@webiny/api-headless-cms-workflows 0.0.0-unstable.7c2def32a7 → 0.0.0-unstable.9609e4e0c9

package/features/target/CmsEntryReviewTargetReadAccess.js

@@ -0,0 +1,91 @@
+import { GetModelUseCase } from "@webiny/api-headless-cms/features/contentModel/GetModel/index.js";
+import { ROOT_FOLDER } from "@webiny/api-headless-cms/constants.js";
+import { ReviewTargetReadAccess } from "@webiny/api-workflows/features/review/ReviewTargetReadAccess/index.js";
+import { CandidateReadAccess } from "@webiny/api-workflows/features/identity/CandidateReadAccess/index.js";
+import { getModelIdFromAppName, isCmsNamespace } from "../../utils/appName.js";
+import { CmsEntryTargetReader } from "./CmsEntryTargetReader/index.js";
+import { CmsEntryAccess } from "./CmsEntryAccess/index.js";
+import { CmsModelGroupService } from "./CmsModelGroupService/index.js";
+import { CandidateFolderReadRules } from "./CandidateFolderReadRules/index.js";
+class CmsEntryReviewTargetReadAccessImpl {
+    constructor(targets, access, candidates, getModel, modelGroups, folderRules){
+        this.targets = targets;
+        this.access = access;
+        this.candidates = candidates;
+        this.getModel = getModel;
+        this.modelGroups = modelGroups;
+        this.folderRules = folderRules;
+    }
+    canHandle(model) {
+        return isCmsNamespace(model);
+    }
+    async filterReadableUsers(params) {
+        if (0 === params.users.length) return [];
+        let subject;
+        try {
+            subject = await this.readSubject(params);
+        } catch  {
+            return [];
+        }
+        if (!subject) return [];
+        const { check, folderId } = subject;
+        let folderRule;
+        if (folderId && folderId !== ROOT_FOLDER) folderRule = this.folderRules.create({
+            folderId,
+            users: params.users
+        });
+        const readable = [];
+        for (const user of params.users){
+            if (void 0 !== params.limit && readable.length >= params.limit) break;
+            const canRead = await this.candidates.canUserRead(user, ()=>check(folderRule));
+            if (canRead) readable.push(user.id);
+        }
+        return readable;
+    }
+    async readSubject(params) {
+        if ("target" === params.read.type) {
+            const { targetId } = params.read;
+            const target = await this.targets.read({
+                model: params.model,
+                targetRevisionId: params.read.targetRevisionId
+            });
+            if (!target || target.entry.entryId !== targetId) return null;
+            return {
+                check: (folderRule)=>this.access.canRead(target, folderRule),
+                folderId: target.entry.location?.folderId ?? null
+            };
+        }
+        const modelId = getModelIdFromAppName(params.model);
+        if (!modelId) return null;
+        const modelResult = await this.getModel.execute(modelId);
+        if (modelResult.isFail() || modelResult.value.isPrivate) return null;
+        const groupResult = await this.modelGroups.getGroup(modelResult.value);
+        if (groupResult.isFail()) return null;
+        const model = modelResult.value;
+        const group = groupResult.value;
+        const { folderId } = params.read;
+        return {
+            check: (folderRule)=>this.access.canReadInFolder({
+                    model,
+                    group,
+                    folderId,
+                    folderRule
+                }),
+            folderId
+        };
+    }
+}
+const CmsEntryReviewTargetReadAccess = ReviewTargetReadAccess.createImplementation({
+    implementation: CmsEntryReviewTargetReadAccessImpl,
+    dependencies: [
+        CmsEntryTargetReader,
+        CmsEntryAccess,
+        CandidateReadAccess,
+        GetModelUseCase,
+        CmsModelGroupService,
+        CandidateFolderReadRules
+    ]
+});
+export { CmsEntryReviewTargetReadAccess };
+
+//# sourceMappingURL=CmsEntryReviewTargetReadAccess.js.map

package/features/target/CmsEntryReviewTargetReadAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/target/CmsEntryReviewTargetReadAccess.js","sources":["../../../src/features/target/CmsEntryReviewTargetReadAccess.ts"],"sourcesContent":["import type { CmsGroup, CmsModel } from \"@webiny/api-headless-cms/types/index.js\";\nimport { GetModelUseCase } from \"@webiny/api-headless-cms/features/contentModel/GetModel/index.js\";\nimport { ROOT_FOLDER } from \"@webiny/api-headless-cms/constants.js\";\nimport { ReviewTargetReadAccess } from \"@webiny/api-workflows/features/review/ReviewTargetReadAccess/index.js\";\nimport { CandidateReadAccess } from \"@webiny/api-workflows/features/identity/CandidateReadAccess/index.js\";\nimport { getModelIdFromAppName, isCmsNamespace } from \"~/utils/appName.js\";\nimport { CmsEntryTargetReader } from \"./CmsEntryTargetReader/index.js\";\nimport { CmsEntryAccess } from \"./CmsEntryAccess/index.js\";\nimport { CmsModelGroupService } from \"./CmsModelGroupService/index.js\";\nimport { CandidateFolderReadRules } from \"./CandidateFolderReadRules/index.js\";\nimport type { FolderReadRule } from \"./FolderReadRule.js\";\n\n/** What every candidate's check needs, read once per call as the current identity. */\ninterface CandidateReadSubject {\n    /** The candidate check, run as the candidate. */\n    check: (folderRule: FolderReadRule | undefined) => Promise<boolean>;\n    /** The folder a rule is needed for; `null` for the root folder. */\n    folderId: string | null;\n}\n\n/**\n * `filterReadableUsers` for `cms.*` targets (D61, D133, R48, R121). The model, group, revision and\n * the folder's permission record are read once per call, as the current identity, so nothing is\n * read as the other users (A19) and nothing is read per user (Q79); only the CMS access check\n * (group read, model read, entry and folder access, R72) runs as each user, through\n * `CandidateReadAccess` (R67), which wraps it in `withIdentity` and `withAuthorization`.\n *\n * Contract: this class does not widen access itself, and the CMS model cache is filled\n * per tenant after access filtering. A whole AI step run executes inside `withoutAuthorization`\n * (R161), so the model and group reads of the AI editor happen there; the access checks here\n * apply after the cache and run as the candidate user through `CandidateReadAccess`, the only\n * place that changes identity for the check. Any failure, including a throwing target or model\n * read, leaves the users out (fail closed, R50).\n */\nclass CmsEntryReviewTargetReadAccessImpl implements ReviewTargetReadAccess.Interface {\n    public constructor(\n        private targets: CmsEntryTargetReader.Interface,\n        private access: CmsEntryAccess.Interface,\n        private candidates: CandidateReadAccess.Interface,\n        private getModel: GetModelUseCase.Interface,\n        private modelGroups: CmsModelGroupService.Interface,\n        private folderRules: CandidateFolderReadRules.Interface\n    ) {}\n\n    public canHandle(model: string): boolean {\n        return isCmsNamespace(model);\n    }\n\n    public async filterReadableUsers(\n        params: ReviewTargetReadAccess.UsersParams\n    ): Promise<string[]> {\n        if (params.users.length === 0) {\n            return [];\n        }\n        let subject: CandidateReadSubject | null;\n        try {\n            subject = await this.readSubject(params);\n        } catch {\n            return [];\n        }\n        if (!subject) {\n            return [];\n        }\n        const { check, folderId } = subject;\n        let folderRule: FolderReadRule | undefined;\n        if (folderId && folderId !== ROOT_FOLDER) {\n            folderRule = this.folderRules.create({ folderId, users: params.users });\n        }\n\n        const readable: string[] = [];\n        // One user at a time, as that user: the check reads nothing, but each user's own\n        // permissions load once (cached per identity), so a limited call stops early.\n        for (const user of params.users) {\n            if (params.limit !== undefined && readable.length >= params.limit) {\n                break;\n            }\n            // oxlint-disable-next-line no-await-in-loop -- one user at a time, as that user; a limited call stops early.\n            const canRead = await this.candidates.canUserRead(user, () => check(folderRule));\n            if (canRead) {\n                readable.push(user.id);\n            }\n        }\n        return readable;\n    }\n\n    /**\n     * The target revision (or, for a folder without a revision, the model and group, R121) as the\n     * current identity; `null` when there is nothing anyone can read.\n     */\n    private async readSubject(\n        params: ReviewTargetReadAccess.UsersParams\n    ): Promise<CandidateReadSubject | null> {\n        if (params.read.type === \"target\") {\n            const { targetId } = params.read;\n            const target = await this.targets.read({\n                model: params.model,\n                targetRevisionId: params.read.targetRevisionId\n            });\n            if (!target || target.entry.entryId !== targetId) {\n                return null;\n            }\n            return {\n                check: folderRule => this.access.canRead(target, folderRule),\n                folderId: target.entry.location?.folderId ?? null\n            };\n        }\n\n        // Without an entry (the routing inspector): the model and folder only, so a user shown as\n        // readable can still lack access to one entry (own-only permissions, A47).\n        const modelId = getModelIdFromAppName(params.model);\n        if (!modelId) {\n            return null;\n        }\n        const modelResult = await this.getModel.execute(modelId);\n        if (modelResult.isFail() || modelResult.value.isPrivate) {\n            return null;\n        }\n        const groupResult = await this.modelGroups.getGroup(modelResult.value);\n        if (groupResult.isFail()) {\n            return null;\n        }\n        const model: CmsModel = modelResult.value;\n        const group: CmsGroup = groupResult.value;\n        const { folderId } = params.read;\n        return {\n            check: folderRule =>\n                this.access.canReadInFolder({ model, group, folderId, folderRule }),\n            folderId\n        };\n    }\n}\n\nexport const CmsEntryReviewTargetReadAccess = ReviewTargetReadAccess.createImplementation({\n    implementation: CmsEntryReviewTargetReadAccessImpl,\n    dependencies: [\n        CmsEntryTargetReader,\n        CmsEntryAccess,\n        CandidateReadAccess,\n        GetModelUseCase,\n        CmsModelGroupService,\n        CandidateFolderReadRules\n    ]\n});\n"],"names":["CmsEntryReviewTargetReadAccessImpl","targets","access","candidates","getModel","modelGroups","folderRules","model","isCmsNamespace","params","subject","check","folderId","folderRule","ROOT_FOLDER","readable","user","undefined","canRead","targetId","target","modelId","getModelIdFromAppName","modelResult","groupResult","group","CmsEntryReviewTargetReadAccess","ReviewTargetReadAccess","CmsEntryTargetReader","CmsEntryAccess","CandidateReadAccess","GetModelUseCase","CmsModelGroupService","CandidateFolderReadRules"],"mappings":";;;;;;;;;AAkCA,MAAMA;IACF,YACYC,OAAuC,EACvCC,MAAgC,EAChCC,UAAyC,EACzCC,QAAmC,EACnCC,WAA2C,EAC3CC,WAA+C,CACzD;aANUL,OAAO,GAAPA;aACAC,MAAM,GAANA;aACAC,UAAU,GAAVA;aACAC,QAAQ,GAARA;aACAC,WAAW,GAAXA;aACAC,WAAW,GAAXA;IACT;IAEI,UAAUC,KAAa,EAAW;QACrC,OAAOC,eAAeD;IAC1B;IAEA,MAAa,oBACTE,MAA0C,EACzB;QACjB,IAAIA,AAAwB,MAAxBA,OAAO,KAAK,CAAC,MAAM,EACnB,OAAO,EAAE;QAEb,IAAIC;QACJ,IAAI;YACAA,UAAU,MAAM,IAAI,CAAC,WAAW,CAACD;QACrC,EAAE,OAAM;YACJ,OAAO,EAAE;QACb;QACA,IAAI,CAACC,SACD,OAAO,EAAE;QAEb,MAAM,EAAEC,KAAK,EAAEC,QAAQ,EAAE,GAAGF;QAC5B,IAAIG;QACJ,IAAID,YAAYA,aAAaE,aACzBD,aAAa,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;YAAED;YAAU,OAAOH,OAAO,KAAK;QAAC;QAGzE,MAAMM,WAAqB,EAAE;QAG7B,KAAK,MAAMC,QAAQP,OAAO,KAAK,CAAE;YAC7B,IAAIA,AAAiBQ,WAAjBR,OAAO,KAAK,IAAkBM,SAAS,MAAM,IAAIN,OAAO,KAAK,EAC7D;YAGJ,MAAMS,UAAU,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAACF,MAAM,IAAML,MAAME;YACpE,IAAIK,SACAH,SAAS,IAAI,CAACC,KAAK,EAAE;QAE7B;QACA,OAAOD;IACX;IAMA,MAAc,YACVN,MAA0C,EACN;QACpC,IAAIA,AAAqB,aAArBA,OAAO,IAAI,CAAC,IAAI,EAAe;YAC/B,MAAM,EAAEU,QAAQ,EAAE,GAAGV,OAAO,IAAI;YAChC,MAAMW,SAAS,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;gBACnC,OAAOX,OAAO,KAAK;gBACnB,kBAAkBA,OAAO,IAAI,CAAC,gBAAgB;YAClD;YACA,IAAI,CAACW,UAAUA,OAAO,KAAK,CAAC,OAAO,KAAKD,UACpC,OAAO;YAEX,OAAO;gBACH,OAAON,CAAAA,aAAc,IAAI,CAAC,MAAM,CAAC,OAAO,CAACO,QAAQP;gBACjD,UAAUO,OAAO,KAAK,CAAC,QAAQ,EAAE,YAAY;YACjD;QACJ;QAIA,MAAMC,UAAUC,sBAAsBb,OAAO,KAAK;QAClD,IAAI,CAACY,SACD,OAAO;QAEX,MAAME,cAAc,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAACF;QAChD,IAAIE,YAAY,MAAM,MAAMA,YAAY,KAAK,CAAC,SAAS,EACnD,OAAO;QAEX,MAAMC,cAAc,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAACD,YAAY,KAAK;QACrE,IAAIC,YAAY,MAAM,IAClB,OAAO;QAEX,MAAMjB,QAAkBgB,YAAY,KAAK;QACzC,MAAME,QAAkBD,YAAY,KAAK;QACzC,MAAM,EAAEZ,QAAQ,EAAE,GAAGH,OAAO,IAAI;QAChC,OAAO;YACH,OAAOI,CAAAA,aACH,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;oBAAEN;oBAAOkB;oBAAOb;oBAAUC;gBAAW;YACrED;QACJ;IACJ;AACJ;AAEO,MAAMc,iCAAiCC,uBAAuB,oBAAoB,CAAC;IACtF,gBAAgB3B;IAChB,cAAc;QACV4B;QACAC;QACAC;QACAC;QACAC;QACAC;KACH;AACL"}

package/features/target/CmsEntryReviewTargetSync.d.ts

@@ -0,0 +1,23 @@
+import { IdentityContext } from "@webiny/api-core/features/security/IdentityContext/index.js";
+import { GetModelUseCase } from "@webiny/api-headless-cms/features/contentModel/GetModel/index.js";
+import { UpdateEntrySystemUseCase } from "@webiny/api-headless-cms/features/contentEntry/UpdateEntrySystem/index.js";
+import { ReviewTargetSync } from "@webiny/api-workflows/features/review/ReviewTargetSync/index.js";
+/**
+ * Writes `system.workflow` on the CMS revision (spec 4.5, D52, R63). The model is read as the
+ * current identity, never without authorization: an access-free read could fill the tenant-keyed
+ * CMS model cache with an unfiltered list (A19). Only the system write runs without authorization,
+ * so a reviewer with read access can move the review on. `UpdateEntrySystemUseCase` publishes
+ * `EntryBeforeUpdateSystem`, not `EntryBeforeUpdate`, so the save block does not apply (D62).
+ */
+declare class CmsEntryReviewTargetSyncImpl implements ReviewTargetSync.Interface {
+    private identityContext;
+    private getModel;
+    private updateEntrySystem;
+    constructor(identityContext: IdentityContext.Interface, getModel: GetModelUseCase.Interface, updateEntrySystem: UpdateEntrySystemUseCase.Interface);
+    canSync(model: string): boolean;
+    sync(params: ReviewTargetSync.Params): ReviewTargetSync.Return;
+}
+export declare const CmsEntryReviewTargetSync: typeof CmsEntryReviewTargetSyncImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/api-workflows/features/review/ReviewTargetSync/abstractions").IReviewTargetSync>;
+};
+export {};

package/features/target/CmsEntryReviewTargetSync.js

@@ -0,0 +1,42 @@
+import { Result } from "@webiny/feature/api";
+import { IdentityContext } from "@webiny/api-core/features/security/IdentityContext/index.js";
+import { GetModelUseCase } from "@webiny/api-headless-cms/features/contentModel/GetModel/index.js";
+import { UpdateEntrySystemUseCase } from "@webiny/api-headless-cms/features/contentEntry/UpdateEntrySystem/index.js";
+import { ReviewTargetSync } from "@webiny/api-workflows/features/review/ReviewTargetSync/index.js";
+import { getModelIdFromAppName, isCmsNamespace } from "../../utils/appName.js";
+class CmsEntryReviewTargetSyncImpl {
+    constructor(identityContext, getModel, updateEntrySystem){
+        this.identityContext = identityContext;
+        this.getModel = getModel;
+        this.updateEntrySystem = updateEntrySystem;
+    }
+    canSync(model) {
+        return isCmsNamespace(model);
+    }
+    async sync(params) {
+        const modelId = getModelIdFromAppName(params.review.model);
+        if (!modelId) return Result.fail(new Error(`"${params.review.model}" is not a Headless CMS review namespace.`));
+        try {
+            const model = await this.getModel.execute(modelId);
+            if (model.isFail()) return Result.fail(model.error);
+            const updated = await this.identityContext.withoutAuthorization(()=>this.updateEntrySystem.execute(model.value, params.review.targetRevisionId, {
+                    workflow: params.systemWorkflow
+                }));
+            if (updated.isFail()) return Result.fail(updated.error);
+            return Result.ok();
+        } catch (error) {
+            return Result.fail(error instanceof Error ? error : new Error(String(error)));
+        }
+    }
+}
+const CmsEntryReviewTargetSync = ReviewTargetSync.createImplementation({
+    implementation: CmsEntryReviewTargetSyncImpl,
+    dependencies: [
+        IdentityContext,
+        GetModelUseCase,
+        UpdateEntrySystemUseCase
+    ]
+});
+export { CmsEntryReviewTargetSync };
+
+//# sourceMappingURL=CmsEntryReviewTargetSync.js.map

package/features/target/CmsEntryReviewTargetSync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/target/CmsEntryReviewTargetSync.js","sources":["../../../src/features/target/CmsEntryReviewTargetSync.ts"],"sourcesContent":["import { Result } from \"@webiny/feature/api\";\nimport { IdentityContext } from \"@webiny/api-core/features/security/IdentityContext/index.js\";\nimport { GetModelUseCase } from \"@webiny/api-headless-cms/features/contentModel/GetModel/index.js\";\nimport { UpdateEntrySystemUseCase } from \"@webiny/api-headless-cms/features/contentEntry/UpdateEntrySystem/index.js\";\nimport { ReviewTargetSync } from \"@webiny/api-workflows/features/review/ReviewTargetSync/index.js\";\nimport { getModelIdFromAppName, isCmsNamespace } from \"~/utils/appName.js\";\n\n/**\n * Writes `system.workflow` on the CMS revision (spec 4.5, D52, R63). The model is read as the\n * current identity, never without authorization: an access-free read could fill the tenant-keyed\n * CMS model cache with an unfiltered list (A19). Only the system write runs without authorization,\n * so a reviewer with read access can move the review on. `UpdateEntrySystemUseCase` publishes\n * `EntryBeforeUpdateSystem`, not `EntryBeforeUpdate`, so the save block does not apply (D62).\n */\nclass CmsEntryReviewTargetSyncImpl implements ReviewTargetSync.Interface {\n    public constructor(\n        private identityContext: IdentityContext.Interface,\n        private getModel: GetModelUseCase.Interface,\n        private updateEntrySystem: UpdateEntrySystemUseCase.Interface\n    ) {}\n\n    public canSync(model: string): boolean {\n        return isCmsNamespace(model);\n    }\n\n    public async sync(params: ReviewTargetSync.Params): ReviewTargetSync.Return {\n        const modelId = getModelIdFromAppName(params.review.model);\n        if (!modelId) {\n            return Result.fail(\n                new Error(`\"${params.review.model}\" is not a Headless CMS review namespace.`)\n            );\n        }\n\n        try {\n            const model = await this.getModel.execute(modelId);\n            if (model.isFail()) {\n                return Result.fail(model.error);\n            }\n\n            const updated = await this.identityContext.withoutAuthorization(() => {\n                return this.updateEntrySystem.execute(model.value, params.review.targetRevisionId, {\n                    workflow: params.systemWorkflow\n                });\n            });\n            if (updated.isFail()) {\n                return Result.fail(updated.error);\n            }\n            return Result.ok();\n        } catch (error) {\n            return Result.fail(error instanceof Error ? error : new Error(String(error)));\n        }\n    }\n}\n\nexport const CmsEntryReviewTargetSync = ReviewTargetSync.createImplementation({\n    implementation: CmsEntryReviewTargetSyncImpl,\n    dependencies: [IdentityContext, GetModelUseCase, UpdateEntrySystemUseCase]\n});\n"],"names":["CmsEntryReviewTargetSyncImpl","identityContext","getModel","updateEntrySystem","model","isCmsNamespace","params","modelId","getModelIdFromAppName","Result","Error","updated","error","String","CmsEntryReviewTargetSync","ReviewTargetSync","IdentityContext","GetModelUseCase","UpdateEntrySystemUseCase"],"mappings":";;;;;;AAcA,MAAMA;IACF,YACYC,eAA0C,EAC1CC,QAAmC,EACnCC,iBAAqD,CAC/D;aAHUF,eAAe,GAAfA;aACAC,QAAQ,GAARA;aACAC,iBAAiB,GAAjBA;IACT;IAEI,QAAQC,KAAa,EAAW;QACnC,OAAOC,eAAeD;IAC1B;IAEA,MAAa,KAAKE,MAA+B,EAA2B;QACxE,MAAMC,UAAUC,sBAAsBF,OAAO,MAAM,CAAC,KAAK;QACzD,IAAI,CAACC,SACD,OAAOE,OAAO,IAAI,CACd,IAAIC,MAAM,CAAC,CAAC,EAAEJ,OAAO,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC;QAIpF,IAAI;YACA,MAAMF,QAAQ,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAACG;YAC1C,IAAIH,MAAM,MAAM,IACZ,OAAOK,OAAO,IAAI,CAACL,MAAM,KAAK;YAGlC,MAAMO,UAAU,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,IACrD,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAACP,MAAM,KAAK,EAAEE,OAAO,MAAM,CAAC,gBAAgB,EAAE;oBAC/E,UAAUA,OAAO,cAAc;gBACnC;YAEJ,IAAIK,QAAQ,MAAM,IACd,OAAOF,OAAO,IAAI,CAACE,QAAQ,KAAK;YAEpC,OAAOF,OAAO,EAAE;QACpB,EAAE,OAAOG,OAAO;YACZ,OAAOH,OAAO,IAAI,CAACG,iBAAiBF,QAAQE,QAAQ,IAAIF,MAAMG,OAAOD;QACzE;IACJ;AACJ;AAEO,MAAME,2BAA2BC,iBAAiB,oBAAoB,CAAC;IAC1E,gBAAgBf;IAChB,cAAc;QAACgB;QAAiBC;QAAiBC;KAAyB;AAC9E"}

package/features/target/CmsEntryTargetReader/CmsEntryTargetReader.d.ts

@@ -0,0 +1,27 @@
+import { GetModelUseCase } from "@webiny/api-headless-cms/features/contentModel/GetModel/index.js";
+import { GetRevisionByIdUseCase } from "@webiny/api-headless-cms/features/contentEntry/GetRevisionById/index.js";
+import { GetEntriesByIdsUseCase } from "@webiny/api-headless-cms/features/contentEntry/GetEntriesByIds/index.js";
+import { CmsEntryTargetReader as Abstraction } from "./abstractions.js";
+import { CmsModelGroupService } from "../CmsModelGroupService/index.js";
+/**
+ * The model is read through the access-controlled `GetModelUseCase` as the current identity: a
+ * model the user cannot read is no target for them, and nothing fills the tenant-keyed model cache
+ * without access filtering (A19). The group is read the same way, so `CmsEntryAccess` can check
+ * group read for another user without reading anything as them. The revision itself is read
+ * without entry checks; callers decide access with `CmsEntryAccess`.
+ */
+declare class CmsEntryTargetReaderImpl implements Abstraction.Interface {
+    private getModel;
+    private modelGroups;
+    private getRevisionById;
+    private getEntriesByIds;
+    constructor(getModel: GetModelUseCase.Interface, modelGroups: CmsModelGroupService.Interface, getRevisionById: GetRevisionByIdUseCase.Interface, getEntriesByIds: GetEntriesByIdsUseCase.Interface);
+    read(params: Abstraction.Params): Promise<Abstraction.Target | null>;
+    readMany(params: Abstraction.ManyParams): Promise<Abstraction.Target[]>;
+    /** The model and its group as the current identity; `null` when they are no target. */
+    private readModel;
+}
+export declare const CmsEntryTargetReader: typeof CmsEntryTargetReaderImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("./abstractions.js").ICmsEntryTargetReader>;
+};
+export {};

package/features/target/CmsEntryTargetReader/CmsEntryTargetReader.js

@@ -0,0 +1,81 @@
+import { GetModelUseCase } from "@webiny/api-headless-cms/features/contentModel/GetModel/index.js";
+import { GetRevisionByIdUseCase } from "@webiny/api-headless-cms/features/contentEntry/GetRevisionById/index.js";
+import { GetEntriesByIdsUseCase } from "@webiny/api-headless-cms/features/contentEntry/GetEntriesByIds/index.js";
+import { getModelIdFromAppName } from "../../../utils/appName.js";
+import { CmsEntryTargetReader } from "./abstractions.js";
+import { CmsModelGroupService } from "../CmsModelGroupService/index.js";
+const MODEL_NOT_FOUND = "Cms/Model/NotFound";
+const MODEL_NOT_AUTHORIZED = "Cms/Model/NotAuthorized";
+const GROUP_NOT_FOUND = "Cms/ModelGroup/NotFound";
+const GROUP_NOT_AUTHORIZED = "Cms/ModelGroup/NotAuthorized";
+const ENTRY_NOT_FOUND = "Cms/Entry/NotFound";
+const ENTRIES_NOT_AUTHORIZED = "Cms/Entry/NotAuthorized";
+class CmsEntryTargetReaderImpl {
+    constructor(getModel, modelGroups, getRevisionById, getEntriesByIds){
+        this.getModel = getModel;
+        this.modelGroups = modelGroups;
+        this.getRevisionById = getRevisionById;
+        this.getEntriesByIds = getEntriesByIds;
+    }
+    async read(params) {
+        const targetModel = await this.readModel(params.model);
+        if (!targetModel) return null;
+        const entry = await this.getRevisionById.execute(targetModel.model, params.targetRevisionId);
+        if (entry.isFail()) {
+            if (entry.error.code === ENTRY_NOT_FOUND) return null;
+            throw entry.error;
+        }
+        return {
+            ...targetModel,
+            entry: entry.value
+        };
+    }
+    async readMany(params) {
+        if (0 === params.targetRevisionIds.length) return [];
+        const targetModel = await this.readModel(params.model);
+        if (!targetModel) return [];
+        const revisionIds = [
+            ...new Set(params.targetRevisionIds)
+        ];
+        const entries = await this.getEntriesByIds.execute(targetModel.model, revisionIds);
+        if (entries.isFail()) {
+            if (entries.error.code === ENTRIES_NOT_AUTHORIZED) return [];
+            throw entries.error;
+        }
+        return entries.value.map((entry)=>({
+                ...targetModel,
+                entry
+            }));
+    }
+    async readModel(namespace) {
+        const modelId = getModelIdFromAppName(namespace);
+        if (!modelId) return null;
+        const model = await this.getModel.execute(modelId);
+        if (model.isFail()) {
+            if (model.error.code === MODEL_NOT_FOUND || model.error.code === MODEL_NOT_AUTHORIZED) return null;
+            throw model.error;
+        }
+        if (model.value.isPrivate) return null;
+        const group = await this.modelGroups.getGroup(model.value);
+        if (group.isFail()) {
+            if (group.error.code === GROUP_NOT_FOUND || group.error.code === GROUP_NOT_AUTHORIZED) return null;
+            throw group.error;
+        }
+        return {
+            model: model.value,
+            group: group.value
+        };
+    }
+}
+const CmsEntryTargetReader_CmsEntryTargetReader = CmsEntryTargetReader.createImplementation({
+    implementation: CmsEntryTargetReaderImpl,
+    dependencies: [
+        GetModelUseCase,
+        CmsModelGroupService,
+        GetRevisionByIdUseCase,
+        GetEntriesByIdsUseCase
+    ]
+});
+export { CmsEntryTargetReader_CmsEntryTargetReader as CmsEntryTargetReader };
+
+//# sourceMappingURL=CmsEntryTargetReader.js.map

package/features/target/CmsEntryTargetReader/CmsEntryTargetReader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/target/CmsEntryTargetReader/CmsEntryTargetReader.js","sources":["../../../../src/features/target/CmsEntryTargetReader/CmsEntryTargetReader.ts"],"sourcesContent":["import type { CmsGroup, CmsModel } from \"@webiny/api-headless-cms/types/index.js\";\nimport { GetModelUseCase } from \"@webiny/api-headless-cms/features/contentModel/GetModel/index.js\";\nimport { GetRevisionByIdUseCase } from \"@webiny/api-headless-cms/features/contentEntry/GetRevisionById/index.js\";\nimport { GetEntriesByIdsUseCase } from \"@webiny/api-headless-cms/features/contentEntry/GetEntriesByIds/index.js\";\nimport { getModelIdFromAppName } from \"~/utils/appName.js\";\nimport { CmsEntryTargetReader as Abstraction } from \"./abstractions.js\";\nimport { CmsModelGroupService } from \"../CmsModelGroupService/index.js\";\n\nconst MODEL_NOT_FOUND = \"Cms/Model/NotFound\";\nconst MODEL_NOT_AUTHORIZED = \"Cms/Model/NotAuthorized\";\nconst GROUP_NOT_FOUND = \"Cms/ModelGroup/NotFound\";\nconst GROUP_NOT_AUTHORIZED = \"Cms/ModelGroup/NotAuthorized\";\nconst ENTRY_NOT_FOUND = \"Cms/Entry/NotFound\";\n// The identity has no entry permission on the model, so no revision is a target for it.\nconst ENTRIES_NOT_AUTHORIZED = \"Cms/Entry/NotAuthorized\";\n\ninterface TargetModel {\n    model: CmsModel;\n    group: CmsGroup;\n}\n\n/**\n * The model is read through the access-controlled `GetModelUseCase` as the current identity: a\n * model the user cannot read is no target for them, and nothing fills the tenant-keyed model cache\n * without access filtering (A19). The group is read the same way, so `CmsEntryAccess` can check\n * group read for another user without reading anything as them. The revision itself is read\n * without entry checks; callers decide access with `CmsEntryAccess`.\n */\nclass CmsEntryTargetReaderImpl implements Abstraction.Interface {\n    public constructor(\n        private getModel: GetModelUseCase.Interface,\n        private modelGroups: CmsModelGroupService.Interface,\n        private getRevisionById: GetRevisionByIdUseCase.Interface,\n        private getEntriesByIds: GetEntriesByIdsUseCase.Interface\n    ) {}\n\n    public async read(params: Abstraction.Params): Promise<Abstraction.Target | null> {\n        const targetModel = await this.readModel(params.model);\n        if (!targetModel) {\n            return null;\n        }\n\n        const entry = await this.getRevisionById.execute(\n            targetModel.model,\n            params.targetRevisionId\n        );\n        if (entry.isFail()) {\n            if (entry.error.code === ENTRY_NOT_FOUND) {\n                return null;\n            }\n            throw entry.error;\n        }\n\n        return { ...targetModel, entry: entry.value };\n    }\n\n    public async readMany(params: Abstraction.ManyParams): Promise<Abstraction.Target[]> {\n        if (params.targetRevisionIds.length === 0) {\n            return [];\n        }\n        const targetModel = await this.readModel(params.model);\n        if (!targetModel) {\n            return [];\n        }\n\n        // One batch read for every revision (Q79); trashed revisions are left out.\n        const revisionIds = [...new Set(params.targetRevisionIds)];\n        const entries = await this.getEntriesByIds.execute(targetModel.model, revisionIds);\n        if (entries.isFail()) {\n            if (entries.error.code === ENTRIES_NOT_AUTHORIZED) {\n                return [];\n            }\n            throw entries.error;\n        }\n\n        return entries.value.map(entry => ({ ...targetModel, entry }));\n    }\n\n    /** The model and its group as the current identity; `null` when they are no target. */\n    private async readModel(namespace: string): Promise<TargetModel | null> {\n        const modelId = getModelIdFromAppName(namespace);\n        if (!modelId) {\n            return null;\n        }\n\n        const model = await this.getModel.execute(modelId);\n        if (model.isFail()) {\n            if (model.error.code === MODEL_NOT_FOUND || model.error.code === MODEL_NOT_AUTHORIZED) {\n                return null;\n            }\n            throw model.error;\n        }\n        if (model.value.isPrivate) {\n            return null;\n        }\n\n        const group = await this.modelGroups.getGroup(model.value);\n        if (group.isFail()) {\n            if (group.error.code === GROUP_NOT_FOUND || group.error.code === GROUP_NOT_AUTHORIZED) {\n                return null;\n            }\n            throw group.error;\n        }\n\n        return { model: model.value, group: group.value };\n    }\n}\n\nexport const CmsEntryTargetReader = Abstraction.createImplementation({\n    implementation: CmsEntryTargetReaderImpl,\n    dependencies: [\n        GetModelUseCase,\n        CmsModelGroupService,\n        GetRevisionByIdUseCase,\n        GetEntriesByIdsUseCase\n    ]\n});\n"],"names":["MODEL_NOT_FOUND","MODEL_NOT_AUTHORIZED","GROUP_NOT_FOUND","GROUP_NOT_AUTHORIZED","ENTRY_NOT_FOUND","ENTRIES_NOT_AUTHORIZED","CmsEntryTargetReaderImpl","getModel","modelGroups","getRevisionById","getEntriesByIds","params","targetModel","entry","revisionIds","Set","entries","namespace","modelId","getModelIdFromAppName","model","group","CmsEntryTargetReader","Abstraction","GetModelUseCase","CmsModelGroupService","GetRevisionByIdUseCase","GetEntriesByIdsUseCase"],"mappings":";;;;;;AAQA,MAAMA,kBAAkB;AACxB,MAAMC,uBAAuB;AAC7B,MAAMC,kBAAkB;AACxB,MAAMC,uBAAuB;AAC7B,MAAMC,kBAAkB;AAExB,MAAMC,yBAAyB;AAc/B,MAAMC;IACF,YACYC,QAAmC,EACnCC,WAA2C,EAC3CC,eAAiD,EACjDC,eAAiD,CAC3D;aAJUH,QAAQ,GAARA;aACAC,WAAW,GAAXA;aACAC,eAAe,GAAfA;aACAC,eAAe,GAAfA;IACT;IAEH,MAAa,KAAKC,MAA0B,EAAsC;QAC9E,MAAMC,cAAc,MAAM,IAAI,CAAC,SAAS,CAACD,OAAO,KAAK;QACrD,IAAI,CAACC,aACD,OAAO;QAGX,MAAMC,QAAQ,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAC5CD,YAAY,KAAK,EACjBD,OAAO,gBAAgB;QAE3B,IAAIE,MAAM,MAAM,IAAI;YAChB,IAAIA,MAAM,KAAK,CAAC,IAAI,KAAKT,iBACrB,OAAO;YAEX,MAAMS,MAAM,KAAK;QACrB;QAEA,OAAO;YAAE,GAAGD,WAAW;YAAE,OAAOC,MAAM,KAAK;QAAC;IAChD;IAEA,MAAa,SAASF,MAA8B,EAAiC;QACjF,IAAIA,AAAoC,MAApCA,OAAO,iBAAiB,CAAC,MAAM,EAC/B,OAAO,EAAE;QAEb,MAAMC,cAAc,MAAM,IAAI,CAAC,SAAS,CAACD,OAAO,KAAK;QACrD,IAAI,CAACC,aACD,OAAO,EAAE;QAIb,MAAME,cAAc;eAAI,IAAIC,IAAIJ,OAAO,iBAAiB;SAAE;QAC1D,MAAMK,UAAU,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAACJ,YAAY,KAAK,EAAEE;QACtE,IAAIE,QAAQ,MAAM,IAAI;YAClB,IAAIA,QAAQ,KAAK,CAAC,IAAI,KAAKX,wBACvB,OAAO,EAAE;YAEb,MAAMW,QAAQ,KAAK;QACvB;QAEA,OAAOA,QAAQ,KAAK,CAAC,GAAG,CAACH,CAAAA,QAAU;gBAAE,GAAGD,WAAW;gBAAEC;YAAM;IAC/D;IAGA,MAAc,UAAUI,SAAiB,EAA+B;QACpE,MAAMC,UAAUC,sBAAsBF;QACtC,IAAI,CAACC,SACD,OAAO;QAGX,MAAME,QAAQ,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAACF;QAC1C,IAAIE,MAAM,MAAM,IAAI;YAChB,IAAIA,MAAM,KAAK,CAAC,IAAI,KAAKpB,mBAAmBoB,MAAM,KAAK,CAAC,IAAI,KAAKnB,sBAC7D,OAAO;YAEX,MAAMmB,MAAM,KAAK;QACrB;QACA,IAAIA,MAAM,KAAK,CAAC,SAAS,EACrB,OAAO;QAGX,MAAMC,QAAQ,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAACD,MAAM,KAAK;QACzD,IAAIC,MAAM,MAAM,IAAI;YAChB,IAAIA,MAAM,KAAK,CAAC,IAAI,KAAKnB,mBAAmBmB,MAAM,KAAK,CAAC,IAAI,KAAKlB,sBAC7D,OAAO;YAEX,MAAMkB,MAAM,KAAK;QACrB;QAEA,OAAO;YAAE,OAAOD,MAAM,KAAK;YAAE,OAAOC,MAAM,KAAK;QAAC;IACpD;AACJ;AAEO,MAAMC,4CAAuBC,qBAAAA,oBAAgC,CAAC;IACjE,gBAAgBjB;IAChB,cAAc;QACVkB;QACAC;QACAC;QACAC;KACH;AACL"}

package/features/target/CmsEntryTargetReader/abstractions.d.ts

@@ -0,0 +1,40 @@
+import type { CmsEntry, CmsGroup, CmsModel } from "@webiny/api-headless-cms/types/index.js";
+export interface CmsEntryTargetReadParams {
+    /** Namespace id, e.g. "cms.article". */
+    model: string;
+    targetRevisionId: string;
+}
+export interface CmsEntryTargetsReadParams {
+    /** Namespace id, e.g. "cms.article". */
+    model: string;
+    targetRevisionIds: string[];
+}
+export interface CmsEntryTarget {
+    model: CmsModel;
+    /** The model's group, read as the current identity; group read is part of entry access (R72). */
+    group: CmsGroup;
+    entry: CmsEntry;
+}
+export interface ICmsEntryTargetReader {
+    /**
+     * Reads the revision as the current identity. `null` when the namespace is not `cms.*`, the
+     * model or its group does not exist or cannot be read, the model is private, or the revision
+     * does not exist (a trashed revision reads as missing). Other failures are thrown.
+     */
+    read(params: CmsEntryTargetReadParams): Promise<CmsEntryTarget | null>;
+    /**
+     * Reads many revisions of one model in one batch read, as the current identity, in no
+     * particular order. A revision that does not exist (or is trashed) is left out; `[]` when the
+     * model or group cannot be read, the model is private or the identity has no entry
+     * permission on it. Other failures are thrown.
+     */
+    readMany(params: CmsEntryTargetsReadParams): Promise<CmsEntryTarget[]>;
+}
+/** Loads a CMS target revision for the `cms.*` adapter and wrappers (R47). */
+export declare const CmsEntryTargetReader: import("@webiny/di").Abstraction<ICmsEntryTargetReader>;
+export declare namespace CmsEntryTargetReader {
+    type Interface = ICmsEntryTargetReader;
+    type Params = CmsEntryTargetReadParams;
+    type ManyParams = CmsEntryTargetsReadParams;
+    type Target = CmsEntryTarget;
+}

package/features/target/CmsEntryTargetReader/abstractions.js

@@ -0,0 +1,5 @@
+import { createAbstraction } from "@webiny/feature/api";
+const CmsEntryTargetReader = createAbstraction("CmsEntryTargetReader");
+export { CmsEntryTargetReader };
+
+//# sourceMappingURL=abstractions.js.map

package/features/target/CmsEntryTargetReader/abstractions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/target/CmsEntryTargetReader/abstractions.js","sources":["../../../../src/features/target/CmsEntryTargetReader/abstractions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport type { CmsEntry, CmsGroup, CmsModel } from \"@webiny/api-headless-cms/types/index.js\";\n\nexport interface CmsEntryTargetReadParams {\n    /** Namespace id, e.g. \"cms.article\". */\n    model: string;\n    targetRevisionId: string;\n}\n\nexport interface CmsEntryTargetsReadParams {\n    /** Namespace id, e.g. \"cms.article\". */\n    model: string;\n    targetRevisionIds: string[];\n}\n\nexport interface CmsEntryTarget {\n    model: CmsModel;\n    /** The model's group, read as the current identity; group read is part of entry access (R72). */\n    group: CmsGroup;\n    entry: CmsEntry;\n}\n\nexport interface ICmsEntryTargetReader {\n    /**\n     * Reads the revision as the current identity. `null` when the namespace is not `cms.*`, the\n     * model or its group does not exist or cannot be read, the model is private, or the revision\n     * does not exist (a trashed revision reads as missing). Other failures are thrown.\n     */\n    read(params: CmsEntryTargetReadParams): Promise<CmsEntryTarget | null>;\n    /**\n     * Reads many revisions of one model in one batch read, as the current identity, in no\n     * particular order. A revision that does not exist (or is trashed) is left out; `[]` when the\n     * model or group cannot be read, the model is private or the identity has no entry\n     * permission on it. Other failures are thrown.\n     */\n    readMany(params: CmsEntryTargetsReadParams): Promise<CmsEntryTarget[]>;\n}\n\n/** Loads a CMS target revision for the `cms.*` adapter and wrappers (R47). */\nexport const CmsEntryTargetReader =\n    createAbstraction<ICmsEntryTargetReader>(\"CmsEntryTargetReader\");\n\nexport namespace CmsEntryTargetReader {\n    export type Interface = ICmsEntryTargetReader;\n    export type Params = CmsEntryTargetReadParams;\n    export type ManyParams = CmsEntryTargetsReadParams;\n    export type Target = CmsEntryTarget;\n}\n"],"names":["CmsEntryTargetReader","createAbstraction"],"mappings":";AAuCO,MAAMA,uBACTC,kBAAyC"}

package/features/target/CmsEntryTargetReader/index.d.ts

@@ -0,0 +1 @@
+export { CmsEntryTargetReader } from "./abstractions.js";

package/features/target/CmsEntryTargetReader/index.js

@@ -0,0 +1 @@
+export { CmsEntryTargetReader } from "./abstractions.js";

package/features/target/CmsModelGroupService/CmsModelGroupService.d.ts

@@ -0,0 +1,12 @@
+import type { CmsModel } from "@webiny/api-headless-cms/types/index.js";
+import { ListGroupsUseCase } from "@webiny/api-headless-cms/features/contentModelGroup/ListGroups/index.js";
+import { CmsModelGroupService as Abstraction } from "./abstractions.js";
+declare class CmsModelGroupServiceImpl implements Abstraction.Interface {
+    private listGroups;
+    constructor(listGroups: ListGroupsUseCase.Interface);
+    getGroup(model: CmsModel): Abstraction.Return;
+}
+export declare const CmsModelGroupService: typeof CmsModelGroupServiceImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("./abstractions.js").ICmsModelGroupService>;
+};
+export {};

package/features/target/CmsModelGroupService/CmsModelGroupService.js

@@ -0,0 +1,25 @@
+import { Result } from "@webiny/feature/api";
+import { ListGroupsUseCase } from "@webiny/api-headless-cms/features/contentModelGroup/ListGroups/index.js";
+import { GroupNotFoundError } from "@webiny/api-headless-cms/domain/contentModelGroup/errors.js";
+import { CmsModelGroupService } from "./abstractions.js";
+class CmsModelGroupServiceImpl {
+    constructor(listGroups){
+        this.listGroups = listGroups;
+    }
+    async getGroup(model) {
+        const groups = await this.listGroups.execute();
+        if (groups.isFail()) return Result.fail(groups.error);
+        const group = groups.value.find((item)=>item.slug === model.group);
+        if (!group) return Result.fail(new GroupNotFoundError(model.group));
+        return Result.ok(group);
+    }
+}
+const CmsModelGroupService_CmsModelGroupService = CmsModelGroupService.createImplementation({
+    implementation: CmsModelGroupServiceImpl,
+    dependencies: [
+        ListGroupsUseCase
+    ]
+});
+export { CmsModelGroupService_CmsModelGroupService as CmsModelGroupService };
+
+//# sourceMappingURL=CmsModelGroupService.js.map

package/features/target/CmsModelGroupService/CmsModelGroupService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/target/CmsModelGroupService/CmsModelGroupService.js","sources":["../../../../src/features/target/CmsModelGroupService/CmsModelGroupService.ts"],"sourcesContent":["import { Result } from \"@webiny/feature/api\";\nimport type { CmsModel } from \"@webiny/api-headless-cms/types/index.js\";\nimport { ListGroupsUseCase } from \"@webiny/api-headless-cms/features/contentModelGroup/ListGroups/index.js\";\nimport { GroupNotFoundError } from \"@webiny/api-headless-cms/domain/contentModelGroup/errors.js\";\nimport { CmsModelGroupService as Abstraction } from \"./abstractions.js\";\n\nclass CmsModelGroupServiceImpl implements Abstraction.Interface {\n    public constructor(private listGroups: ListGroupsUseCase.Interface) {}\n\n    public async getGroup(model: CmsModel): Abstraction.Return {\n        const groups = await this.listGroups.execute();\n        if (groups.isFail()) {\n            return Result.fail(groups.error);\n        }\n        const group = groups.value.find(item => item.slug === model.group);\n        if (!group) {\n            return Result.fail(new GroupNotFoundError(model.group));\n        }\n        return Result.ok(group);\n    }\n}\n\nexport const CmsModelGroupService = Abstraction.createImplementation({\n    implementation: CmsModelGroupServiceImpl,\n    dependencies: [ListGroupsUseCase]\n});\n"],"names":["CmsModelGroupServiceImpl","listGroups","model","groups","Result","group","item","GroupNotFoundError","CmsModelGroupService","Abstraction","ListGroupsUseCase"],"mappings":";;;;AAMA,MAAMA;IACF,YAA2BC,UAAuC,CAAE;aAAzCA,UAAU,GAAVA;IAA0C;IAErE,MAAa,SAASC,KAAe,EAAsB;QACvD,MAAMC,SAAS,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO;QAC5C,IAAIA,OAAO,MAAM,IACb,OAAOC,OAAO,IAAI,CAACD,OAAO,KAAK;QAEnC,MAAME,QAAQF,OAAO,KAAK,CAAC,IAAI,CAACG,CAAAA,OAAQA,KAAK,IAAI,KAAKJ,MAAM,KAAK;QACjE,IAAI,CAACG,OACD,OAAOD,OAAO,IAAI,CAAC,IAAIG,mBAAmBL,MAAM,KAAK;QAEzD,OAAOE,OAAO,EAAE,CAACC;IACrB;AACJ;AAEO,MAAMG,4CAAuBC,qBAAAA,oBAAgC,CAAC;IACjE,gBAAgBT;IAChB,cAAc;QAACU;KAAkB;AACrC"}

package/features/target/CmsModelGroupService/abstractions.d.ts

@@ -0,0 +1,24 @@
+import { type Result } from "@webiny/feature/api";
+import type { CmsGroup, CmsModel } from "@webiny/api-headless-cms/types/index.js";
+import type { GroupNotFoundError } from "@webiny/api-headless-cms/domain/contentModelGroup/errors.js";
+import type { ListGroupsUseCase } from "@webiny/api-headless-cms/features/contentModelGroup/ListGroups/index.js";
+export type CmsModelGroupError = GroupNotFoundError | ListGroupsUseCase.Error;
+export interface ICmsModelGroupService {
+    /**
+     * The model's group, read as the current identity. Fails with `Cms/ModelGroup/NotFound` when
+     * no readable group has the model's slug, `Cms/ModelGroup/NotAuthorized` without group read,
+     * or the list's persistence error.
+     */
+    getGroup(model: CmsModel): Promise<Result<CmsGroup, CmsModelGroupError>>;
+}
+/**
+ * Finds a model's group. A model holds its group's slug, not its id (database groups get a
+ * generated id), so the group is found by slug in the access-controlled group list, as the CMS
+ * `AccessControl` does.
+ */
+export declare const CmsModelGroupService: import("@webiny/di").Abstraction<ICmsModelGroupService>;
+export declare namespace CmsModelGroupService {
+    type Interface = ICmsModelGroupService;
+    type Error = CmsModelGroupError;
+    type Return = Promise<Result<CmsGroup, CmsModelGroupError>>;
+}

package/features/target/CmsModelGroupService/abstractions.js

@@ -0,0 +1,5 @@
+import { createAbstraction } from "@webiny/feature/api";
+const CmsModelGroupService = createAbstraction("CmsModelGroupService");
+export { CmsModelGroupService };
+
+//# sourceMappingURL=abstractions.js.map

package/features/target/CmsModelGroupService/abstractions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/target/CmsModelGroupService/abstractions.js","sources":["../../../../src/features/target/CmsModelGroupService/abstractions.ts"],"sourcesContent":["import { createAbstraction, type Result } from \"@webiny/feature/api\";\nimport type { CmsGroup, CmsModel } from \"@webiny/api-headless-cms/types/index.js\";\nimport type { GroupNotFoundError } from \"@webiny/api-headless-cms/domain/contentModelGroup/errors.js\";\nimport type { ListGroupsUseCase } from \"@webiny/api-headless-cms/features/contentModelGroup/ListGroups/index.js\";\n\nexport type CmsModelGroupError = GroupNotFoundError | ListGroupsUseCase.Error;\n\nexport interface ICmsModelGroupService {\n    /**\n     * The model's group, read as the current identity. Fails with `Cms/ModelGroup/NotFound` when\n     * no readable group has the model's slug, `Cms/ModelGroup/NotAuthorized` without group read,\n     * or the list's persistence error.\n     */\n    getGroup(model: CmsModel): Promise<Result<CmsGroup, CmsModelGroupError>>;\n}\n\n/**\n * Finds a model's group. A model holds its group's slug, not its id (database groups get a\n * generated id), so the group is found by slug in the access-controlled group list, as the CMS\n * `AccessControl` does.\n */\nexport const CmsModelGroupService =\n    createAbstraction<ICmsModelGroupService>(\"CmsModelGroupService\");\n\nexport namespace CmsModelGroupService {\n    export type Interface = ICmsModelGroupService;\n    export type Error = CmsModelGroupError;\n    export type Return = Promise<Result<CmsGroup, CmsModelGroupError>>;\n}\n"],"names":["CmsModelGroupService","createAbstraction"],"mappings":";AAqBO,MAAMA,uBACTC,kBAAyC"}

package/features/target/CmsModelGroupService/index.d.ts

@@ -0,0 +1 @@
+export { CmsModelGroupService } from "./abstractions.js";

package/features/target/CmsModelGroupService/index.js

@@ -0,0 +1 @@
+export { CmsModelGroupService } from "./abstractions.js";

package/features/target/CmsWorkflowModelParser.d.ts

@@ -0,0 +1,9 @@
+import { WorkflowModelParser } from "@webiny/api-workflows/features/model/WorkflowModelParser/index.js";
+/** A `cms.<modelId>` workflow model: the `cms` app and the CMS model id (D15, D137, R113). */
+declare class CmsWorkflowModelParserImpl implements WorkflowModelParser.Interface {
+    parse(model: string): WorkflowModelParser.Parsed | null;
+}
+export declare const CmsWorkflowModelParser: typeof CmsWorkflowModelParserImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/api-workflows/features/model/WorkflowModelParser/abstractions").IWorkflowModelParser>;
+};
+export {};

package/features/target/CmsWorkflowModelParser.js

@@ -0,0 +1,18 @@
+import { WorkflowModelParser } from "@webiny/api-workflows/features/model/WorkflowModelParser/index.js";
+import { getModelIdFromAppName } from "../../utils/appName.js";
+class CmsWorkflowModelParserImpl {
+    parse(model) {
+        const modelId = getModelIdFromAppName(model);
+        return modelId ? {
+            app: "cms",
+            modelId
+        } : null;
+    }
+}
+const CmsWorkflowModelParser = WorkflowModelParser.createImplementation({
+    implementation: CmsWorkflowModelParserImpl,
+    dependencies: []
+});
+export { CmsWorkflowModelParser };
+
+//# sourceMappingURL=CmsWorkflowModelParser.js.map

package/features/target/CmsWorkflowModelParser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/target/CmsWorkflowModelParser.js","sources":["../../../src/features/target/CmsWorkflowModelParser.ts"],"sourcesContent":["import { WorkflowModelParser } from \"@webiny/api-workflows/features/model/WorkflowModelParser/index.js\";\nimport { getModelIdFromAppName } from \"~/utils/appName.js\";\n\n/** A `cms.<modelId>` workflow model: the `cms` app and the CMS model id (D15, D137, R113). */\nclass CmsWorkflowModelParserImpl implements WorkflowModelParser.Interface {\n    public parse(model: string): WorkflowModelParser.Parsed | null {\n        const modelId = getModelIdFromAppName(model);\n        return modelId ? { app: \"cms\", modelId } : null;\n    }\n}\n\nexport const CmsWorkflowModelParser = WorkflowModelParser.createImplementation({\n    implementation: CmsWorkflowModelParserImpl,\n    dependencies: []\n});\n"],"names":["CmsWorkflowModelParserImpl","model","modelId","getModelIdFromAppName","CmsWorkflowModelParser","WorkflowModelParser"],"mappings":";;AAIA,MAAMA;IACK,MAAMC,KAAa,EAAqC;QAC3D,MAAMC,UAAUC,sBAAsBF;QACtC,OAAOC,UAAU;YAAE,KAAK;YAAOA;QAAQ,IAAI;IAC/C;AACJ;AAEO,MAAME,yBAAyBC,oBAAoB,oBAAoB,CAAC;IAC3E,gBAAgBL;IAChB,cAAc,EAAE;AACpB"}

package/features/target/FolderReadRule.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Folder content read of the current identity, decided from folder permissions loaded once for
+ * many checks (Q79), instead of one `getFolderLevelPermissions` read per check. Used by the
+ * access checks (`CmsEntryAccess`, `WbPageAccess`) for bulk and candidate checks.
+ */
+export interface FolderReadRule {
+    /** Whether the current identity can read content in the folder (never the root folder). */
+    canReadFolder(folderId: string): Promise<boolean>;
+}

package/features/target/WorkflowEntrySystemField.d.ts

@@ -0,0 +1,13 @@
+import { CmsEntrySystemField } from "@webiny/api-headless-cms/features/contentEntry/EntrySystemField/index.js";
+import type { CmsModelField } from "@webiny/api-headless-cms/types/index.js";
+/**
+ * Makes `system.workflow` filterable in CMS entry listing (spec 4.5), on every storage. Website
+ * Builder pages are CMS entries, so this covers them too.
+ */
+declare class WorkflowEntrySystemFieldImpl implements CmsEntrySystemField.Interface {
+    readonly field: CmsModelField;
+}
+export declare const WorkflowEntrySystemField: typeof WorkflowEntrySystemFieldImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/api-headless-cms/features/contentEntry/EntrySystemField/abstractions").ICmsEntrySystemField>;
+};
+export {};

package/features/target/WorkflowEntrySystemField.js

@@ -0,0 +1,35 @@
+import { createModelField } from "@webiny/api-headless-cms";
+import { CmsEntrySystemField } from "@webiny/api-headless-cms/features/contentEntry/EntrySystemField/index.js";
+const WORKFLOW_TEXT_FIELDS = [
+    "workflowId",
+    "reviewState",
+    "stepId",
+    "stepState"
+];
+class WorkflowEntrySystemFieldImpl {
+    constructor(){
+        this.field = createModelField({
+            id: "workflow",
+            fieldId: "workflow",
+            storageId: "workflow",
+            type: "object",
+            label: "Workflow",
+            settings: {
+                fields: WORKFLOW_TEXT_FIELDS.map((fieldId)=>createModelField({
+                        id: fieldId,
+                        fieldId,
+                        storageId: fieldId,
+                        type: "text",
+                        label: fieldId
+                    }))
+            }
+        });
+    }
+}
+const WorkflowEntrySystemField = CmsEntrySystemField.createImplementation({
+    implementation: WorkflowEntrySystemFieldImpl,
+    dependencies: []
+});
+export { WorkflowEntrySystemField };
+
+//# sourceMappingURL=WorkflowEntrySystemField.js.map

package/features/target/WorkflowEntrySystemField.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/target/WorkflowEntrySystemField.js","sources":["../../../src/features/target/WorkflowEntrySystemField.ts"],"sourcesContent":["import { createModelField } from \"@webiny/api-headless-cms\";\nimport { CmsEntrySystemField } from \"@webiny/api-headless-cms/features/contentEntry/EntrySystemField/index.js\";\nimport type { CmsModelField } from \"@webiny/api-headless-cms/types/index.js\";\n\nconst WORKFLOW_TEXT_FIELDS = [\"workflowId\", \"reviewState\", \"stepId\", \"stepState\"];\n\n/**\n * Makes `system.workflow` filterable in CMS entry listing (spec 4.5), on every storage. Website\n * Builder pages are CMS entries, so this covers them too.\n */\nclass WorkflowEntrySystemFieldImpl implements CmsEntrySystemField.Interface {\n    public readonly field: CmsModelField = createModelField({\n        id: \"workflow\",\n        fieldId: \"workflow\",\n        storageId: \"workflow\",\n        type: \"object\",\n        label: \"Workflow\",\n        settings: {\n            fields: WORKFLOW_TEXT_FIELDS.map(fieldId => {\n                return createModelField({\n                    id: fieldId,\n                    fieldId,\n                    storageId: fieldId,\n                    type: \"text\",\n                    label: fieldId\n                });\n            })\n        }\n    });\n}\n\nexport const WorkflowEntrySystemField = CmsEntrySystemField.createImplementation({\n    implementation: WorkflowEntrySystemFieldImpl,\n    dependencies: []\n});\n"],"names":["WORKFLOW_TEXT_FIELDS","WorkflowEntrySystemFieldImpl","createModelField","fieldId","WorkflowEntrySystemField","CmsEntrySystemField"],"mappings":";;AAIA,MAAMA,uBAAuB;IAAC;IAAc;IAAe;IAAU;CAAY;AAMjF,MAAMC;;aACc,KAAK,GAAkBC,iBAAiB;YACpD,IAAI;YACJ,SAAS;YACT,WAAW;YACX,MAAM;YACN,OAAO;YACP,UAAU;gBACN,QAAQF,qBAAqB,GAAG,CAACG,CAAAA,UACtBD,iBAAiB;wBACpB,IAAIC;wBACJA;wBACA,WAAWA;wBACX,MAAM;wBACN,OAAOA;oBACX;YAER;QACJ;;AACJ;AAEO,MAAMC,2BAA2BC,oBAAoB,oBAAoB,CAAC;IAC7E,gBAAgBJ;IAChB,cAAc,EAAE;AACpB"}

package/features/target/feature.d.ts

@@ -0,0 +1,5 @@
+/** The `cms.*` target adapter (spec 9.3). */
+export declare const CmsTargetFeature: {
+    name: string;
+    register(container: import("@webiny/di").Container): void;
+};