@webiny/api-headless-cms-workflows 0.0.0-unstable.9f53ea597d → 0.0.0-unstable.a85ef555b2

package/features/target/CandidateFolderReadRules/abstractions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/target/CandidateFolderReadRules/abstractions.js","sources":["../../../../src/features/target/CandidateFolderReadRules/abstractions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport type { FolderReadRule } from \"../FolderReadRule.js\";\n\n/** A candidate, as the engine listed it (`AdminUser` fits). */\nexport interface CandidateFolderUser {\n    id: string;\n    /** Team ids, as stored on the admin user. */\n    teams?: string[];\n}\n\nexport interface CandidateFolderReadRuleParams {\n    /** The folder the candidates are checked for; never the root folder. */\n    folderId: string;\n    /** Every candidate the rule is run for, with their teams, so no user is read per check. */\n    users: CandidateFolderUser[];\n}\n\nexport interface ICandidateFolderReadRules {\n    /**\n     * A folder rule run as each candidate, inside `CandidateReadAccess`. The folder's permission\n     * record is read once, on first use, and the candidates' teams once (only with teams on and\n     * a team grant on the folder); each candidate's access is then evaluated in memory as\n     * `FolderLevelPermissions.getFolderLevelPermissions` and `canAccessFolderContent` evaluate it\n     * for that user: the team grants of the user's teams, then the defaults (full access is\n     * owner, a folder without permissions is public). Another folder answers `false`.\n     */\n    create(params: CandidateFolderReadRuleParams): FolderReadRule;\n}\n\n/**\n * Folder content read for routing candidates (R48, Q79): one folder permission read per routing\n * evaluation instead of one per candidate, and no team lookup per candidate. Shared by the CMS and\n * Website Builder adapters, which check folders by id.\n */\nexport const CandidateFolderReadRules = createAbstraction<ICandidateFolderReadRules>(\n    \"CandidateFolderReadRules\"\n);\n\nexport namespace CandidateFolderReadRules {\n    export type Interface = ICandidateFolderReadRules;\n    export type User = CandidateFolderUser;\n    export type Params = CandidateFolderReadRuleParams;\n}\n"],"names":["CandidateFolderReadRules","createAbstraction"],"mappings":";AAkCO,MAAMA,2BAA2BC,kBACpC"}

package/features/target/CandidateFolderReadRules/index.d.ts

@@ -0,0 +1 @@
+export { CandidateFolderReadRules } from "./abstractions.js";

package/features/target/CandidateFolderReadRules/index.js

@@ -0,0 +1 @@
+export { CandidateFolderReadRules } from "./abstractions.js";

package/features/target/CmsEntryAccess/CmsEntryAccess.d.ts

@@ -0,0 +1,32 @@
+import { AccessControl } from "@webiny/api-headless-cms/features/shared/abstractions.js";
+import { GetModelUseCase } from "@webiny/api-headless-cms/features/contentModel/GetModel/index.js";
+import { FolderLevelPermissions } from "@webiny/api-aco/features/flp/FolderLevelPermissions/index.js";
+import type { CmsEntryTarget } from "../CmsEntryTargetReader/abstractions.js";
+import type { FolderReadRule } from "../FolderReadRule.js";
+import { CmsEntryAccess as Abstraction } from "./abstractions.js";
+import { CmsModelGroupService } from "../CmsModelGroupService/index.js";
+/**
+ * Group and model read first (what `GetModelUseCase` and the group cache enforce for the current
+ * identity), then the entry permission, then FLP as `GetEntryByIdWithFlpDecorator`,
+ * `UpdateEntryWithFlpDecorator` and `DeleteEntryWithFlpDecorator` (api-aco) apply it.
+ *
+ * Models with `authorization: false` (entry checks disabled) are still refused at the group check
+ * for an identity without group read: `canAccessGroup` does not look at the model's flag. That
+ * fails closed and is stricter than the CMS's own entry use cases.
+ */
+declare class CmsEntryAccessImpl implements Abstraction.Interface {
+    private accessControl;
+    private getModel;
+    private modelGroups;
+    private folderLevelPermissions;
+    constructor(accessControl: AccessControl.Interface, getModel: GetModelUseCase.Interface, modelGroups: CmsModelGroupService.Interface, folderLevelPermissions: FolderLevelPermissions.Interface);
+    canRead(target: CmsEntryTarget, folderRule?: FolderReadRule): Promise<boolean>;
+    canWrite(target: CmsEntryTarget): Promise<boolean>;
+    canDelete(target: CmsEntryTarget): Promise<boolean>;
+    canReadInFolder(params: Abstraction.FolderReadParams): Promise<boolean>;
+    canDeleteAnyEntry(namespace: string): Promise<boolean>;
+}
+export declare const CmsEntryAccess: typeof CmsEntryAccessImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("./abstractions.js").ICmsEntryAccess>;
+};
+export {};

package/features/target/CmsEntryAccess/CmsEntryAccess.js

@@ -0,0 +1,141 @@
+import { AccessControl } from "@webiny/api-headless-cms/features/shared/abstractions.js";
+import { GetModelUseCase } from "@webiny/api-headless-cms/features/contentModel/GetModel/index.js";
+import { FolderLevelPermissions } from "@webiny/api-aco/features/flp/FolderLevelPermissions/index.js";
+import { ROOT_FOLDER } from "@webiny/api-headless-cms/constants.js";
+import { getModelIdFromAppName } from "../../../utils/appName.js";
+import { CmsEntryAccess } from "./abstractions.js";
+import { UNREADABLE_CODES } from "./unreadableCodes.js";
+import { CmsModelGroupService } from "../CmsModelGroupService/index.js";
+class CmsEntryAccessImpl {
+    constructor(accessControl, getModel, modelGroups, folderLevelPermissions){
+        this.accessControl = accessControl;
+        this.getModel = getModel;
+        this.modelGroups = modelGroups;
+        this.folderLevelPermissions = folderLevelPermissions;
+    }
+    async canRead(target, folderRule) {
+        if (!await this.accessControl.canAccessGroup({
+            group: target.group
+        })) return false;
+        if (!await this.accessControl.canAccessModel({
+            model: target.model
+        })) return false;
+        const canAccessEntry = await this.accessControl.canAccessEntry({
+            model: target.model,
+            entry: target.entry,
+            rwd: "r"
+        });
+        if (!canAccessEntry) return false;
+        if (!this.folderLevelPermissions.canUseFolderLevelPermissions()) return true;
+        const folderId = target.entry.location?.folderId;
+        if (!folderId || folderId === ROOT_FOLDER) return true;
+        if (folderRule) return folderRule.canReadFolder(folderId);
+        const permissions = await this.folderLevelPermissions.getFolderLevelPermissions(folderId);
+        return this.folderLevelPermissions.canAccessFolderContent({
+            permissions,
+            rwd: "r"
+        });
+    }
+    async canWrite(target) {
+        if (!await this.accessControl.canAccessGroup({
+            group: target.group
+        })) return false;
+        if (!await this.accessControl.canAccessModel({
+            model: target.model
+        })) return false;
+        const canAccessEntry = await this.accessControl.canAccessEntry({
+            model: target.model,
+            entry: target.entry,
+            rwd: "w"
+        });
+        if (!canAccessEntry) return false;
+        if (!this.folderLevelPermissions.canUseFolderLevelPermissions()) return true;
+        const folderId = target.entry.location?.folderId;
+        if (!folderId || folderId === ROOT_FOLDER) return true;
+        const permissions = await this.folderLevelPermissions.getFolderLevelPermissions(folderId);
+        return this.folderLevelPermissions.canAccessFolderContent({
+            permissions,
+            rwd: "w"
+        });
+    }
+    async canDelete(target) {
+        if (!await this.accessControl.canAccessGroup({
+            group: target.group
+        })) return false;
+        if (!await this.accessControl.canAccessModel({
+            model: target.model
+        })) return false;
+        const canAccessEntry = await this.accessControl.canAccessEntry({
+            model: target.model,
+            entry: target.entry,
+            rwd: "d"
+        });
+        if (!canAccessEntry) return false;
+        if (!this.folderLevelPermissions.canUseFolderLevelPermissions()) return true;
+        const folderId = target.entry.location?.folderId;
+        if (!folderId || folderId === ROOT_FOLDER) return true;
+        const permissions = await this.folderLevelPermissions.getFolderLevelPermissions(folderId);
+        return this.folderLevelPermissions.canAccessFolderContent({
+            permissions,
+            rwd: "d"
+        });
+    }
+    async canReadInFolder(params) {
+        if (!await this.accessControl.canAccessGroup({
+            group: params.group
+        })) return false;
+        if (!await this.accessControl.canAccessModel({
+            model: params.model
+        })) return false;
+        const canAccessEntries = await this.accessControl.canAccessEntry({
+            model: params.model,
+            rwd: "r"
+        });
+        if (!canAccessEntries) return false;
+        if (!this.folderLevelPermissions.canUseFolderLevelPermissions()) return true;
+        if (!params.folderId || params.folderId === ROOT_FOLDER) return true;
+        if (params.folderRule) return params.folderRule.canReadFolder(params.folderId);
+        const permissions = await this.folderLevelPermissions.getFolderLevelPermissions(params.folderId);
+        return this.folderLevelPermissions.canAccessFolderContent({
+            permissions,
+            rwd: "r"
+        });
+    }
+    async canDeleteAnyEntry(namespace) {
+        const modelId = getModelIdFromAppName(namespace);
+        if (!modelId) return false;
+        const model = await this.getModel.execute(modelId);
+        if (model.isFail()) {
+            if (UNREADABLE_CODES.includes(model.error.code)) return false;
+            throw model.error;
+        }
+        if (model.value.isPrivate) return false;
+        const group = await this.modelGroups.getGroup(model.value);
+        if (group.isFail()) {
+            if (UNREADABLE_CODES.includes(group.error.code)) return false;
+            throw group.error;
+        }
+        if (!await this.accessControl.canAccessGroup({
+            group: group.value
+        })) return false;
+        if (!await this.accessControl.canAccessModel({
+            model: model.value
+        })) return false;
+        return this.accessControl.canAccessEntry({
+            model: model.value,
+            rwd: "d"
+        });
+    }
+}
+const CmsEntryAccess_CmsEntryAccess = CmsEntryAccess.createImplementation({
+    implementation: CmsEntryAccessImpl,
+    dependencies: [
+        AccessControl,
+        GetModelUseCase,
+        CmsModelGroupService,
+        FolderLevelPermissions
+    ]
+});
+export { CmsEntryAccess_CmsEntryAccess as CmsEntryAccess };
+
+//# sourceMappingURL=CmsEntryAccess.js.map

package/features/target/CmsEntryAccess/CmsEntryAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/target/CmsEntryAccess/CmsEntryAccess.js","sources":["../../../../src/features/target/CmsEntryAccess/CmsEntryAccess.ts"],"sourcesContent":["import { AccessControl } from \"@webiny/api-headless-cms/features/shared/abstractions.js\";\nimport { GetModelUseCase } from \"@webiny/api-headless-cms/features/contentModel/GetModel/index.js\";\nimport { FolderLevelPermissions } from \"@webiny/api-aco/features/flp/FolderLevelPermissions/index.js\";\nimport { ROOT_FOLDER } from \"@webiny/api-headless-cms/constants.js\";\nimport { getModelIdFromAppName } from \"~/utils/appName.js\";\nimport type { CmsEntryTarget } from \"../CmsEntryTargetReader/abstractions.js\";\nimport type { FolderReadRule } from \"../FolderReadRule.js\";\nimport { CmsEntryAccess as Abstraction } from \"./abstractions.js\";\nimport { UNREADABLE_CODES } from \"./unreadableCodes.js\";\nimport { CmsModelGroupService } from \"../CmsModelGroupService/index.js\";\n\n/**\n * Group and model read first (what `GetModelUseCase` and the group cache enforce for the current\n * identity), then the entry permission, then FLP as `GetEntryByIdWithFlpDecorator`,\n * `UpdateEntryWithFlpDecorator` and `DeleteEntryWithFlpDecorator` (api-aco) apply it.\n *\n * Models with `authorization: false` (entry checks disabled) are still refused at the group check\n * for an identity without group read: `canAccessGroup` does not look at the model's flag. That\n * fails closed and is stricter than the CMS's own entry use cases.\n */\nclass CmsEntryAccessImpl implements Abstraction.Interface {\n    public constructor(\n        private accessControl: AccessControl.Interface,\n        private getModel: GetModelUseCase.Interface,\n        private modelGroups: CmsModelGroupService.Interface,\n        private folderLevelPermissions: FolderLevelPermissions.Interface\n    ) {}\n\n    public async canRead(target: CmsEntryTarget, folderRule?: FolderReadRule): Promise<boolean> {\n        if (!(await this.accessControl.canAccessGroup({ group: target.group }))) {\n            return false;\n        }\n        if (!(await this.accessControl.canAccessModel({ model: target.model }))) {\n            return false;\n        }\n        const canAccessEntry = await this.accessControl.canAccessEntry({\n            model: target.model,\n            entry: target.entry,\n            rwd: \"r\"\n        });\n        if (!canAccessEntry) {\n            return false;\n        }\n        // Folder-level permissions are skipped when FLP is not in use for the identity (e.g. API\n        // keys) or the entry is in the root folder, as the ACO CMS decorators do.\n        if (!this.folderLevelPermissions.canUseFolderLevelPermissions()) {\n            return true;\n        }\n        const folderId = target.entry.location?.folderId;\n        if (!folderId || folderId === ROOT_FOLDER) {\n            return true;\n        }\n        if (folderRule) {\n            return folderRule.canReadFolder(folderId);\n        }\n        const permissions = await this.folderLevelPermissions.getFolderLevelPermissions(folderId);\n        return this.folderLevelPermissions.canAccessFolderContent({ permissions, rwd: \"r\" });\n    }\n\n    public async canWrite(target: CmsEntryTarget): Promise<boolean> {\n        if (!(await this.accessControl.canAccessGroup({ group: target.group }))) {\n            return false;\n        }\n        if (!(await this.accessControl.canAccessModel({ model: target.model }))) {\n            return false;\n        }\n        const canAccessEntry = await this.accessControl.canAccessEntry({\n            model: target.model,\n            entry: target.entry,\n            rwd: \"w\"\n        });\n        if (!canAccessEntry) {\n            return false;\n        }\n        // Folder-level permissions are skipped when FLP is not in use for the identity (e.g. API\n        // keys) or the entry is in the root folder, as the ACO CMS decorators do.\n        if (!this.folderLevelPermissions.canUseFolderLevelPermissions()) {\n            return true;\n        }\n        const folderId = target.entry.location?.folderId;\n        if (!folderId || folderId === ROOT_FOLDER) {\n            return true;\n        }\n        const permissions = await this.folderLevelPermissions.getFolderLevelPermissions(folderId);\n        return this.folderLevelPermissions.canAccessFolderContent({ permissions, rwd: \"w\" });\n    }\n\n    public async canDelete(target: CmsEntryTarget): Promise<boolean> {\n        if (!(await this.accessControl.canAccessGroup({ group: target.group }))) {\n            return false;\n        }\n        if (!(await this.accessControl.canAccessModel({ model: target.model }))) {\n            return false;\n        }\n        const canAccessEntry = await this.accessControl.canAccessEntry({\n            model: target.model,\n            entry: target.entry,\n            rwd: \"d\"\n        });\n        if (!canAccessEntry) {\n            return false;\n        }\n        // Folder-level permissions are skipped when FLP is not in use for the identity (e.g. API\n        // keys) or the entry is in the root folder, as the ACO CMS decorators do.\n        if (!this.folderLevelPermissions.canUseFolderLevelPermissions()) {\n            return true;\n        }\n        const folderId = target.entry.location?.folderId;\n        if (!folderId || folderId === ROOT_FOLDER) {\n            return true;\n        }\n        const permissions = await this.folderLevelPermissions.getFolderLevelPermissions(folderId);\n        return this.folderLevelPermissions.canAccessFolderContent({ permissions, rwd: \"d\" });\n    }\n\n    public async canReadInFolder(params: Abstraction.FolderReadParams): Promise<boolean> {\n        if (!(await this.accessControl.canAccessGroup({ group: params.group }))) {\n            return false;\n        }\n        if (!(await this.accessControl.canAccessModel({ model: params.model }))) {\n            return false;\n        }\n        const canAccessEntries = await this.accessControl.canAccessEntry({\n            model: params.model,\n            rwd: \"r\"\n        });\n        if (!canAccessEntries) {\n            return false;\n        }\n        // As for an entry: skipped when FLP is not in use for the identity or for the root folder.\n        if (!this.folderLevelPermissions.canUseFolderLevelPermissions()) {\n            return true;\n        }\n        if (!params.folderId || params.folderId === ROOT_FOLDER) {\n            return true;\n        }\n        if (params.folderRule) {\n            return params.folderRule.canReadFolder(params.folderId);\n        }\n        const permissions = await this.folderLevelPermissions.getFolderLevelPermissions(\n            params.folderId\n        );\n        return this.folderLevelPermissions.canAccessFolderContent({ permissions, rwd: \"r\" });\n    }\n\n    public async canDeleteAnyEntry(namespace: string): Promise<boolean> {\n        const modelId = getModelIdFromAppName(namespace);\n        if (!modelId) {\n            return false;\n        }\n        const model = await this.getModel.execute(modelId);\n        if (model.isFail()) {\n            if (UNREADABLE_CODES.includes(model.error.code)) {\n                return false;\n            }\n            throw model.error;\n        }\n        if (model.value.isPrivate) {\n            return false;\n        }\n        const group = await this.modelGroups.getGroup(model.value);\n        if (group.isFail()) {\n            if (UNREADABLE_CODES.includes(group.error.code)) {\n                return false;\n            }\n            throw group.error;\n        }\n        if (!(await this.accessControl.canAccessGroup({ group: group.value }))) {\n            return false;\n        }\n        if (!(await this.accessControl.canAccessModel({ model: model.value }))) {\n            return false;\n        }\n        return this.accessControl.canAccessEntry({ model: model.value, rwd: \"d\" });\n    }\n}\n\nexport const CmsEntryAccess = Abstraction.createImplementation({\n    implementation: CmsEntryAccessImpl,\n    dependencies: [AccessControl, GetModelUseCase, CmsModelGroupService, FolderLevelPermissions]\n});\n"],"names":["CmsEntryAccessImpl","accessControl","getModel","modelGroups","folderLevelPermissions","target","folderRule","canAccessEntry","folderId","ROOT_FOLDER","permissions","params","canAccessEntries","namespace","modelId","getModelIdFromAppName","model","UNREADABLE_CODES","group","CmsEntryAccess","Abstraction","AccessControl","GetModelUseCase","CmsModelGroupService","FolderLevelPermissions"],"mappings":";;;;;;;;AAoBA,MAAMA;IACF,YACYC,aAAsC,EACtCC,QAAmC,EACnCC,WAA2C,EAC3CC,sBAAwD,CAClE;aAJUH,aAAa,GAAbA;aACAC,QAAQ,GAARA;aACAC,WAAW,GAAXA;aACAC,sBAAsB,GAAtBA;IACT;IAEH,MAAa,QAAQC,MAAsB,EAAEC,UAA2B,EAAoB;QACxF,IAAI,CAAE,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC;YAAE,OAAOD,OAAO,KAAK;QAAC,IAChE,OAAO;QAEX,IAAI,CAAE,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC;YAAE,OAAOA,OAAO,KAAK;QAAC,IAChE,OAAO;QAEX,MAAME,iBAAiB,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC;YAC3D,OAAOF,OAAO,KAAK;YACnB,OAAOA,OAAO,KAAK;YACnB,KAAK;QACT;QACA,IAAI,CAACE,gBACD,OAAO;QAIX,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,4BAA4B,IACzD,OAAO;QAEX,MAAMC,WAAWH,OAAO,KAAK,CAAC,QAAQ,EAAE;QACxC,IAAI,CAACG,YAAYA,aAAaC,aAC1B,OAAO;QAEX,IAAIH,YACA,OAAOA,WAAW,aAAa,CAACE;QAEpC,MAAME,cAAc,MAAM,IAAI,CAAC,sBAAsB,CAAC,yBAAyB,CAACF;QAChF,OAAO,IAAI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;YAAEE;YAAa,KAAK;QAAI;IACtF;IAEA,MAAa,SAASL,MAAsB,EAAoB;QAC5D,IAAI,CAAE,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC;YAAE,OAAOA,OAAO,KAAK;QAAC,IAChE,OAAO;QAEX,IAAI,CAAE,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC;YAAE,OAAOA,OAAO,KAAK;QAAC,IAChE,OAAO;QAEX,MAAME,iBAAiB,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC;YAC3D,OAAOF,OAAO,KAAK;YACnB,OAAOA,OAAO,KAAK;YACnB,KAAK;QACT;QACA,IAAI,CAACE,gBACD,OAAO;QAIX,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,4BAA4B,IACzD,OAAO;QAEX,MAAMC,WAAWH,OAAO,KAAK,CAAC,QAAQ,EAAE;QACxC,IAAI,CAACG,YAAYA,aAAaC,aAC1B,OAAO;QAEX,MAAMC,cAAc,MAAM,IAAI,CAAC,sBAAsB,CAAC,yBAAyB,CAACF;QAChF,OAAO,IAAI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;YAAEE;YAAa,KAAK;QAAI;IACtF;IAEA,MAAa,UAAUL,MAAsB,EAAoB;QAC7D,IAAI,CAAE,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC;YAAE,OAAOA,OAAO,KAAK;QAAC,IAChE,OAAO;QAEX,IAAI,CAAE,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC;YAAE,OAAOA,OAAO,KAAK;QAAC,IAChE,OAAO;QAEX,MAAME,iBAAiB,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC;YAC3D,OAAOF,OAAO,KAAK;YACnB,OAAOA,OAAO,KAAK;YACnB,KAAK;QACT;QACA,IAAI,CAACE,gBACD,OAAO;QAIX,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,4BAA4B,IACzD,OAAO;QAEX,MAAMC,WAAWH,OAAO,KAAK,CAAC,QAAQ,EAAE;QACxC,IAAI,CAACG,YAAYA,aAAaC,aAC1B,OAAO;QAEX,MAAMC,cAAc,MAAM,IAAI,CAAC,sBAAsB,CAAC,yBAAyB,CAACF;QAChF,OAAO,IAAI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;YAAEE;YAAa,KAAK;QAAI;IACtF;IAEA,MAAa,gBAAgBC,MAAoC,EAAoB;QACjF,IAAI,CAAE,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC;YAAE,OAAOA,OAAO,KAAK;QAAC,IAChE,OAAO;QAEX,IAAI,CAAE,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC;YAAE,OAAOA,OAAO,KAAK;QAAC,IAChE,OAAO;QAEX,MAAMC,mBAAmB,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC;YAC7D,OAAOD,OAAO,KAAK;YACnB,KAAK;QACT;QACA,IAAI,CAACC,kBACD,OAAO;QAGX,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,4BAA4B,IACzD,OAAO;QAEX,IAAI,CAACD,OAAO,QAAQ,IAAIA,OAAO,QAAQ,KAAKF,aACxC,OAAO;QAEX,IAAIE,OAAO,UAAU,EACjB,OAAOA,OAAO,UAAU,CAAC,aAAa,CAACA,OAAO,QAAQ;QAE1D,MAAMD,cAAc,MAAM,IAAI,CAAC,sBAAsB,CAAC,yBAAyB,CAC3EC,OAAO,QAAQ;QAEnB,OAAO,IAAI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;YAAED;YAAa,KAAK;QAAI;IACtF;IAEA,MAAa,kBAAkBG,SAAiB,EAAoB;QAChE,MAAMC,UAAUC,sBAAsBF;QACtC,IAAI,CAACC,SACD,OAAO;QAEX,MAAME,QAAQ,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAACF;QAC1C,IAAIE,MAAM,MAAM,IAAI;YAChB,IAAIC,iBAAiB,QAAQ,CAACD,MAAM,KAAK,CAAC,IAAI,GAC1C,OAAO;YAEX,MAAMA,MAAM,KAAK;QACrB;QACA,IAAIA,MAAM,KAAK,CAAC,SAAS,EACrB,OAAO;QAEX,MAAME,QAAQ,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAACF,MAAM,KAAK;QACzD,IAAIE,MAAM,MAAM,IAAI;YAChB,IAAID,iBAAiB,QAAQ,CAACC,MAAM,KAAK,CAAC,IAAI,GAC1C,OAAO;YAEX,MAAMA,MAAM,KAAK;QACrB;QACA,IAAI,CAAE,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC;YAAE,OAAOA,MAAM,KAAK;QAAC,IAC/D,OAAO;QAEX,IAAI,CAAE,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC;YAAE,OAAOF,MAAM,KAAK;QAAC,IAC/D,OAAO;QAEX,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC;YAAE,OAAOA,MAAM,KAAK;YAAE,KAAK;QAAI;IAC5E;AACJ;AAEO,MAAMG,gCAAiBC,eAAAA,oBAAgC,CAAC;IAC3D,gBAAgBpB;IAChB,cAAc;QAACqB;QAAeC;QAAiBC;QAAsBC;KAAuB;AAChG"}

package/features/target/CmsEntryAccess/abstractions.d.ts

@@ -0,0 +1,48 @@
+import type { CmsGroup, CmsModel } from "@webiny/api-headless-cms/types/index.js";
+import type { CmsEntryTarget } from "../CmsEntryTargetReader/abstractions.js";
+import type { FolderReadRule } from "../FolderReadRule.js";
+export interface CmsEntryFolderReadParams {
+    /** Read as the current identity before the check (A19). */
+    model: CmsModel;
+    group: CmsGroup;
+    /** `null` or "root": the root folder, no folder-level check. */
+    folderId: string | null;
+    /** Decides the folder from permissions loaded once; one folder read per check when omitted. */
+    folderRule?: FolderReadRule;
+}
+export interface ICmsEntryAccess {
+    /**
+     * Read access of the current identity (review actions, get review). With `folderRule`, the
+     * folder is decided by the rule (folder permissions loaded once for many checks, Q79), so the
+     * check reads nothing; without it, the folder's permissions are read for this check.
+     */
+    canRead(target: CmsEntryTarget, folderRule?: FolderReadRule): Promise<boolean>;
+    /** Write access of the current identity (request a review, D77). */
+    canWrite(target: CmsEntryTarget): Promise<boolean>;
+    /** Delete access of the current identity (trash or delete, cancel-for-delete, D134). */
+    canDelete(target: CmsEntryTarget): Promise<boolean>;
+    /**
+     * Entity-level delete permission for a `cms.*` namespace, as `DeleteEntryUseCase` checks it
+     * before it loads an entry (`canAccessEntry({ model, rwd: "d" })`), plus group and model read.
+     * `false` for another app's namespace, a private, missing or unreadable model or group. Lets
+     * the cancel-for-delete wrapper refuse before it reads anything (R86).
+     */
+    canDeleteAnyEntry(namespace: string): Promise<boolean>;
+    /**
+     * Read access of the current identity to the model's entries in a folder, without an entry
+     * (the routing inspector, R121): group read, model read, entity-level entry read and the
+     * folder's content read. Evaluated as another user inside `CandidateReadAccess`.
+     */
+    canReadInFolder(params: CmsEntryFolderReadParams): Promise<boolean>;
+}
+/**
+ * The CMS's own entry access logic for the current identity (R47, R72): group read, model read
+ * and entry permissions (incl. own-only) through `AccessControl`, plus folder-level permissions on
+ * the entry's folder. Evaluated as another user inside `CandidateReadAccess` for `canUserRead`
+ * (R48).
+ */
+export declare const CmsEntryAccess: import("@webiny/di").Abstraction<ICmsEntryAccess>;
+export declare namespace CmsEntryAccess {
+    type Interface = ICmsEntryAccess;
+    type FolderReadParams = CmsEntryFolderReadParams;
+}

package/features/target/CmsEntryAccess/abstractions.js

@@ -0,0 +1,5 @@
+import { createAbstraction } from "@webiny/feature/api";
+const CmsEntryAccess = createAbstraction("CmsEntryAccess");
+export { CmsEntryAccess };
+
+//# sourceMappingURL=abstractions.js.map

package/features/target/CmsEntryAccess/abstractions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/target/CmsEntryAccess/abstractions.js","sources":["../../../../src/features/target/CmsEntryAccess/abstractions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport type { CmsGroup, CmsModel } from \"@webiny/api-headless-cms/types/index.js\";\nimport type { CmsEntryTarget } from \"../CmsEntryTargetReader/abstractions.js\";\nimport type { FolderReadRule } from \"../FolderReadRule.js\";\n\nexport interface CmsEntryFolderReadParams {\n    /** Read as the current identity before the check (A19). */\n    model: CmsModel;\n    group: CmsGroup;\n    /** `null` or \"root\": the root folder, no folder-level check. */\n    folderId: string | null;\n    /** Decides the folder from permissions loaded once; one folder read per check when omitted. */\n    folderRule?: FolderReadRule;\n}\n\nexport interface ICmsEntryAccess {\n    /**\n     * Read access of the current identity (review actions, get review). With `folderRule`, the\n     * folder is decided by the rule (folder permissions loaded once for many checks, Q79), so the\n     * check reads nothing; without it, the folder's permissions are read for this check.\n     */\n    canRead(target: CmsEntryTarget, folderRule?: FolderReadRule): Promise<boolean>;\n    /** Write access of the current identity (request a review, D77). */\n    canWrite(target: CmsEntryTarget): Promise<boolean>;\n    /** Delete access of the current identity (trash or delete, cancel-for-delete, D134). */\n    canDelete(target: CmsEntryTarget): Promise<boolean>;\n    /**\n     * Entity-level delete permission for a `cms.*` namespace, as `DeleteEntryUseCase` checks it\n     * before it loads an entry (`canAccessEntry({ model, rwd: \"d\" })`), plus group and model read.\n     * `false` for another app's namespace, a private, missing or unreadable model or group. Lets\n     * the cancel-for-delete wrapper refuse before it reads anything (R86).\n     */\n    canDeleteAnyEntry(namespace: string): Promise<boolean>;\n    /**\n     * Read access of the current identity to the model's entries in a folder, without an entry\n     * (the routing inspector, R121): group read, model read, entity-level entry read and the\n     * folder's content read. Evaluated as another user inside `CandidateReadAccess`.\n     */\n    canReadInFolder(params: CmsEntryFolderReadParams): Promise<boolean>;\n}\n\n/**\n * The CMS's own entry access logic for the current identity (R47, R72): group read, model read\n * and entry permissions (incl. own-only) through `AccessControl`, plus folder-level permissions on\n * the entry's folder. Evaluated as another user inside `CandidateReadAccess` for `canUserRead`\n * (R48).\n */\nexport const CmsEntryAccess = createAbstraction<ICmsEntryAccess>(\"CmsEntryAccess\");\n\nexport namespace CmsEntryAccess {\n    export type Interface = ICmsEntryAccess;\n    export type FolderReadParams = CmsEntryFolderReadParams;\n}\n"],"names":["CmsEntryAccess","createAbstraction"],"mappings":";AA+CO,MAAMA,iBAAiBC,kBAAmC"}

package/features/target/CmsEntryAccess/index.d.ts

@@ -0,0 +1,2 @@
+export { CmsEntryAccess } from "./abstractions.js";
+export { UNREADABLE_CODES } from "./unreadableCodes.js";

package/features/target/CmsEntryAccess/index.js

@@ -0,0 +1,2 @@
+export { CmsEntryAccess } from "./abstractions.js";
+export { UNREADABLE_CODES } from "./unreadableCodes.js";

package/features/target/CmsEntryAccess/unreadableCodes.d.ts

@@ -0,0 +1 @@
+export declare const UNREADABLE_CODES: string[];

package/features/target/CmsEntryAccess/unreadableCodes.js

@@ -0,0 +1,9 @@
+const UNREADABLE_CODES = [
+    "Cms/Model/NotFound",
+    "Cms/Model/NotAuthorized",
+    "Cms/ModelGroup/NotFound",
+    "Cms/ModelGroup/NotAuthorized"
+];
+export { UNREADABLE_CODES };
+
+//# sourceMappingURL=unreadableCodes.js.map

package/features/target/CmsEntryAccess/unreadableCodes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/target/CmsEntryAccess/unreadableCodes.js","sources":["../../../../src/features/target/CmsEntryAccess/unreadableCodes.ts"],"sourcesContent":["/*\n * The error codes of a model or group the identity cannot read, or that does not exist. Shared by\n * `CmsEntryAccess` and the wrapper use cases that read a model and its group themselves.\n */\nexport const UNREADABLE_CODES = [\n    \"Cms/Model/NotFound\",\n    \"Cms/Model/NotAuthorized\",\n    \"Cms/ModelGroup/NotFound\",\n    \"Cms/ModelGroup/NotAuthorized\"\n];\n"],"names":["UNREADABLE_CODES"],"mappings":"AAIO,MAAMA,mBAAmB;IAC5B;IACA;IACA;IACA;CACH"}

package/features/target/CmsEntryDeniedFolders/CmsEntryDeniedFolders.d.ts

@@ -0,0 +1,21 @@
+import { IdentityContext } from "@webiny/api-core/features/security/IdentityContext/index.js";
+import { FolderLevelPermissions } from "@webiny/api-aco/features/flp/FolderLevelPermissions/index.js";
+import type { FolderReadRule } from "../FolderReadRule.js";
+import { CmsEntryDeniedFolders as Abstraction } from "./abstractions.js";
+/**
+ * Registered as a singleton in the request container, so the cache lives for one request. Keyed
+ * by identity id and folder type, because `withIdentity` can switch the identity mid-request.
+ */
+declare class CmsEntryDeniedFoldersImpl implements Abstraction.Interface {
+    private identityContext;
+    private folderLevelPermissions;
+    private readonly cache;
+    constructor(identityContext: IdentityContext.Interface, folderLevelPermissions: FolderLevelPermissions.Interface);
+    listDeniedFolderIds(modelIds: string[]): Promise<string[]>;
+    createFolderReadRule(modelIds: string[]): Promise<FolderReadRule>;
+    private listDeniedOfType;
+}
+export declare const CmsEntryDeniedFolders: typeof CmsEntryDeniedFoldersImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("./abstractions.js").ICmsEntryDeniedFolders>;
+};
+export {};

package/features/target/CmsEntryDeniedFolders/CmsEntryDeniedFolders.js

@@ -0,0 +1,66 @@
+import { IdentityContext } from "@webiny/api-core/features/security/IdentityContext/index.js";
+import { FolderLevelPermissions } from "@webiny/api-aco/features/flp/FolderLevelPermissions/index.js";
+import { ROOT_FOLDER } from "@webiny/api-aco/constants.js";
+import { toCmsFolderType } from "../../../utils/folderType.js";
+import { CmsEntryDeniedFolders } from "./abstractions.js";
+class CmsEntryDeniedFoldersImpl {
+    constructor(identityContext, folderLevelPermissions){
+        this.identityContext = identityContext;
+        this.folderLevelPermissions = folderLevelPermissions;
+        this.cache = new Map();
+    }
+    async listDeniedFolderIds(modelIds) {
+        if (!this.folderLevelPermissions.canUseFolderLevelPermissions()) return [];
+        const identity = this.identityContext.getIdentity();
+        const uniqueModelIds = [
+            ...new Set(modelIds)
+        ];
+        const deniedPerType = await Promise.all(uniqueModelIds.map((modelId)=>{
+            const type = toCmsFolderType(modelId);
+            return this.listDeniedOfType(identity.id, type);
+        }));
+        return deniedPerType.flat();
+    }
+    async createFolderReadRule(modelIds) {
+        const deniedIds = await this.listDeniedFolderIds(modelIds);
+        const denied = new Set(deniedIds);
+        return {
+            canReadFolder: async (folderId)=>!denied.has(folderId)
+        };
+    }
+    async listDeniedOfType(identityId, type) {
+        const key = `${identityId}#${type}`;
+        const cached = this.cache.get(key);
+        if (cached) return [
+            ...cached
+        ];
+        const records = await this.folderLevelPermissions.listFolderLevelPermissions({
+            where: {
+                type,
+                path_startsWith: `${ROOT_FOLDER}/`
+            }
+        });
+        const denied = [];
+        for (const record of records){
+            const canRead = await this.folderLevelPermissions.canAccessFolderContent({
+                permissions: record.permissions,
+                rwd: "r"
+            });
+            if (!canRead) denied.push(record.id);
+        }
+        this.cache.set(key, denied);
+        return [
+            ...denied
+        ];
+    }
+}
+const CmsEntryDeniedFolders_CmsEntryDeniedFolders = CmsEntryDeniedFolders.createImplementation({
+    implementation: CmsEntryDeniedFoldersImpl,
+    dependencies: [
+        IdentityContext,
+        FolderLevelPermissions
+    ]
+});
+export { CmsEntryDeniedFolders_CmsEntryDeniedFolders as CmsEntryDeniedFolders };
+
+//# sourceMappingURL=CmsEntryDeniedFolders.js.map

package/features/target/CmsEntryDeniedFolders/CmsEntryDeniedFolders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/target/CmsEntryDeniedFolders/CmsEntryDeniedFolders.js","sources":["../../../../src/features/target/CmsEntryDeniedFolders/CmsEntryDeniedFolders.ts"],"sourcesContent":["import { IdentityContext } from \"@webiny/api-core/features/security/IdentityContext/index.js\";\nimport { FolderLevelPermissions } from \"@webiny/api-aco/features/flp/FolderLevelPermissions/index.js\";\nimport { ROOT_FOLDER } from \"@webiny/api-aco/constants.js\";\nimport { toCmsFolderType } from \"~/utils/folderType.js\";\nimport type { FolderReadRule } from \"../FolderReadRule.js\";\nimport { CmsEntryDeniedFolders as Abstraction } from \"./abstractions.js\";\n\n/**\n * Registered as a singleton in the request container, so the cache lives for one request. Keyed\n * by identity id and folder type, because `withIdentity` can switch the identity mid-request.\n */\nclass CmsEntryDeniedFoldersImpl implements Abstraction.Interface {\n    private readonly cache = new Map<string, string[]>();\n\n    public constructor(\n        private identityContext: IdentityContext.Interface,\n        private folderLevelPermissions: FolderLevelPermissions.Interface\n    ) {}\n\n    public async listDeniedFolderIds(modelIds: string[]): Promise<string[]> {\n        // Skipped when FLP is not in use for the identity, as the ACO CMS decorators do.\n        if (!this.folderLevelPermissions.canUseFolderLevelPermissions()) {\n            return [];\n        }\n        const identity = this.identityContext.getIdentity();\n        const uniqueModelIds = [...new Set(modelIds)];\n        // ACO lists folder permissions of one folder type at a time, so each model's folders take\n        // one read; they run concurrently, never one read per folder or per entry.\n        const deniedPerType = await Promise.all(\n            uniqueModelIds.map(modelId => {\n                const type = toCmsFolderType(modelId);\n                return this.listDeniedOfType(identity.id, type);\n            })\n        );\n        return deniedPerType.flat();\n    }\n\n    public async createFolderReadRule(modelIds: string[]): Promise<FolderReadRule> {\n        const deniedIds = await this.listDeniedFolderIds(modelIds);\n        const denied = new Set(deniedIds);\n        return {\n            canReadFolder: async (folderId: string): Promise<boolean> => !denied.has(folderId)\n        };\n    }\n\n    private async listDeniedOfType(identityId: string, type: string): Promise<string[]> {\n        const key = `${identityId}#${type}`;\n        const cached = this.cache.get(key);\n        if (cached) {\n            return [...cached];\n        }\n\n        // Every folder path starts at the root, and the storage lists a type only by parent or by\n        // path prefix: the root prefix gives every folder of the type in one read.\n        const records = await this.folderLevelPermissions.listFolderLevelPermissions({\n            where: { type, path_startsWith: `${ROOT_FOLDER}/` }\n        });\n        const denied: string[] = [];\n        for (const record of records) {\n            // In memory: the record's permissions already carry the inherited and default ones.\n            // oxlint-disable-next-line no-await-in-loop -- in memory: the record carries its permissions.\n            const canRead = await this.folderLevelPermissions.canAccessFolderContent({\n                permissions: record.permissions,\n                rwd: \"r\"\n            });\n            if (!canRead) {\n                denied.push(record.id);\n            }\n        }\n        this.cache.set(key, denied);\n        return [...denied];\n    }\n}\n\nexport const CmsEntryDeniedFolders = Abstraction.createImplementation({\n    implementation: CmsEntryDeniedFoldersImpl,\n    dependencies: [IdentityContext, FolderLevelPermissions]\n});\n"],"names":["CmsEntryDeniedFoldersImpl","identityContext","folderLevelPermissions","Map","modelIds","identity","uniqueModelIds","Set","deniedPerType","Promise","modelId","type","toCmsFolderType","deniedIds","denied","folderId","identityId","key","cached","records","ROOT_FOLDER","record","canRead","CmsEntryDeniedFolders","Abstraction","IdentityContext","FolderLevelPermissions"],"mappings":";;;;;AAWA,MAAMA;IAGF,YACYC,eAA0C,EAC1CC,sBAAwD,CAClE;aAFUD,eAAe,GAAfA;aACAC,sBAAsB,GAAtBA;aAJK,KAAK,GAAG,IAAIC;IAK1B;IAEH,MAAa,oBAAoBC,QAAkB,EAAqB;QAEpE,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,4BAA4B,IACzD,OAAO,EAAE;QAEb,MAAMC,WAAW,IAAI,CAAC,eAAe,CAAC,WAAW;QACjD,MAAMC,iBAAiB;eAAI,IAAIC,IAAIH;SAAU;QAG7C,MAAMI,gBAAgB,MAAMC,QAAQ,GAAG,CACnCH,eAAe,GAAG,CAACI,CAAAA;YACf,MAAMC,OAAOC,gBAAgBF;YAC7B,OAAO,IAAI,CAAC,gBAAgB,CAACL,SAAS,EAAE,EAAEM;QAC9C;QAEJ,OAAOH,cAAc,IAAI;IAC7B;IAEA,MAAa,qBAAqBJ,QAAkB,EAA2B;QAC3E,MAAMS,YAAY,MAAM,IAAI,CAAC,mBAAmB,CAACT;QACjD,MAAMU,SAAS,IAAIP,IAAIM;QACvB,OAAO;YACH,eAAe,OAAOE,WAAuC,CAACD,OAAO,GAAG,CAACC;QAC7E;IACJ;IAEA,MAAc,iBAAiBC,UAAkB,EAAEL,IAAY,EAAqB;QAChF,MAAMM,MAAM,GAAGD,WAAW,CAAC,EAAEL,MAAM;QACnC,MAAMO,SAAS,IAAI,CAAC,KAAK,CAAC,GAAG,CAACD;QAC9B,IAAIC,QACA,OAAO;eAAIA;SAAO;QAKtB,MAAMC,UAAU,MAAM,IAAI,CAAC,sBAAsB,CAAC,0BAA0B,CAAC;YACzE,OAAO;gBAAER;gBAAM,iBAAiB,GAAGS,YAAY,CAAC,CAAC;YAAC;QACtD;QACA,MAAMN,SAAmB,EAAE;QAC3B,KAAK,MAAMO,UAAUF,QAAS;YAG1B,MAAMG,UAAU,MAAM,IAAI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;gBACrE,aAAaD,OAAO,WAAW;gBAC/B,KAAK;YACT;YACA,IAAI,CAACC,SACDR,OAAO,IAAI,CAACO,OAAO,EAAE;QAE7B;QACA,IAAI,CAAC,KAAK,CAAC,GAAG,CAACJ,KAAKH;QACpB,OAAO;eAAIA;SAAO;IACtB;AACJ;AAEO,MAAMS,8CAAwBC,sBAAAA,oBAAgC,CAAC;IAClE,gBAAgBxB;IAChB,cAAc;QAACyB;QAAiBC;KAAuB;AAC3D"}

package/features/target/CmsEntryDeniedFolders/abstractions.d.ts

@@ -0,0 +1,23 @@
+import type { FolderReadRule } from "../FolderReadRule.js";
+export interface ICmsEntryDeniedFolders {
+    /**
+     * Ids of the folders of these models' entries whose content the current identity cannot read
+     * (Q77). Empty when folder-level permissions are not in use for the identity (e.g. API keys).
+     * Folders without permission records and the root folder are readable, so they never appear.
+     */
+    listDeniedFolderIds(modelIds: string[]): Promise<string[]>;
+    /**
+     * The same rules as a `FolderReadRule` for many entry checks of the current identity
+     * (`CmsEntryAccess.canRead`), so the checks read no folder permissions of their own.
+     */
+    createFolderReadRule(modelIds: string[]): Promise<FolderReadRule>;
+}
+/**
+ * Folder read rules of CMS entries for list filters, as `CmsEntryAccess` applies them to one entry:
+ * one `listFolderLevelPermissions` per folder type (`cms:<modelId>`), evaluated in memory with
+ * `canAccessFolderContent`. Cached per identity and folder type for the request.
+ */
+export declare const CmsEntryDeniedFolders: import("@webiny/di").Abstraction<ICmsEntryDeniedFolders>;
+export declare namespace CmsEntryDeniedFolders {
+    type Interface = ICmsEntryDeniedFolders;
+}

package/features/target/CmsEntryDeniedFolders/abstractions.js

@@ -0,0 +1,5 @@
+import { createAbstraction } from "@webiny/feature/api";
+const CmsEntryDeniedFolders = createAbstraction("CmsEntryDeniedFolders");
+export { CmsEntryDeniedFolders };
+
+//# sourceMappingURL=abstractions.js.map

package/features/target/CmsEntryDeniedFolders/abstractions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/target/CmsEntryDeniedFolders/abstractions.js","sources":["../../../../src/features/target/CmsEntryDeniedFolders/abstractions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport type { FolderReadRule } from \"../FolderReadRule.js\";\n\nexport interface ICmsEntryDeniedFolders {\n    /**\n     * Ids of the folders of these models' entries whose content the current identity cannot read\n     * (Q77). Empty when folder-level permissions are not in use for the identity (e.g. API keys).\n     * Folders without permission records and the root folder are readable, so they never appear.\n     */\n    listDeniedFolderIds(modelIds: string[]): Promise<string[]>;\n    /**\n     * The same rules as a `FolderReadRule` for many entry checks of the current identity\n     * (`CmsEntryAccess.canRead`), so the checks read no folder permissions of their own.\n     */\n    createFolderReadRule(modelIds: string[]): Promise<FolderReadRule>;\n}\n\n/**\n * Folder read rules of CMS entries for list filters, as `CmsEntryAccess` applies them to one entry:\n * one `listFolderLevelPermissions` per folder type (`cms:<modelId>`), evaluated in memory with\n * `canAccessFolderContent`. Cached per identity and folder type for the request.\n */\nexport const CmsEntryDeniedFolders =\n    createAbstraction<ICmsEntryDeniedFolders>(\"CmsEntryDeniedFolders\");\n\nexport namespace CmsEntryDeniedFolders {\n    export type Interface = ICmsEntryDeniedFolders;\n}\n"],"names":["CmsEntryDeniedFolders","createAbstraction"],"mappings":";AAsBO,MAAMA,wBACTC,kBAA0C"}

package/features/target/CmsEntryDeniedFolders/index.d.ts

@@ -0,0 +1 @@
+export { CmsEntryDeniedFolders } from "./abstractions.js";

package/features/target/CmsEntryDeniedFolders/index.js

@@ -0,0 +1 @@
+export { CmsEntryDeniedFolders } from "./abstractions.js";

package/features/target/CmsEntryFolderExistsService/CmsEntryFolderExistsService.d.ts

@@ -0,0 +1,18 @@
+import { GetModelUseCase } from "@webiny/api-headless-cms/features/contentModel/GetModel/index.js";
+import { GetFolderRepository } from "@webiny/api-aco/features/folder/GetFolder/abstractions.js";
+import { CmsEntryFolderExistsService as Abstraction } from "./abstractions.js";
+/**
+ * The model is read as the current identity (the editor), so the answer never covers a model
+ * they cannot bind (D116); the folder through ACO's repository, which applies no folder-level
+ * permissions (D69).
+ */
+declare class CmsEntryFolderExistsServiceImpl implements Abstraction.Interface {
+    private getModel;
+    private getFolder;
+    constructor(getModel: GetModelUseCase.Interface, getFolder: GetFolderRepository.Interface);
+    exists(params: Abstraction.Params): Promise<boolean>;
+}
+export declare const CmsEntryFolderExistsService: typeof CmsEntryFolderExistsServiceImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("./abstractions.js").ICmsEntryFolderExistsService>;
+};
+export {};

package/features/target/CmsEntryFolderExistsService/CmsEntryFolderExistsService.js

@@ -0,0 +1,43 @@
+import { GetModelUseCase } from "@webiny/api-headless-cms/features/contentModel/GetModel/index.js";
+import { GetFolderRepository } from "@webiny/api-aco/features/folder/GetFolder/abstractions.js";
+import { getModelIdFromFolderType } from "../../../utils/folderType.js";
+import { isBindableModel } from "../../../utils/isBindableModel.js";
+import { CmsEntryFolderExistsService } from "./abstractions.js";
+const UNREADABLE_MODEL_CODES = [
+    "Cms/Model/NotFound",
+    "Cms/Model/NotAuthorized"
+];
+const FOLDER_NOT_FOUND = "Aco/Folder/NotFound";
+class CmsEntryFolderExistsServiceImpl {
+    constructor(getModel, getFolder){
+        this.getModel = getModel;
+        this.getFolder = getFolder;
+    }
+    async exists(params) {
+        if (!params.id || params.id.includes("#")) return false;
+        const modelId = getModelIdFromFolderType(params.type);
+        if (!modelId) return false;
+        const model = await this.getModel.execute(modelId);
+        if (model.isFail()) {
+            if (UNREADABLE_MODEL_CODES.includes(model.error.code)) return false;
+            throw model.error;
+        }
+        if (!isBindableModel(model.value)) return false;
+        const folder = await this.getFolder.execute(params.id);
+        if (folder.isFail()) {
+            if (folder.error.code === FOLDER_NOT_FOUND) return false;
+            throw folder.error;
+        }
+        return folder.value.type === params.type;
+    }
+}
+const CmsEntryFolderExistsService_CmsEntryFolderExistsService = CmsEntryFolderExistsService.createImplementation({
+    implementation: CmsEntryFolderExistsServiceImpl,
+    dependencies: [
+        GetModelUseCase,
+        GetFolderRepository
+    ]
+});
+export { CmsEntryFolderExistsService_CmsEntryFolderExistsService as CmsEntryFolderExistsService };
+
+//# sourceMappingURL=CmsEntryFolderExistsService.js.map

package/features/target/CmsEntryFolderExistsService/CmsEntryFolderExistsService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/target/CmsEntryFolderExistsService/CmsEntryFolderExistsService.js","sources":["../../../../src/features/target/CmsEntryFolderExistsService/CmsEntryFolderExistsService.ts"],"sourcesContent":["import { GetModelUseCase } from \"@webiny/api-headless-cms/features/contentModel/GetModel/index.js\";\nimport { GetFolderRepository } from \"@webiny/api-aco/features/folder/GetFolder/abstractions.js\";\nimport { getModelIdFromFolderType } from \"~/utils/folderType.js\";\nimport { isBindableModel } from \"~/utils/isBindableModel.js\";\nimport { CmsEntryFolderExistsService as Abstraction } from \"./abstractions.js\";\n\nconst UNREADABLE_MODEL_CODES = [\"Cms/Model/NotFound\", \"Cms/Model/NotAuthorized\"];\nconst FOLDER_NOT_FOUND = \"Aco/Folder/NotFound\";\n\n/**\n * The model is read as the current identity (the editor), so the answer never covers a model\n * they cannot bind (D116); the folder through ACO's repository, which applies no folder-level\n * permissions (D69).\n */\nclass CmsEntryFolderExistsServiceImpl implements Abstraction.Interface {\n    public constructor(\n        private getModel: GetModelUseCase.Interface,\n        private getFolder: GetFolderRepository.Interface\n    ) {}\n\n    public async exists(params: Abstraction.Params): Promise<boolean> {\n        // The ACO repository reads \"<id>#<n>\" as a revision; such an id is never a folder.\n        if (!params.id || params.id.includes(\"#\")) {\n            return false;\n        }\n        const modelId = getModelIdFromFolderType(params.type);\n        if (!modelId) {\n            return false;\n        }\n\n        const model = await this.getModel.execute(modelId);\n        if (model.isFail()) {\n            if (UNREADABLE_MODEL_CODES.includes(model.error.code)) {\n                return false;\n            }\n            throw model.error;\n        }\n        if (!isBindableModel(model.value)) {\n            return false;\n        }\n\n        const folder = await this.getFolder.execute(params.id);\n        if (folder.isFail()) {\n            if (folder.error.code === FOLDER_NOT_FOUND) {\n                return false;\n            }\n            throw folder.error;\n        }\n        return folder.value.type === params.type;\n    }\n}\n\nexport const CmsEntryFolderExistsService = Abstraction.createImplementation({\n    implementation: CmsEntryFolderExistsServiceImpl,\n    dependencies: [GetModelUseCase, GetFolderRepository]\n});\n"],"names":["UNREADABLE_MODEL_CODES","FOLDER_NOT_FOUND","CmsEntryFolderExistsServiceImpl","getModel","getFolder","params","modelId","getModelIdFromFolderType","model","isBindableModel","folder","CmsEntryFolderExistsService","Abstraction","GetModelUseCase","GetFolderRepository"],"mappings":";;;;;AAMA,MAAMA,yBAAyB;IAAC;IAAsB;CAA0B;AAChF,MAAMC,mBAAmB;AAOzB,MAAMC;IACF,YACYC,QAAmC,EACnCC,SAAwC,CAClD;aAFUD,QAAQ,GAARA;aACAC,SAAS,GAATA;IACT;IAEH,MAAa,OAAOC,MAA0B,EAAoB;QAE9D,IAAI,CAACA,OAAO,EAAE,IAAIA,OAAO,EAAE,CAAC,QAAQ,CAAC,MACjC,OAAO;QAEX,MAAMC,UAAUC,yBAAyBF,OAAO,IAAI;QACpD,IAAI,CAACC,SACD,OAAO;QAGX,MAAME,QAAQ,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAACF;QAC1C,IAAIE,MAAM,MAAM,IAAI;YAChB,IAAIR,uBAAuB,QAAQ,CAACQ,MAAM,KAAK,CAAC,IAAI,GAChD,OAAO;YAEX,MAAMA,MAAM,KAAK;QACrB;QACA,IAAI,CAACC,gBAAgBD,MAAM,KAAK,GAC5B,OAAO;QAGX,MAAME,SAAS,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAACL,OAAO,EAAE;QACrD,IAAIK,OAAO,MAAM,IAAI;YACjB,IAAIA,OAAO,KAAK,CAAC,IAAI,KAAKT,kBACtB,OAAO;YAEX,MAAMS,OAAO,KAAK;QACtB;QACA,OAAOA,OAAO,KAAK,CAAC,IAAI,KAAKL,OAAO,IAAI;IAC5C;AACJ;AAEO,MAAMM,0DAA8BC,4BAAAA,oBAAgC,CAAC;IACxE,gBAAgBV;IAChB,cAAc;QAACW;QAAiBC;KAAoB;AACxD"}

package/features/target/CmsEntryFolderExistsService/abstractions.d.ts

@@ -0,0 +1,23 @@
+export interface CmsEntryFolderExistsParams {
+    id: string;
+    /** ACO folder type, `cms:<modelId>`. */
+    type: string;
+}
+export interface ICmsEntryFolderExistsService {
+    /**
+     * Whether a folder with this id and type exists. `false` for a type that is not
+     * `cms:<modelId>`, a model the current identity cannot read, a private or unpublishable model,
+     * a missing folder or a folder of another type. Throws when a model or folder read fails.
+     */
+    exists(params: CmsEntryFolderExistsParams): Promise<boolean>;
+}
+/**
+ * Folder existence for the workflow editor's folder rules (D69, R125): the folder repository
+ * without folder-level permissions, so it answers for folders the editor cannot open, and only a
+ * boolean. The caller checks `editor`.
+ */
+export declare const CmsEntryFolderExistsService: import("@webiny/di").Abstraction<ICmsEntryFolderExistsService>;
+export declare namespace CmsEntryFolderExistsService {
+    type Interface = ICmsEntryFolderExistsService;
+    type Params = CmsEntryFolderExistsParams;
+}

package/features/target/CmsEntryFolderExistsService/abstractions.js

@@ -0,0 +1,5 @@
+import { createAbstraction } from "@webiny/feature/api";
+const CmsEntryFolderExistsService = createAbstraction("CmsEntryFolderExistsService");
+export { CmsEntryFolderExistsService };
+
+//# sourceMappingURL=abstractions.js.map

package/features/target/CmsEntryFolderExistsService/abstractions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/target/CmsEntryFolderExistsService/abstractions.js","sources":["../../../../src/features/target/CmsEntryFolderExistsService/abstractions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\n\nexport interface CmsEntryFolderExistsParams {\n    id: string;\n    /** ACO folder type, `cms:<modelId>`. */\n    type: string;\n}\n\nexport interface ICmsEntryFolderExistsService {\n    /**\n     * Whether a folder with this id and type exists. `false` for a type that is not\n     * `cms:<modelId>`, a model the current identity cannot read, a private or unpublishable model,\n     * a missing folder or a folder of another type. Throws when a model or folder read fails.\n     */\n    exists(params: CmsEntryFolderExistsParams): Promise<boolean>;\n}\n\n/**\n * Folder existence for the workflow editor's folder rules (D69, R125): the folder repository\n * without folder-level permissions, so it answers for folders the editor cannot open, and only a\n * boolean. The caller checks `editor`.\n */\nexport const CmsEntryFolderExistsService = createAbstraction<ICmsEntryFolderExistsService>(\n    \"CmsEntryFolderExistsService\"\n);\n\nexport namespace CmsEntryFolderExistsService {\n    export type Interface = ICmsEntryFolderExistsService;\n    export type Params = CmsEntryFolderExistsParams;\n}\n"],"names":["CmsEntryFolderExistsService","createAbstraction"],"mappings":";AAsBO,MAAMA,8BAA8BC,kBACvC"}

package/features/target/CmsEntryFolderExistsService/index.d.ts

@@ -0,0 +1 @@
+export { CmsEntryFolderExistsService } from "./abstractions.js";

package/features/target/CmsEntryFolderExistsService/index.js

@@ -0,0 +1 @@
+export { CmsEntryFolderExistsService } from "./abstractions.js";

package/features/target/CmsEntryReviewNamespace/CmsModelReviewNamespace.d.ts

@@ -0,0 +1,10 @@
+import type { CmsModel } from "@webiny/api-headless-cms/types/index.js";
+import { CmsEntryReviewNamespace } from "./abstractions.js";
+/** Public CMS models review under `cms.<modelId>`; private models are left to their app (R51). */
+declare class CmsModelReviewNamespaceImpl implements CmsEntryReviewNamespace.Interface {
+    resolve(model: CmsModel): string | null;
+}
+export declare const CmsModelReviewNamespace: typeof CmsModelReviewNamespaceImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("./abstractions.js").ICmsEntryReviewNamespace>;
+};
+export {};

package/features/target/CmsEntryReviewNamespace/CmsModelReviewNamespace.js

@@ -0,0 +1,14 @@
+import { getCmsNamespace } from "../../../utils/appName.js";
+import { CmsEntryReviewNamespace } from "./abstractions.js";
+class CmsModelReviewNamespaceImpl {
+    resolve(model) {
+        return getCmsNamespace(model);
+    }
+}
+const CmsModelReviewNamespace = CmsEntryReviewNamespace.createImplementation({
+    implementation: CmsModelReviewNamespaceImpl,
+    dependencies: []
+});
+export { CmsModelReviewNamespace };
+
+//# sourceMappingURL=CmsModelReviewNamespace.js.map

package/features/target/CmsEntryReviewNamespace/CmsModelReviewNamespace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/target/CmsEntryReviewNamespace/CmsModelReviewNamespace.js","sources":["../../../../src/features/target/CmsEntryReviewNamespace/CmsModelReviewNamespace.ts"],"sourcesContent":["import type { CmsModel } from \"@webiny/api-headless-cms/types/index.js\";\nimport { getCmsNamespace } from \"~/utils/appName.js\";\nimport { CmsEntryReviewNamespace } from \"./abstractions.js\";\n\n/** Public CMS models review under `cms.<modelId>`; private models are left to their app (R51). */\nclass CmsModelReviewNamespaceImpl implements CmsEntryReviewNamespace.Interface {\n    public resolve(model: CmsModel): string | null {\n        return getCmsNamespace(model);\n    }\n}\n\nexport const CmsModelReviewNamespace = CmsEntryReviewNamespace.createImplementation({\n    implementation: CmsModelReviewNamespaceImpl,\n    dependencies: []\n});\n"],"names":["CmsModelReviewNamespaceImpl","model","getCmsNamespace","CmsModelReviewNamespace","CmsEntryReviewNamespace"],"mappings":";;AAKA,MAAMA;IACK,QAAQC,KAAe,EAAiB;QAC3C,OAAOC,gBAAgBD;IAC3B;AACJ;AAEO,MAAME,0BAA0BC,wBAAwB,oBAAoB,CAAC;IAChF,gBAAgBJ;IAChB,cAAc,EAAE;AACpB"}