@webiny/api-core 6.3.0 → 6.4.0-beta.0

package/features/security/authorization/GroupsTeamsAuthorizer/abstractions.js.map

@@ -1 +1 @@
-{"version":3,"names":["createAbstraction","PermissionsProcessor"],"sources":["abstractions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport type { SecurityPermission } from \"~/types/security.js\";\nimport { Identity } from \"~/features/security/IdentityContext/index.js\";\n\nexport interface ITenantPermission extends SecurityPermission {\n    _src: string;\n}\n\nexport interface IPermissionsProcessor {\n    getPermissions(identity: Identity): Promise<ITenantPermission[] | null>;\n}\n\nexport const PermissionsProcessor =\n    createAbstraction<IPermissionsProcessor>(\"PermissionsProcessor\");\n\nexport namespace PermissionsProcessor {\n    export type Interface = IPermissionsProcessor;\n    export type Permissions = ITenantPermission[];\n}\n"],"mappings":"AAAA,SAASA,iBAAiB,QAAQ,qBAAqB;AAYvD,OAAO,MAAMC,oBAAoB,GAC7BD,iBAAiB,CAAwB,sBAAsB,CAAC","ignoreList":[]}
+{"version":3,"file":"features/security/authorization/GroupsTeamsAuthorizer/abstractions.js","sources":["../../../../../src/features/security/authorization/GroupsTeamsAuthorizer/abstractions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport type { SecurityPermission } from \"~/types/security.js\";\nimport { Identity } from \"~/features/security/IdentityContext/index.js\";\n\nexport interface ITenantPermission extends SecurityPermission {\n    _src: string;\n}\n\nexport interface IPermissionsProcessor {\n    getPermissions(identity: Identity): Promise<ITenantPermission[] | null>;\n}\n\nexport const PermissionsProcessor =\n    createAbstraction<IPermissionsProcessor>(\"PermissionsProcessor\");\n\nexport namespace PermissionsProcessor {\n    export type Interface = IPermissionsProcessor;\n    export type Permissions = ITenantPermission[];\n}\n"],"names":["PermissionsProcessor","createAbstraction"],"mappings":";AAYO,MAAMA,uBACTC,kBAAyC"}

package/features/security/authorization/GroupsTeamsAuthorizer/feature.js

@@ -1,12 +1,13 @@
 import { createFeature } from "@webiny/feature/api";
 import { RolesTeamsAuthorizer } from "./RolesTeamsAuthorizer.js";
 import { GetPermissionsFromIdentity } from "./GetPermissionsFromIdentity.js";
-export const GroupsTeamsAuthorizerFeature = createFeature({
-  name: "GroupsTeamsAuthorizer",
-  register(container) {
-    container.register(RolesTeamsAuthorizer).inSingletonScope();
-    container.register(GetPermissionsFromIdentity);
-  }
+const GroupsTeamsAuthorizerFeature = createFeature({
+    name: "GroupsTeamsAuthorizer",
+    register (container) {
+        container.register(RolesTeamsAuthorizer).inSingletonScope();
+        container.register(GetPermissionsFromIdentity);
+    }
 });
+export { GroupsTeamsAuthorizerFeature };
 
 //# sourceMappingURL=feature.js.map

package/features/security/authorization/GroupsTeamsAuthorizer/feature.js.map

@@ -1 +1 @@
-{"version":3,"names":["createFeature","RolesTeamsAuthorizer","GetPermissionsFromIdentity","GroupsTeamsAuthorizerFeature","name","register","container","inSingletonScope"],"sources":["feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { RolesTeamsAuthorizer } from \"./RolesTeamsAuthorizer.js\";\nimport { GetPermissionsFromIdentity } from \"./GetPermissionsFromIdentity.js\";\n\nexport const GroupsTeamsAuthorizerFeature = createFeature({\n    name: \"GroupsTeamsAuthorizer\",\n    register(container) {\n        container.register(RolesTeamsAuthorizer).inSingletonScope();\n        container.register(GetPermissionsFromIdentity);\n    }\n});\n"],"mappings":"AAAA,SAASA,aAAa,QAAQ,qBAAqB;AACnD,SAASC,oBAAoB;AAC7B,SAASC,0BAA0B;AAEnC,OAAO,MAAMC,4BAA4B,GAAGH,aAAa,CAAC;EACtDI,IAAI,EAAE,uBAAuB;EAC7BC,QAAQA,CAACC,SAAS,EAAE;IAChBA,SAAS,CAACD,QAAQ,CAACJ,oBAAoB,CAAC,CAACM,gBAAgB,CAAC,CAAC;IAC3DD,SAAS,CAACD,QAAQ,CAACH,0BAA0B,CAAC;EAClD;AACJ,CAAC,CAAC","ignoreList":[]}
+{"version":3,"file":"features/security/authorization/GroupsTeamsAuthorizer/feature.js","sources":["../../../../../src/features/security/authorization/GroupsTeamsAuthorizer/feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { RolesTeamsAuthorizer } from \"./RolesTeamsAuthorizer.js\";\nimport { GetPermissionsFromIdentity } from \"./GetPermissionsFromIdentity.js\";\n\nexport const GroupsTeamsAuthorizerFeature = createFeature({\n    name: \"GroupsTeamsAuthorizer\",\n    register(container) {\n        container.register(RolesTeamsAuthorizer).inSingletonScope();\n        container.register(GetPermissionsFromIdentity);\n    }\n});\n"],"names":["GroupsTeamsAuthorizerFeature","createFeature","container","RolesTeamsAuthorizer","GetPermissionsFromIdentity"],"mappings":";;;AAIO,MAAMA,+BAA+BC,cAAc;IACtD,MAAM;IACN,UAASC,SAAS;QACdA,UAAU,QAAQ,CAACC,sBAAsB,gBAAgB;QACzDD,UAAU,QAAQ,CAACE;IACvB;AACJ"}

package/features/security/login/abstractions.js

@@ -1,13 +1,14 @@
 import { DomainEvent } from "../../eventPublisher/index.js";
 import { createAbstraction } from "@webiny/feature/api";
-export class AfterLoginEvent extends DomainEvent {
-  eventType = "login.afterLogin";
-  getHandlerAbstraction() {
-    return AfterLoginEventHandler;
-  }
+class AfterLoginEvent extends DomainEvent {
+    getHandlerAbstraction() {
+        return AfterLoginEventHandler;
+    }
+    constructor(...args){
+        super(...args), this.eventType = "login.afterLogin";
+    }
 }
-
-/** Hook into login lifecycle after a user logs in. */
-export const AfterLoginEventHandler = createAbstraction("AfterLoginEventHandler");
+const AfterLoginEventHandler = createAbstraction("AfterLoginEventHandler");
+export { AfterLoginEvent, AfterLoginEventHandler };
 
 //# sourceMappingURL=abstractions.js.map

package/features/security/login/abstractions.js.map

@@ -1 +1 @@
-{"version":3,"names":["DomainEvent","createAbstraction","AfterLoginEvent","eventType","getHandlerAbstraction","AfterLoginEventHandler"],"sources":["abstractions.ts"],"sourcesContent":["import { DomainEvent } from \"~/features/eventPublisher/index.js\";\nimport type { IEventHandler } from \"~/features/eventPublisher/index.js\";\nimport { createAbstraction } from \"@webiny/feature/api\";\nimport { Identity } from \"~/features/security/IdentityContext/index.js\";\n\nexport interface AfterLoginPayload {\n    identity: Identity;\n}\n\nexport class AfterLoginEvent extends DomainEvent<AfterLoginPayload> {\n    eventType = \"login.afterLogin\" as const;\n\n    getHandlerAbstraction() {\n        return AfterLoginEventHandler;\n    }\n}\n\n/** Hook into login lifecycle after a user logs in. */\nexport const AfterLoginEventHandler =\n    createAbstraction<IEventHandler<AfterLoginEvent>>(\"AfterLoginEventHandler\");\n\nexport namespace AfterLoginEventHandler {\n    export type Interface = IEventHandler<AfterLoginEvent>;\n    export type Event = AfterLoginEvent;\n}\n"],"mappings":"AAAA,SAASA,WAAW;AAEpB,SAASC,iBAAiB,QAAQ,qBAAqB;AAOvD,OAAO,MAAMC,eAAe,SAASF,WAAW,CAAoB;EAChEG,SAAS,GAAG,kBAAkB;EAE9BC,qBAAqBA,CAAA,EAAG;IACpB,OAAOC,sBAAsB;EACjC;AACJ;;AAEA;AACA,OAAO,MAAMA,sBAAsB,GAC/BJ,iBAAiB,CAAiC,wBAAwB,CAAC","ignoreList":[]}
+{"version":3,"file":"features/security/login/abstractions.js","sources":["../../../../src/features/security/login/abstractions.ts"],"sourcesContent":["import { DomainEvent } from \"~/features/eventPublisher/index.js\";\nimport type { IEventHandler } from \"~/features/eventPublisher/index.js\";\nimport { createAbstraction } from \"@webiny/feature/api\";\nimport { Identity } from \"~/features/security/IdentityContext/index.js\";\n\nexport interface AfterLoginPayload {\n    identity: Identity;\n}\n\nexport class AfterLoginEvent extends DomainEvent<AfterLoginPayload> {\n    eventType = \"login.afterLogin\" as const;\n\n    getHandlerAbstraction() {\n        return AfterLoginEventHandler;\n    }\n}\n\n/** Hook into login lifecycle after a user logs in. */\nexport const AfterLoginEventHandler =\n    createAbstraction<IEventHandler<AfterLoginEvent>>(\"AfterLoginEventHandler\");\n\nexport namespace AfterLoginEventHandler {\n    export type Interface = IEventHandler<AfterLoginEvent>;\n    export type Event = AfterLoginEvent;\n}\n"],"names":["AfterLoginEvent","DomainEvent","AfterLoginEventHandler","createAbstraction"],"mappings":";;AASO,MAAMA,wBAAwBC;IAGjC,wBAAwB;QACpB,OAAOC;IACX;;QALG,qBACH,SAAS,GAAG;;AAKhB;AAGO,MAAMA,yBACTC,kBAAkD"}

package/features/security/login/index.js

@@ -1,3 +1 @@
 export * from "./abstractions.js";
-
-//# sourceMappingURL=index.js.map

package/features/security/permissions/createPermissionSchema.js

@@ -1,8 +1,9 @@
-export function createPermissionSchema(config) {
-  return {
-    ...config,
-    entities: config.entities ?? []
-  };
+function createPermissionSchema(config) {
+    return {
+        ...config,
+        entities: config.entities ?? []
+    };
 }
+export { createPermissionSchema };
 
 //# sourceMappingURL=createPermissionSchema.js.map

package/features/security/permissions/createPermissionSchema.js.map

@@ -1 +1 @@
-{"version":3,"names":["createPermissionSchema","config","entities"],"sources":["createPermissionSchema.ts"],"sourcesContent":["import type { PermissionSchemaConfig } from \"./types.js\";\n\nexport function createPermissionSchema<const T extends PermissionSchemaConfig>(config: T): T {\n    return {\n        ...config,\n        entities: config.entities ?? []\n    };\n}\n"],"mappings":"AAEA,OAAO,SAASA,sBAAsBA,CAAyCC,MAAS,EAAK;EACzF,OAAO;IACH,GAAGA,MAAM;IACTC,QAAQ,EAAED,MAAM,CAACC,QAAQ,IAAI;EACjC,CAAC;AACL","ignoreList":[]}
+{"version":3,"file":"features/security/permissions/createPermissionSchema.js","sources":["../../../../src/features/security/permissions/createPermissionSchema.ts"],"sourcesContent":["import type { PermissionSchemaConfig } from \"./types.js\";\n\nexport function createPermissionSchema<const T extends PermissionSchemaConfig>(config: T): T {\n    return {\n        ...config,\n        entities: config.entities ?? []\n    };\n}\n"],"names":["createPermissionSchema","config"],"mappings":"AAEO,SAASA,uBAA+DC,MAAS;IACpF,OAAO;QACH,GAAGA,MAAM;QACT,UAAUA,OAAO,QAAQ,IAAI,EAAE;IACnC;AACJ"}

package/features/security/permissions/createPermissions.js

@@ -1,250 +1,162 @@
-import { createAbstraction } from "@webiny/feature/api";
-import { createFeature } from "@webiny/feature/api";
+import { createAbstraction, createFeature } from "@webiny/feature/api";
 import { IdentityContext } from "../IdentityContext/index.js";
 function buildEntityMap(schema) {
-  const map = new Map();
-  for (const entity of schema.entities ?? []) {
-    const actions = new Set();
-    for (const action of entity.actions ?? []) {
-      actions.add(action.name);
-    }
-    map.set(entity.id, {
-      permission: entity.permission,
-      actions,
-      hasOwn: entity.scopes.includes("own")
-    });
-  }
-  return map;
+    const map = new Map();
+    for (const entity of schema.entities ?? []){
+        const actions = new Set();
+        for (const action of entity.actions ?? [])actions.add(action.name);
+        map.set(entity.id, {
+            permission: entity.permission,
+            actions,
+            hasOwn: entity.scopes.includes("own")
+        });
+    }
+    return map;
 }
 function getEntity(entityMap, entityId) {
-  const entity = entityMap.get(entityId);
-  if (!entity) {
-    throw new Error(`Unknown entity "${entityId}" in permission schema.`);
-  }
-  return entity;
+    const entity = entityMap.get(entityId);
+    if (!entity) throw new Error(`Unknown entity "${entityId}" in permission schema.`);
+    return entity;
 }
 class SchemaPermissions {
-  constructor(schema, identityContext) {
-    this.entityMap = buildEntityMap(schema);
-    this.fullAccessName = `${schema.prefix}.*`;
-    this.identityContext = identityContext;
-  }
-  async canAccess(entityId, item) {
-    if (await this.identityContext.hasFullAccess()) {
-      return true;
-    }
-    if (await this.hasFullSchemaAccess()) {
-      return true;
-    }
-    const entity = getEntity(this.entityMap, entityId);
-    const permissions = await this.getEntityPermissions(entity.permission);
-    if (!permissions.length) {
-      return false;
-    }
-    // No item — just check entity-level access.
-    if (item === undefined) {
-      return true;
-    }
-    // Item provided — if all permissions require own, verify ownership.
-    const ownOnly = !permissions.some(p => !p.own);
-    if (!ownOnly) {
-      return true;
-    }
-    const identity = this.identityContext.getIdentity();
-    return item.createdBy?.id === identity.id;
-  }
-  async onlyOwnRecords(entityId) {
-    if (await this.identityContext.hasFullAccess()) {
-      return false;
-    }
-    if (await this.hasFullSchemaAccess()) {
-      return false;
-    }
-    const entity = getEntity(this.entityMap, entityId);
-    const permissions = await this.getEntityPermissions(entity.permission);
-    if (!permissions.length) {
-      return false;
-    }
-    return !permissions.some(p => !p.own);
-  }
-  async canRead(entityId) {
-    if (await this.identityContext.hasFullAccess()) {
-      return true;
-    }
-    if (await this.hasFullSchemaAccess()) {
-      return true;
+    constructor(schema, identityContext){
+        this.entityMap = buildEntityMap(schema);
+        this.fullAccessName = `${schema.prefix}.*`;
+        this.identityContext = identityContext;
+    }
+    async canAccess(entityId, item) {
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        if (void 0 === item) return true;
+        const ownOnly = !permissions.some((p)=>!p.own);
+        if (!ownOnly) return true;
+        const identity = this.identityContext.getIdentity();
+        return item.createdBy?.id === identity.id;
+    }
+    async onlyOwnRecords(entityId) {
+        if (await this.identityContext.hasFullAccess()) return false;
+        if (await this.hasFullSchemaAccess()) return false;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        return !permissions.some((p)=>!p.own);
+    }
+    async canRead(entityId) {
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        return permissions.some((permission)=>{
+            if ("string" != typeof permission.rwd) return true;
+            return permission.rwd.includes("r");
+        });
+    }
+    async canCreate(entityId) {
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        return permissions.some((permission)=>{
+            if ("string" != typeof permission.rwd) return true;
+            return permission.rwd.includes("w");
+        });
+    }
+    async canEdit(entityId, item) {
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        const identity = this.identityContext.getIdentity();
+        return permissions.some((permission)=>{
+            if (permission.own) {
+                if (!item?.createdBy) return true;
+                return item.createdBy.id === identity.id;
+            }
+            if ("string" != typeof permission.rwd) return true;
+            return permission.rwd.includes("w");
+        });
+    }
+    async canDelete(entityId, item) {
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        const identity = this.identityContext.getIdentity();
+        return permissions.some((permission)=>{
+            if (permission.own) return item?.createdBy?.id === identity.id;
+            if ("string" != typeof permission.rwd) return true;
+            return permission.rwd.includes("d");
+        });
+    }
+    async canPublish(entityId) {
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        return permissions.some((permission)=>permission.pw?.includes("p"));
+    }
+    async canUnpublish(entityId) {
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        return permissions.some((permission)=>permission.pw?.includes("u"));
+    }
+    async canAction(action, entityId) {
+        if (await this.identityContext.hasFullAccess()) return true;
+        if (await this.hasFullSchemaAccess()) return true;
+        const entity = getEntity(this.entityMap, entityId);
+        const permissions = await this.getEntityPermissions(entity.permission);
+        if (!permissions.length) return false;
+        return permissions.some((permission)=>true === permission[action]);
+    }
+    async getEntityPermissions(entityPermission) {
+        const permissions = await this.identityContext.getPermissions(entityPermission);
+        if (permissions.length) return permissions;
+        const wildcard = await this.identityContext.getPermission(this.fullAccessName);
+        return wildcard ? [
+            wildcard
+        ] : [];
+    }
+    async hasFullSchemaAccess() {
+        const permission = await this.identityContext.getPermission(this.fullAccessName);
+        if (!permission) return false;
+        const keys = Object.keys(permission).filter((k)=>"name" !== k);
+        const hasRwd = keys.includes("rwd");
+        return !hasRwd;
     }
-    const entity = getEntity(this.entityMap, entityId);
-    const permissions = await this.getEntityPermissions(entity.permission);
-    if (!permissions.length) {
-      return false;
-    }
-    return permissions.some(permission => {
-      if (typeof permission.rwd !== "string") {
-        return true;
-      }
-      return permission.rwd.includes("r");
-    });
-  }
-  async canCreate(entityId) {
-    if (await this.identityContext.hasFullAccess()) {
-      return true;
-    }
-    if (await this.hasFullSchemaAccess()) {
-      return true;
-    }
-    const entity = getEntity(this.entityMap, entityId);
-    const permissions = await this.getEntityPermissions(entity.permission);
-    if (!permissions.length) {
-      return false;
-    }
-    return permissions.some(permission => {
-      if (typeof permission.rwd !== "string") {
-        return true;
-      }
-      return permission.rwd.includes("w");
-    });
-  }
-  async canEdit(entityId, item) {
-    if (await this.identityContext.hasFullAccess()) {
-      return true;
-    }
-    if (await this.hasFullSchemaAccess()) {
-      return true;
-    }
-    const entity = getEntity(this.entityMap, entityId);
-    const permissions = await this.getEntityPermissions(entity.permission);
-    if (!permissions.length) {
-      return false;
-    }
-    const identity = this.identityContext.getIdentity();
-    return permissions.some(permission => {
-      if (permission.own) {
-        // No item provided (new/unsaved) — allow access.
-        if (!item?.createdBy) {
-          return true;
+}
+function createPermissionsAbstraction(schema) {
+    return createAbstraction(`${schema.prefix}:Permissions`);
+}
+function createPermissionsFeature(schema, abstraction) {
+    class PermissionsImpl extends SchemaPermissions {
+        constructor(identityContext){
+            super(schema, identityContext);
         }
-        return item.createdBy.id === identity.id;
-      }
-      if (typeof permission.rwd !== "string") {
-        return true;
-      }
-      return permission.rwd.includes("w");
-    });
-  }
-  async canDelete(entityId, item) {
-    if (await this.identityContext.hasFullAccess()) {
-      return true;
-    }
-    if (await this.hasFullSchemaAccess()) {
-      return true;
-    }
-    const entity = getEntity(this.entityMap, entityId);
-    const permissions = await this.getEntityPermissions(entity.permission);
-    if (!permissions.length) {
-      return false;
-    }
-    const identity = this.identityContext.getIdentity();
-    return permissions.some(permission => {
-      if (permission.own) {
-        return item?.createdBy?.id === identity.id;
-      }
-      if (typeof permission.rwd !== "string") {
-        return true;
-      }
-      return permission.rwd.includes("d");
-    });
-  }
-  async canPublish(entityId) {
-    if (await this.identityContext.hasFullAccess()) {
-      return true;
-    }
-    if (await this.hasFullSchemaAccess()) {
-      return true;
-    }
-    const entity = getEntity(this.entityMap, entityId);
-    const permissions = await this.getEntityPermissions(entity.permission);
-    if (!permissions.length) {
-      return false;
-    }
-    return permissions.some(permission => {
-      return permission.pw?.includes("p");
-    });
-  }
-  async canUnpublish(entityId) {
-    if (await this.identityContext.hasFullAccess()) {
-      return true;
-    }
-    if (await this.hasFullSchemaAccess()) {
-      return true;
-    }
-    const entity = getEntity(this.entityMap, entityId);
-    const permissions = await this.getEntityPermissions(entity.permission);
-    if (!permissions.length) {
-      return false;
     }
-    return permissions.some(permission => {
-      return permission.pw?.includes("u");
+    const Implementation = abstraction.createImplementation({
+        implementation: PermissionsImpl,
+        dependencies: [
+            IdentityContext
+        ]
     });
-  }
-  async canAction(action, entityId) {
-    if (await this.identityContext.hasFullAccess()) {
-      return true;
-    }
-    if (await this.hasFullSchemaAccess()) {
-      return true;
-    }
-    const entity = getEntity(this.entityMap, entityId);
-    const permissions = await this.getEntityPermissions(entity.permission);
-    if (!permissions.length) {
-      return false;
-    }
-    return permissions.some(permission => {
-      return permission[action] === true;
+    return createFeature({
+        name: `${schema.prefix}:Permissions`,
+        register (container) {
+            container.register(Implementation);
+        }
     });
-  }
-  async getEntityPermissions(entityPermission) {
-    const permissions = await this.identityContext.getPermissions(entityPermission);
-    if (permissions.length) {
-      return permissions;
-    }
-    // Fall back to the schema wildcard (e.g. "test.*") — its flags apply to all entities.
-    const wildcard = await this.identityContext.getPermission(this.fullAccessName);
-    return wildcard ? [wildcard] : [];
-  }
-  async hasFullSchemaAccess() {
-    const permission = await this.identityContext.getPermission(this.fullAccessName);
-    if (!permission) {
-      return false;
-    }
-    // Only treat as full access if the permission has no `rwd` flag.
-    // A permission like { name: "wb.*", rwd: "r" } should NOT grant full access.
-    const keys = Object.keys(permission).filter(k => k !== "name");
-    const hasRwd = keys.includes("rwd");
-
-    // It's full-access only if there's no `rwd` flag.
-    return !hasRwd;
-  }
-}
-export function createPermissionsAbstraction(schema) {
-  return createAbstraction(`${schema.prefix}:Permissions`);
-}
-export function createPermissionsFeature(schema, abstraction) {
-  class PermissionsImpl extends SchemaPermissions {
-    constructor(identityContext) {
-      super(schema, identityContext);
-    }
-  }
-  const Implementation = abstraction.createImplementation({
-    implementation: PermissionsImpl,
-    dependencies: [IdentityContext]
-  });
-  return createFeature({
-    name: `${schema.prefix}:Permissions`,
-    register(container) {
-      container.register(Implementation);
-    }
-  });
 }
+export { createPermissionsAbstraction, createPermissionsFeature };
 
 //# sourceMappingURL=createPermissions.js.map

package/features/security/permissions/createPermissions.js.map

@@ -1 +1 @@
-{"version":3,"names":["createAbstraction","createFeature","IdentityContext","buildEntityMap","schema","map","Map","entity","entities","actions","Set","action","add","name","set","id","permission","hasOwn","scopes","includes","getEntity","entityMap","entityId","get","Error","SchemaPermissions","constructor","identityContext","fullAccessName","prefix","canAccess","item","hasFullAccess","hasFullSchemaAccess","permissions","getEntityPermissions","length","undefined","ownOnly","some","p","own","identity","getIdentity","createdBy","onlyOwnRecords","canRead","rwd","canCreate","canEdit","canDelete","canPublish","pw","canUnpublish","canAction","entityPermission","getPermissions","wildcard","getPermission","keys","Object","filter","k","hasRwd","createPermissionsAbstraction","createPermissionsFeature","abstraction","PermissionsImpl","Implementation","createImplementation","implementation","dependencies","register","container"],"sources":["createPermissions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport { createFeature } from \"@webiny/feature/api\";\nimport { IdentityContext } from \"~/features/security/IdentityContext/index.js\";\nimport type { Abstraction } from \"@webiny/di\";\nimport type { PermissionSchemaConfig } from \"./types.js\";\nimport type { OwnableItem } from \"./types.js\";\nimport type { Permissions } from \"./types.js\";\n\ninterface EntityLookup {\n    permission: string;\n    actions: Set<string>;\n    hasOwn: boolean;\n}\n\nfunction buildEntityMap(schema: PermissionSchemaConfig): Map<string, EntityLookup> {\n    const map = new Map<string, EntityLookup>();\n    for (const entity of schema.entities ?? []) {\n        const actions = new Set<string>();\n        for (const action of entity.actions ?? []) {\n            actions.add(action.name);\n        }\n        map.set(entity.id, {\n            permission: entity.permission,\n            actions,\n            hasOwn: entity.scopes.includes(\"own\")\n        });\n    }\n    return map;\n}\n\nfunction getEntity(entityMap: Map<string, EntityLookup>, entityId: string): EntityLookup {\n    const entity = entityMap.get(entityId);\n    if (!entity) {\n        throw new Error(`Unknown entity \"${entityId}\" in permission schema.`);\n    }\n    return entity;\n}\n\nclass SchemaPermissions<S extends PermissionSchemaConfig> {\n    private readonly entityMap: Map<string, EntityLookup>;\n    private readonly fullAccessName: string;\n    private readonly identityContext: IdentityContext.Interface;\n\n    constructor(schema: S, identityContext: IdentityContext.Interface) {\n        this.entityMap = buildEntityMap(schema);\n        this.fullAccessName = `${schema.prefix}.*`;\n        this.identityContext = identityContext;\n    }\n\n    async canAccess(entityId: string, item?: OwnableItem): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        // No item — just check entity-level access.\n        if (item === undefined) {\n            return true;\n        }\n        // Item provided — if all permissions require own, verify ownership.\n        const ownOnly = !permissions.some(p => !p.own);\n        if (!ownOnly) {\n            return true;\n        }\n        const identity = this.identityContext.getIdentity();\n        return item.createdBy?.id === identity.id;\n    }\n\n    async onlyOwnRecords(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return false;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return false;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return !permissions.some(p => !p.own);\n    }\n\n    async canRead(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"r\");\n        });\n    }\n\n    async canCreate(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"w\");\n        });\n    }\n\n    async canEdit(entityId: string, item?: OwnableItem): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        const identity = this.identityContext.getIdentity();\n        return permissions.some(permission => {\n            if (permission.own) {\n                // No item provided (new/unsaved) — allow access.\n                if (!item?.createdBy) {\n                    return true;\n                }\n                return item.createdBy.id === identity.id;\n            }\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"w\");\n        });\n    }\n\n    async canDelete(entityId: string, item?: OwnableItem): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        const identity = this.identityContext.getIdentity();\n        return permissions.some(permission => {\n            if (permission.own) {\n                return item?.createdBy?.id === identity.id;\n            }\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"d\");\n        });\n    }\n\n    async canPublish(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission.pw?.includes(\"p\");\n        });\n    }\n\n    async canUnpublish(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission.pw?.includes(\"u\");\n        });\n    }\n\n    async canAction(action: string, entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission[action] === true;\n        });\n    }\n\n    private async getEntityPermissions(entityPermission: string): Promise<any[]> {\n        const permissions = await this.identityContext.getPermissions(entityPermission);\n        if (permissions.length) {\n            return permissions;\n        }\n        // Fall back to the schema wildcard (e.g. \"test.*\") — its flags apply to all entities.\n        const wildcard = await this.identityContext.getPermission(this.fullAccessName);\n        return wildcard ? [wildcard] : [];\n    }\n\n    private async hasFullSchemaAccess(): Promise<boolean> {\n        const permission = await this.identityContext.getPermission(this.fullAccessName);\n        if (!permission) {\n            return false;\n        }\n        // Only treat as full access if the permission has no `rwd` flag.\n        // A permission like { name: \"wb.*\", rwd: \"r\" } should NOT grant full access.\n        const keys = Object.keys(permission).filter(k => k !== \"name\");\n\n        const hasRwd = keys.includes(\"rwd\");\n\n        // It's full-access only if there's no `rwd` flag.\n        return !hasRwd;\n    }\n}\n\nexport function createPermissionsAbstraction<const S extends PermissionSchemaConfig>(schema: S) {\n    return createAbstraction<Permissions<S>>(`${schema.prefix}:Permissions`);\n}\n\nexport function createPermissionsFeature<const S extends PermissionSchemaConfig>(\n    schema: S,\n    abstraction: Abstraction<Permissions<S>>\n) {\n    class PermissionsImpl extends SchemaPermissions<S> {\n        constructor(identityContext: IdentityContext.Interface) {\n            super(schema, identityContext);\n        }\n    }\n\n    const Implementation = abstraction.createImplementation({\n        implementation: PermissionsImpl,\n        dependencies: [IdentityContext]\n    } as any);\n\n    return createFeature({\n        name: `${schema.prefix}:Permissions`,\n        register(container) {\n            container.register(Implementation);\n        }\n    });\n}\n"],"mappings":"AAAA,SAASA,iBAAiB,QAAQ,qBAAqB;AACvD,SAASC,aAAa,QAAQ,qBAAqB;AACnD,SAASC,eAAe;AAYxB,SAASC,cAAcA,CAACC,MAA8B,EAA6B;EAC/E,MAAMC,GAAG,GAAG,IAAIC,GAAG,CAAuB,CAAC;EAC3C,KAAK,MAAMC,MAAM,IAAIH,MAAM,CAACI,QAAQ,IAAI,EAAE,EAAE;IACxC,MAAMC,OAAO,GAAG,IAAIC,GAAG,CAAS,CAAC;IACjC,KAAK,MAAMC,MAAM,IAAIJ,MAAM,CAACE,OAAO,IAAI,EAAE,EAAE;MACvCA,OAAO,CAACG,GAAG,CAACD,MAAM,CAACE,IAAI,CAAC;IAC5B;IACAR,GAAG,CAACS,GAAG,CAACP,MAAM,CAACQ,EAAE,EAAE;MACfC,UAAU,EAAET,MAAM,CAACS,UAAU;MAC7BP,OAAO;MACPQ,MAAM,EAAEV,MAAM,CAACW,MAAM,CAACC,QAAQ,CAAC,KAAK;IACxC,CAAC,CAAC;EACN;EACA,OAAOd,GAAG;AACd;AAEA,SAASe,SAASA,CAACC,SAAoC,EAAEC,QAAgB,EAAgB;EACrF,MAAMf,MAAM,GAAGc,SAAS,CAACE,GAAG,CAACD,QAAQ,CAAC;EACtC,IAAI,CAACf,MAAM,EAAE;IACT,MAAM,IAAIiB,KAAK,CAAC,mBAAmBF,QAAQ,yBAAyB,CAAC;EACzE;EACA,OAAOf,MAAM;AACjB;AAEA,MAAMkB,iBAAiB,CAAmC;EAKtDC,WAAWA,CAACtB,MAAS,EAAEuB,eAA0C,EAAE;IAC/D,IAAI,CAACN,SAAS,GAAGlB,cAAc,CAACC,MAAM,CAAC;IACvC,IAAI,CAACwB,cAAc,GAAG,GAAGxB,MAAM,CAACyB,MAAM,IAAI;IAC1C,IAAI,CAACF,eAAe,GAAGA,eAAe;EAC1C;EAEA,MAAMG,SAASA,CAACR,QAAgB,EAAES,IAAkB,EAAoB;IACpE,IAAI,MAAM,IAAI,CAACJ,eAAe,CAACK,aAAa,CAAC,CAAC,EAAE;MAC5C,OAAO,IAAI;IACf;IACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;MAClC,OAAO,IAAI;IACf;IACA,MAAM1B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMY,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC5B,MAAM,CAACS,UAAU,CAAC;IACtE,IAAI,CAACkB,WAAW,CAACE,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA;IACA,IAAIL,IAAI,KAAKM,SAAS,EAAE;MACpB,OAAO,IAAI;IACf;IACA;IACA,MAAMC,OAAO,GAAG,CAACJ,WAAW,CAACK,IAAI,CAACC,CAAC,IAAI,CAACA,CAAC,CAACC,GAAG,CAAC;IAC9C,IAAI,CAACH,OAAO,EAAE;MACV,OAAO,IAAI;IACf;IACA,MAAMI,QAAQ,GAAG,IAAI,CAACf,eAAe,CAACgB,WAAW,CAAC,CAAC;IACnD,OAAOZ,IAAI,CAACa,SAAS,EAAE7B,EAAE,KAAK2B,QAAQ,CAAC3B,EAAE;EAC7C;EAEA,MAAM8B,cAAcA,CAACvB,QAAgB,EAAoB;IACrD,IAAI,MAAM,IAAI,CAACK,eAAe,CAACK,aAAa,CAAC,CAAC,EAAE;MAC5C,OAAO,KAAK;IAChB;IACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;MAClC,OAAO,KAAK;IAChB;IACA,MAAM1B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMY,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC5B,MAAM,CAACS,UAAU,CAAC;IACtE,IAAI,CAACkB,WAAW,CAACE,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAO,CAACF,WAAW,CAACK,IAAI,CAACC,CAAC,IAAI,CAACA,CAAC,CAACC,GAAG,CAAC;EACzC;EAEA,MAAMK,OAAOA,CAACxB,QAAgB,EAAoB;IAC9C,IAAI,MAAM,IAAI,CAACK,eAAe,CAACK,aAAa,CAAC,CAAC,EAAE;MAC5C,OAAO,IAAI;IACf;IACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;MAClC,OAAO,IAAI;IACf;IACA,MAAM1B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMY,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC5B,MAAM,CAACS,UAAU,CAAC;IACtE,IAAI,CAACkB,WAAW,CAACE,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAOF,WAAW,CAACK,IAAI,CAACvB,UAAU,IAAI;MAClC,IAAI,OAAOA,UAAU,CAAC+B,GAAG,KAAK,QAAQ,EAAE;QACpC,OAAO,IAAI;MACf;MACA,OAAO/B,UAAU,CAAC+B,GAAG,CAAC5B,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN;EAEA,MAAM6B,SAASA,CAAC1B,QAAgB,EAAoB;IAChD,IAAI,MAAM,IAAI,CAACK,eAAe,CAACK,aAAa,CAAC,CAAC,EAAE;MAC5C,OAAO,IAAI;IACf;IACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;MAClC,OAAO,IAAI;IACf;IACA,MAAM1B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMY,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC5B,MAAM,CAACS,UAAU,CAAC;IACtE,IAAI,CAACkB,WAAW,CAACE,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAOF,WAAW,CAACK,IAAI,CAACvB,UAAU,IAAI;MAClC,IAAI,OAAOA,UAAU,CAAC+B,GAAG,KAAK,QAAQ,EAAE;QACpC,OAAO,IAAI;MACf;MACA,OAAO/B,UAAU,CAAC+B,GAAG,CAAC5B,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN;EAEA,MAAM8B,OAAOA,CAAC3B,QAAgB,EAAES,IAAkB,EAAoB;IAClE,IAAI,MAAM,IAAI,CAACJ,eAAe,CAACK,aAAa,CAAC,CAAC,EAAE;MAC5C,OAAO,IAAI;IACf;IACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;MAClC,OAAO,IAAI;IACf;IACA,MAAM1B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMY,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC5B,MAAM,CAACS,UAAU,CAAC;IACtE,IAAI,CAACkB,WAAW,CAACE,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,MAAMM,QAAQ,GAAG,IAAI,CAACf,eAAe,CAACgB,WAAW,CAAC,CAAC;IACnD,OAAOT,WAAW,CAACK,IAAI,CAACvB,UAAU,IAAI;MAClC,IAAIA,UAAU,CAACyB,GAAG,EAAE;QAChB;QACA,IAAI,CAACV,IAAI,EAAEa,SAAS,EAAE;UAClB,OAAO,IAAI;QACf;QACA,OAAOb,IAAI,CAACa,SAAS,CAAC7B,EAAE,KAAK2B,QAAQ,CAAC3B,EAAE;MAC5C;MACA,IAAI,OAAOC,UAAU,CAAC+B,GAAG,KAAK,QAAQ,EAAE;QACpC,OAAO,IAAI;MACf;MACA,OAAO/B,UAAU,CAAC+B,GAAG,CAAC5B,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN;EAEA,MAAM+B,SAASA,CAAC5B,QAAgB,EAAES,IAAkB,EAAoB;IACpE,IAAI,MAAM,IAAI,CAACJ,eAAe,CAACK,aAAa,CAAC,CAAC,EAAE;MAC5C,OAAO,IAAI;IACf;IACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;MAClC,OAAO,IAAI;IACf;IACA,MAAM1B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMY,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC5B,MAAM,CAACS,UAAU,CAAC;IACtE,IAAI,CAACkB,WAAW,CAACE,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,MAAMM,QAAQ,GAAG,IAAI,CAACf,eAAe,CAACgB,WAAW,CAAC,CAAC;IACnD,OAAOT,WAAW,CAACK,IAAI,CAACvB,UAAU,IAAI;MAClC,IAAIA,UAAU,CAACyB,GAAG,EAAE;QAChB,OAAOV,IAAI,EAAEa,SAAS,EAAE7B,EAAE,KAAK2B,QAAQ,CAAC3B,EAAE;MAC9C;MACA,IAAI,OAAOC,UAAU,CAAC+B,GAAG,KAAK,QAAQ,EAAE;QACpC,OAAO,IAAI;MACf;MACA,OAAO/B,UAAU,CAAC+B,GAAG,CAAC5B,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN;EAEA,MAAMgC,UAAUA,CAAC7B,QAAgB,EAAoB;IACjD,IAAI,MAAM,IAAI,CAACK,eAAe,CAACK,aAAa,CAAC,CAAC,EAAE;MAC5C,OAAO,IAAI;IACf;IACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;MAClC,OAAO,IAAI;IACf;IACA,MAAM1B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMY,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC5B,MAAM,CAACS,UAAU,CAAC;IACtE,IAAI,CAACkB,WAAW,CAACE,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAOF,WAAW,CAACK,IAAI,CAACvB,UAAU,IAAI;MAClC,OAAOA,UAAU,CAACoC,EAAE,EAAEjC,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN;EAEA,MAAMkC,YAAYA,CAAC/B,QAAgB,EAAoB;IACnD,IAAI,MAAM,IAAI,CAACK,eAAe,CAACK,aAAa,CAAC,CAAC,EAAE;MAC5C,OAAO,IAAI;IACf;IACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;MAClC,OAAO,IAAI;IACf;IACA,MAAM1B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMY,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC5B,MAAM,CAACS,UAAU,CAAC;IACtE,IAAI,CAACkB,WAAW,CAACE,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAOF,WAAW,CAACK,IAAI,CAACvB,UAAU,IAAI;MAClC,OAAOA,UAAU,CAACoC,EAAE,EAAEjC,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN;EAEA,MAAMmC,SAASA,CAAC3C,MAAc,EAAEW,QAAgB,EAAoB;IAChE,IAAI,MAAM,IAAI,CAACK,eAAe,CAACK,aAAa,CAAC,CAAC,EAAE;MAC5C,OAAO,IAAI;IACf;IACA,IAAI,MAAM,IAAI,CAACC,mBAAmB,CAAC,CAAC,EAAE;MAClC,OAAO,IAAI;IACf;IACA,MAAM1B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMY,WAAW,GAAG,MAAM,IAAI,CAACC,oBAAoB,CAAC5B,MAAM,CAACS,UAAU,CAAC;IACtE,IAAI,CAACkB,WAAW,CAACE,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAOF,WAAW,CAACK,IAAI,CAACvB,UAAU,IAAI;MAClC,OAAOA,UAAU,CAACL,MAAM,CAAC,KAAK,IAAI;IACtC,CAAC,CAAC;EACN;EAEA,MAAcwB,oBAAoBA,CAACoB,gBAAwB,EAAkB;IACzE,MAAMrB,WAAW,GAAG,MAAM,IAAI,CAACP,eAAe,CAAC6B,cAAc,CAACD,gBAAgB,CAAC;IAC/E,IAAIrB,WAAW,CAACE,MAAM,EAAE;MACpB,OAAOF,WAAW;IACtB;IACA;IACA,MAAMuB,QAAQ,GAAG,MAAM,IAAI,CAAC9B,eAAe,CAAC+B,aAAa,CAAC,IAAI,CAAC9B,cAAc,CAAC;IAC9E,OAAO6B,QAAQ,GAAG,CAACA,QAAQ,CAAC,GAAG,EAAE;EACrC;EAEA,MAAcxB,mBAAmBA,CAAA,EAAqB;IAClD,MAAMjB,UAAU,GAAG,MAAM,IAAI,CAACW,eAAe,CAAC+B,aAAa,CAAC,IAAI,CAAC9B,cAAc,CAAC;IAChF,IAAI,CAACZ,UAAU,EAAE;MACb,OAAO,KAAK;IAChB;IACA;IACA;IACA,MAAM2C,IAAI,GAAGC,MAAM,CAACD,IAAI,CAAC3C,UAAU,CAAC,CAAC6C,MAAM,CAACC,CAAC,IAAIA,CAAC,KAAK,MAAM,CAAC;IAE9D,MAAMC,MAAM,GAAGJ,IAAI,CAACxC,QAAQ,CAAC,KAAK,CAAC;;IAEnC;IACA,OAAO,CAAC4C,MAAM;EAClB;AACJ;AAEA,OAAO,SAASC,4BAA4BA,CAAyC5D,MAAS,EAAE;EAC5F,OAAOJ,iBAAiB,CAAiB,GAAGI,MAAM,CAACyB,MAAM,cAAc,CAAC;AAC5E;AAEA,OAAO,SAASoC,wBAAwBA,CACpC7D,MAAS,EACT8D,WAAwC,EAC1C;EACE,MAAMC,eAAe,SAAS1C,iBAAiB,CAAI;IAC/CC,WAAWA,CAACC,eAA0C,EAAE;MACpD,KAAK,CAACvB,MAAM,EAAEuB,eAAe,CAAC;IAClC;EACJ;EAEA,MAAMyC,cAAc,GAAGF,WAAW,CAACG,oBAAoB,CAAC;IACpDC,cAAc,EAAEH,eAAe;IAC/BI,YAAY,EAAE,CAACrE,eAAe;EAClC,CAAQ,CAAC;EAET,OAAOD,aAAa,CAAC;IACjBY,IAAI,EAAE,GAAGT,MAAM,CAACyB,MAAM,cAAc;IACpC2C,QAAQA,CAACC,SAAS,EAAE;MAChBA,SAAS,CAACD,QAAQ,CAACJ,cAAc,CAAC;IACtC;EACJ,CAAC,CAAC;AACN","ignoreList":[]}
+{"version":3,"file":"features/security/permissions/createPermissions.js","sources":["../../../../src/features/security/permissions/createPermissions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport { createFeature } from \"@webiny/feature/api\";\nimport { IdentityContext } from \"~/features/security/IdentityContext/index.js\";\nimport type { Abstraction } from \"@webiny/di\";\nimport type { PermissionSchemaConfig } from \"./types.js\";\nimport type { OwnableItem } from \"./types.js\";\nimport type { Permissions } from \"./types.js\";\n\ninterface EntityLookup {\n    permission: string;\n    actions: Set<string>;\n    hasOwn: boolean;\n}\n\nfunction buildEntityMap(schema: PermissionSchemaConfig): Map<string, EntityLookup> {\n    const map = new Map<string, EntityLookup>();\n    for (const entity of schema.entities ?? []) {\n        const actions = new Set<string>();\n        for (const action of entity.actions ?? []) {\n            actions.add(action.name);\n        }\n        map.set(entity.id, {\n            permission: entity.permission,\n            actions,\n            hasOwn: entity.scopes.includes(\"own\")\n        });\n    }\n    return map;\n}\n\nfunction getEntity(entityMap: Map<string, EntityLookup>, entityId: string): EntityLookup {\n    const entity = entityMap.get(entityId);\n    if (!entity) {\n        throw new Error(`Unknown entity \"${entityId}\" in permission schema.`);\n    }\n    return entity;\n}\n\nclass SchemaPermissions<S extends PermissionSchemaConfig> {\n    private readonly entityMap: Map<string, EntityLookup>;\n    private readonly fullAccessName: string;\n    private readonly identityContext: IdentityContext.Interface;\n\n    constructor(schema: S, identityContext: IdentityContext.Interface) {\n        this.entityMap = buildEntityMap(schema);\n        this.fullAccessName = `${schema.prefix}.*`;\n        this.identityContext = identityContext;\n    }\n\n    async canAccess(entityId: string, item?: OwnableItem): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        // No item — just check entity-level access.\n        if (item === undefined) {\n            return true;\n        }\n        // Item provided — if all permissions require own, verify ownership.\n        const ownOnly = !permissions.some(p => !p.own);\n        if (!ownOnly) {\n            return true;\n        }\n        const identity = this.identityContext.getIdentity();\n        return item.createdBy?.id === identity.id;\n    }\n\n    async onlyOwnRecords(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return false;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return false;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return !permissions.some(p => !p.own);\n    }\n\n    async canRead(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"r\");\n        });\n    }\n\n    async canCreate(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"w\");\n        });\n    }\n\n    async canEdit(entityId: string, item?: OwnableItem): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        const identity = this.identityContext.getIdentity();\n        return permissions.some(permission => {\n            if (permission.own) {\n                // No item provided (new/unsaved) — allow access.\n                if (!item?.createdBy) {\n                    return true;\n                }\n                return item.createdBy.id === identity.id;\n            }\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"w\");\n        });\n    }\n\n    async canDelete(entityId: string, item?: OwnableItem): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        const identity = this.identityContext.getIdentity();\n        return permissions.some(permission => {\n            if (permission.own) {\n                return item?.createdBy?.id === identity.id;\n            }\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"d\");\n        });\n    }\n\n    async canPublish(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission.pw?.includes(\"p\");\n        });\n    }\n\n    async canUnpublish(entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission.pw?.includes(\"u\");\n        });\n    }\n\n    async canAction(action: string, entityId: string): Promise<boolean> {\n        if (await this.identityContext.hasFullAccess()) {\n            return true;\n        }\n        if (await this.hasFullSchemaAccess()) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = await this.getEntityPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission[action] === true;\n        });\n    }\n\n    private async getEntityPermissions(entityPermission: string): Promise<any[]> {\n        const permissions = await this.identityContext.getPermissions(entityPermission);\n        if (permissions.length) {\n            return permissions;\n        }\n        // Fall back to the schema wildcard (e.g. \"test.*\") — its flags apply to all entities.\n        const wildcard = await this.identityContext.getPermission(this.fullAccessName);\n        return wildcard ? [wildcard] : [];\n    }\n\n    private async hasFullSchemaAccess(): Promise<boolean> {\n        const permission = await this.identityContext.getPermission(this.fullAccessName);\n        if (!permission) {\n            return false;\n        }\n        // Only treat as full access if the permission has no `rwd` flag.\n        // A permission like { name: \"wb.*\", rwd: \"r\" } should NOT grant full access.\n        const keys = Object.keys(permission).filter(k => k !== \"name\");\n\n        const hasRwd = keys.includes(\"rwd\");\n\n        // It's full-access only if there's no `rwd` flag.\n        return !hasRwd;\n    }\n}\n\nexport function createPermissionsAbstraction<const S extends PermissionSchemaConfig>(schema: S) {\n    return createAbstraction<Permissions<S>>(`${schema.prefix}:Permissions`);\n}\n\nexport function createPermissionsFeature<const S extends PermissionSchemaConfig>(\n    schema: S,\n    abstraction: Abstraction<Permissions<S>>\n) {\n    class PermissionsImpl extends SchemaPermissions<S> {\n        constructor(identityContext: IdentityContext.Interface) {\n            super(schema, identityContext);\n        }\n    }\n\n    const Implementation = abstraction.createImplementation({\n        implementation: PermissionsImpl,\n        dependencies: [IdentityContext]\n    } as any);\n\n    return createFeature({\n        name: `${schema.prefix}:Permissions`,\n        register(container) {\n            container.register(Implementation);\n        }\n    });\n}\n"],"names":["buildEntityMap","schema","map","Map","entity","actions","Set","action","getEntity","entityMap","entityId","Error","SchemaPermissions","identityContext","item","permissions","undefined","ownOnly","p","identity","permission","entityPermission","wildcard","keys","Object","k","hasRwd","createPermissionsAbstraction","createAbstraction","createPermissionsFeature","abstraction","PermissionsImpl","Implementation","IdentityContext","createFeature","container"],"mappings":";;AAcA,SAASA,eAAeC,MAA8B;IAClD,MAAMC,MAAM,IAAIC;IAChB,KAAK,MAAMC,UAAUH,OAAO,QAAQ,IAAI,EAAE,CAAE;QACxC,MAAMI,UAAU,IAAIC;QACpB,KAAK,MAAMC,UAAUH,OAAO,OAAO,IAAI,EAAE,CACrCC,QAAQ,GAAG,CAACE,OAAO,IAAI;QAE3BL,IAAI,GAAG,CAACE,OAAO,EAAE,EAAE;YACf,YAAYA,OAAO,UAAU;YAC7BC;YACA,QAAQD,OAAO,MAAM,CAAC,QAAQ,CAAC;QACnC;IACJ;IACA,OAAOF;AACX;AAEA,SAASM,UAAUC,SAAoC,EAAEC,QAAgB;IACrE,MAAMN,SAASK,UAAU,GAAG,CAACC;IAC7B,IAAI,CAACN,QACD,MAAM,IAAIO,MAAM,CAAC,gBAAgB,EAAED,SAAS,uBAAuB,CAAC;IAExE,OAAON;AACX;AAEA,MAAMQ;IAKF,YAAYX,MAAS,EAAEY,eAA0C,CAAE;QAC/D,IAAI,CAAC,SAAS,GAAGb,eAAeC;QAChC,IAAI,CAAC,cAAc,GAAG,GAAGA,OAAO,MAAM,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,eAAe,GAAGY;IAC3B;IAEA,MAAM,UAAUH,QAAgB,EAAEI,IAAkB,EAAoB;QACpE,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMV,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAGX,IAAID,AAASE,WAATF,MACA,OAAO;QAGX,MAAMG,UAAU,CAACF,YAAY,IAAI,CAACG,CAAAA,IAAK,CAACA,EAAE,GAAG;QAC7C,IAAI,CAACD,SACD,OAAO;QAEX,MAAME,WAAW,IAAI,CAAC,eAAe,CAAC,WAAW;QACjD,OAAOL,KAAK,SAAS,EAAE,OAAOK,SAAS,EAAE;IAC7C;IAEA,MAAM,eAAeT,QAAgB,EAAoB;QACrD,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,OAAO,CAACA,YAAY,IAAI,CAACG,CAAAA,IAAK,CAACA,EAAE,GAAG;IACxC;IAEA,MAAM,QAAQR,QAAgB,EAAoB;QAC9C,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,OAAOA,YAAY,IAAI,CAACK,CAAAA;YACpB,IAAI,AAA0B,YAA1B,OAAOA,WAAW,GAAG,EACrB,OAAO;YAEX,OAAOA,WAAW,GAAG,CAAC,QAAQ,CAAC;QACnC;IACJ;IAEA,MAAM,UAAUV,QAAgB,EAAoB;QAChD,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,OAAOA,YAAY,IAAI,CAACK,CAAAA;YACpB,IAAI,AAA0B,YAA1B,OAAOA,WAAW,GAAG,EACrB,OAAO;YAEX,OAAOA,WAAW,GAAG,CAAC,QAAQ,CAAC;QACnC;IACJ;IAEA,MAAM,QAAQV,QAAgB,EAAEI,IAAkB,EAAoB;QAClE,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMV,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,MAAMI,WAAW,IAAI,CAAC,eAAe,CAAC,WAAW;QACjD,OAAOJ,YAAY,IAAI,CAACK,CAAAA;YACpB,IAAIA,WAAW,GAAG,EAAE;gBAEhB,IAAI,CAACN,MAAM,WACP,OAAO;gBAEX,OAAOA,KAAK,SAAS,CAAC,EAAE,KAAKK,SAAS,EAAE;YAC5C;YACA,IAAI,AAA0B,YAA1B,OAAOC,WAAW,GAAG,EACrB,OAAO;YAEX,OAAOA,WAAW,GAAG,CAAC,QAAQ,CAAC;QACnC;IACJ;IAEA,MAAM,UAAUV,QAAgB,EAAEI,IAAkB,EAAoB;QACpE,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMV,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,MAAMI,WAAW,IAAI,CAAC,eAAe,CAAC,WAAW;QACjD,OAAOJ,YAAY,IAAI,CAACK,CAAAA;YACpB,IAAIA,WAAW,GAAG,EACd,OAAON,MAAM,WAAW,OAAOK,SAAS,EAAE;YAE9C,IAAI,AAA0B,YAA1B,OAAOC,WAAW,GAAG,EACrB,OAAO;YAEX,OAAOA,WAAW,GAAG,CAAC,QAAQ,CAAC;QACnC;IACJ;IAEA,MAAM,WAAWV,QAAgB,EAAoB;QACjD,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,OAAOA,YAAY,IAAI,CAACK,CAAAA,aACbA,WAAW,EAAE,EAAE,SAAS;IAEvC;IAEA,MAAM,aAAaV,QAAgB,EAAoB;QACnD,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,OAAOA,YAAY,IAAI,CAACK,CAAAA,aACbA,WAAW,EAAE,EAAE,SAAS;IAEvC;IAEA,MAAM,UAAUb,MAAc,EAAEG,QAAgB,EAAoB;QAChE,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,IACxC,OAAO;QAEX,IAAI,MAAM,IAAI,CAAC,mBAAmB,IAC9B,OAAO;QAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;QACzC,MAAMK,cAAc,MAAM,IAAI,CAAC,oBAAoB,CAACX,OAAO,UAAU;QACrE,IAAI,CAACW,YAAY,MAAM,EACnB,OAAO;QAEX,OAAOA,YAAY,IAAI,CAACK,CAAAA,aACbA,AAAuB,SAAvBA,UAAU,CAACb,OAAO;IAEjC;IAEA,MAAc,qBAAqBc,gBAAwB,EAAkB;QACzE,MAAMN,cAAc,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CAACM;QAC9D,IAAIN,YAAY,MAAM,EAClB,OAAOA;QAGX,MAAMO,WAAW,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc;QAC7E,OAAOA,WAAW;YAACA;SAAS,GAAG,EAAE;IACrC;IAEA,MAAc,sBAAwC;QAClD,MAAMF,aAAa,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc;QAC/E,IAAI,CAACA,YACD,OAAO;QAIX,MAAMG,OAAOC,OAAO,IAAI,CAACJ,YAAY,MAAM,CAACK,CAAAA,IAAKA,AAAM,WAANA;QAEjD,MAAMC,SAASH,KAAK,QAAQ,CAAC;QAG7B,OAAO,CAACG;IACZ;AACJ;AAEO,SAASC,6BAAqE1B,MAAS;IAC1F,OAAO2B,kBAAkC,GAAG3B,OAAO,MAAM,CAAC,YAAY,CAAC;AAC3E;AAEO,SAAS4B,yBACZ5B,MAAS,EACT6B,WAAwC;IAExC,MAAMC,wBAAwBnB;QAC1B,YAAYC,eAA0C,CAAE;YACpD,KAAK,CAACZ,QAAQY;QAClB;IACJ;IAEA,MAAMmB,iBAAiBF,YAAY,oBAAoB,CAAC;QACpD,gBAAgBC;QAChB,cAAc;YAACE;SAAgB;IACnC;IAEA,OAAOC,cAAc;QACjB,MAAM,GAAGjC,OAAO,MAAM,CAAC,YAAY,CAAC;QACpC,UAASkC,SAAS;YACdA,UAAU,QAAQ,CAACH;QACvB;IACJ;AACJ"}

package/features/security/permissions/index.js

@@ -1,4 +1,2 @@
 export { createPermissionSchema } from "./createPermissionSchema.js";
 export { createPermissionsAbstraction, createPermissionsFeature } from "./createPermissions.js";
-
-//# sourceMappingURL=index.js.map

package/features/security/permissions/types.js

@@ -1,3 +0,0 @@
-export {};
-
-//# sourceMappingURL=types.js.map