features/wcp/WcpContext/WcpContext.js

@@ -63,6 +63,9 @@ export class WcpContextImpl {
   getProject() {
     return this.license.getProject();
   }
+  getProjectWithFeatureFlags() {
+    return this.getProject();
+  }
   getProjectEnvironment() {
     return wcpProjectEnvironment;
   }
@@ -96,6 +99,9 @@ export class WcpContextImpl {
   canUseWorkflows() {
     return this.license.canUseWorkflows();
   }
+  canUseHcmsFieldPermissions() {
+    return this.license.canUseHcmsFieldPermissions();
+  }
   ensureCanUseFeature(wcpFeatureId) {
     if (this.license.canUseFeature(wcpFeatureId)) {
       return;

package/features/wcp/WcpContext/WcpContext.js.map

@@ -1 +1 @@
-{"version":3,"names":["getWcpApiUrl","getWcpAppUrl","getWcpProjectEnvironment","WError","wcpFetch","wcpProjectEnvironment","WcpContextImpl","constructor","license","getWcpProjectUrl","path","orgId","org","id","projectId","project","url","filter","Boolean","join","updateSeats","operation","updateSeatsUrl","response","authorization","apiKey","body","meta","action","error","message","console","status","statusText","updateTenants","updateTenantsUrl","getRawLicense","getProject","getProjectEnvironment","getProjectLicense","canUseFeature","wcpFeatureId","canUseAacl","canUseTeams","canUseFolderLevelPermissions","canUsePrivateFiles","canUseAuditLogs","canUseRecordLocking","canUseFileManagerThreatDetection","canUseWorkflows","ensureCanUseFeature","upgradeProjectLicenseLink","incrementSeats","decrementSeats","incrementTenants","decrementTenants","toDto"],"sources":["WcpContext.ts"],"sourcesContent":["import type { WCP_FEATURE_LABEL } from \"@webiny/wcp\";\nimport { getWcpApiUrl, getWcpAppUrl, getWcpProjectEnvironment } from \"@webiny/wcp\";\nimport WError from \"@webiny/error\";\nimport type {\n    DecryptedWcpProjectLicense,\n    ILicense,\n    WcpProjectEnvironment,\n    WcpProject\n} from \"@webiny/wcp/types.js\";\nimport { WcpContext } from \"./abstractions.js\";\nimport { wcpFetch } from \"./utils.js\";\n\nconst wcpProjectEnvironment = getWcpProjectEnvironment();\n\nexport interface CreateWcpContextParams {\n    testProjectLicense?: DecryptedWcpProjectLicense;\n}\n\nexport class WcpContextImpl implements WcpContext.Interface {\n    constructor(private license: ILicense) {}\n\n    private getWcpProjectUrl(path = \"\"): string | null {\n        if (!wcpProjectEnvironment) {\n            return null;\n        }\n\n        const orgId = wcpProjectEnvironment.org.id;\n        const projectId = wcpProjectEnvironment.project.id;\n        const url = [\"/orgs\", orgId, \"projects\", projectId, path].filter(Boolean).join(\"/\");\n        return getWcpApiUrl(url);\n    }\n\n    private async updateSeats(operation: \"increment\" | \"decrement\"): Promise<void> {\n        if (!wcpProjectEnvironment) {\n            return;\n        }\n\n        const updateSeatsUrl = this.getWcpProjectUrl(\"package/seats\");\n\n        const response = await wcpFetch({\n            url: updateSeatsUrl!,\n            authorization: wcpProjectEnvironment.apiKey,\n            body: { operation },\n            meta: {\n                action: operation + \"Seats\"\n            }\n        });\n\n        if (response.error) {\n            const message = response.message || `Failed to ${operation} user seats.`;\n            console.error(message, response.status, response.statusText);\n            throw new WError(message, \"WCP_CANNOT_UPDATE_USER_TENANTS\");\n        }\n    }\n\n    private async updateTenants(operation: \"increment\" | \"decrement\"): Promise<void> {\n        if (!wcpProjectEnvironment) {\n            return;\n        }\n\n        const updateTenantsUrl = this.getWcpProjectUrl(\"package/tenants\");\n\n        const response = await wcpFetch({\n            url: updateTenantsUrl!,\n            authorization: wcpProjectEnvironment.apiKey,\n            body: { operation },\n            meta: {\n                action: operation + \"Tenants\"\n            }\n        });\n\n        if (response.error) {\n            const message = response.message || `Failed to ${operation} tenants.`;\n            console.error(message, response.status, response.statusText);\n            throw new WError(message, \"WCP_CANNOT_UPDATE_USER_TENANTS\");\n        }\n    }\n\n    getRawLicense(): DecryptedWcpProjectLicense | null {\n        return this.license.getRawLicense();\n    }\n\n    getProject(): WcpProject | null {\n        return this.license.getProject();\n    }\n\n    getProjectEnvironment(): WcpProjectEnvironment | null {\n        return wcpProjectEnvironment;\n    }\n\n    getProjectLicense(): ILicense {\n        return this.license;\n    }\n\n    canUseFeature(wcpFeatureId: keyof typeof WCP_FEATURE_LABEL): boolean {\n        return this.license.canUseFeature(wcpFeatureId);\n    }\n\n    canUseAacl(): boolean {\n        return this.license.canUseAacl();\n    }\n\n    canUseTeams(): boolean {\n        return this.license.canUseTeams();\n    }\n\n    canUseFolderLevelPermissions(): boolean {\n        return this.license.canUseFolderLevelPermissions();\n    }\n\n    canUsePrivateFiles(): boolean {\n        return this.license.canUsePrivateFiles();\n    }\n\n    canUseAuditLogs(): boolean {\n        return this.license.canUseAuditLogs();\n    }\n\n    canUseRecordLocking(): boolean {\n        return this.license.canUseRecordLocking();\n    }\n\n    canUseFileManagerThreatDetection(): boolean {\n        return this.license.canUseFileManagerThreatDetection();\n    }\n\n    canUseWorkflows(): boolean {\n        return this.license.canUseWorkflows();\n    }\n\n    ensureCanUseFeature(wcpFeatureId: keyof typeof WCP_FEATURE_LABEL): void {\n        if (this.license.canUseFeature(wcpFeatureId)) {\n            return;\n        }\n\n        let message = `The ${wcpFeatureId} Webiny Control Panel feature cannot be used because your project license does not permit it.`;\n        if (wcpProjectEnvironment) {\n            const { org, project } = wcpProjectEnvironment;\n            const upgradeProjectLicenseLink = getWcpAppUrl(`/${org.id}/${project.id}/settings`);\n            message += ` To upgrade your project license, please use the following link: ${upgradeProjectLicenseLink}.`;\n        }\n\n        throw new WError(message, \"WCP_CANNOT_USE_FEATURE\", { wcpFeatureId });\n    }\n\n    async incrementSeats(): Promise<void> {\n        await this.updateSeats(\"increment\");\n    }\n\n    async decrementSeats(): Promise<void> {\n        await this.updateSeats(\"decrement\");\n    }\n\n    async incrementTenants(): Promise<void> {\n        await this.updateTenants(\"increment\");\n    }\n\n    async decrementTenants(): Promise<void> {\n        await this.updateTenants(\"decrement\");\n    }\n\n    toDto() {\n        return this.getRawLicense();\n    }\n}\n"],"mappings":"AACA,SAASA,YAAY,EAAEC,YAAY,EAAEC,wBAAwB,QAAQ,aAAa;AAClF,OAAOC,MAAM,MAAM,eAAe;AAQlC,SAASC,QAAQ;AAEjB,MAAMC,qBAAqB,GAAGH,wBAAwB,CAAC,CAAC;AAMxD,OAAO,MAAMI,cAAc,CAAiC;EACxDC,WAAWA,CAASC,OAAiB,EAAE;IAAA,KAAnBA,OAAiB,GAAjBA,OAAiB;EAAG;EAEhCC,gBAAgBA,CAACC,IAAI,GAAG,EAAE,EAAiB;IAC/C,IAAI,CAACL,qBAAqB,EAAE;MACxB,OAAO,IAAI;IACf;IAEA,MAAMM,KAAK,GAAGN,qBAAqB,CAACO,GAAG,CAACC,EAAE;IAC1C,MAAMC,SAAS,GAAGT,qBAAqB,CAACU,OAAO,CAACF,EAAE;IAClD,MAAMG,GAAG,GAAG,CAAC,OAAO,EAAEL,KAAK,EAAE,UAAU,EAAEG,SAAS,EAAEJ,IAAI,CAAC,CAACO,MAAM,CAACC,OAAO,CAAC,CAACC,IAAI,CAAC,GAAG,CAAC;IACnF,OAAOnB,YAAY,CAACgB,GAAG,CAAC;EAC5B;EAEA,MAAcI,WAAWA,CAACC,SAAoC,EAAiB;IAC3E,IAAI,CAAChB,qBAAqB,EAAE;MACxB;IACJ;IAEA,MAAMiB,cAAc,GAAG,IAAI,CAACb,gBAAgB,CAAC,eAAe,CAAC;IAE7D,MAAMc,QAAQ,GAAG,MAAMnB,QAAQ,CAAC;MAC5BY,GAAG,EAAEM,cAAe;MACpBE,aAAa,EAAEnB,qBAAqB,CAACoB,MAAM;MAC3CC,IAAI,EAAE;QAAEL;MAAU,CAAC;MACnBM,IAAI,EAAE;QACFC,MAAM,EAAEP,SAAS,GAAG;MACxB;IACJ,CAAC,CAAC;IAEF,IAAIE,QAAQ,CAACM,KAAK,EAAE;MAChB,MAAMC,OAAO,GAAGP,QAAQ,CAACO,OAAO,IAAI,aAAaT,SAAS,cAAc;MACxEU,OAAO,CAACF,KAAK,CAACC,OAAO,EAAEP,QAAQ,CAACS,MAAM,EAAET,QAAQ,CAACU,UAAU,CAAC;MAC5D,MAAM,IAAI9B,MAAM,CAAC2B,OAAO,EAAE,gCAAgC,CAAC;IAC/D;EACJ;EAEA,MAAcI,aAAaA,CAACb,SAAoC,EAAiB;IAC7E,IAAI,CAAChB,qBAAqB,EAAE;MACxB;IACJ;IAEA,MAAM8B,gBAAgB,GAAG,IAAI,CAAC1B,gBAAgB,CAAC,iBAAiB,CAAC;IAEjE,MAAMc,QAAQ,GAAG,MAAMnB,QAAQ,CAAC;MAC5BY,GAAG,EAAEmB,gBAAiB;MACtBX,aAAa,EAAEnB,qBAAqB,CAACoB,MAAM;MAC3CC,IAAI,EAAE;QAAEL;MAAU,CAAC;MACnBM,IAAI,EAAE;QACFC,MAAM,EAAEP,SAAS,GAAG;MACxB;IACJ,CAAC,CAAC;IAEF,IAAIE,QAAQ,CAACM,KAAK,EAAE;MAChB,MAAMC,OAAO,GAAGP,QAAQ,CAACO,OAAO,IAAI,aAAaT,SAAS,WAAW;MACrEU,OAAO,CAACF,KAAK,CAACC,OAAO,EAAEP,QAAQ,CAACS,MAAM,EAAET,QAAQ,CAACU,UAAU,CAAC;MAC5D,MAAM,IAAI9B,MAAM,CAAC2B,OAAO,EAAE,gCAAgC,CAAC;IAC/D;EACJ;EAEAM,aAAaA,CAAA,EAAsC;IAC/C,OAAO,IAAI,CAAC5B,OAAO,CAAC4B,aAAa,CAAC,CAAC;EACvC;EAEAC,UAAUA,CAAA,EAAsB;IAC5B,OAAO,IAAI,CAAC7B,OAAO,CAAC6B,UAAU,CAAC,CAAC;EACpC;EAEAC,qBAAqBA,CAAA,EAAiC;IAClD,OAAOjC,qBAAqB;EAChC;EAEAkC,iBAAiBA,CAAA,EAAa;IAC1B,OAAO,IAAI,CAAC/B,OAAO;EACvB;EAEAgC,aAAaA,CAACC,YAA4C,EAAW;IACjE,OAAO,IAAI,CAACjC,OAAO,CAACgC,aAAa,CAACC,YAAY,CAAC;EACnD;EAEAC,UAAUA,CAAA,EAAY;IAClB,OAAO,IAAI,CAAClC,OAAO,CAACkC,UAAU,CAAC,CAAC;EACpC;EAEAC,WAAWA,CAAA,EAAY;IACnB,OAAO,IAAI,CAACnC,OAAO,CAACmC,WAAW,CAAC,CAAC;EACrC;EAEAC,4BAA4BA,CAAA,EAAY;IACpC,OAAO,IAAI,CAACpC,OAAO,CAACoC,4BAA4B,CAAC,CAAC;EACtD;EAEAC,kBAAkBA,CAAA,EAAY;IAC1B,OAAO,IAAI,CAACrC,OAAO,CAACqC,kBAAkB,CAAC,CAAC;EAC5C;EAEAC,eAAeA,CAAA,EAAY;IACvB,OAAO,IAAI,CAACtC,OAAO,CAACsC,eAAe,CAAC,CAAC;EACzC;EAEAC,mBAAmBA,CAAA,EAAY;IAC3B,OAAO,IAAI,CAACvC,OAAO,CAACuC,mBAAmB,CAAC,CAAC;EAC7C;EAEAC,gCAAgCA,CAAA,EAAY;IACxC,OAAO,IAAI,CAACxC,OAAO,CAACwC,gCAAgC,CAAC,CAAC;EAC1D;EAEAC,eAAeA,CAAA,EAAY;IACvB,OAAO,IAAI,CAACzC,OAAO,CAACyC,eAAe,CAAC,CAAC;EACzC;EAEAC,mBAAmBA,CAACT,YAA4C,EAAQ;IACpE,IAAI,IAAI,CAACjC,OAAO,CAACgC,aAAa,CAACC,YAAY,CAAC,EAAE;MAC1C;IACJ;IAEA,IAAIX,OAAO,GAAG,OAAOW,YAAY,+FAA+F;IAChI,IAAIpC,qBAAqB,EAAE;MACvB,MAAM;QAAEO,GAAG;QAAEG;MAAQ,CAAC,GAAGV,qBAAqB;MAC9C,MAAM8C,yBAAyB,GAAGlD,YAAY,CAAC,IAAIW,GAAG,CAACC,EAAE,IAAIE,OAAO,CAACF,EAAE,WAAW,CAAC;MACnFiB,OAAO,IAAI,oEAAoEqB,yBAAyB,GAAG;IAC/G;IAEA,MAAM,IAAIhD,MAAM,CAAC2B,OAAO,EAAE,wBAAwB,EAAE;MAAEW;IAAa,CAAC,CAAC;EACzE;EAEA,MAAMW,cAAcA,CAAA,EAAkB;IAClC,MAAM,IAAI,CAAChC,WAAW,CAAC,WAAW,CAAC;EACvC;EAEA,MAAMiC,cAAcA,CAAA,EAAkB;IAClC,MAAM,IAAI,CAACjC,WAAW,CAAC,WAAW,CAAC;EACvC;EAEA,MAAMkC,gBAAgBA,CAAA,EAAkB;IACpC,MAAM,IAAI,CAACpB,aAAa,CAAC,WAAW,CAAC;EACzC;EAEA,MAAMqB,gBAAgBA,CAAA,EAAkB;IACpC,MAAM,IAAI,CAACrB,aAAa,CAAC,WAAW,CAAC;EACzC;EAEAsB,KAAKA,CAAA,EAAG;IACJ,OAAO,IAAI,CAACpB,aAAa,CAAC,CAAC;EAC/B;AACJ","ignoreList":[]}
+{"version":3,"names":["getWcpApiUrl","getWcpAppUrl","getWcpProjectEnvironment","WError","wcpFetch","wcpProjectEnvironment","WcpContextImpl","constructor","license","getWcpProjectUrl","path","orgId","org","id","projectId","project","url","filter","Boolean","join","updateSeats","operation","updateSeatsUrl","response","authorization","apiKey","body","meta","action","error","message","console","status","statusText","updateTenants","updateTenantsUrl","getRawLicense","getProject","getProjectWithFeatureFlags","getProjectEnvironment","getProjectLicense","canUseFeature","wcpFeatureId","canUseAacl","canUseTeams","canUseFolderLevelPermissions","canUsePrivateFiles","canUseAuditLogs","canUseRecordLocking","canUseFileManagerThreatDetection","canUseWorkflows","canUseHcmsFieldPermissions","ensureCanUseFeature","upgradeProjectLicenseLink","incrementSeats","decrementSeats","incrementTenants","decrementTenants","toDto"],"sources":["WcpContext.ts"],"sourcesContent":["import type { WCP_FEATURE_LABEL } from \"@webiny/wcp\";\nimport { getWcpApiUrl, getWcpAppUrl, getWcpProjectEnvironment } from \"@webiny/wcp\";\nimport WError from \"@webiny/error\";\nimport type {\n    DecryptedWcpProjectLicense,\n    ILicense,\n    WcpProjectEnvironment,\n    WcpProject\n} from \"@webiny/wcp/types.js\";\nimport { WcpContext } from \"./abstractions.js\";\nimport { wcpFetch } from \"./utils.js\";\n\nconst wcpProjectEnvironment = getWcpProjectEnvironment();\n\nexport interface CreateWcpContextParams {\n    testProjectLicense?: DecryptedWcpProjectLicense;\n}\n\nexport class WcpContextImpl implements WcpContext.Interface {\n    constructor(private license: ILicense) {}\n\n    private getWcpProjectUrl(path = \"\"): string | null {\n        if (!wcpProjectEnvironment) {\n            return null;\n        }\n\n        const orgId = wcpProjectEnvironment.org.id;\n        const projectId = wcpProjectEnvironment.project.id;\n        const url = [\"/orgs\", orgId, \"projects\", projectId, path].filter(Boolean).join(\"/\");\n        return getWcpApiUrl(url);\n    }\n\n    private async updateSeats(operation: \"increment\" | \"decrement\"): Promise<void> {\n        if (!wcpProjectEnvironment) {\n            return;\n        }\n\n        const updateSeatsUrl = this.getWcpProjectUrl(\"package/seats\");\n\n        const response = await wcpFetch({\n            url: updateSeatsUrl!,\n            authorization: wcpProjectEnvironment.apiKey,\n            body: { operation },\n            meta: {\n                action: operation + \"Seats\"\n            }\n        });\n\n        if (response.error) {\n            const message = response.message || `Failed to ${operation} user seats.`;\n            console.error(message, response.status, response.statusText);\n            throw new WError(message, \"WCP_CANNOT_UPDATE_USER_TENANTS\");\n        }\n    }\n\n    private async updateTenants(operation: \"increment\" | \"decrement\"): Promise<void> {\n        if (!wcpProjectEnvironment) {\n            return;\n        }\n\n        const updateTenantsUrl = this.getWcpProjectUrl(\"package/tenants\");\n\n        const response = await wcpFetch({\n            url: updateTenantsUrl!,\n            authorization: wcpProjectEnvironment.apiKey,\n            body: { operation },\n            meta: {\n                action: operation + \"Tenants\"\n            }\n        });\n\n        if (response.error) {\n            const message = response.message || `Failed to ${operation} tenants.`;\n            console.error(message, response.status, response.statusText);\n            throw new WError(message, \"WCP_CANNOT_UPDATE_USER_TENANTS\");\n        }\n    }\n\n    getRawLicense(): DecryptedWcpProjectLicense | null {\n        return this.license.getRawLicense();\n    }\n\n    getProject(): WcpProject | null {\n        return this.license.getProject();\n    }\n\n    getProjectWithFeatureFlags(): WcpProject | null {\n        return this.getProject();\n    }\n\n    getProjectEnvironment(): WcpProjectEnvironment | null {\n        return wcpProjectEnvironment;\n    }\n\n    getProjectLicense(): ILicense {\n        return this.license;\n    }\n\n    canUseFeature(wcpFeatureId: keyof typeof WCP_FEATURE_LABEL): boolean {\n        return this.license.canUseFeature(wcpFeatureId);\n    }\n\n    canUseAacl(): boolean {\n        return this.license.canUseAacl();\n    }\n\n    canUseTeams(): boolean {\n        return this.license.canUseTeams();\n    }\n\n    canUseFolderLevelPermissions(): boolean {\n        return this.license.canUseFolderLevelPermissions();\n    }\n\n    canUsePrivateFiles(): boolean {\n        return this.license.canUsePrivateFiles();\n    }\n\n    canUseAuditLogs(): boolean {\n        return this.license.canUseAuditLogs();\n    }\n\n    canUseRecordLocking(): boolean {\n        return this.license.canUseRecordLocking();\n    }\n\n    canUseFileManagerThreatDetection(): boolean {\n        return this.license.canUseFileManagerThreatDetection();\n    }\n\n    canUseWorkflows(): boolean {\n        return this.license.canUseWorkflows();\n    }\n\n    canUseHcmsFieldPermissions(): boolean {\n        return this.license.canUseHcmsFieldPermissions();\n    }\n\n    ensureCanUseFeature(wcpFeatureId: keyof typeof WCP_FEATURE_LABEL): void {\n        if (this.license.canUseFeature(wcpFeatureId)) {\n            return;\n        }\n\n        let message = `The ${wcpFeatureId} Webiny Control Panel feature cannot be used because your project license does not permit it.`;\n        if (wcpProjectEnvironment) {\n            const { org, project } = wcpProjectEnvironment;\n            const upgradeProjectLicenseLink = getWcpAppUrl(`/${org.id}/${project.id}/settings`);\n            message += ` To upgrade your project license, please use the following link: ${upgradeProjectLicenseLink}.`;\n        }\n\n        throw new WError(message, \"WCP_CANNOT_USE_FEATURE\", { wcpFeatureId });\n    }\n\n    async incrementSeats(): Promise<void> {\n        await this.updateSeats(\"increment\");\n    }\n\n    async decrementSeats(): Promise<void> {\n        await this.updateSeats(\"decrement\");\n    }\n\n    async incrementTenants(): Promise<void> {\n        await this.updateTenants(\"increment\");\n    }\n\n    async decrementTenants(): Promise<void> {\n        await this.updateTenants(\"decrement\");\n    }\n\n    toDto() {\n        return this.getRawLicense();\n    }\n}\n"],"mappings":"AACA,SAASA,YAAY,EAAEC,YAAY,EAAEC,wBAAwB,QAAQ,aAAa;AAClF,OAAOC,MAAM,MAAM,eAAe;AAQlC,SAASC,QAAQ;AAEjB,MAAMC,qBAAqB,GAAGH,wBAAwB,CAAC,CAAC;AAMxD,OAAO,MAAMI,cAAc,CAAiC;EACxDC,WAAWA,CAASC,OAAiB,EAAE;IAAA,KAAnBA,OAAiB,GAAjBA,OAAiB;EAAG;EAEhCC,gBAAgBA,CAACC,IAAI,GAAG,EAAE,EAAiB;IAC/C,IAAI,CAACL,qBAAqB,EAAE;MACxB,OAAO,IAAI;IACf;IAEA,MAAMM,KAAK,GAAGN,qBAAqB,CAACO,GAAG,CAACC,EAAE;IAC1C,MAAMC,SAAS,GAAGT,qBAAqB,CAACU,OAAO,CAACF,EAAE;IAClD,MAAMG,GAAG,GAAG,CAAC,OAAO,EAAEL,KAAK,EAAE,UAAU,EAAEG,SAAS,EAAEJ,IAAI,CAAC,CAACO,MAAM,CAACC,OAAO,CAAC,CAACC,IAAI,CAAC,GAAG,CAAC;IACnF,OAAOnB,YAAY,CAACgB,GAAG,CAAC;EAC5B;EAEA,MAAcI,WAAWA,CAACC,SAAoC,EAAiB;IAC3E,IAAI,CAAChB,qBAAqB,EAAE;MACxB;IACJ;IAEA,MAAMiB,cAAc,GAAG,IAAI,CAACb,gBAAgB,CAAC,eAAe,CAAC;IAE7D,MAAMc,QAAQ,GAAG,MAAMnB,QAAQ,CAAC;MAC5BY,GAAG,EAAEM,cAAe;MACpBE,aAAa,EAAEnB,qBAAqB,CAACoB,MAAM;MAC3CC,IAAI,EAAE;QAAEL;MAAU,CAAC;MACnBM,IAAI,EAAE;QACFC,MAAM,EAAEP,SAAS,GAAG;MACxB;IACJ,CAAC,CAAC;IAEF,IAAIE,QAAQ,CAACM,KAAK,EAAE;MAChB,MAAMC,OAAO,GAAGP,QAAQ,CAACO,OAAO,IAAI,aAAaT,SAAS,cAAc;MACxEU,OAAO,CAACF,KAAK,CAACC,OAAO,EAAEP,QAAQ,CAACS,MAAM,EAAET,QAAQ,CAACU,UAAU,CAAC;MAC5D,MAAM,IAAI9B,MAAM,CAAC2B,OAAO,EAAE,gCAAgC,CAAC;IAC/D;EACJ;EAEA,MAAcI,aAAaA,CAACb,SAAoC,EAAiB;IAC7E,IAAI,CAAChB,qBAAqB,EAAE;MACxB;IACJ;IAEA,MAAM8B,gBAAgB,GAAG,IAAI,CAAC1B,gBAAgB,CAAC,iBAAiB,CAAC;IAEjE,MAAMc,QAAQ,GAAG,MAAMnB,QAAQ,CAAC;MAC5BY,GAAG,EAAEmB,gBAAiB;MACtBX,aAAa,EAAEnB,qBAAqB,CAACoB,MAAM;MAC3CC,IAAI,EAAE;QAAEL;MAAU,CAAC;MACnBM,IAAI,EAAE;QACFC,MAAM,EAAEP,SAAS,GAAG;MACxB;IACJ,CAAC,CAAC;IAEF,IAAIE,QAAQ,CAACM,KAAK,EAAE;MAChB,MAAMC,OAAO,GAAGP,QAAQ,CAACO,OAAO,IAAI,aAAaT,SAAS,WAAW;MACrEU,OAAO,CAACF,KAAK,CAACC,OAAO,EAAEP,QAAQ,CAACS,MAAM,EAAET,QAAQ,CAACU,UAAU,CAAC;MAC5D,MAAM,IAAI9B,MAAM,CAAC2B,OAAO,EAAE,gCAAgC,CAAC;IAC/D;EACJ;EAEAM,aAAaA,CAAA,EAAsC;IAC/C,OAAO,IAAI,CAAC5B,OAAO,CAAC4B,aAAa,CAAC,CAAC;EACvC;EAEAC,UAAUA,CAAA,EAAsB;IAC5B,OAAO,IAAI,CAAC7B,OAAO,CAAC6B,UAAU,CAAC,CAAC;EACpC;EAEAC,0BAA0BA,CAAA,EAAsB;IAC5C,OAAO,IAAI,CAACD,UAAU,CAAC,CAAC;EAC5B;EAEAE,qBAAqBA,CAAA,EAAiC;IAClD,OAAOlC,qBAAqB;EAChC;EAEAmC,iBAAiBA,CAAA,EAAa;IAC1B,OAAO,IAAI,CAAChC,OAAO;EACvB;EAEAiC,aAAaA,CAACC,YAA4C,EAAW;IACjE,OAAO,IAAI,CAAClC,OAAO,CAACiC,aAAa,CAACC,YAAY,CAAC;EACnD;EAEAC,UAAUA,CAAA,EAAY;IAClB,OAAO,IAAI,CAACnC,OAAO,CAACmC,UAAU,CAAC,CAAC;EACpC;EAEAC,WAAWA,CAAA,EAAY;IACnB,OAAO,IAAI,CAACpC,OAAO,CAACoC,WAAW,CAAC,CAAC;EACrC;EAEAC,4BAA4BA,CAAA,EAAY;IACpC,OAAO,IAAI,CAACrC,OAAO,CAACqC,4BAA4B,CAAC,CAAC;EACtD;EAEAC,kBAAkBA,CAAA,EAAY;IAC1B,OAAO,IAAI,CAACtC,OAAO,CAACsC,kBAAkB,CAAC,CAAC;EAC5C;EAEAC,eAAeA,CAAA,EAAY;IACvB,OAAO,IAAI,CAACvC,OAAO,CAACuC,eAAe,CAAC,CAAC;EACzC;EAEAC,mBAAmBA,CAAA,EAAY;IAC3B,OAAO,IAAI,CAACxC,OAAO,CAACwC,mBAAmB,CAAC,CAAC;EAC7C;EAEAC,gCAAgCA,CAAA,EAAY;IACxC,OAAO,IAAI,CAACzC,OAAO,CAACyC,gCAAgC,CAAC,CAAC;EAC1D;EAEAC,eAAeA,CAAA,EAAY;IACvB,OAAO,IAAI,CAAC1C,OAAO,CAAC0C,eAAe,CAAC,CAAC;EACzC;EAEAC,0BAA0BA,CAAA,EAAY;IAClC,OAAO,IAAI,CAAC3C,OAAO,CAAC2C,0BAA0B,CAAC,CAAC;EACpD;EAEAC,mBAAmBA,CAACV,YAA4C,EAAQ;IACpE,IAAI,IAAI,CAAClC,OAAO,CAACiC,aAAa,CAACC,YAAY,CAAC,EAAE;MAC1C;IACJ;IAEA,IAAIZ,OAAO,GAAG,OAAOY,YAAY,+FAA+F;IAChI,IAAIrC,qBAAqB,EAAE;MACvB,MAAM;QAAEO,GAAG;QAAEG;MAAQ,CAAC,GAAGV,qBAAqB;MAC9C,MAAMgD,yBAAyB,GAAGpD,YAAY,CAAC,IAAIW,GAAG,CAACC,EAAE,IAAIE,OAAO,CAACF,EAAE,WAAW,CAAC;MACnFiB,OAAO,IAAI,oEAAoEuB,yBAAyB,GAAG;IAC/G;IAEA,MAAM,IAAIlD,MAAM,CAAC2B,OAAO,EAAE,wBAAwB,EAAE;MAAEY;IAAa,CAAC,CAAC;EACzE;EAEA,MAAMY,cAAcA,CAAA,EAAkB;IAClC,MAAM,IAAI,CAAClC,WAAW,CAAC,WAAW,CAAC;EACvC;EAEA,MAAMmC,cAAcA,CAAA,EAAkB;IAClC,MAAM,IAAI,CAACnC,WAAW,CAAC,WAAW,CAAC;EACvC;EAEA,MAAMoC,gBAAgBA,CAAA,EAAkB;IACpC,MAAM,IAAI,CAACtB,aAAa,CAAC,WAAW,CAAC;EACzC;EAEA,MAAMuB,gBAAgBA,CAAA,EAAkB;IACpC,MAAM,IAAI,CAACvB,aAAa,CAAC,WAAW,CAAC;EACzC;EAEAwB,KAAKA,CAAA,EAAG;IACJ,OAAO,IAAI,CAACtB,aAAa,CAAC,CAAC;EAC/B;AACJ","ignoreList":[]}

package/features/wcp/WcpContext/abstractions.d.ts

@@ -5,6 +5,7 @@ import type { WCP_FEATURE_LABEL } from "@webiny/wcp";
  */
 export interface IWcpContext extends ILicense {
     getProject(): WcpProject | null;
+    getProjectWithFeatureFlags(): WcpProject | null;
     getProjectLicense(): ILicense;
     getProjectEnvironment(): WcpProjectEnvironment | null;
     ensureCanUseFeature(featureId: keyof typeof WCP_FEATURE_LABEL): void;

package/features/wcp/WcpContext/abstractions.js.map

@@ -1 +1 @@
-{"version":3,"names":["createAbstraction","WcpContext"],"sources":["abstractions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport type { ILicense, WcpProject, WcpProjectEnvironment } from \"@webiny/wcp/types.js\";\nimport type { WCP_FEATURE_LABEL } from \"@webiny/wcp\";\n\n/**\n * WcpContext Abstraction\n */\nexport interface IWcpContext extends ILicense {\n    getProject(): WcpProject | null;\n    getProjectLicense(): ILicense;\n    getProjectEnvironment(): WcpProjectEnvironment | null;\n    ensureCanUseFeature(featureId: keyof typeof WCP_FEATURE_LABEL): void;\n    incrementSeats(): Promise<void>;\n    decrementSeats(): Promise<void>;\n    incrementTenants(): Promise<void>;\n    decrementTenants(): Promise<void>;\n}\n\nexport const WcpContext = createAbstraction<IWcpContext>(\"WcpContext\");\n\nexport namespace WcpContext {\n    export type Interface = IWcpContext;\n}\n"],"mappings":"AAAA,SAASA,iBAAiB,QAAQ,qBAAqB;;AAIvD;AACA;AACA;;AAYA,OAAO,MAAMC,UAAU,GAAGD,iBAAiB,CAAc,YAAY,CAAC","ignoreList":[]}
+{"version":3,"names":["createAbstraction","WcpContext"],"sources":["abstractions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport type { ILicense, WcpProject, WcpProjectEnvironment } from \"@webiny/wcp/types.js\";\nimport type { WCP_FEATURE_LABEL } from \"@webiny/wcp\";\n\n/**\n * WcpContext Abstraction\n */\nexport interface IWcpContext extends ILicense {\n    getProject(): WcpProject | null;\n    getProjectWithFeatureFlags(): WcpProject | null;\n    getProjectLicense(): ILicense;\n    getProjectEnvironment(): WcpProjectEnvironment | null;\n    ensureCanUseFeature(featureId: keyof typeof WCP_FEATURE_LABEL): void;\n    incrementSeats(): Promise<void>;\n    decrementSeats(): Promise<void>;\n    incrementTenants(): Promise<void>;\n    decrementTenants(): Promise<void>;\n}\n\nexport const WcpContext = createAbstraction<IWcpContext>(\"WcpContext\");\n\nexport namespace WcpContext {\n    export type Interface = IWcpContext;\n}\n"],"mappings":"AAAA,SAASA,iBAAiB,QAAQ,qBAAqB;;AAIvD;AACA;AACA;;AAaA,OAAO,MAAMC,UAAU,GAAGD,iBAAiB,CAAc,YAAY,CAAC","ignoreList":[]}

package/features/wcp/WcpContext/decorators/WcpContextWithFeatureFlagsDecorator.d.ts

@@ -0,0 +1,79 @@
+import type { WCP_FEATURE_LABEL } from "@webiny/wcp";
+import { WcpContext } from "../abstractions.js";
+import { FeatureFlags } from "../../../featureFlags/abstractions.js";
+declare class WcpContextWithFeatureFlagsDecoratorImpl implements WcpContext.Interface {
+    private featureFlags;
+    private decoratee;
+    constructor(featureFlags: FeatureFlags.Interface, decoratee: WcpContext.Interface);
+    getRawLicense(): import("@webiny/wcp/types.js").DecryptedWcpProjectLicense | null;
+    getProject(): import("@webiny/wcp/types.js").WcpProject | null;
+    getProjectWithFeatureFlags(): {
+        package: {
+            features: {
+                multiTenancy: {
+                    enabled: true;
+                    options: {
+                        maxCount: {
+                            type: import("@webiny/wcp/types.js").MT_OPTIONS_MAX_COUNT_TYPE;
+                            count?: number;
+                        };
+                    };
+                };
+                advancedPublishingWorkflow: {
+                    enabled: boolean;
+                };
+                advancedAccessControlLayer: {
+                    enabled: boolean;
+                    options: {
+                        teams: boolean;
+                        privateFiles: boolean;
+                        folderLevelPermissions: boolean;
+                        hcmsFieldPermissions: boolean;
+                    };
+                };
+                auditLogs: {
+                    enabled: boolean;
+                };
+                recordLocking: {
+                    enabled: boolean;
+                };
+                fileManager: {
+                    enabled: boolean;
+                    options: {
+                        threatDetection: boolean;
+                    };
+                };
+                seats: {
+                    enabled: true;
+                    options: {
+                        maxCount: number;
+                    };
+                };
+            };
+        };
+        orgId: string;
+        projectId: string;
+    } | null;
+    getProjectEnvironment(): import("@webiny/wcp/types.js").WcpProjectEnvironment | null;
+    getProjectLicense(): import("@webiny/wcp/types.js").ILicense;
+    canUseFeature(wcpFeatureId: keyof typeof WCP_FEATURE_LABEL): boolean;
+    canUseAacl(): boolean;
+    canUseTeams(): boolean;
+    canUseFolderLevelPermissions(): boolean;
+    canUsePrivateFiles(): boolean;
+    canUseAuditLogs(): boolean;
+    canUseRecordLocking(): boolean;
+    canUseFileManagerThreatDetection(): boolean;
+    canUseWorkflows(): boolean;
+    canUseHcmsFieldPermissions(): boolean;
+    ensureCanUseFeature(featureId: keyof typeof WCP_FEATURE_LABEL): void;
+    incrementSeats(): Promise<void>;
+    decrementSeats(): Promise<void>;
+    incrementTenants(): Promise<void>;
+    decrementTenants(): Promise<void>;
+    toDto(): import("@webiny/wcp/types.js").DecryptedWcpProjectLicense | null;
+}
+export declare const WcpContextWithFeatureFlagsDecorator: typeof WcpContextWithFeatureFlagsDecoratorImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("../abstractions.js").IWcpContext>;
+};
+export {};