@webiny/api-core 6.4.11 → 6.6.0-alpha.1

package/features/security/apiKeys/shared/ApiKeysRepository.js

@@ -8,6 +8,7 @@ class ApiKeysRepositoryImpl {
         this.tenantContext = tenantContext;
         this.storageOperations = storageOperations;
         this.apiKeyProvider = apiKeyProvider;
+        this.resolving = false;
     }
     async get(id) {
         try {
@@ -30,8 +31,15 @@ class ApiKeysRepositoryImpl {
                 tenant: tenant.id
             });
             if (apiKey) return Result.ok(apiKey);
-            const factoryApiKey = await this.apiKeyProvider.getByToken(token);
-            if (factoryApiKey) return Result.ok(factoryApiKey);
+            if (!this.resolving) {
+                this.resolving = true;
+                try {
+                    const factoryApiKey = await this.apiKeyProvider.getByToken(token);
+                    if (factoryApiKey) return Result.ok(factoryApiKey);
+                } finally{
+                    this.resolving = false;
+                }
+            }
             return Result.fail(new ApiKeyNotFoundError());
         } catch (error) {
             return Result.fail(new ApiKeyPersistenceError(error));
@@ -45,8 +53,15 @@ class ApiKeysRepositoryImpl {
                 tenant: tenant.id
             });
             if (apiKey) return Result.ok(apiKey);
-            const factoryApiKey = await this.apiKeyProvider.getBySlug(slug);
-            if (factoryApiKey) return Result.ok(factoryApiKey);
+            if (!this.resolving) {
+                this.resolving = true;
+                try {
+                    const factoryApiKey = await this.apiKeyProvider.getBySlug(slug);
+                    if (factoryApiKey) return Result.ok(factoryApiKey);
+                } finally{
+                    this.resolving = false;
+                }
+            }
             return Result.fail(new ApiKeyNotFoundError());
         } catch (error) {
             return Result.fail(new ApiKeyPersistenceError(error));

package/features/security/apiKeys/shared/ApiKeysRepository.js.map

@@ -1 +1 @@
-{"version":3,"file":"features/security/apiKeys/shared/ApiKeysRepository.js","sources":["../../../../../src/features/security/apiKeys/shared/ApiKeysRepository.ts"],"sourcesContent":["import { createImplementation } from \"@webiny/feature/api\";\nimport { Result } from \"@webiny/feature/api\";\nimport { ApiKeysRepository as RepositoryAbstraction } from \"./abstractions.js\";\nimport { ApiKeyProvider } from \"./abstractions.js\";\nimport type { ApiKey, ListApiKeysInput } from \"./types.js\";\nimport { SecurityStorageOperations } from \"~/features/security/shared/abstractions.js\";\nimport { TenantContext } from \"~/features/tenancy/TenantContext/index.js\";\nimport { ApiKeyNotFoundError, ApiKeyPersistenceError, ApiKeyValidationError } from \"./errors.js\";\n\n// TODO: create an ApiKeyMapper\n\nclass ApiKeysRepositoryImpl implements RepositoryAbstraction.Interface {\n    constructor(\n        private tenantContext: TenantContext.Interface,\n        private storageOperations: SecurityStorageOperations.Interface,\n        private apiKeyProvider: ApiKeyProvider.Interface\n    ) {}\n\n    async get(id: string): Promise<Result<ApiKey, RepositoryAbstraction.Error>> {\n        try {\n            const tenant = this.tenantContext.getTenant();\n            const apiKey = await this.storageOperations.getApiKey({ id, tenant: tenant.id });\n            if (apiKey) {\n                return Result.ok(apiKey);\n            }\n\n            return Result.fail(new ApiKeyNotFoundError());\n        } catch (error) {\n            return Result.fail(error);\n        }\n    }\n\n    async getByToken(token: string): Promise<Result<ApiKey, RepositoryAbstraction.Error>> {\n        try {\n            // First, check the database (database keys have priority over factory keys)\n            const tenant = this.tenantContext.getTenant();\n            const apiKey = await this.storageOperations.getApiKeyByToken({\n                token,\n                tenant: tenant.id\n            });\n\n            if (apiKey) {\n                return Result.ok(apiKey);\n            }\n\n            // If not found in database, check if the API key is provided by a factory\n            const factoryApiKey = await this.apiKeyProvider.getByToken(token);\n            if (factoryApiKey) {\n                return Result.ok(factoryApiKey);\n            }\n\n            return Result.fail(new ApiKeyNotFoundError());\n        } catch (error) {\n            return Result.fail(new ApiKeyPersistenceError(error));\n        }\n    }\n\n    async getBySlug(slug: string): Promise<Result<ApiKey, RepositoryAbstraction.Error>> {\n        try {\n            // First, check the database (database keys have priority over factory keys)\n            const tenant = this.tenantContext.getTenant();\n            const apiKey = await this.storageOperations.getApiKeyBySlug({\n                slug,\n                tenant: tenant.id\n            });\n\n            if (apiKey) {\n                return Result.ok(apiKey);\n            }\n\n            // If not found in database, check if the API key is provided by a factory\n            const factoryApiKey = await this.apiKeyProvider.getBySlug(slug);\n            if (factoryApiKey) {\n                return Result.ok(factoryApiKey);\n            }\n\n            return Result.fail(new ApiKeyNotFoundError());\n        } catch (error) {\n            return Result.fail(new ApiKeyPersistenceError(error));\n        }\n    }\n\n    async list(params: ListApiKeysInput): Promise<Result<ApiKey[], RepositoryAbstraction.Error>> {\n        try {\n            const tenant = this.tenantContext.getTenant();\n            const result = await this.storageOperations.listApiKeys({\n                where: { tenant: tenant.id },\n                ...params\n            });\n            return Result.ok(result);\n        } catch (error) {\n            return Result.fail(new ApiKeyPersistenceError(error));\n        }\n    }\n\n    async create(apiKey: ApiKey): Promise<Result<void, RepositoryAbstraction.Error>> {\n        try {\n            // Check if an API key with the same slug already exists\n            const existingKeyResult = await this.getBySlug(apiKey.slug);\n\n            // If we found a key, it's a duplicate slug - return validation error\n            if (existingKeyResult.isOk()) {\n                return Result.fail(\n                    new ApiKeyValidationError(`API key with slug \"${apiKey.slug}\" already exists.`)\n                );\n            }\n\n            // \"NotFound\" error is ok. Everything else is not ok.\n            if (existingKeyResult.error.code !== \"ApiKey/NotFound\") {\n                return Result.fail(existingKeyResult.error);\n            }\n\n            // Slug is unique, proceed with creation\n            const tenant = this.tenantContext.getTenant();\n            await this.storageOperations.createApiKey({ apiKey: { ...apiKey, tenant: tenant.id } });\n            return Result.ok();\n        } catch (error) {\n            return Result.fail(new ApiKeyPersistenceError(error));\n        }\n    }\n\n    async update(apiKey: ApiKey): Promise<Result<void, RepositoryAbstraction.Error>> {\n        try {\n            const tenant = this.tenantContext.getTenant();\n            await this.storageOperations.updateApiKey({ apiKey: { ...apiKey, tenant: tenant.id } });\n\n            return Result.ok();\n        } catch (error) {\n            return Result.fail(new ApiKeyPersistenceError(error));\n        }\n    }\n\n    async delete(apiKey: ApiKey): Promise<Result<void, RepositoryAbstraction.Error>> {\n        try {\n            const tenant = this.tenantContext.getTenant();\n            await this.storageOperations.deleteApiKey({ apiKey: { ...apiKey, tenant: tenant.id } });\n\n            return Result.ok();\n        } catch (error) {\n            return Result.fail(new ApiKeyPersistenceError(error));\n        }\n    }\n}\n\nexport const ApiKeysRepository = createImplementation({\n    abstraction: RepositoryAbstraction,\n    implementation: ApiKeysRepositoryImpl,\n    dependencies: [TenantContext, SecurityStorageOperations, ApiKeyProvider]\n});\n"],"names":["ApiKeysRepositoryImpl","tenantContext","storageOperations","apiKeyProvider","id","tenant","apiKey","Result","ApiKeyNotFoundError","error","token","factoryApiKey","ApiKeyPersistenceError","slug","params","result","existingKeyResult","ApiKeyValidationError","ApiKeysRepository","createImplementation","RepositoryAbstraction","TenantContext","SecurityStorageOperations","ApiKeyProvider"],"mappings":";;;;;AAWA,MAAMA;IACF,YACYC,aAAsC,EACtCC,iBAAsD,EACtDC,cAAwC,CAClD;aAHUF,aAAa,GAAbA;aACAC,iBAAiB,GAAjBA;aACAC,cAAc,GAAdA;IACT;IAEH,MAAM,IAAIC,EAAU,EAAwD;QACxE,IAAI;YACA,MAAMC,SAAS,IAAI,CAAC,aAAa,CAAC,SAAS;YAC3C,MAAMC,SAAS,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC;gBAAEF;gBAAI,QAAQC,OAAO,EAAE;YAAC;YAC9E,IAAIC,QACA,OAAOC,OAAO,EAAE,CAACD;YAGrB,OAAOC,OAAO,IAAI,CAAC,IAAIC;QAC3B,EAAE,OAAOC,OAAO;YACZ,OAAOF,OAAO,IAAI,CAACE;QACvB;IACJ;IAEA,MAAM,WAAWC,KAAa,EAAwD;QAClF,IAAI;YAEA,MAAML,SAAS,IAAI,CAAC,aAAa,CAAC,SAAS;YAC3C,MAAMC,SAAS,MAAM,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC;gBACzDI;gBACA,QAAQL,OAAO,EAAE;YACrB;YAEA,IAAIC,QACA,OAAOC,OAAO,EAAE,CAACD;YAIrB,MAAMK,gBAAgB,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAACD;YAC3D,IAAIC,eACA,OAAOJ,OAAO,EAAE,CAACI;YAGrB,OAAOJ,OAAO,IAAI,CAAC,IAAIC;QAC3B,EAAE,OAAOC,OAAO;YACZ,OAAOF,OAAO,IAAI,CAAC,IAAIK,uBAAuBH;QAClD;IACJ;IAEA,MAAM,UAAUI,IAAY,EAAwD;QAChF,IAAI;YAEA,MAAMR,SAAS,IAAI,CAAC,aAAa,CAAC,SAAS;YAC3C,MAAMC,SAAS,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;gBACxDO;gBACA,QAAQR,OAAO,EAAE;YACrB;YAEA,IAAIC,QACA,OAAOC,OAAO,EAAE,CAACD;YAIrB,MAAMK,gBAAgB,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAACE;YAC1D,IAAIF,eACA,OAAOJ,OAAO,EAAE,CAACI;YAGrB,OAAOJ,OAAO,IAAI,CAAC,IAAIC;QAC3B,EAAE,OAAOC,OAAO;YACZ,OAAOF,OAAO,IAAI,CAAC,IAAIK,uBAAuBH;QAClD;IACJ;IAEA,MAAM,KAAKK,MAAwB,EAA0D;QACzF,IAAI;YACA,MAAMT,SAAS,IAAI,CAAC,aAAa,CAAC,SAAS;YAC3C,MAAMU,SAAS,MAAM,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC;gBACpD,OAAO;oBAAE,QAAQV,OAAO,EAAE;gBAAC;gBAC3B,GAAGS,MAAM;YACb;YACA,OAAOP,OAAO,EAAE,CAACQ;QACrB,EAAE,OAAON,OAAO;YACZ,OAAOF,OAAO,IAAI,CAAC,IAAIK,uBAAuBH;QAClD;IACJ;IAEA,MAAM,OAAOH,MAAc,EAAsD;QAC7E,IAAI;YAEA,MAAMU,oBAAoB,MAAM,IAAI,CAAC,SAAS,CAACV,OAAO,IAAI;YAG1D,IAAIU,kBAAkB,IAAI,IACtB,OAAOT,OAAO,IAAI,CACd,IAAIU,sBAAsB,CAAC,mBAAmB,EAAEX,OAAO,IAAI,CAAC,iBAAiB,CAAC;YAKtF,IAAIU,AAAiC,sBAAjCA,kBAAkB,KAAK,CAAC,IAAI,EAC5B,OAAOT,OAAO,IAAI,CAACS,kBAAkB,KAAK;YAI9C,MAAMX,SAAS,IAAI,CAAC,aAAa,CAAC,SAAS;YAC3C,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC;gBAAE,QAAQ;oBAAE,GAAGC,MAAM;oBAAE,QAAQD,OAAO,EAAE;gBAAC;YAAE;YACrF,OAAOE,OAAO,EAAE;QACpB,EAAE,OAAOE,OAAO;YACZ,OAAOF,OAAO,IAAI,CAAC,IAAIK,uBAAuBH;QAClD;IACJ;IAEA,MAAM,OAAOH,MAAc,EAAsD;QAC7E,IAAI;YACA,MAAMD,SAAS,IAAI,CAAC,aAAa,CAAC,SAAS;YAC3C,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC;gBAAE,QAAQ;oBAAE,GAAGC,MAAM;oBAAE,QAAQD,OAAO,EAAE;gBAAC;YAAE;YAErF,OAAOE,OAAO,EAAE;QACpB,EAAE,OAAOE,OAAO;YACZ,OAAOF,OAAO,IAAI,CAAC,IAAIK,uBAAuBH;QAClD;IACJ;IAEA,MAAM,OAAOH,MAAc,EAAsD;QAC7E,IAAI;YACA,MAAMD,SAAS,IAAI,CAAC,aAAa,CAAC,SAAS;YAC3C,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC;gBAAE,QAAQ;oBAAE,GAAGC,MAAM;oBAAE,QAAQD,OAAO,EAAE;gBAAC;YAAE;YAErF,OAAOE,OAAO,EAAE;QACpB,EAAE,OAAOE,OAAO;YACZ,OAAOF,OAAO,IAAI,CAAC,IAAIK,uBAAuBH;QAClD;IACJ;AACJ;AAEO,MAAMS,sCAAoBC,qBAAqB;IAClD,aAAaC;IACb,gBAAgBpB;IAChB,cAAc;QAACqB;QAAeC;QAA2BC;KAAe;AAC5E"}
+{"version":3,"file":"features/security/apiKeys/shared/ApiKeysRepository.js","sources":["../../../../../src/features/security/apiKeys/shared/ApiKeysRepository.ts"],"sourcesContent":["import { createImplementation } from \"@webiny/feature/api\";\nimport { Result } from \"@webiny/feature/api\";\nimport { ApiKeysRepository as RepositoryAbstraction } from \"./abstractions.js\";\nimport { ApiKeyProvider } from \"./abstractions.js\";\nimport type { ApiKey, ListApiKeysInput } from \"./types.js\";\nimport { SecurityStorageOperations } from \"~/features/security/shared/abstractions.js\";\nimport { TenantContext } from \"~/features/tenancy/TenantContext/index.js\";\nimport { ApiKeyNotFoundError, ApiKeyPersistenceError, ApiKeyValidationError } from \"./errors.js\";\n\n// TODO: create an ApiKeyMapper\n\nclass ApiKeysRepositoryImpl implements RepositoryAbstraction.Interface {\n    private resolving = false;\n\n    constructor(\n        private tenantContext: TenantContext.Interface,\n        private storageOperations: SecurityStorageOperations.Interface,\n        private apiKeyProvider: ApiKeyProvider.Interface\n    ) {}\n\n    async get(id: string): Promise<Result<ApiKey, RepositoryAbstraction.Error>> {\n        try {\n            const tenant = this.tenantContext.getTenant();\n            const apiKey = await this.storageOperations.getApiKey({ id, tenant: tenant.id });\n            if (apiKey) {\n                return Result.ok(apiKey);\n            }\n\n            return Result.fail(new ApiKeyNotFoundError());\n        } catch (error) {\n            return Result.fail(error);\n        }\n    }\n\n    async getByToken(token: string): Promise<Result<ApiKey, RepositoryAbstraction.Error>> {\n        try {\n            const tenant = this.tenantContext.getTenant();\n            const apiKey = await this.storageOperations.getApiKeyByToken({\n                token,\n                tenant: tenant.id\n            });\n\n            if (apiKey) {\n                return Result.ok(apiKey);\n            }\n\n            if (!this.resolving) {\n                this.resolving = true;\n                try {\n                    const factoryApiKey = await this.apiKeyProvider.getByToken(token);\n                    if (factoryApiKey) {\n                        return Result.ok(factoryApiKey);\n                    }\n                } finally {\n                    this.resolving = false;\n                }\n            }\n\n            return Result.fail(new ApiKeyNotFoundError());\n        } catch (error) {\n            return Result.fail(new ApiKeyPersistenceError(error));\n        }\n    }\n\n    async getBySlug(slug: string): Promise<Result<ApiKey, RepositoryAbstraction.Error>> {\n        try {\n            const tenant = this.tenantContext.getTenant();\n            const apiKey = await this.storageOperations.getApiKeyBySlug({\n                slug,\n                tenant: tenant.id\n            });\n\n            if (apiKey) {\n                return Result.ok(apiKey);\n            }\n\n            if (!this.resolving) {\n                this.resolving = true;\n                try {\n                    const factoryApiKey = await this.apiKeyProvider.getBySlug(slug);\n                    if (factoryApiKey) {\n                        return Result.ok(factoryApiKey);\n                    }\n                } finally {\n                    this.resolving = false;\n                }\n            }\n\n            return Result.fail(new ApiKeyNotFoundError());\n        } catch (error) {\n            return Result.fail(new ApiKeyPersistenceError(error));\n        }\n    }\n\n    async list(params: ListApiKeysInput): Promise<Result<ApiKey[], RepositoryAbstraction.Error>> {\n        try {\n            const tenant = this.tenantContext.getTenant();\n            const result = await this.storageOperations.listApiKeys({\n                where: { tenant: tenant.id },\n                ...params\n            });\n            return Result.ok(result);\n        } catch (error) {\n            return Result.fail(new ApiKeyPersistenceError(error));\n        }\n    }\n\n    async create(apiKey: ApiKey): Promise<Result<void, RepositoryAbstraction.Error>> {\n        try {\n            // Check if an API key with the same slug already exists\n            const existingKeyResult = await this.getBySlug(apiKey.slug);\n\n            // If we found a key, it's a duplicate slug - return validation error\n            if (existingKeyResult.isOk()) {\n                return Result.fail(\n                    new ApiKeyValidationError(`API key with slug \"${apiKey.slug}\" already exists.`)\n                );\n            }\n\n            // \"NotFound\" error is ok. Everything else is not ok.\n            if (existingKeyResult.error.code !== \"ApiKey/NotFound\") {\n                return Result.fail(existingKeyResult.error);\n            }\n\n            // Slug is unique, proceed with creation\n            const tenant = this.tenantContext.getTenant();\n            await this.storageOperations.createApiKey({ apiKey: { ...apiKey, tenant: tenant.id } });\n            return Result.ok();\n        } catch (error) {\n            return Result.fail(new ApiKeyPersistenceError(error));\n        }\n    }\n\n    async update(apiKey: ApiKey): Promise<Result<void, RepositoryAbstraction.Error>> {\n        try {\n            const tenant = this.tenantContext.getTenant();\n            await this.storageOperations.updateApiKey({ apiKey: { ...apiKey, tenant: tenant.id } });\n\n            return Result.ok();\n        } catch (error) {\n            return Result.fail(new ApiKeyPersistenceError(error));\n        }\n    }\n\n    async delete(apiKey: ApiKey): Promise<Result<void, RepositoryAbstraction.Error>> {\n        try {\n            const tenant = this.tenantContext.getTenant();\n            await this.storageOperations.deleteApiKey({ apiKey: { ...apiKey, tenant: tenant.id } });\n\n            return Result.ok();\n        } catch (error) {\n            return Result.fail(new ApiKeyPersistenceError(error));\n        }\n    }\n}\n\nexport const ApiKeysRepository = createImplementation({\n    abstraction: RepositoryAbstraction,\n    implementation: ApiKeysRepositoryImpl,\n    dependencies: [TenantContext, SecurityStorageOperations, ApiKeyProvider]\n});\n"],"names":["ApiKeysRepositoryImpl","tenantContext","storageOperations","apiKeyProvider","id","tenant","apiKey","Result","ApiKeyNotFoundError","error","token","factoryApiKey","ApiKeyPersistenceError","slug","params","result","existingKeyResult","ApiKeyValidationError","ApiKeysRepository","createImplementation","RepositoryAbstraction","TenantContext","SecurityStorageOperations","ApiKeyProvider"],"mappings":";;;;;AAWA,MAAMA;IAGF,YACYC,aAAsC,EACtCC,iBAAsD,EACtDC,cAAwC,CAClD;aAHUF,aAAa,GAAbA;aACAC,iBAAiB,GAAjBA;aACAC,cAAc,GAAdA;aALJ,SAAS,GAAG;IAMjB;IAEH,MAAM,IAAIC,EAAU,EAAwD;QACxE,IAAI;YACA,MAAMC,SAAS,IAAI,CAAC,aAAa,CAAC,SAAS;YAC3C,MAAMC,SAAS,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC;gBAAEF;gBAAI,QAAQC,OAAO,EAAE;YAAC;YAC9E,IAAIC,QACA,OAAOC,OAAO,EAAE,CAACD;YAGrB,OAAOC,OAAO,IAAI,CAAC,IAAIC;QAC3B,EAAE,OAAOC,OAAO;YACZ,OAAOF,OAAO,IAAI,CAACE;QACvB;IACJ;IAEA,MAAM,WAAWC,KAAa,EAAwD;QAClF,IAAI;YACA,MAAML,SAAS,IAAI,CAAC,aAAa,CAAC,SAAS;YAC3C,MAAMC,SAAS,MAAM,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC;gBACzDI;gBACA,QAAQL,OAAO,EAAE;YACrB;YAEA,IAAIC,QACA,OAAOC,OAAO,EAAE,CAACD;YAGrB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;gBACjB,IAAI,CAAC,SAAS,GAAG;gBACjB,IAAI;oBACA,MAAMK,gBAAgB,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAACD;oBAC3D,IAAIC,eACA,OAAOJ,OAAO,EAAE,CAACI;gBAEzB,SAAU;oBACN,IAAI,CAAC,SAAS,GAAG;gBACrB;YACJ;YAEA,OAAOJ,OAAO,IAAI,CAAC,IAAIC;QAC3B,EAAE,OAAOC,OAAO;YACZ,OAAOF,OAAO,IAAI,CAAC,IAAIK,uBAAuBH;QAClD;IACJ;IAEA,MAAM,UAAUI,IAAY,EAAwD;QAChF,IAAI;YACA,MAAMR,SAAS,IAAI,CAAC,aAAa,CAAC,SAAS;YAC3C,MAAMC,SAAS,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;gBACxDO;gBACA,QAAQR,OAAO,EAAE;YACrB;YAEA,IAAIC,QACA,OAAOC,OAAO,EAAE,CAACD;YAGrB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;gBACjB,IAAI,CAAC,SAAS,GAAG;gBACjB,IAAI;oBACA,MAAMK,gBAAgB,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAACE;oBAC1D,IAAIF,eACA,OAAOJ,OAAO,EAAE,CAACI;gBAEzB,SAAU;oBACN,IAAI,CAAC,SAAS,GAAG;gBACrB;YACJ;YAEA,OAAOJ,OAAO,IAAI,CAAC,IAAIC;QAC3B,EAAE,OAAOC,OAAO;YACZ,OAAOF,OAAO,IAAI,CAAC,IAAIK,uBAAuBH;QAClD;IACJ;IAEA,MAAM,KAAKK,MAAwB,EAA0D;QACzF,IAAI;YACA,MAAMT,SAAS,IAAI,CAAC,aAAa,CAAC,SAAS;YAC3C,MAAMU,SAAS,MAAM,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC;gBACpD,OAAO;oBAAE,QAAQV,OAAO,EAAE;gBAAC;gBAC3B,GAAGS,MAAM;YACb;YACA,OAAOP,OAAO,EAAE,CAACQ;QACrB,EAAE,OAAON,OAAO;YACZ,OAAOF,OAAO,IAAI,CAAC,IAAIK,uBAAuBH;QAClD;IACJ;IAEA,MAAM,OAAOH,MAAc,EAAsD;QAC7E,IAAI;YAEA,MAAMU,oBAAoB,MAAM,IAAI,CAAC,SAAS,CAACV,OAAO,IAAI;YAG1D,IAAIU,kBAAkB,IAAI,IACtB,OAAOT,OAAO,IAAI,CACd,IAAIU,sBAAsB,CAAC,mBAAmB,EAAEX,OAAO,IAAI,CAAC,iBAAiB,CAAC;YAKtF,IAAIU,AAAiC,sBAAjCA,kBAAkB,KAAK,CAAC,IAAI,EAC5B,OAAOT,OAAO,IAAI,CAACS,kBAAkB,KAAK;YAI9C,MAAMX,SAAS,IAAI,CAAC,aAAa,CAAC,SAAS;YAC3C,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC;gBAAE,QAAQ;oBAAE,GAAGC,MAAM;oBAAE,QAAQD,OAAO,EAAE;gBAAC;YAAE;YACrF,OAAOE,OAAO,EAAE;QACpB,EAAE,OAAOE,OAAO;YACZ,OAAOF,OAAO,IAAI,CAAC,IAAIK,uBAAuBH;QAClD;IACJ;IAEA,MAAM,OAAOH,MAAc,EAAsD;QAC7E,IAAI;YACA,MAAMD,SAAS,IAAI,CAAC,aAAa,CAAC,SAAS;YAC3C,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC;gBAAE,QAAQ;oBAAE,GAAGC,MAAM;oBAAE,QAAQD,OAAO,EAAE;gBAAC;YAAE;YAErF,OAAOE,OAAO,EAAE;QACpB,EAAE,OAAOE,OAAO;YACZ,OAAOF,OAAO,IAAI,CAAC,IAAIK,uBAAuBH;QAClD;IACJ;IAEA,MAAM,OAAOH,MAAc,EAAsD;QAC7E,IAAI;YACA,MAAMD,SAAS,IAAI,CAAC,aAAa,CAAC,SAAS;YAC3C,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC;gBAAE,QAAQ;oBAAE,GAAGC,MAAM;oBAAE,QAAQD,OAAO,EAAE;gBAAC;YAAE;YAErF,OAAOE,OAAO,EAAE;QACpB,EAAE,OAAOE,OAAO;YACZ,OAAOF,OAAO,IAAI,CAAC,IAAIK,uBAAuBH;QAClD;IACJ;AACJ;AAEO,MAAMS,sCAAoBC,qBAAqB;IAClD,aAAaC;IACb,gBAAgBpB;IAChB,cAAc;QAACqB;QAAeC;QAA2BC;KAAe;AAC5E"}

package/features/security/apiKeys/shared/generateToken.d.ts

@@ -4,4 +4,4 @@
  * When authentication plugins kick in, they will be able to tell if they should handle
  * the token by checking the first letter.
  */
-export declare const generateToken: (tokenLength?: number) => string;
+export declare const generateToken: (tokenLength?: number) => `wat_${string}`;

package/features/security/apiKeys/shared/generateToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"features/security/apiKeys/shared/generateToken.js","sources":["../../../../../src/features/security/apiKeys/shared/generateToken.ts"],"sourcesContent":["import crypto from \"crypto\";\n\n/**\n * Generates a random token for API keys.\n * API Keys are prefixed with letter \"wat_\" to make token verification easier.\n * When authentication plugins kick in, they will be able to tell if they should handle\n * the token by checking the first letter.\n */\nexport const generateToken = (tokenLength = 40): string => {\n    const token = crypto.randomBytes(Math.ceil(tokenLength / 2)).toString(\"hex\");\n\n    // API Keys are prefixed with letters \"wat_\" to make token verification easier\n    if (token.startsWith(\"wat_\")) {\n        return token;\n    }\n\n    return `wat_${token.slice(0, tokenLength - 4)}`;\n};\n"],"names":["generateToken","tokenLength","token","crypto","Math"],"mappings":";AAQO,MAAMA,gBAAgB,CAACC,cAAc,EAAE;IAC1C,MAAMC,QAAQC,SAAAA,WAAkB,CAACC,KAAK,IAAI,CAACH,cAAc,IAAI,QAAQ,CAAC;IAGtE,IAAIC,MAAM,UAAU,CAAC,SACjB,OAAOA;IAGX,OAAO,CAAC,IAAI,EAAEA,MAAM,KAAK,CAAC,GAAGD,cAAc,IAAI;AACnD"}
+{"version":3,"file":"features/security/apiKeys/shared/generateToken.js","sources":["../../../../../src/features/security/apiKeys/shared/generateToken.ts"],"sourcesContent":["import crypto from \"crypto\";\n\n/**\n * Generates a random token for API keys.\n * API Keys are prefixed with letter \"wat_\" to make token verification easier.\n * When authentication plugins kick in, they will be able to tell if they should handle\n * the token by checking the first letter.\n */\nexport const generateToken = (tokenLength = 40): `wat_${string}` => {\n    const token = crypto.randomBytes(Math.ceil(tokenLength / 2)).toString(\"hex\");\n\n    // API Keys are prefixed with letters \"wat_\" to make token verification easier\n    if (token.startsWith(\"wat_\")) {\n        return token as `wat_${string}`;\n    }\n\n    return `wat_${token.slice(0, tokenLength - 4)}`;\n};\n"],"names":["generateToken","tokenLength","token","crypto","Math"],"mappings":";AAQO,MAAMA,gBAAgB,CAACC,cAAc,EAAE;IAC1C,MAAMC,QAAQC,SAAAA,WAAkB,CAACC,KAAK,IAAI,CAACH,cAAc,IAAI,QAAQ,CAAC;IAGtE,IAAIC,MAAM,UAAU,CAAC,SACjB,OAAOA;IAGX,OAAO,CAAC,IAAI,EAAEA,MAAM,KAAK,CAAC,GAAGD,cAAc,IAAI;AACnD"}

package/features/security/apiKeys/shared/schemas.d.ts

@@ -2,14 +2,14 @@ import { z } from "zod";
 export declare const createApiKeyInputSchema: z.ZodObject<{
     name: z.ZodString;
     slug: z.ZodString;
-    description: z.ZodString;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     permissions: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodObject<{
         name: z.ZodString;
     }, z.core.$loose>>>>;
 }, z.core.$strip>;
 export declare const updateApiKeyInputSchema: z.ZodObject<{
     name: z.ZodOptional<z.ZodString>;
-    description: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     permissions: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodObject<{
         name: z.ZodString;
     }, z.core.$loose>>>>;

package/features/security/apiKeys/shared/schemas.js

@@ -2,14 +2,14 @@ import { z } from "zod";
 const createApiKeyInputSchema = z.object({
     name: z.string().min(1),
     slug: z.string().min(1),
-    description: z.string(),
+    description: z.string().max(500).nullish(),
     permissions: z.array(z.looseObject({
         name: z.string()
     })).optional().default([])
 });
 const updateApiKeyInputSchema = z.object({
     name: z.string().min(1).optional(),
-    description: z.string().optional(),
+    description: z.string().max(500).nullish(),
     permissions: z.array(z.looseObject({
         name: z.string()
     })).optional().default([])

package/features/security/apiKeys/shared/schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"features/security/apiKeys/shared/schemas.js","sources":["../../../../../src/features/security/apiKeys/shared/schemas.ts"],"sourcesContent":["import { z } from \"zod\";\n\nexport const createApiKeyInputSchema = z.object({\n    name: z.string().min(1),\n    slug: z.string().min(1),\n    description: z.string(),\n    permissions: z\n        .array(z.looseObject({ name: z.string() }))\n        .optional()\n        .default([])\n});\n\nexport const updateApiKeyInputSchema = z.object({\n    name: z.string().min(1).optional(),\n    description: z.string().optional(),\n    permissions: z\n        .array(z.looseObject({ name: z.string() }))\n        .optional()\n        .default([])\n});\n\nexport const listApiKeysInputSchema = z.object({\n    where: z\n        .object({\n            name: z.string().optional(),\n            name_contains: z.string().optional(),\n            description: z.string().optional(),\n            description_contains: z.string().optional()\n        })\n        .optional(),\n    limit: z.number().int().positive().max(100).optional(),\n    after: z.string().optional(),\n    sort: z.array(z.enum([\"createdOn_ASC\", \"createdOn_DESC\"])).optional()\n});\n"],"names":["createApiKeyInputSchema","z","updateApiKeyInputSchema","listApiKeysInputSchema"],"mappings":";AAEO,MAAMA,0BAA0BC,EAAE,MAAM,CAAC;IAC5C,MAAMA,EAAE,MAAM,GAAG,GAAG,CAAC;IACrB,MAAMA,EAAE,MAAM,GAAG,GAAG,CAAC;IACrB,aAAaA,EAAE,MAAM;IACrB,aAAaA,EAAAA,KACH,CAACA,EAAE,WAAW,CAAC;QAAE,MAAMA,EAAE,MAAM;IAAG,IACvC,QAAQ,GACR,OAAO,CAAC,EAAE;AACnB;AAEO,MAAMC,0BAA0BD,EAAE,MAAM,CAAC;IAC5C,MAAMA,EAAE,MAAM,GAAG,GAAG,CAAC,GAAG,QAAQ;IAChC,aAAaA,EAAE,MAAM,GAAG,QAAQ;IAChC,aAAaA,EAAAA,KACH,CAACA,EAAE,WAAW,CAAC;QAAE,MAAMA,EAAE,MAAM;IAAG,IACvC,QAAQ,GACR,OAAO,CAAC,EAAE;AACnB;AAEO,MAAME,yBAAyBF,EAAE,MAAM,CAAC;IAC3C,OAAOA,EAAAA,MACI,CAAC;QACJ,MAAMA,EAAE,MAAM,GAAG,QAAQ;QACzB,eAAeA,EAAE,MAAM,GAAG,QAAQ;QAClC,aAAaA,EAAE,MAAM,GAAG,QAAQ;QAChC,sBAAsBA,EAAE,MAAM,GAAG,QAAQ;IAC7C,GACC,QAAQ;IACb,OAAOA,EAAE,MAAM,GAAG,GAAG,GAAG,QAAQ,GAAG,GAAG,CAAC,KAAK,QAAQ;IACpD,OAAOA,EAAE,MAAM,GAAG,QAAQ;IAC1B,MAAMA,EAAE,KAAK,CAACA,CAAC,CAADA,OAAM,CAAC;QAAC;QAAiB;KAAiB,GAAG,QAAQ;AACvE"}
+{"version":3,"file":"features/security/apiKeys/shared/schemas.js","sources":["../../../../../src/features/security/apiKeys/shared/schemas.ts"],"sourcesContent":["import { z } from \"zod\";\n\nexport const createApiKeyInputSchema = z.object({\n    name: z.string().min(1),\n    slug: z.string().min(1),\n    // Nullable in the GraphQL schema - see `descriptionOnCreate` for why this is `.nullish()`.\n    // This was a bare `z.string()`, so an API key created without a description was rejected\n    // whether the client sent null or omitted the field entirely. `max` matches teams and roles.\n    description: z.string().max(500).nullish(),\n    permissions: z\n        .array(z.looseObject({ name: z.string() }))\n        .optional()\n        .default([])\n});\n\nexport const updateApiKeyInputSchema = z.object({\n    name: z.string().min(1).optional(),\n    // Nullable in the GraphQL schema - see `descriptionOnUpdate` for why this is `.nullish()` and\n    // must not carry a `.transform()`. `max` matches teams and roles.\n    description: z.string().max(500).nullish(),\n    permissions: z\n        .array(z.looseObject({ name: z.string() }))\n        .optional()\n        .default([])\n});\n\nexport const listApiKeysInputSchema = z.object({\n    where: z\n        .object({\n            name: z.string().optional(),\n            name_contains: z.string().optional(),\n            description: z.string().optional(),\n            description_contains: z.string().optional()\n        })\n        .optional(),\n    limit: z.number().int().positive().max(100).optional(),\n    after: z.string().optional(),\n    sort: z.array(z.enum([\"createdOn_ASC\", \"createdOn_DESC\"])).optional()\n});\n"],"names":["createApiKeyInputSchema","z","updateApiKeyInputSchema","listApiKeysInputSchema"],"mappings":";AAEO,MAAMA,0BAA0BC,EAAE,MAAM,CAAC;IAC5C,MAAMA,EAAE,MAAM,GAAG,GAAG,CAAC;IACrB,MAAMA,EAAE,MAAM,GAAG,GAAG,CAAC;IAIrB,aAAaA,EAAE,MAAM,GAAG,GAAG,CAAC,KAAK,OAAO;IACxC,aAAaA,EAAAA,KACH,CAACA,EAAE,WAAW,CAAC;QAAE,MAAMA,EAAE,MAAM;IAAG,IACvC,QAAQ,GACR,OAAO,CAAC,EAAE;AACnB;AAEO,MAAMC,0BAA0BD,EAAE,MAAM,CAAC;IAC5C,MAAMA,EAAE,MAAM,GAAG,GAAG,CAAC,GAAG,QAAQ;IAGhC,aAAaA,EAAE,MAAM,GAAG,GAAG,CAAC,KAAK,OAAO;IACxC,aAAaA,EAAAA,KACH,CAACA,EAAE,WAAW,CAAC;QAAE,MAAMA,EAAE,MAAM;IAAG,IACvC,QAAQ,GACR,OAAO,CAAC,EAAE;AACnB;AAEO,MAAME,yBAAyBF,EAAE,MAAM,CAAC;IAC3C,OAAOA,EAAAA,MACI,CAAC;QACJ,MAAMA,EAAE,MAAM,GAAG,QAAQ;QACzB,eAAeA,EAAE,MAAM,GAAG,QAAQ;QAClC,aAAaA,EAAE,MAAM,GAAG,QAAQ;QAChC,sBAAsBA,EAAE,MAAM,GAAG,QAAQ;IAC7C,GACC,QAAQ;IACb,OAAOA,EAAE,MAAM,GAAG,GAAG,GAAG,QAAQ,GAAG,GAAG,CAAC,KAAK,QAAQ;IACpD,OAAOA,EAAE,MAAM,GAAG,QAAQ;IAC1B,MAAMA,EAAE,KAAK,CAACA,CAAC,CAADA,OAAM,CAAC;QAAC;QAAiB;KAAiB,GAAG,QAAQ;AACvE"}

package/features/security/apiKeys/shared/types.d.ts

@@ -4,7 +4,7 @@ export interface ApiKey {
     name: string;
     slug: string;
     description: string;
-    token: string;
+    token: `wat_${string}`;
     permissions: SecurityPermission[];
     createdBy: CreatedBy;
     createdOn: string;

package/features/security/authorization/GroupsTeamsAuthorizer/GetPermissionsFromIdentity.d.ts

@@ -1,4 +1,4 @@
-import { WcpContext } from "../../../../features/wcp/WcpContext/index.js";
+import { FeatureFlags } from "../../../../features/featureFlags/abstractions.js";
 import { Identity } from "../../../../features/security/IdentityContext/index.js";
 import { PermissionsProcessor } from "./abstractions.js";
 import { RolesRepository } from "../../../../features/security/roles/shared/abstractions.js";
@@ -7,14 +7,14 @@ import { AdminUsersRepository } from "../../../../features/users/shared/abstract
 export type RoleId = string | undefined;
 export type TeamId = string | undefined;
 declare class GetPermissionsFromGroupsAndTeamsImpl implements PermissionsProcessor.Interface {
-    private wcpContext;
+    private featureFlags;
     private usersRepository;
     private rolesRepository;
     private teamsRepository;
-    constructor(wcpContext: WcpContext.Interface, usersRepository: AdminUsersRepository.Interface, rolesRepository: RolesRepository.Interface, teamsRepository: TeamsRepository.Interface);
+    constructor(featureFlags: FeatureFlags.Interface, usersRepository: AdminUsersRepository.Interface, rolesRepository: RolesRepository.Interface, teamsRepository: TeamsRepository.Interface);
     getPermissions(identity: Identity): Promise<{
-        _src: string;
         name: string;
+        _src: string;
     }[] | null>;
 }
 export declare const GetPermissionsFromIdentity: typeof GetPermissionsFromGroupsAndTeamsImpl & {

package/features/security/authorization/GroupsTeamsAuthorizer/GetPermissionsFromIdentity.js

@@ -1,12 +1,12 @@
-import { WcpContext } from "../../../wcp/WcpContext/index.js";
+import { FeatureFlags } from "../../../featureFlags/abstractions.js";
 import { PermissionsProcessor } from "./abstractions.js";
 import { RolesRepository } from "../../roles/shared/abstractions.js";
 import { TeamsRepository } from "../../teams/shared/abstractions.js";
 import { getPermissionsFromRoles } from "../../utils/getPermissionsFromRoles.js";
 import { AdminUsersRepository } from "../../../users/shared/abstractions.js";
 class GetPermissionsFromGroupsAndTeamsImpl {
-    constructor(wcpContext, usersRepository, rolesRepository, teamsRepository){
-        this.wcpContext = wcpContext;
+    constructor(featureFlags, usersRepository, rolesRepository, teamsRepository){
+        this.featureFlags = featureFlags;
         this.usersRepository = usersRepository;
         this.rolesRepository = rolesRepository;
         this.teamsRepository = teamsRepository;
@@ -32,7 +32,7 @@ class GetPermissionsFromGroupsAndTeamsImpl {
             const loadedRolesByIds = rolesResult.isOk() ? rolesResult.value : [];
             loadedRoles.push(...loadedRolesByIds);
         }
-        if (this.wcpContext.canUseTeams()) {
+        if (this.featureFlags.get().isEnabled("advancedAccessControlLayer.teams")) {
             teamIds.push(...user.teams ?? []);
             const filteredTeamIds = teamIds.filter(Boolean);
             const dedupedTeamIds = Array.from(new Set(filteredTeamIds));
@@ -65,7 +65,7 @@ class GetPermissionsFromGroupsAndTeamsImpl {
 const GetPermissionsFromIdentity = PermissionsProcessor.createImplementation({
     implementation: GetPermissionsFromGroupsAndTeamsImpl,
     dependencies: [
-        WcpContext,
+        FeatureFlags,
         AdminUsersRepository,
         RolesRepository,
         TeamsRepository

package/features/security/authorization/GroupsTeamsAuthorizer/GetPermissionsFromIdentity.js.map

@@ -1 +1 @@
-{"version":3,"file":"features/security/authorization/GroupsTeamsAuthorizer/GetPermissionsFromIdentity.js","sources":["../../../../../src/features/security/authorization/GroupsTeamsAuthorizer/GetPermissionsFromIdentity.ts"],"sourcesContent":["import { WcpContext } from \"~/features/wcp/WcpContext/index.js\";\nimport type { SecurityRole } from \"~/types/security.js\";\nimport { Identity } from \"~/features/security/IdentityContext/index.js\";\nimport { PermissionsProcessor } from \"./abstractions.js\";\nimport { RolesRepository } from \"~/features/security/roles/shared/abstractions.js\";\nimport { TeamsRepository } from \"~/features/security/teams/shared/abstractions.js\";\nimport { getPermissionsFromRoles } from \"~/features/security/utils/getPermissionsFromRoles.js\";\nimport { AdminUsersRepository } from \"~/features/users/shared/abstractions.js\";\n\nexport type RoleId = string | undefined;\nexport type TeamId = string | undefined;\n\nclass GetPermissionsFromGroupsAndTeamsImpl implements PermissionsProcessor.Interface {\n    constructor(\n        private wcpContext: WcpContext.Interface,\n        private usersRepository: AdminUsersRepository.Interface,\n        private rolesRepository: RolesRepository.Interface,\n        private teamsRepository: TeamsRepository.Interface\n    ) {}\n\n    async getPermissions(identity: Identity) {\n        const userResult = await this.usersRepository.get({ id: identity.id });\n        if (userResult.isFail()) {\n            return null;\n        }\n\n        const user = userResult.value;\n\n        // Load roles that are associated with the current identity. Also load roles\n        // that are assigned via one or more teams (if the Teams feature is enabled).\n        const roleIds: RoleId[] = [];\n        const teamIds: TeamId[] = [];\n\n        roleIds.push(...(user.roles ?? []));\n\n        const filteredRoleIds = roleIds.filter(Boolean) as string[];\n        const dedupedRoleIds = Array.from(new Set(filteredRoleIds));\n\n        const loadedRoles: SecurityRole[] = [];\n\n        if (dedupedRoleIds.length > 0) {\n            const rolesResult = await this.rolesRepository.list({\n                where: { id_in: dedupedRoleIds }\n            });\n\n            const loadedRolesByIds = rolesResult.isOk() ? rolesResult.value : [];\n            loadedRoles.push(...loadedRolesByIds);\n        }\n\n        if (this.wcpContext.canUseTeams()) {\n            teamIds.push(...(user.teams ?? []));\n\n            const filteredTeamIds = teamIds.filter(Boolean) as string[];\n            const dedupedTeamIds = Array.from(new Set(filteredTeamIds));\n\n            if (dedupedTeamIds.length > 0) {\n                const teamsResult = await this.teamsRepository.list({\n                    where: { id_in: dedupedTeamIds }\n                });\n\n                const loadedTeams = teamsResult.isOk() ? teamsResult.value : [];\n\n                // Upon returning teams, we're filtering out team roles that were already loaded.\n                // Also note that `team.roles` contains role IDs, not slugs.\n                const roleIdsFromTeams = loadedTeams\n                    .flatMap(team => team.roles)\n                    .filter(roleId => {\n                        const alreadyLoaded = loadedRoles.find(role => role.id === roleId);\n                        return !alreadyLoaded;\n                    });\n\n                if (roleIdsFromTeams.length > 0) {\n                    const moreRolesResult = await this.rolesRepository.list({\n                        where: { id_in: roleIdsFromTeams }\n                    });\n\n                    const rolesFromTeams = moreRolesResult.isOk() ? moreRolesResult.value : [];\n                    loadedRoles.push(...rolesFromTeams);\n                }\n            }\n        }\n\n        if (loadedRoles.length > 0) {\n            return getPermissionsFromRoles(loadedRoles);\n        }\n\n        return null;\n    }\n}\n\nexport const GetPermissionsFromIdentity = PermissionsProcessor.createImplementation({\n    implementation: GetPermissionsFromGroupsAndTeamsImpl,\n    dependencies: [WcpContext, AdminUsersRepository, RolesRepository, TeamsRepository]\n});\n"],"names":["GetPermissionsFromGroupsAndTeamsImpl","wcpContext","usersRepository","rolesRepository","teamsRepository","identity","userResult","user","roleIds","teamIds","filteredRoleIds","Boolean","dedupedRoleIds","Array","Set","loadedRoles","rolesResult","loadedRolesByIds","filteredTeamIds","dedupedTeamIds","teamsResult","loadedTeams","roleIdsFromTeams","team","roleId","alreadyLoaded","role","moreRolesResult","rolesFromTeams","getPermissionsFromRoles","GetPermissionsFromIdentity","PermissionsProcessor","WcpContext","AdminUsersRepository","RolesRepository","TeamsRepository"],"mappings":";;;;;;AAYA,MAAMA;IACF,YACYC,UAAgC,EAChCC,eAA+C,EAC/CC,eAA0C,EAC1CC,eAA0C,CACpD;aAJUH,UAAU,GAAVA;aACAC,eAAe,GAAfA;aACAC,eAAe,GAAfA;aACAC,eAAe,GAAfA;IACT;IAEH,MAAM,eAAeC,QAAkB,EAAE;QACrC,MAAMC,aAAa,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;YAAE,IAAID,SAAS,EAAE;QAAC;QACpE,IAAIC,WAAW,MAAM,IACjB,OAAO;QAGX,MAAMC,OAAOD,WAAW,KAAK;QAI7B,MAAME,UAAoB,EAAE;QAC5B,MAAMC,UAAoB,EAAE;QAE5BD,QAAQ,IAAI,IAAKD,KAAK,KAAK,IAAI,EAAE;QAEjC,MAAMG,kBAAkBF,QAAQ,MAAM,CAACG;QACvC,MAAMC,iBAAiBC,MAAM,IAAI,CAAC,IAAIC,IAAIJ;QAE1C,MAAMK,cAA8B,EAAE;QAEtC,IAAIH,eAAe,MAAM,GAAG,GAAG;YAC3B,MAAMI,cAAc,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;gBAChD,OAAO;oBAAE,OAAOJ;gBAAe;YACnC;YAEA,MAAMK,mBAAmBD,YAAY,IAAI,KAAKA,YAAY,KAAK,GAAG,EAAE;YACpED,YAAY,IAAI,IAAIE;QACxB;QAEA,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,IAAI;YAC/BR,QAAQ,IAAI,IAAKF,KAAK,KAAK,IAAI,EAAE;YAEjC,MAAMW,kBAAkBT,QAAQ,MAAM,CAACE;YACvC,MAAMQ,iBAAiBN,MAAM,IAAI,CAAC,IAAIC,IAAII;YAE1C,IAAIC,eAAe,MAAM,GAAG,GAAG;gBAC3B,MAAMC,cAAc,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;oBAChD,OAAO;wBAAE,OAAOD;oBAAe;gBACnC;gBAEA,MAAME,cAAcD,YAAY,IAAI,KAAKA,YAAY,KAAK,GAAG,EAAE;gBAI/D,MAAME,mBAAmBD,YACpB,OAAO,CAACE,CAAAA,OAAQA,KAAK,KAAK,EAC1B,MAAM,CAACC,CAAAA;oBACJ,MAAMC,gBAAgBV,YAAY,IAAI,CAACW,CAAAA,OAAQA,KAAK,EAAE,KAAKF;oBAC3D,OAAO,CAACC;gBACZ;gBAEJ,IAAIH,iBAAiB,MAAM,GAAG,GAAG;oBAC7B,MAAMK,kBAAkB,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;wBACpD,OAAO;4BAAE,OAAOL;wBAAiB;oBACrC;oBAEA,MAAMM,iBAAiBD,gBAAgB,IAAI,KAAKA,gBAAgB,KAAK,GAAG,EAAE;oBAC1EZ,YAAY,IAAI,IAAIa;gBACxB;YACJ;QACJ;QAEA,IAAIb,YAAY,MAAM,GAAG,GACrB,OAAOc,wBAAwBd;QAGnC,OAAO;IACX;AACJ;AAEO,MAAMe,6BAA6BC,qBAAqB,oBAAoB,CAAC;IAChF,gBAAgB/B;IAChB,cAAc;QAACgC;QAAYC;QAAsBC;QAAiBC;KAAgB;AACtF"}
+{"version":3,"file":"features/security/authorization/GroupsTeamsAuthorizer/GetPermissionsFromIdentity.js","sources":["../../../../../src/features/security/authorization/GroupsTeamsAuthorizer/GetPermissionsFromIdentity.ts"],"sourcesContent":["import { FeatureFlags } from \"~/features/featureFlags/abstractions.js\";\nimport type { SecurityRole } from \"~/types/security.js\";\nimport { Identity } from \"~/features/security/IdentityContext/index.js\";\nimport { PermissionsProcessor } from \"./abstractions.js\";\nimport { RolesRepository } from \"~/features/security/roles/shared/abstractions.js\";\nimport { TeamsRepository } from \"~/features/security/teams/shared/abstractions.js\";\nimport { getPermissionsFromRoles } from \"~/features/security/utils/getPermissionsFromRoles.js\";\nimport { AdminUsersRepository } from \"~/features/users/shared/abstractions.js\";\n\nexport type RoleId = string | undefined;\nexport type TeamId = string | undefined;\n\nclass GetPermissionsFromGroupsAndTeamsImpl implements PermissionsProcessor.Interface {\n    constructor(\n        private featureFlags: FeatureFlags.Interface,\n        private usersRepository: AdminUsersRepository.Interface,\n        private rolesRepository: RolesRepository.Interface,\n        private teamsRepository: TeamsRepository.Interface\n    ) {}\n\n    async getPermissions(identity: Identity) {\n        const userResult = await this.usersRepository.get({ id: identity.id });\n        if (userResult.isFail()) {\n            return null;\n        }\n\n        const user = userResult.value;\n\n        // Load roles that are associated with the current identity. Also load roles\n        // that are assigned via one or more teams (if the Teams feature is enabled).\n        const roleIds: RoleId[] = [];\n        const teamIds: TeamId[] = [];\n\n        roleIds.push(...(user.roles ?? []));\n\n        const filteredRoleIds = roleIds.filter(Boolean) as string[];\n        const dedupedRoleIds = Array.from(new Set(filteredRoleIds));\n\n        const loadedRoles: SecurityRole[] = [];\n\n        if (dedupedRoleIds.length > 0) {\n            const rolesResult = await this.rolesRepository.list({\n                where: { id_in: dedupedRoleIds }\n            });\n\n            const loadedRolesByIds = rolesResult.isOk() ? rolesResult.value : [];\n            loadedRoles.push(...loadedRolesByIds);\n        }\n\n        if (this.featureFlags.get().isEnabled(\"advancedAccessControlLayer.teams\")) {\n            teamIds.push(...(user.teams ?? []));\n\n            const filteredTeamIds = teamIds.filter(Boolean) as string[];\n            const dedupedTeamIds = Array.from(new Set(filteredTeamIds));\n\n            if (dedupedTeamIds.length > 0) {\n                const teamsResult = await this.teamsRepository.list({\n                    where: { id_in: dedupedTeamIds }\n                });\n\n                const loadedTeams = teamsResult.isOk() ? teamsResult.value : [];\n\n                // Upon returning teams, we're filtering out team roles that were already loaded.\n                // Also note that `team.roles` contains role IDs, not slugs.\n                const roleIdsFromTeams = loadedTeams\n                    .flatMap(team => team.roles)\n                    .filter(roleId => {\n                        const alreadyLoaded = loadedRoles.find(role => role.id === roleId);\n                        return !alreadyLoaded;\n                    });\n\n                if (roleIdsFromTeams.length > 0) {\n                    const moreRolesResult = await this.rolesRepository.list({\n                        where: { id_in: roleIdsFromTeams }\n                    });\n\n                    const rolesFromTeams = moreRolesResult.isOk() ? moreRolesResult.value : [];\n                    loadedRoles.push(...rolesFromTeams);\n                }\n            }\n        }\n\n        if (loadedRoles.length > 0) {\n            return getPermissionsFromRoles(loadedRoles);\n        }\n\n        return null;\n    }\n}\n\nexport const GetPermissionsFromIdentity = PermissionsProcessor.createImplementation({\n    implementation: GetPermissionsFromGroupsAndTeamsImpl,\n    dependencies: [FeatureFlags, AdminUsersRepository, RolesRepository, TeamsRepository]\n});\n"],"names":["GetPermissionsFromGroupsAndTeamsImpl","featureFlags","usersRepository","rolesRepository","teamsRepository","identity","userResult","user","roleIds","teamIds","filteredRoleIds","Boolean","dedupedRoleIds","Array","Set","loadedRoles","rolesResult","loadedRolesByIds","filteredTeamIds","dedupedTeamIds","teamsResult","loadedTeams","roleIdsFromTeams","team","roleId","alreadyLoaded","role","moreRolesResult","rolesFromTeams","getPermissionsFromRoles","GetPermissionsFromIdentity","PermissionsProcessor","FeatureFlags","AdminUsersRepository","RolesRepository","TeamsRepository"],"mappings":";;;;;;AAYA,MAAMA;IACF,YACYC,YAAoC,EACpCC,eAA+C,EAC/CC,eAA0C,EAC1CC,eAA0C,CACpD;aAJUH,YAAY,GAAZA;aACAC,eAAe,GAAfA;aACAC,eAAe,GAAfA;aACAC,eAAe,GAAfA;IACT;IAEH,MAAM,eAAeC,QAAkB,EAAE;QACrC,MAAMC,aAAa,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;YAAE,IAAID,SAAS,EAAE;QAAC;QACpE,IAAIC,WAAW,MAAM,IACjB,OAAO;QAGX,MAAMC,OAAOD,WAAW,KAAK;QAI7B,MAAME,UAAoB,EAAE;QAC5B,MAAMC,UAAoB,EAAE;QAE5BD,QAAQ,IAAI,IAAKD,KAAK,KAAK,IAAI,EAAE;QAEjC,MAAMG,kBAAkBF,QAAQ,MAAM,CAACG;QACvC,MAAMC,iBAAiBC,MAAM,IAAI,CAAC,IAAIC,IAAIJ;QAE1C,MAAMK,cAA8B,EAAE;QAEtC,IAAIH,eAAe,MAAM,GAAG,GAAG;YAC3B,MAAMI,cAAc,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;gBAChD,OAAO;oBAAE,OAAOJ;gBAAe;YACnC;YAEA,MAAMK,mBAAmBD,YAAY,IAAI,KAAKA,YAAY,KAAK,GAAG,EAAE;YACpED,YAAY,IAAI,IAAIE;QACxB;QAEA,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,GAAG,SAAS,CAAC,qCAAqC;YACvER,QAAQ,IAAI,IAAKF,KAAK,KAAK,IAAI,EAAE;YAEjC,MAAMW,kBAAkBT,QAAQ,MAAM,CAACE;YACvC,MAAMQ,iBAAiBN,MAAM,IAAI,CAAC,IAAIC,IAAII;YAE1C,IAAIC,eAAe,MAAM,GAAG,GAAG;gBAC3B,MAAMC,cAAc,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;oBAChD,OAAO;wBAAE,OAAOD;oBAAe;gBACnC;gBAEA,MAAME,cAAcD,YAAY,IAAI,KAAKA,YAAY,KAAK,GAAG,EAAE;gBAI/D,MAAME,mBAAmBD,YACpB,OAAO,CAACE,CAAAA,OAAQA,KAAK,KAAK,EAC1B,MAAM,CAACC,CAAAA;oBACJ,MAAMC,gBAAgBV,YAAY,IAAI,CAACW,CAAAA,OAAQA,KAAK,EAAE,KAAKF;oBAC3D,OAAO,CAACC;gBACZ;gBAEJ,IAAIH,iBAAiB,MAAM,GAAG,GAAG;oBAC7B,MAAMK,kBAAkB,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;wBACpD,OAAO;4BAAE,OAAOL;wBAAiB;oBACrC;oBAEA,MAAMM,iBAAiBD,gBAAgB,IAAI,KAAKA,gBAAgB,KAAK,GAAG,EAAE;oBAC1EZ,YAAY,IAAI,IAAIa;gBACxB;YACJ;QACJ;QAEA,IAAIb,YAAY,MAAM,GAAG,GACrB,OAAOc,wBAAwBd;QAGnC,OAAO;IACX;AACJ;AAEO,MAAMe,6BAA6BC,qBAAqB,oBAAoB,CAAC;IAChF,gBAAgB/B;IAChB,cAAc;QAACgC;QAAcC;QAAsBC;QAAiBC;KAAgB;AACxF"}

package/features/security/roles/CreateRole/CreateRoleUseCase.js

@@ -7,6 +7,7 @@ import { IdentityContext } from "../../IdentityContext/abstractions.js";
 import { createRoleValidation } from "./schema.js";
 import { RoleAfterCreateEvent, RoleBeforeCreateEvent } from "./events.js";
 import { NotAuthorizedError, RoleExistsError, RoleValidationError } from "../shared/errors.js";
+import { descriptionOnCreate } from "../../shared/description.js";
 class CreateRoleUseCaseImpl {
     constructor(identityContext, eventPublisher, repository){
         this.identityContext = identityContext;
@@ -24,12 +25,16 @@ class CreateRoleUseCaseImpl {
             slug: data.slug
         });
         if (existingRoleResult.isOk()) return Result.fail(new RoleExistsError(data.slug));
+        const createInput = {
+            ...data,
+            description: descriptionOnCreate(data.description)
+        };
         const role = {
             id: mdbid(),
-            name: data.name,
-            slug: data.slug,
-            description: data.description,
-            permissions: data.permissions,
+            name: createInput.name,
+            slug: createInput.slug,
+            description: descriptionOnCreate(createInput.description),
+            permissions: createInput.permissions,
             system: input.system || false,
             createdOn: new Date().toISOString(),
             createdBy: {
@@ -41,13 +46,13 @@ class CreateRoleUseCaseImpl {
         };
         await this.eventPublisher.publish(new RoleBeforeCreateEvent({
             role,
-            input: validation.data
+            input: createInput
         }));
         const result = await this.repository.create(role);
         if (result.isFail()) return Result.fail(result.error);
         await this.eventPublisher.publish(new RoleAfterCreateEvent({
             role,
-            input: validation.data
+            input: createInput
         }));
         return Result.ok(role);
     }

package/features/security/roles/CreateRole/CreateRoleUseCase.js.map

@@ -1 +1 @@
-{"version":3,"file":"features/security/roles/CreateRole/CreateRoleUseCase.js","sources":["../../../../../src/features/security/roles/CreateRole/CreateRoleUseCase.ts"],"sourcesContent":["import { mdbid } from \"@webiny/utils\";\nimport { createImplementation } from \"@webiny/feature/api\";\nimport { Result } from \"@webiny/feature/api\";\nimport { EventPublisher } from \"~/features/eventPublisher/index.js\";\nimport { CreateRoleUseCase as UseCaseAbstraction } from \"./abstractions.js\";\nimport { RolesRepository } from \"../shared/abstractions.js\";\nimport { IdentityContext } from \"../../IdentityContext/abstractions.js\";\nimport { createRoleValidation } from \"./schema.js\";\nimport { RoleBeforeCreateEvent, RoleAfterCreateEvent } from \"./events.js\";\nimport type { Role, CreateRoleInput } from \"../shared/types.js\";\nimport { NotAuthorizedError, RoleExistsError, RoleValidationError } from \"../shared/errors.js\";\n\nclass CreateRoleUseCaseImpl implements UseCaseAbstraction.Interface {\n    constructor(\n        private identityContext: IdentityContext.Interface,\n        private eventPublisher: EventPublisher.Interface,\n        private repository: RolesRepository.Interface\n    ) {}\n\n    async execute(input: CreateRoleInput): Promise<Result<Role, UseCaseAbstraction.Error>> {\n        const hasPermission = await this.identityContext.getPermission(\"security.role\");\n\n        if (!hasPermission) {\n            return Result.fail(new NotAuthorizedError());\n        }\n\n        const validation = createRoleValidation.safeParse(input);\n        if (!validation.success) {\n            return Result.fail(new RoleValidationError(validation.error.issues[0].message));\n        }\n\n        const identity = this.identityContext.getIdentity();\n        const data = validation.data;\n\n        // Check if role with same slug already exists\n        const existingRoleResult = await this.repository.get({ slug: data.slug });\n        if (existingRoleResult.isOk()) {\n            return Result.fail(new RoleExistsError(data.slug));\n        }\n\n        const role: Role = {\n            id: mdbid(),\n            name: data.name,\n            slug: data.slug,\n            description: data.description,\n            permissions: data.permissions,\n            system: input.system || false,\n            createdOn: new Date().toISOString(),\n            createdBy: {\n                id: identity.id,\n                displayName: identity.displayName,\n                type: identity.type\n            },\n            plugin: false\n        };\n\n        await this.eventPublisher.publish(\n            new RoleBeforeCreateEvent({ role, input: validation.data })\n        );\n\n        const result = await this.repository.create(role);\n\n        if (result.isFail()) {\n            return Result.fail(result.error);\n        }\n\n        await this.eventPublisher.publish(\n            new RoleAfterCreateEvent({ role, input: validation.data })\n        );\n\n        return Result.ok(role);\n    }\n}\n\nexport const CreateRoleUseCase = createImplementation({\n    abstraction: UseCaseAbstraction,\n    implementation: CreateRoleUseCaseImpl,\n    dependencies: [IdentityContext, EventPublisher, RolesRepository]\n});\n"],"names":["CreateRoleUseCaseImpl","identityContext","eventPublisher","repository","input","hasPermission","Result","NotAuthorizedError","validation","createRoleValidation","RoleValidationError","identity","data","existingRoleResult","RoleExistsError","role","mdbid","Date","RoleBeforeCreateEvent","result","RoleAfterCreateEvent","CreateRoleUseCase","createImplementation","UseCaseAbstraction","IdentityContext","EventPublisher","RolesRepository"],"mappings":";;;;;;;;;AAYA,MAAMA;IACF,YACYC,eAA0C,EAC1CC,cAAwC,EACxCC,UAAqC,CAC/C;aAHUF,eAAe,GAAfA;aACAC,cAAc,GAAdA;aACAC,UAAU,GAAVA;IACT;IAEH,MAAM,QAAQC,KAAsB,EAAmD;QACnF,MAAMC,gBAAgB,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC;QAE/D,IAAI,CAACA,eACD,OAAOC,OAAO,IAAI,CAAC,IAAIC;QAG3B,MAAMC,aAAaC,qBAAqB,SAAS,CAACL;QAClD,IAAI,CAACI,WAAW,OAAO,EACnB,OAAOF,OAAO,IAAI,CAAC,IAAII,oBAAoBF,WAAW,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO;QAGjF,MAAMG,WAAW,IAAI,CAAC,eAAe,CAAC,WAAW;QACjD,MAAMC,OAAOJ,WAAW,IAAI;QAG5B,MAAMK,qBAAqB,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAMD,KAAK,IAAI;QAAC;QACvE,IAAIC,mBAAmB,IAAI,IACvB,OAAOP,OAAO,IAAI,CAAC,IAAIQ,gBAAgBF,KAAK,IAAI;QAGpD,MAAMG,OAAa;YACf,IAAIC;YACJ,MAAMJ,KAAK,IAAI;YACf,MAAMA,KAAK,IAAI;YACf,aAAaA,KAAK,WAAW;YAC7B,aAAaA,KAAK,WAAW;YAC7B,QAAQR,MAAM,MAAM,IAAI;YACxB,WAAW,IAAIa,OAAO,WAAW;YACjC,WAAW;gBACP,IAAIN,SAAS,EAAE;gBACf,aAAaA,SAAS,WAAW;gBACjC,MAAMA,SAAS,IAAI;YACvB;YACA,QAAQ;QACZ;QAEA,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAC7B,IAAIO,sBAAsB;YAAEH;YAAM,OAAOP,WAAW,IAAI;QAAC;QAG7D,MAAMW,SAAS,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAACJ;QAE5C,IAAII,OAAO,MAAM,IACb,OAAOb,OAAO,IAAI,CAACa,OAAO,KAAK;QAGnC,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAC7B,IAAIC,qBAAqB;YAAEL;YAAM,OAAOP,WAAW,IAAI;QAAC;QAG5D,OAAOF,OAAO,EAAE,CAACS;IACrB;AACJ;AAEO,MAAMM,sCAAoBC,qBAAqB;IAClD,aAAaC;IACb,gBAAgBvB;IAChB,cAAc;QAACwB;QAAiBC;QAAgBC;KAAgB;AACpE"}
+{"version":3,"file":"features/security/roles/CreateRole/CreateRoleUseCase.js","sources":["../../../../../src/features/security/roles/CreateRole/CreateRoleUseCase.ts"],"sourcesContent":["import { mdbid } from \"@webiny/utils\";\nimport { createImplementation } from \"@webiny/feature/api\";\nimport { Result } from \"@webiny/feature/api\";\nimport { EventPublisher } from \"~/features/eventPublisher/index.js\";\nimport { CreateRoleUseCase as UseCaseAbstraction } from \"./abstractions.js\";\nimport { RolesRepository } from \"../shared/abstractions.js\";\nimport { IdentityContext } from \"../../IdentityContext/abstractions.js\";\nimport { createRoleValidation } from \"./schema.js\";\nimport { RoleBeforeCreateEvent, RoleAfterCreateEvent } from \"./events.js\";\nimport type { Role, CreateRoleInput } from \"../shared/types.js\";\nimport { NotAuthorizedError, RoleExistsError, RoleValidationError } from \"../shared/errors.js\";\nimport { descriptionOnCreate } from \"../../shared/description.js\";\n\nclass CreateRoleUseCaseImpl implements UseCaseAbstraction.Interface {\n    constructor(\n        private identityContext: IdentityContext.Interface,\n        private eventPublisher: EventPublisher.Interface,\n        private repository: RolesRepository.Interface\n    ) {}\n\n    async execute(input: CreateRoleInput): Promise<Result<Role, UseCaseAbstraction.Error>> {\n        const hasPermission = await this.identityContext.getPermission(\"security.role\");\n\n        if (!hasPermission) {\n            return Result.fail(new NotAuthorizedError());\n        }\n\n        const validation = createRoleValidation.safeParse(input);\n        if (!validation.success) {\n            return Result.fail(new RoleValidationError(validation.error.issues[0].message));\n        }\n\n        const identity = this.identityContext.getIdentity();\n        const data = validation.data;\n\n        // Check if role with same slug already exists\n        const existingRoleResult = await this.repository.get({ slug: data.slug });\n        if (existingRoleResult.isOk()) {\n            return Result.fail(new RoleExistsError(data.slug));\n        }\n\n        // Normalised up front so that null reaches neither the entity nor the published events.\n        const createInput: CreateRoleInput = {\n            ...data,\n            description: descriptionOnCreate(data.description)\n        };\n\n        const role: Role = {\n            id: mdbid(),\n            name: createInput.name,\n            slug: createInput.slug,\n            description: descriptionOnCreate(createInput.description),\n            permissions: createInput.permissions,\n            system: input.system || false,\n            createdOn: new Date().toISOString(),\n            createdBy: {\n                id: identity.id,\n                displayName: identity.displayName,\n                type: identity.type\n            },\n            plugin: false\n        };\n\n        await this.eventPublisher.publish(new RoleBeforeCreateEvent({ role, input: createInput }));\n\n        const result = await this.repository.create(role);\n\n        if (result.isFail()) {\n            return Result.fail(result.error);\n        }\n\n        await this.eventPublisher.publish(new RoleAfterCreateEvent({ role, input: createInput }));\n\n        return Result.ok(role);\n    }\n}\n\nexport const CreateRoleUseCase = createImplementation({\n    abstraction: UseCaseAbstraction,\n    implementation: CreateRoleUseCaseImpl,\n    dependencies: [IdentityContext, EventPublisher, RolesRepository]\n});\n"],"names":["CreateRoleUseCaseImpl","identityContext","eventPublisher","repository","input","hasPermission","Result","NotAuthorizedError","validation","createRoleValidation","RoleValidationError","identity","data","existingRoleResult","RoleExistsError","createInput","descriptionOnCreate","role","mdbid","Date","RoleBeforeCreateEvent","result","RoleAfterCreateEvent","CreateRoleUseCase","createImplementation","UseCaseAbstraction","IdentityContext","EventPublisher","RolesRepository"],"mappings":";;;;;;;;;;AAaA,MAAMA;IACF,YACYC,eAA0C,EAC1CC,cAAwC,EACxCC,UAAqC,CAC/C;aAHUF,eAAe,GAAfA;aACAC,cAAc,GAAdA;aACAC,UAAU,GAAVA;IACT;IAEH,MAAM,QAAQC,KAAsB,EAAmD;QACnF,MAAMC,gBAAgB,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC;QAE/D,IAAI,CAACA,eACD,OAAOC,OAAO,IAAI,CAAC,IAAIC;QAG3B,MAAMC,aAAaC,qBAAqB,SAAS,CAACL;QAClD,IAAI,CAACI,WAAW,OAAO,EACnB,OAAOF,OAAO,IAAI,CAAC,IAAII,oBAAoBF,WAAW,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO;QAGjF,MAAMG,WAAW,IAAI,CAAC,eAAe,CAAC,WAAW;QACjD,MAAMC,OAAOJ,WAAW,IAAI;QAG5B,MAAMK,qBAAqB,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAMD,KAAK,IAAI;QAAC;QACvE,IAAIC,mBAAmB,IAAI,IACvB,OAAOP,OAAO,IAAI,CAAC,IAAIQ,gBAAgBF,KAAK,IAAI;QAIpD,MAAMG,cAA+B;YACjC,GAAGH,IAAI;YACP,aAAaI,oBAAoBJ,KAAK,WAAW;QACrD;QAEA,MAAMK,OAAa;YACf,IAAIC;YACJ,MAAMH,YAAY,IAAI;YACtB,MAAMA,YAAY,IAAI;YACtB,aAAaC,oBAAoBD,YAAY,WAAW;YACxD,aAAaA,YAAY,WAAW;YACpC,QAAQX,MAAM,MAAM,IAAI;YACxB,WAAW,IAAIe,OAAO,WAAW;YACjC,WAAW;gBACP,IAAIR,SAAS,EAAE;gBACf,aAAaA,SAAS,WAAW;gBACjC,MAAMA,SAAS,IAAI;YACvB;YACA,QAAQ;QACZ;QAEA,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAIS,sBAAsB;YAAEH;YAAM,OAAOF;QAAY;QAEvF,MAAMM,SAAS,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAACJ;QAE5C,IAAII,OAAO,MAAM,IACb,OAAOf,OAAO,IAAI,CAACe,OAAO,KAAK;QAGnC,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAIC,qBAAqB;YAAEL;YAAM,OAAOF;QAAY;QAEtF,OAAOT,OAAO,EAAE,CAACW;IACrB;AACJ;AAEO,MAAMM,sCAAoBC,qBAAqB;IAClD,aAAaC;IACb,gBAAgBzB;IAChB,cAAc;QAAC0B;QAAiBC;QAAgBC;KAAgB;AACpE"}

package/features/security/roles/CreateRole/schema.d.ts

@@ -2,7 +2,7 @@ import { z } from "zod";
 export declare const createRoleValidation: z.ZodObject<{
     name: z.ZodString;
     slug: z.ZodString;
-    description: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     permissions: z.ZodArray<z.ZodObject<{
         name: z.ZodString;
     }, z.core.$loose>>;

package/features/security/roles/CreateRole/schema.js

@@ -2,7 +2,7 @@ import { z } from "zod";
 const createRoleValidation = z.object({
     name: z.string().min(3),
     slug: z.string().min(3),
-    description: z.string().max(500).optional().default(""),
+    description: z.string().max(500).nullish(),
     permissions: z.array(z.looseObject({
         name: z.string()
     }))

package/features/security/roles/CreateRole/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"features/security/roles/CreateRole/schema.js","sources":["../../../../../src/features/security/roles/CreateRole/schema.ts"],"sourcesContent":["import { z } from \"zod\";\n\nexport const createRoleValidation = z.object({\n    name: z.string().min(3),\n    slug: z.string().min(3),\n    description: z.string().max(500).optional().default(\"\"),\n    permissions: z.array(z.looseObject({ name: z.string() }))\n});\n"],"names":["createRoleValidation","z"],"mappings":";AAEO,MAAMA,uBAAuBC,EAAE,MAAM,CAAC;IACzC,MAAMA,EAAE,MAAM,GAAG,GAAG,CAAC;IACrB,MAAMA,EAAE,MAAM,GAAG,GAAG,CAAC;IACrB,aAAaA,EAAE,MAAM,GAAG,GAAG,CAAC,KAAK,QAAQ,GAAG,OAAO,CAAC;IACpD,aAAaA,EAAE,KAAK,CAACA,EAAE,WAAW,CAAC;QAAE,MAAMA,EAAE,MAAM;IAAG;AAC1D"}
+{"version":3,"file":"features/security/roles/CreateRole/schema.js","sources":["../../../../../src/features/security/roles/CreateRole/schema.ts"],"sourcesContent":["import { z } from \"zod\";\n\nexport const createRoleValidation = z.object({\n    name: z.string().min(3),\n    slug: z.string().min(3),\n    // Nullable in the GraphQL schema - see `descriptionOnCreate` for why this is `.nullish()`.\n    // `.optional().default(\"\")` did NOT cover this: Zod applies a default to `undefined` only, so\n    // an explicit null still failed validation.\n    description: z.string().max(500).nullish(),\n    permissions: z.array(z.looseObject({ name: z.string() }))\n});\n"],"names":["createRoleValidation","z"],"mappings":";AAEO,MAAMA,uBAAuBC,EAAE,MAAM,CAAC;IACzC,MAAMA,EAAE,MAAM,GAAG,GAAG,CAAC;IACrB,MAAMA,EAAE,MAAM,GAAG,GAAG,CAAC;IAIrB,aAAaA,EAAE,MAAM,GAAG,GAAG,CAAC,KAAK,OAAO;IACxC,aAAaA,EAAE,KAAK,CAACA,EAAE,WAAW,CAAC;QAAE,MAAMA,EAAE,MAAM;IAAG;AAC1D"}

package/features/security/roles/Installer/RolesInstaller.js

@@ -15,7 +15,6 @@ class RolesInstallerImpl {
     }
     async install() {
         const rolesResult = await this.listRolesUseCase.execute();
-        if (rolesResult.isFail()) throw rolesResult.error;
         const roles = rolesResult.value;
         if (!roles.find((g)=>"full-access" === g.slug)) {
             const result = await this.createRoleUseCase.execute({

package/features/security/roles/Installer/RolesInstaller.js.map

@@ -1 +1 @@
-{"version":3,"file":"features/security/roles/Installer/RolesInstaller.js","sources":["../../../../../src/features/security/roles/Installer/RolesInstaller.ts"],"sourcesContent":["import { AppInstaller } from \"~/features/tenancy/InstallTenant/index.js\";\nimport { createImplementation } from \"@webiny/feature/api\";\nimport { Role } from \"../shared/types.js\";\nimport { ListRolesUseCase } from \"~/features/security/roles/ListRoles/index.js\";\nimport { CreateRoleUseCase } from \"~/features/security/roles/CreateRole/index.js\";\nimport { DeleteRoleUseCase } from \"~/features/security/roles/DeleteRole/index.js\";\n\nclass RolesInstallerImpl implements AppInstaller.Interface {\n    readonly alwaysRun = true;\n    readonly appName = \"Security\";\n    readonly dependsOn = [];\n    private createdRoles: Role[] = [];\n\n    constructor(\n        private listRolesUseCase: ListRolesUseCase.Interface,\n        private createRoleUseCase: CreateRoleUseCase.Interface,\n        private deleteRoleUseCase: DeleteRoleUseCase.Interface\n    ) {}\n\n    async install(): Promise<void> {\n        const rolesResult = await this.listRolesUseCase.execute();\n        if (rolesResult.isFail()) {\n            throw rolesResult.error;\n        }\n        const roles = rolesResult.value;\n\n        if (!roles.find(g => g.slug === \"full-access\")) {\n            const result = await this.createRoleUseCase.execute({\n                name: \"Full Access\",\n                description: \"Grants full access to all apps.\",\n                system: true,\n                slug: \"full-access\",\n                permissions: [{ name: \"*\" }]\n            });\n\n            if (result.isFail()) {\n                throw result.error;\n            }\n\n            this.createdRoles.push(result.value);\n        }\n    }\n\n    async uninstall(): Promise<void> {\n        for (const role of this.createdRoles) {\n            await this.deleteRoleUseCase.execute(role.id);\n        }\n    }\n}\n\nexport const RoleInstaller = createImplementation({\n    abstraction: AppInstaller,\n    implementation: RolesInstallerImpl,\n    dependencies: [ListRolesUseCase, CreateRoleUseCase, DeleteRoleUseCase]\n});\n"],"names":["RolesInstallerImpl","listRolesUseCase","createRoleUseCase","deleteRoleUseCase","rolesResult","roles","g","result","role","RoleInstaller","createImplementation","AppInstaller","ListRolesUseCase","CreateRoleUseCase","DeleteRoleUseCase"],"mappings":";;;;;AAOA,MAAMA;IAMF,YACYC,gBAA4C,EAC5CC,iBAA8C,EAC9CC,iBAA8C,CACxD;aAHUF,gBAAgB,GAAhBA;aACAC,iBAAiB,GAAjBA;aACAC,iBAAiB,GAAjBA;aARH,SAAS,GAAG;aACZ,OAAO,GAAG;aACV,SAAS,GAAG,EAAE;aACf,YAAY,GAAW,EAAE;IAM9B;IAEH,MAAM,UAAyB;QAC3B,MAAMC,cAAc,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO;QACvD,IAAIA,YAAY,MAAM,IAClB,MAAMA,YAAY,KAAK;QAE3B,MAAMC,QAAQD,YAAY,KAAK;QAE/B,IAAI,CAACC,MAAM,IAAI,CAACC,CAAAA,IAAKA,AAAW,kBAAXA,EAAE,IAAI,GAAqB;YAC5C,MAAMC,SAAS,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;gBAChD,MAAM;gBACN,aAAa;gBACb,QAAQ;gBACR,MAAM;gBACN,aAAa;oBAAC;wBAAE,MAAM;oBAAI;iBAAE;YAChC;YAEA,IAAIA,OAAO,MAAM,IACb,MAAMA,OAAO,KAAK;YAGtB,IAAI,CAAC,YAAY,CAAC,IAAI,CAACA,OAAO,KAAK;QACvC;IACJ;IAEA,MAAM,YAA2B;QAC7B,KAAK,MAAMC,QAAQ,IAAI,CAAC,YAAY,CAChC,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAACA,KAAK,EAAE;IAEpD;AACJ;AAEO,MAAMC,gBAAgBC,qBAAqB;IAC9C,aAAaC;IACb,gBAAgBX;IAChB,cAAc;QAACY;QAAkBC;QAAmBC;KAAkB;AAC1E"}
+{"version":3,"file":"features/security/roles/Installer/RolesInstaller.js","sources":["../../../../../src/features/security/roles/Installer/RolesInstaller.ts"],"sourcesContent":["import { AppInstaller } from \"~/features/tenancy/InstallTenant/index.js\";\nimport { createImplementation } from \"@webiny/feature/api\";\nimport { Role } from \"../shared/types.js\";\nimport { ListRolesUseCase } from \"~/features/security/roles/ListRoles/index.js\";\nimport { CreateRoleUseCase } from \"~/features/security/roles/CreateRole/index.js\";\nimport { DeleteRoleUseCase } from \"~/features/security/roles/DeleteRole/index.js\";\n\nclass RolesInstallerImpl implements AppInstaller.Interface {\n    readonly alwaysRun = true;\n    readonly appName = \"Security\";\n    readonly dependsOn = [];\n    private createdRoles: Role[] = [];\n\n    constructor(\n        private listRolesUseCase: ListRolesUseCase.Interface,\n        private createRoleUseCase: CreateRoleUseCase.Interface,\n        private deleteRoleUseCase: DeleteRoleUseCase.Interface\n    ) {}\n\n    async install(): Promise<void> {\n        const rolesResult = await this.listRolesUseCase.execute();\n        const roles = rolesResult.value;\n\n        if (!roles.find(g => g.slug === \"full-access\")) {\n            const result = await this.createRoleUseCase.execute({\n                name: \"Full Access\",\n                description: \"Grants full access to all apps.\",\n                system: true,\n                slug: \"full-access\",\n                permissions: [{ name: \"*\" }]\n            });\n\n            if (result.isFail()) {\n                throw result.error;\n            }\n\n            this.createdRoles.push(result.value);\n        }\n    }\n\n    async uninstall(): Promise<void> {\n        for (const role of this.createdRoles) {\n            await this.deleteRoleUseCase.execute(role.id);\n        }\n    }\n}\n\nexport const RoleInstaller = createImplementation({\n    abstraction: AppInstaller,\n    implementation: RolesInstallerImpl,\n    dependencies: [ListRolesUseCase, CreateRoleUseCase, DeleteRoleUseCase]\n});\n"],"names":["RolesInstallerImpl","listRolesUseCase","createRoleUseCase","deleteRoleUseCase","rolesResult","roles","g","result","role","RoleInstaller","createImplementation","AppInstaller","ListRolesUseCase","CreateRoleUseCase","DeleteRoleUseCase"],"mappings":";;;;;AAOA,MAAMA;IAMF,YACYC,gBAA4C,EAC5CC,iBAA8C,EAC9CC,iBAA8C,CACxD;aAHUF,gBAAgB,GAAhBA;aACAC,iBAAiB,GAAjBA;aACAC,iBAAiB,GAAjBA;aARH,SAAS,GAAG;aACZ,OAAO,GAAG;aACV,SAAS,GAAG,EAAE;aACf,YAAY,GAAW,EAAE;IAM9B;IAEH,MAAM,UAAyB;QAC3B,MAAMC,cAAc,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO;QACvD,MAAMC,QAAQD,YAAY,KAAK;QAE/B,IAAI,CAACC,MAAM,IAAI,CAACC,CAAAA,IAAKA,AAAW,kBAAXA,EAAE,IAAI,GAAqB;YAC5C,MAAMC,SAAS,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;gBAChD,MAAM;gBACN,aAAa;gBACb,QAAQ;gBACR,MAAM;gBACN,aAAa;oBAAC;wBAAE,MAAM;oBAAI;iBAAE;YAChC;YAEA,IAAIA,OAAO,MAAM,IACb,MAAMA,OAAO,KAAK;YAGtB,IAAI,CAAC,YAAY,CAAC,IAAI,CAACA,OAAO,KAAK;QACvC;IACJ;IAEA,MAAM,YAA2B;QAC7B,KAAK,MAAMC,QAAQ,IAAI,CAAC,YAAY,CAChC,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAACA,KAAK,EAAE;IAEpD;AACJ;AAEO,MAAMC,gBAAgBC,qBAAqB;IAC9C,aAAaC;IACb,gBAAgBX;IAChB,cAAc;QAACY;QAAkBC;QAAmBC;KAAkB;AAC1E"}

package/features/security/roles/UpdateRole/UpdateRoleUseCase.js

@@ -5,6 +5,7 @@ import { IdentityContext } from "../../IdentityContext/abstractions.js";
 import { EventPublisher } from "../../../eventPublisher/index.js";
 import { updateRoleValidation } from "./schema.js";
 import { RoleAfterUpdateEvent, RoleBeforeUpdateEvent } from "./events.js";
+import { descriptionOnUpdate } from "../../shared/description.js";
 import { CannotUpdatePluginRolesError, NotAuthorizedError, RoleValidationError } from "../shared/errors.js";
 class UpdateRoleUseCaseImpl {
     constructor(repository, identityContext, eventPublisher){
@@ -23,21 +24,26 @@ class UpdateRoleUseCaseImpl {
         if (existingResult.isFail()) return Result.fail(existingResult.error);
         const existingRole = existingResult.value;
         if (existingRole.plugin) return Result.fail(new CannotUpdatePluginRolesError());
+        const { description, ...rest } = validation.data;
+        const changes = {
+            ...rest,
+            ...descriptionOnUpdate(description)
+        };
         const updatedRole = {
             ...existingRole,
-            ...validation.data
+            ...changes
         };
         await this.eventPublisher.publish(new RoleBeforeUpdateEvent({
             original: existingRole,
             updated: updatedRole,
-            input: validation.data
+            input: changes
         }));
         const result = await this.repository.update(updatedRole);
         if (result.isFail()) return Result.fail(result.error);
         await this.eventPublisher.publish(new RoleAfterUpdateEvent({
             original: existingRole,
             updated: updatedRole,
-            input: validation.data
+            input: changes
         }));
         return Result.ok(updatedRole);
     }

package/features/security/roles/UpdateRole/UpdateRoleUseCase.js.map

@@ -1 +1 @@
-{"version":3,"file":"features/security/roles/UpdateRole/UpdateRoleUseCase.js","sources":["../../../../../src/features/security/roles/UpdateRole/UpdateRoleUseCase.ts"],"sourcesContent":["import { Result } from \"@webiny/feature/api\";\nimport { UpdateRoleUseCase as UseCase } from \"./abstractions.js\";\nimport { RolesRepository } from \"../shared/abstractions.js\";\nimport { IdentityContext } from \"../../IdentityContext/abstractions.js\";\nimport { EventPublisher } from \"~/features/eventPublisher/index.js\";\nimport { updateRoleValidation } from \"./schema.js\";\nimport { RoleBeforeUpdateEvent, RoleAfterUpdateEvent } from \"./events.js\";\nimport type { Role, UpdateRoleInput } from \"../shared/types.js\";\nimport {\n    NotAuthorizedError,\n    CannotUpdatePluginRolesError,\n    RoleValidationError\n} from \"../shared/errors.js\";\n\nclass UpdateRoleUseCaseImpl implements UseCase.Interface {\n    private repository: RolesRepository.Interface;\n    private identityContext: IdentityContext.Interface;\n    private eventPublisher: EventPublisher.Interface;\n\n    constructor(\n        repository: RolesRepository.Interface,\n        identityContext: IdentityContext.Interface,\n        eventPublisher: EventPublisher.Interface\n    ) {\n        this.repository = repository;\n        this.identityContext = identityContext;\n        this.eventPublisher = eventPublisher;\n    }\n\n    async execute(id: string, input: UpdateRoleInput): Promise<Result<Role, UseCase.Error>> {\n        const hasPermission = await this.identityContext.getPermission(\"security.role\");\n        if (!hasPermission) {\n            return Result.fail(new NotAuthorizedError());\n        }\n\n        const validation = updateRoleValidation.safeParse(input);\n        if (!validation.success) {\n            return Result.fail(new RoleValidationError(validation.error.issues[0].message));\n        }\n\n        const existingResult = await this.repository.get({ id });\n        if (existingResult.isFail()) {\n            return Result.fail(existingResult.error);\n        }\n\n        const existingRole = existingResult.value;\n\n        // Check if role is created via plugin\n        if (existingRole.plugin) {\n            return Result.fail(new CannotUpdatePluginRolesError());\n        }\n\n        const updatedRole: Role = {\n            ...existingRole,\n            ...validation.data\n        };\n\n        await this.eventPublisher.publish(\n            new RoleBeforeUpdateEvent({\n                original: existingRole,\n                updated: updatedRole,\n                input: validation.data\n            })\n        );\n\n        const result = await this.repository.update(updatedRole);\n\n        if (result.isFail()) {\n            return Result.fail(result.error);\n        }\n\n        await this.eventPublisher.publish(\n            new RoleAfterUpdateEvent({\n                original: existingRole,\n                updated: updatedRole,\n                input: validation.data\n            })\n        );\n\n        return Result.ok(updatedRole);\n    }\n}\n\nexport const UpdateRoleUseCase = UseCase.createImplementation({\n    implementation: UpdateRoleUseCaseImpl,\n    dependencies: [RolesRepository, IdentityContext, EventPublisher]\n});\n"],"names":["UpdateRoleUseCaseImpl","repository","identityContext","eventPublisher","id","input","hasPermission","Result","NotAuthorizedError","validation","updateRoleValidation","RoleValidationError","existingResult","existingRole","CannotUpdatePluginRolesError","updatedRole","RoleBeforeUpdateEvent","result","RoleAfterUpdateEvent","UpdateRoleUseCase","UseCase","RolesRepository","IdentityContext","EventPublisher"],"mappings":";;;;;;;;AAcA,MAAMA;IAKF,YACIC,UAAqC,EACrCC,eAA0C,EAC1CC,cAAwC,CAC1C;QACE,IAAI,CAAC,UAAU,GAAGF;QAClB,IAAI,CAAC,eAAe,GAAGC;QACvB,IAAI,CAAC,cAAc,GAAGC;IAC1B;IAEA,MAAM,QAAQC,EAAU,EAAEC,KAAsB,EAAwC;QACpF,MAAMC,gBAAgB,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC;QAC/D,IAAI,CAACA,eACD,OAAOC,OAAO,IAAI,CAAC,IAAIC;QAG3B,MAAMC,aAAaC,qBAAqB,SAAS,CAACL;QAClD,IAAI,CAACI,WAAW,OAAO,EACnB,OAAOF,OAAO,IAAI,CAAC,IAAII,oBAAoBF,WAAW,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO;QAGjF,MAAMG,iBAAiB,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAER;QAAG;QACtD,IAAIQ,eAAe,MAAM,IACrB,OAAOL,OAAO,IAAI,CAACK,eAAe,KAAK;QAG3C,MAAMC,eAAeD,eAAe,KAAK;QAGzC,IAAIC,aAAa,MAAM,EACnB,OAAON,OAAO,IAAI,CAAC,IAAIO;QAG3B,MAAMC,cAAoB;YACtB,GAAGF,YAAY;YACf,GAAGJ,WAAW,IAAI;QACtB;QAEA,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAC7B,IAAIO,sBAAsB;YACtB,UAAUH;YACV,SAASE;YACT,OAAON,WAAW,IAAI;QAC1B;QAGJ,MAAMQ,SAAS,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAACF;QAE5C,IAAIE,OAAO,MAAM,IACb,OAAOV,OAAO,IAAI,CAACU,OAAO,KAAK;QAGnC,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAC7B,IAAIC,qBAAqB;YACrB,UAAUL;YACV,SAASE;YACT,OAAON,WAAW,IAAI;QAC1B;QAGJ,OAAOF,OAAO,EAAE,CAACQ;IACrB;AACJ;AAEO,MAAMI,sCAAoBC,kBAAAA,oBAA4B,CAAC;IAC1D,gBAAgBpB;IAChB,cAAc;QAACqB;QAAiBC;QAAiBC;KAAe;AACpE"}
+{"version":3,"file":"features/security/roles/UpdateRole/UpdateRoleUseCase.js","sources":["../../../../../src/features/security/roles/UpdateRole/UpdateRoleUseCase.ts"],"sourcesContent":["import { Result } from \"@webiny/feature/api\";\nimport { UpdateRoleUseCase as UseCase } from \"./abstractions.js\";\nimport { RolesRepository } from \"../shared/abstractions.js\";\nimport { IdentityContext } from \"../../IdentityContext/abstractions.js\";\nimport { EventPublisher } from \"~/features/eventPublisher/index.js\";\nimport { updateRoleValidation } from \"./schema.js\";\nimport { RoleBeforeUpdateEvent, RoleAfterUpdateEvent } from \"./events.js\";\nimport type { Role, UpdateRoleInput } from \"../shared/types.js\";\nimport { descriptionOnUpdate } from \"../../shared/description.js\";\nimport {\n    NotAuthorizedError,\n    CannotUpdatePluginRolesError,\n    RoleValidationError\n} from \"../shared/errors.js\";\n\nclass UpdateRoleUseCaseImpl implements UseCase.Interface {\n    private repository: RolesRepository.Interface;\n    private identityContext: IdentityContext.Interface;\n    private eventPublisher: EventPublisher.Interface;\n\n    constructor(\n        repository: RolesRepository.Interface,\n        identityContext: IdentityContext.Interface,\n        eventPublisher: EventPublisher.Interface\n    ) {\n        this.repository = repository;\n        this.identityContext = identityContext;\n        this.eventPublisher = eventPublisher;\n    }\n\n    async execute(id: string, input: UpdateRoleInput): Promise<Result<Role, UseCase.Error>> {\n        const hasPermission = await this.identityContext.getPermission(\"security.role\");\n        if (!hasPermission) {\n            return Result.fail(new NotAuthorizedError());\n        }\n\n        const validation = updateRoleValidation.safeParse(input);\n        if (!validation.success) {\n            return Result.fail(new RoleValidationError(validation.error.issues[0].message));\n        }\n\n        const existingResult = await this.repository.get({ id });\n        if (existingResult.isFail()) {\n            return Result.fail(existingResult.error);\n        }\n\n        const existingRole = existingResult.value;\n\n        // Check if role is created via plugin\n        if (existingRole.plugin) {\n            return Result.fail(new CannotUpdatePluginRolesError());\n        }\n\n        // `description` is pulled out of the spread because it is the one field that accepts null.\n        // Normalising it here keeps null out of both the entity and the published events, whose\n        // input type declares `description?: string`.\n        const { description, ...rest } = validation.data;\n\n        const changes: UpdateRoleInput = {\n            ...rest,\n            ...descriptionOnUpdate(description)\n        };\n\n        const updatedRole: Role = {\n            ...existingRole,\n            ...changes\n        };\n\n        await this.eventPublisher.publish(\n            new RoleBeforeUpdateEvent({\n                original: existingRole,\n                updated: updatedRole,\n                input: changes\n            })\n        );\n\n        const result = await this.repository.update(updatedRole);\n\n        if (result.isFail()) {\n            return Result.fail(result.error);\n        }\n\n        await this.eventPublisher.publish(\n            new RoleAfterUpdateEvent({\n                original: existingRole,\n                updated: updatedRole,\n                input: changes\n            })\n        );\n\n        return Result.ok(updatedRole);\n    }\n}\n\nexport const UpdateRoleUseCase = UseCase.createImplementation({\n    implementation: UpdateRoleUseCaseImpl,\n    dependencies: [RolesRepository, IdentityContext, EventPublisher]\n});\n"],"names":["UpdateRoleUseCaseImpl","repository","identityContext","eventPublisher","id","input","hasPermission","Result","NotAuthorizedError","validation","updateRoleValidation","RoleValidationError","existingResult","existingRole","CannotUpdatePluginRolesError","description","rest","changes","descriptionOnUpdate","updatedRole","RoleBeforeUpdateEvent","result","RoleAfterUpdateEvent","UpdateRoleUseCase","UseCase","RolesRepository","IdentityContext","EventPublisher"],"mappings":";;;;;;;;;AAeA,MAAMA;IAKF,YACIC,UAAqC,EACrCC,eAA0C,EAC1CC,cAAwC,CAC1C;QACE,IAAI,CAAC,UAAU,GAAGF;QAClB,IAAI,CAAC,eAAe,GAAGC;QACvB,IAAI,CAAC,cAAc,GAAGC;IAC1B;IAEA,MAAM,QAAQC,EAAU,EAAEC,KAAsB,EAAwC;QACpF,MAAMC,gBAAgB,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC;QAC/D,IAAI,CAACA,eACD,OAAOC,OAAO,IAAI,CAAC,IAAIC;QAG3B,MAAMC,aAAaC,qBAAqB,SAAS,CAACL;QAClD,IAAI,CAACI,WAAW,OAAO,EACnB,OAAOF,OAAO,IAAI,CAAC,IAAII,oBAAoBF,WAAW,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO;QAGjF,MAAMG,iBAAiB,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAER;QAAG;QACtD,IAAIQ,eAAe,MAAM,IACrB,OAAOL,OAAO,IAAI,CAACK,eAAe,KAAK;QAG3C,MAAMC,eAAeD,eAAe,KAAK;QAGzC,IAAIC,aAAa,MAAM,EACnB,OAAON,OAAO,IAAI,CAAC,IAAIO;QAM3B,MAAM,EAAEC,WAAW,EAAE,GAAGC,MAAM,GAAGP,WAAW,IAAI;QAEhD,MAAMQ,UAA2B;YAC7B,GAAGD,IAAI;YACP,GAAGE,oBAAoBH,YAAY;QACvC;QAEA,MAAMI,cAAoB;YACtB,GAAGN,YAAY;YACf,GAAGI,OAAO;QACd;QAEA,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAC7B,IAAIG,sBAAsB;YACtB,UAAUP;YACV,SAASM;YACT,OAAOF;QACX;QAGJ,MAAMI,SAAS,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAACF;QAE5C,IAAIE,OAAO,MAAM,IACb,OAAOd,OAAO,IAAI,CAACc,OAAO,KAAK;QAGnC,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAC7B,IAAIC,qBAAqB;YACrB,UAAUT;YACV,SAASM;YACT,OAAOF;QACX;QAGJ,OAAOV,OAAO,EAAE,CAACY;IACrB;AACJ;AAEO,MAAMI,sCAAoBC,kBAAAA,oBAA4B,CAAC;IAC1D,gBAAgBxB;IAChB,cAAc;QAACyB;QAAiBC;QAAiBC;KAAe;AACpE"}

package/features/security/roles/UpdateRole/schema.d.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 export declare const updateRoleValidation: z.ZodObject<{
     name: z.ZodOptional<z.ZodString>;
-    description: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     permissions: z.ZodOptional<z.ZodArray<z.ZodObject<{
         name: z.ZodString;
     }, z.core.$loose>>>;

package/features/security/roles/UpdateRole/schema.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 const updateRoleValidation = z.object({
     name: z.string().min(3).optional(),
-    description: z.string().max(500).optional(),
+    description: z.string().max(500).nullish(),
     permissions: z.array(z.looseObject({
         name: z.string()
     })).optional()

package/features/security/roles/UpdateRole/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"features/security/roles/UpdateRole/schema.js","sources":["../../../../../src/features/security/roles/UpdateRole/schema.ts"],"sourcesContent":["import { z } from \"zod\";\n\nexport const updateRoleValidation = z.object({\n    name: z.string().min(3).optional(),\n    description: z.string().max(500).optional(),\n    permissions: z.array(z.looseObject({ name: z.string() })).optional()\n});\n"],"names":["updateRoleValidation","z"],"mappings":";AAEO,MAAMA,uBAAuBC,EAAE,MAAM,CAAC;IACzC,MAAMA,EAAE,MAAM,GAAG,GAAG,CAAC,GAAG,QAAQ;IAChC,aAAaA,EAAE,MAAM,GAAG,GAAG,CAAC,KAAK,QAAQ;IACzC,aAAaA,EAAE,KAAK,CAACA,EAAE,WAAW,CAAC;QAAE,MAAMA,EAAE,MAAM;IAAG,IAAI,QAAQ;AACtE"}
+{"version":3,"file":"features/security/roles/UpdateRole/schema.js","sources":["../../../../../src/features/security/roles/UpdateRole/schema.ts"],"sourcesContent":["import { z } from \"zod\";\n\nexport const updateRoleValidation = z.object({\n    name: z.string().min(3).optional(),\n    // Nullable in the GraphQL schema - see `descriptionOnUpdate` for why this is `.nullish()` and\n    // must not carry a `.transform()`.\n    description: z.string().max(500).nullish(),\n    permissions: z.array(z.looseObject({ name: z.string() })).optional()\n});\n"],"names":["updateRoleValidation","z"],"mappings":";AAEO,MAAMA,uBAAuBC,EAAE,MAAM,CAAC;IACzC,MAAMA,EAAE,MAAM,GAAG,GAAG,CAAC,GAAG,QAAQ;IAGhC,aAAaA,EAAE,MAAM,GAAG,GAAG,CAAC,KAAK,OAAO;IACxC,aAAaA,EAAE,KAAK,CAACA,EAAE,WAAW,CAAC;QAAE,MAAMA,EAAE,MAAM;IAAG,IAAI,QAAQ;AACtE"}

package/features/security/shared/description.d.ts

@@ -0,0 +1,4 @@
+export declare const descriptionOnCreate: (value: string | null | undefined) => string;
+export declare const descriptionOnUpdate: (value: string | null | undefined) => {
+    description?: string;
+};

package/features/security/shared/description.js

@@ -0,0 +1,7 @@
+const descriptionOnCreate = (value)=>value ?? "";
+const descriptionOnUpdate = (value)=>void 0 === value ? {} : {
+        description: value ?? ""
+    };
+export { descriptionOnCreate, descriptionOnUpdate };
+
+//# sourceMappingURL=description.js.map

package/features/security/shared/description.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/shared/description.js","sources":["../../../../src/features/security/shared/description.ts"],"sourcesContent":["// Roles, teams and API keys all declare `description: String` in the GraphQL schema - nullable -\n// while their domain types store a plain string and use \"\" to mean \"no description\". Clients\n// therefore legitimately send null, and the admin app does exactly that: it reads an entity saved\n// without a description and submits the edit form again unchanged.\n//\n// Zod's `.optional()` accepts only `undefined`, so those requests used to fail with\n// \"Invalid input: expected string, received null\". The input schemas use `.nullish()` instead, and\n// these two helpers map what comes out of them onto the domain type.\n//\n// Note the schemas must NOT do this mapping via `.transform()`: a transform makes the key required\n// in the parsed output rather than optional, so spreading a parsed update onto a stored entity\n// would write `description: undefined` and wipe the stored value on every partial update.\n\nexport const descriptionOnCreate = (value: string | null | undefined): string => value ?? \"\";\n\n// Returns a patch rather than a value, because on a partial update an absent `description` has to\n// leave the stored one alone, while an explicit null clears it.\nexport const descriptionOnUpdate = (value: string | null | undefined): { description?: string } =>\n    value === undefined ? {} : { description: value ?? \"\" };\n"],"names":["descriptionOnCreate","value","descriptionOnUpdate","undefined"],"mappings":"AAaO,MAAMA,sBAAsB,CAACC,QAA6CA,SAAS;AAInF,MAAMC,sBAAsB,CAACD,QAChCA,AAAUE,WAAVF,QAAsB,CAAC,IAAI;QAAE,aAAaA,SAAS;IAAG"}

package/features/security/shared/index.d.ts

@@ -1,2 +1,3 @@
 export * from "./abstractions.js";
+export * from "./description.js";
 export * from "./errors.js";

package/features/security/shared/index.js

@@ -1,2 +1,3 @@
 export * from "./abstractions.js";
+export * from "./description.js";
 export * from "./errors.js";

package/features/security/teams/CreateTeam/CreateTeamUseCase.d.ts

@@ -2,13 +2,15 @@ import { Result } from "@webiny/feature/api";
 import { EventPublisher } from "../../../../features/eventPublisher/index.js";
 import { CreateTeam } from "./abstractions.js";
 import { TeamsRepository } from "../shared/abstractions.js";
+import { RolesRepository } from "../../roles/shared/abstractions.js";
 import { IdentityContext } from "../../IdentityContext/abstractions.js";
 import type { Team, CreateTeamInput } from "../shared/types.js";
 export declare class CreateTeamUseCase implements CreateTeam.Interface {
     private identityContext;
     private eventPublisher;
     private repository;
-    constructor(identityContext: IdentityContext.Interface, eventPublisher: EventPublisher.Interface, repository: TeamsRepository.Interface);
+    private rolesRepository;
+    constructor(identityContext: IdentityContext.Interface, eventPublisher: EventPublisher.Interface, repository: TeamsRepository.Interface, rolesRepository: RolesRepository.Interface);
     execute(input: CreateTeamInput): Promise<Result<Team, CreateTeam.Error>>;
 }
 export declare const CreateTeamUseCaseImpl: import("@webiny/di").Implementation<typeof CreateTeamUseCase>;