@webiny/api-headless-cms 0.0.0-unstable.de38392959 → 0.0.0-unstable.df7a8bb475

package/context.js.map

@@ -1 +1 @@
-{"version":3,"names":["_error","_interopRequireDefault","require","_api","_CmsParametersPlugin","_system","_contentModelGroup","_contentModel","_contentEntry","_plugins","_valueKeyStorageConverter","_ModelsPermissions","_ModelGroupsPermissions","_EntriesPermissions","_export","_importing","getParameters","context","plugins","byType","CmsParametersPlugin","type","plugin","result","WebinyError","createContextPlugin","storageOperations","ContextPlugin","locale","getLocale","systemLocale","i18n","getIdentity","security","getTenant","tenancy","getCurrentTenant","register","StorageOperationsCmsModelPlugin","createCmsModelFieldConvertersAttachFactory","benchmark","measure","beforeInit","modelGroupsPermissions","ModelGroupsPermissions","getPermissions","fullAccessPermissionName","modelsPermissions","ModelsPermissions","entriesPermissions","EntriesPermissions","cms","READ","PREVIEW","MANAGE","permissions","groups","models","entries","createSystemCrud","createModelGroupsCrud","createModelsCrud","createContentEntryCrud","export","createExportCrud","importing","createImportCrud","init","name","exports"],"sources":["context.ts"],"sourcesContent":["import { CmsContext, HeadlessCmsStorageOperations } from \"~/types\";\nimport WebinyError from \"@webiny/error\";\nimport { ContextPlugin } from \"@webiny/api\";\nimport { CmsParametersPlugin, CmsParametersPluginResponse } from \"~/plugins/CmsParametersPlugin\";\nimport { createSystemCrud } from \"~/crud/system.crud\";\nimport { createModelGroupsCrud } from \"~/crud/contentModelGroup.crud\";\nimport { createModelsCrud } from \"~/crud/contentModel.crud\";\nimport { createContentEntryCrud } from \"~/crud/contentEntry.crud\";\nimport { StorageOperationsCmsModelPlugin } from \"~/plugins\";\nimport { createCmsModelFieldConvertersAttachFactory } from \"~/utils/converters/valueKeyStorageConverter\";\nimport { ModelsPermissions } from \"~/utils/permissions/ModelsPermissions\";\nimport { ModelGroupsPermissions } from \"./utils/permissions/ModelGroupsPermissions\";\nimport { EntriesPermissions } from \"./utils/permissions/EntriesPermissions\";\nimport { createExportCrud } from \"~/export\";\nimport { createImportCrud } from \"~/export/crud/importing\";\n\nconst getParameters = async (context: CmsContext): Promise<CmsParametersPluginResponse> => {\n    const plugins = context.plugins.byType<CmsParametersPlugin>(CmsParametersPlugin.type);\n\n    for (const plugin of plugins) {\n        const result = await plugin.getParameters(context);\n        if (result !== null) {\n            return result;\n        }\n    }\n    throw new WebinyError(\n        \"Could not determine locale and/or type of the CMS.\",\n        \"CMS_LOCALE_AND_TYPE_ERROR\"\n    );\n};\n\nexport interface CrudParams {\n    storageOperations: HeadlessCmsStorageOperations;\n}\n\nexport const createContextPlugin = ({ storageOperations }: CrudParams) => {\n    const plugin = new ContextPlugin<CmsContext>(async context => {\n        const { type, locale } = await getParameters(context);\n\n        const getLocale = () => {\n            const systemLocale = context.i18n.getLocale(locale);\n            if (!systemLocale) {\n                throw new WebinyError(`There is no locale \"${locale}\" in the system.`);\n            }\n            return systemLocale;\n        };\n\n        const getIdentity = () => {\n            return context.security.getIdentity();\n        };\n\n        const getTenant = () => {\n            return context.tenancy.getCurrentTenant();\n        };\n\n        context.plugins.register(\n            new StorageOperationsCmsModelPlugin(\n                createCmsModelFieldConvertersAttachFactory(context.plugins)\n            )\n        );\n\n        await context.benchmark.measure(\"headlessCms.createContext\", async () => {\n            await storageOperations.beforeInit(context);\n\n            const modelGroupsPermissions = new ModelGroupsPermissions({\n                getIdentity: context.security.getIdentity,\n                getPermissions: () => context.security.getPermissions(\"cms.contentModelGroup\"),\n                fullAccessPermissionName: \"cms.*\"\n            });\n\n            const modelsPermissions = new ModelsPermissions({\n                getIdentity: context.security.getIdentity,\n                getPermissions: () => context.security.getPermissions(\"cms.contentModel\"),\n                fullAccessPermissionName: \"cms.*\",\n                modelGroupsPermissions\n            });\n\n            const entriesPermissions = new EntriesPermissions({\n                getIdentity: context.security.getIdentity,\n                getPermissions: () => context.security.getPermissions(\"cms.contentEntry\"),\n                fullAccessPermissionName: \"cms.*\"\n            });\n\n            context.cms = {\n                type,\n                locale,\n                getLocale,\n                READ: type === \"read\",\n                PREVIEW: type === \"preview\",\n                MANAGE: type === \"manage\",\n                storageOperations,\n                permissions: {\n                    groups: modelGroupsPermissions,\n                    models: modelsPermissions,\n                    entries: entriesPermissions\n                },\n                ...createSystemCrud({\n                    context,\n                    getTenant,\n                    getLocale,\n                    getIdentity,\n                    storageOperations\n                }),\n                ...createModelGroupsCrud({\n                    context,\n                    getTenant,\n                    getLocale,\n                    getIdentity,\n                    storageOperations,\n                    modelGroupsPermissions\n                }),\n                ...createModelsCrud({\n                    context,\n                    getLocale,\n                    getTenant,\n                    getIdentity,\n                    storageOperations,\n                    modelsPermissions\n                }),\n                ...createContentEntryCrud({\n                    context,\n                    getIdentity,\n                    getTenant,\n                    getLocale,\n                    storageOperations,\n                    entriesPermissions,\n                    modelsPermissions\n                }),\n                export: {\n                    ...createExportCrud(context)\n                },\n                importing: {\n                    ...createImportCrud(context)\n                }\n            };\n\n            if (!storageOperations.init) {\n                return;\n            }\n            await storageOperations.init(context);\n        });\n    });\n\n    plugin.name = \"cms.createContext\";\n\n    return plugin;\n};\n"],"mappings":";;;;;;;AACA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,IAAA,GAAAD,OAAA;AACA,IAAAE,oBAAA,GAAAF,OAAA;AACA,IAAAG,OAAA,GAAAH,OAAA;AACA,IAAAI,kBAAA,GAAAJ,OAAA;AACA,IAAAK,aAAA,GAAAL,OAAA;AACA,IAAAM,aAAA,GAAAN,OAAA;AACA,IAAAO,QAAA,GAAAP,OAAA;AACA,IAAAQ,yBAAA,GAAAR,OAAA;AACA,IAAAS,kBAAA,GAAAT,OAAA;AACA,IAAAU,uBAAA,GAAAV,OAAA;AACA,IAAAW,mBAAA,GAAAX,OAAA;AACA,IAAAY,OAAA,GAAAZ,OAAA;AACA,IAAAa,UAAA,GAAAb,OAAA;AAEA,MAAMc,aAAa,GAAG,MAAOC,OAAmB,IAA2C;EACvF,MAAMC,OAAO,GAAGD,OAAO,CAACC,OAAO,CAACC,MAAM,CAAsBC,wCAAmB,CAACC,IAAI,CAAC;EAErF,KAAK,MAAMC,MAAM,IAAIJ,OAAO,EAAE;IAC1B,MAAMK,MAAM,GAAG,MAAMD,MAAM,CAACN,aAAa,CAACC,OAAO,CAAC;IAClD,IAAIM,MAAM,KAAK,IAAI,EAAE;MACjB,OAAOA,MAAM;IACjB;EACJ;EACA,MAAM,IAAIC,cAAW,CACjB,oDAAoD,EACpD,2BACJ,CAAC;AACL,CAAC;AAMM,MAAMC,mBAAmB,GAAGA,CAAC;EAAEC;AAA8B,CAAC,KAAK;EACtE,MAAMJ,MAAM,GAAG,IAAIK,kBAAa,CAAa,MAAMV,OAAO,IAAI;IAC1D,MAAM;MAAEI,IAAI;MAAEO;IAAO,CAAC,GAAG,MAAMZ,aAAa,CAACC,OAAO,CAAC;IAErD,MAAMY,SAAS,GAAGA,CAAA,KAAM;MACpB,MAAMC,YAAY,GAAGb,OAAO,CAACc,IAAI,CAACF,SAAS,CAACD,MAAM,CAAC;MACnD,IAAI,CAACE,YAAY,EAAE;QACf,MAAM,IAAIN,cAAW,CAAE,uBAAsBI,MAAO,kBAAiB,CAAC;MAC1E;MACA,OAAOE,YAAY;IACvB,CAAC;IAED,MAAME,WAAW,GAAGA,CAAA,KAAM;MACtB,OAAOf,OAAO,CAACgB,QAAQ,CAACD,WAAW,CAAC,CAAC;IACzC,CAAC;IAED,MAAME,SAAS,GAAGA,CAAA,KAAM;MACpB,OAAOjB,OAAO,CAACkB,OAAO,CAACC,gBAAgB,CAAC,CAAC;IAC7C,CAAC;IAEDnB,OAAO,CAACC,OAAO,CAACmB,QAAQ,CACpB,IAAIC,wCAA+B,CAC/B,IAAAC,oEAA0C,EAACtB,OAAO,CAACC,OAAO,CAC9D,CACJ,CAAC;IAED,MAAMD,OAAO,CAACuB,SAAS,CAACC,OAAO,CAAC,2BAA2B,EAAE,YAAY;MACrE,MAAMf,iBAAiB,CAACgB,UAAU,CAACzB,OAAO,CAAC;MAE3C,MAAM0B,sBAAsB,GAAG,IAAIC,8CAAsB,CAAC;QACtDZ,WAAW,EAAEf,OAAO,CAACgB,QAAQ,CAACD,WAAW;QACzCa,cAAc,EAAEA,CAAA,KAAM5B,OAAO,CAACgB,QAAQ,CAACY,cAAc,CAAC,uBAAuB,CAAC;QAC9EC,wBAAwB,EAAE;MAC9B,CAAC,CAAC;MAEF,MAAMC,iBAAiB,GAAG,IAAIC,oCAAiB,CAAC;QAC5ChB,WAAW,EAAEf,OAAO,CAACgB,QAAQ,CAACD,WAAW;QACzCa,cAAc,EAAEA,CAAA,KAAM5B,OAAO,CAACgB,QAAQ,CAACY,cAAc,CAAC,kBAAkB,CAAC;QACzEC,wBAAwB,EAAE,OAAO;QACjCH;MACJ,CAAC,CAAC;MAEF,MAAMM,kBAAkB,GAAG,IAAIC,sCAAkB,CAAC;QAC9ClB,WAAW,EAAEf,OAAO,CAACgB,QAAQ,CAACD,WAAW;QACzCa,cAAc,EAAEA,CAAA,KAAM5B,OAAO,CAACgB,QAAQ,CAACY,cAAc,CAAC,kBAAkB,CAAC;QACzEC,wBAAwB,EAAE;MAC9B,CAAC,CAAC;MAEF7B,OAAO,CAACkC,GAAG,GAAG;QACV9B,IAAI;QACJO,MAAM;QACNC,SAAS;QACTuB,IAAI,EAAE/B,IAAI,KAAK,MAAM;QACrBgC,OAAO,EAAEhC,IAAI,KAAK,SAAS;QAC3BiC,MAAM,EAAEjC,IAAI,KAAK,QAAQ;QACzBK,iBAAiB;QACjB6B,WAAW,EAAE;UACTC,MAAM,EAAEb,sBAAsB;UAC9Bc,MAAM,EAAEV,iBAAiB;UACzBW,OAAO,EAAET;QACb,CAAC;QACD,GAAG,IAAAU,wBAAgB,EAAC;UAChB1C,OAAO;UACPiB,SAAS;UACTL,SAAS;UACTG,WAAW;UACXN;QACJ,CAAC,CAAC;QACF,GAAG,IAAAkC,wCAAqB,EAAC;UACrB3C,OAAO;UACPiB,SAAS;UACTL,SAAS;UACTG,WAAW;UACXN,iBAAiB;UACjBiB;QACJ,CAAC,CAAC;QACF,GAAG,IAAAkB,8BAAgB,EAAC;UAChB5C,OAAO;UACPY,SAAS;UACTK,SAAS;UACTF,WAAW;UACXN,iBAAiB;UACjBqB;QACJ,CAAC,CAAC;QACF,GAAG,IAAAe,oCAAsB,EAAC;UACtB7C,OAAO;UACPe,WAAW;UACXE,SAAS;UACTL,SAAS;UACTH,iBAAiB;UACjBuB,kBAAkB;UAClBF;QACJ,CAAC,CAAC;QACFgB,MAAM,EAAE;UACJ,GAAG,IAAAC,wBAAgB,EAAC/C,OAAO;QAC/B,CAAC;QACDgD,SAAS,EAAE;UACP,GAAG,IAAAC,2BAAgB,EAACjD,OAAO;QAC/B;MACJ,CAAC;MAED,IAAI,CAACS,iBAAiB,CAACyC,IAAI,EAAE;QACzB;MACJ;MACA,MAAMzC,iBAAiB,CAACyC,IAAI,CAAClD,OAAO,CAAC;IACzC,CAAC,CAAC;EACN,CAAC,CAAC;EAEFK,MAAM,CAAC8C,IAAI,GAAG,mBAAmB;EAEjC,OAAO9C,MAAM;AACjB,CAAC;AAAC+C,OAAA,CAAA5C,mBAAA,GAAAA,mBAAA"}
+{"version":3,"names":["WebinyError","ContextPlugin","processRequestBody","CmsParametersPlugin","AccessControl","createModelGroupsCrud","createModelsCrud","createContentEntryCrud","StorageOperationsCmsModelPlugin","createCmsModelFieldConvertersAttachFactory","createExportCrud","createImportCrud","getSchema","CmsInstallerFeature","ContentEntriesFeature","AccessControlAbstraction","CmsContext","CmsContextAbstraction","StorageOperations","EntryFromStorageTransform","EntryToStorageTransform","PluginsContainer","SearchableFieldsProvider","entryFromStorageTransform","entryToStorageTransform","getSearchableFields","ContentModelGroupFeature","ContentModelFeature","ModelBuilderFeature","CmsWhereMapperFeature","CmsSortMapperFeature","getParameters","context","plugins","byType","type","plugin","result","createContextPlugin","storageOperations","getTenant","tenancy","getCurrentTenant","setSchemaType","cms","READ","PREVIEW","MANAGE","getExecutableSchema","originalType","schema","security","withoutAuthorization","input","register","beforeInit","accessControl","getIdentity","getGroupsPermissions","getPermissions","getModelsPermissions","getEntriesPermissions","listAllGroups","listGroups","export","importing","container","registerInstance","model","entry","params","fields","init","name"],"sources":["context.ts"],"sourcesContent":["import type { ApiEndpoint, CmsContext, HeadlessCmsStorageOperations } from \"~/types/index.js\";\nimport WebinyError from \"@webiny/error\";\nimport { ContextPlugin } from \"@webiny/api\";\nimport type { GraphQLRequestBody } from \"@webiny/handler-graphql/types.js\";\nimport { processRequestBody } from \"@webiny/handler-graphql\";\nimport type { CmsParametersPluginResponse } from \"~/plugins/CmsParametersPlugin.js\";\nimport { CmsParametersPlugin } from \"~/plugins/CmsParametersPlugin.js\";\nimport { AccessControl } from \"~/crud/AccessControl/AccessControl.js\";\nimport { createModelGroupsCrud } from \"~/crud/contentModelGroup.crud.js\";\nimport { createModelsCrud } from \"~/crud/contentModel.crud.js\";\nimport { createContentEntryCrud } from \"~/crud/contentEntry.crud.js\";\nimport { StorageOperationsCmsModelPlugin } from \"~/plugins/index.js\";\nimport { createCmsModelFieldConvertersAttachFactory } from \"~/utils/converters/valueKeyStorageConverter.js\";\nimport { createExportCrud } from \"~/export/index.js\";\nimport { createImportCrud } from \"~/export/crud/importing.js\";\nimport { getSchema } from \"~/graphql/getSchema.js\";\nimport { CmsInstallerFeature } from \"~/features/installer/feature.js\";\nimport { ContentEntriesFeature } from \"~/features/contentEntry/ContentEntriesFeature.js\";\nimport {\n    AccessControl as AccessControlAbstraction,\n    CmsContext as CmsContextAbstraction,\n    StorageOperations\n} from \"~/features/shared/abstractions.js\";\nimport {\n    EntryFromStorageTransform,\n    EntryToStorageTransform,\n    PluginsContainer,\n    SearchableFieldsProvider\n} from \"./legacy/abstractions.js\";\nimport { entryFromStorageTransform, entryToStorageTransform } from \"~/utils/entryStorage.js\";\nimport { getSearchableFields } from \"~/crud/contentEntry/searchableFields.js\";\nimport { ContentModelGroupFeature } from \"~/features/contentModelGroup/ContentModelGroupFeature.js\";\nimport { ContentModelFeature } from \"~/features/contentModel/ContentModelFeature.js\";\nimport { ModelBuilderFeature } from \"~/features/modelBuilder/index.js\";\nimport { CmsWhereMapperFeature } from \"~/features/whereMapper/feature.js\";\nimport { CmsSortMapperFeature } from \"~/features/sortMapper/feature.js\";\n\nconst getParameters = async (context: CmsContext): Promise<CmsParametersPluginResponse> => {\n    const plugins = context.plugins.byType<CmsParametersPlugin>(CmsParametersPlugin.type);\n\n    for (const plugin of plugins) {\n        const result = await plugin.getParameters(context);\n        if (result !== null) {\n            return result;\n        }\n    }\n    throw new WebinyError(\"Could not determine type of the CMS.\", \"CMS_TYPE_ERROR\");\n};\n\nexport interface CrudParams {\n    storageOperations: HeadlessCmsStorageOperations;\n}\n\nexport const createContextPlugin = ({ storageOperations }: CrudParams) => {\n    const plugin = new ContextPlugin<CmsContext>(async context => {\n        const { type } = await getParameters(context);\n\n        const getTenant = () => {\n            return context.tenancy.getCurrentTenant();\n        };\n\n        const setSchemaType = (type: ApiEndpoint | null) => {\n            if (!type) {\n                return;\n            }\n\n            context.cms.type = type;\n\n            switch (type) {\n                case \"read\":\n                    context.cms.READ = true;\n                    break;\n                case \"preview\":\n                    context.cms.PREVIEW = true;\n                    break;\n                default:\n                    context.cms.MANAGE = true;\n            }\n        };\n\n        async function getExecutableSchema(type: ApiEndpoint) {\n            const originalType = context.cms.type;\n            setSchemaType(type);\n\n            const schema = await context.security.withoutAuthorization(() => {\n                return getSchema({\n                    context,\n                    getTenant,\n                    type\n                });\n            });\n\n            setSchemaType(originalType);\n\n            return async <TData, TExtensions>(input: GraphQLRequestBody | GraphQLRequestBody[]) => {\n                return processRequestBody<TData, TExtensions>(input, schema, context);\n            };\n        }\n\n        context.plugins.register(\n            new StorageOperationsCmsModelPlugin(\n                createCmsModelFieldConvertersAttachFactory(context.plugins)\n            )\n        );\n\n        await storageOperations.beforeInit(context);\n\n        const accessControl = new AccessControl({\n            getIdentity: async () => context.security.getIdentity(),\n            getGroupsPermissions: () => context.security.getPermissions(\"cms.contentModelGroup\"),\n            getModelsPermissions: () => context.security.getPermissions(\"cms.contentModel\"),\n            getEntriesPermissions: () => context.security.getPermissions(\"cms.contentEntry\"),\n            listAllGroups: () => {\n                return context.security.withoutAuthorization(() => {\n                    return context.cms.listGroups();\n                });\n            }\n        });\n\n        context.cms = {\n            type,\n            READ: type === \"read\",\n            PREVIEW: type === \"preview\",\n            MANAGE: type === \"manage\",\n            storageOperations,\n            accessControl,\n            getExecutableSchema,\n            ...createModelGroupsCrud({\n                context\n            }),\n            ...createModelsCrud({\n                context\n            }),\n            ...createContentEntryCrud({\n                context\n            }),\n            export: {\n                ...createExportCrud(context)\n            },\n            importing: {\n                ...createImportCrud(context)\n            }\n        };\n\n        // Register legacy dependencies\n        context.container.registerInstance(StorageOperations, storageOperations);\n        context.container.registerInstance(AccessControlAbstraction, accessControl);\n        context.container.registerInstance(CmsContextAbstraction, context);\n        context.container.registerInstance(PluginsContainer, context.plugins);\n        context.container.registerInstance(EntryToStorageTransform, (model, entry) => {\n            return entryToStorageTransform(context, model, entry);\n        });\n        context.container.registerInstance(EntryFromStorageTransform, (model, entry) => {\n            return entryFromStorageTransform(context, model, entry);\n        });\n        context.container.registerInstance(SearchableFieldsProvider, params => {\n            return getSearchableFields({\n                plugins: context.plugins,\n                fields: params.fields,\n                input: []\n            });\n        });\n\n        // Register features\n        CmsInstallerFeature.register(context.container);\n        ContentEntriesFeature.register(context.container);\n        ContentModelFeature.register(context.container);\n        ContentModelGroupFeature.register(context.container);\n        ModelBuilderFeature.register(context.container);\n\n        CmsWhereMapperFeature.register(context.container);\n        CmsSortMapperFeature.register(context.container);\n\n        if (!storageOperations.init) {\n            return;\n        }\n        await storageOperations.init(context);\n    });\n\n    plugin.name = \"cms.createContext\";\n\n    return plugin;\n};\n"],"mappings":"AACA,OAAOA,WAAW,MAAM,eAAe;AACvC,SAASC,aAAa,QAAQ,aAAa;AAE3C,SAASC,kBAAkB,QAAQ,yBAAyB;AAE5D,SAASC,mBAAmB;AAC5B,SAASC,aAAa;AACtB,SAASC,qBAAqB;AAC9B,SAASC,gBAAgB;AACzB,SAASC,sBAAsB;AAC/B,SAASC,+BAA+B;AACxC,SAASC,0CAA0C;AACnD,SAASC,gBAAgB;AACzB,SAASC,gBAAgB;AACzB,SAASC,SAAS;AAClB,SAASC,mBAAmB;AAC5B,SAASC,qBAAqB;AAC9B,SACIV,aAAa,IAAIW,wBAAwB,EACzCC,UAAU,IAAIC,qBAAqB,EACnCC,iBAAiB;AAErB,SACIC,yBAAyB,EACzBC,uBAAuB,EACvBC,gBAAgB,EAChBC,wBAAwB;AAE5B,SAASC,yBAAyB,EAAEC,uBAAuB;AAC3D,SAASC,mBAAmB;AAC5B,SAASC,wBAAwB;AACjC,SAASC,mBAAmB;AAC5B,SAASC,mBAAmB;AAC5B,SAASC,qBAAqB;AAC9B,SAASC,oBAAoB;AAE7B,MAAMC,aAAa,GAAG,MAAOC,OAAmB,IAA2C;EACvF,MAAMC,OAAO,GAAGD,OAAO,CAACC,OAAO,CAACC,MAAM,CAAsB/B,mBAAmB,CAACgC,IAAI,CAAC;EAErF,KAAK,MAAMC,MAAM,IAAIH,OAAO,EAAE;IAC1B,MAAMI,MAAM,GAAG,MAAMD,MAAM,CAACL,aAAa,CAACC,OAAO,CAAC;IAClD,IAAIK,MAAM,KAAK,IAAI,EAAE;MACjB,OAAOA,MAAM;IACjB;EACJ;EACA,MAAM,IAAIrC,WAAW,CAAC,sCAAsC,EAAE,gBAAgB,CAAC;AACnF,CAAC;AAMD,OAAO,MAAMsC,mBAAmB,GAAGA,CAAC;EAAEC;AAA8B,CAAC,KAAK;EACtE,MAAMH,MAAM,GAAG,IAAInC,aAAa,CAAa,MAAM+B,OAAO,IAAI;IAC1D,MAAM;MAAEG;IAAK,CAAC,GAAG,MAAMJ,aAAa,CAACC,OAAO,CAAC;IAE7C,MAAMQ,SAAS,GAAGA,CAAA,KAAM;MACpB,OAAOR,OAAO,CAACS,OAAO,CAACC,gBAAgB,CAAC,CAAC;IAC7C,CAAC;IAED,MAAMC,aAAa,GAAIR,IAAwB,IAAK;MAChD,IAAI,CAACA,IAAI,EAAE;QACP;MACJ;MAEAH,OAAO,CAACY,GAAG,CAACT,IAAI,GAAGA,IAAI;MAEvB,QAAQA,IAAI;QACR,KAAK,MAAM;UACPH,OAAO,CAACY,GAAG,CAACC,IAAI,GAAG,IAAI;UACvB;QACJ,KAAK,SAAS;UACVb,OAAO,CAACY,GAAG,CAACE,OAAO,GAAG,IAAI;UAC1B;QACJ;UACId,OAAO,CAACY,GAAG,CAACG,MAAM,GAAG,IAAI;MACjC;IACJ,CAAC;IAED,eAAeC,mBAAmBA,CAACb,IAAiB,EAAE;MAClD,MAAMc,YAAY,GAAGjB,OAAO,CAACY,GAAG,CAACT,IAAI;MACrCQ,aAAa,CAACR,IAAI,CAAC;MAEnB,MAAMe,MAAM,GAAG,MAAMlB,OAAO,CAACmB,QAAQ,CAACC,oBAAoB,CAAC,MAAM;QAC7D,OAAOxC,SAAS,CAAC;UACboB,OAAO;UACPQ,SAAS;UACTL;QACJ,CAAC,CAAC;MACN,CAAC,CAAC;MAEFQ,aAAa,CAACM,YAAY,CAAC;MAE3B,OAAO,MAA2BI,KAAgD,IAAK;QACnF,OAAOnD,kBAAkB,CAAqBmD,KAAK,EAAEH,MAAM,EAAElB,OAAO,CAAC;MACzE,CAAC;IACL;IAEAA,OAAO,CAACC,OAAO,CAACqB,QAAQ,CACpB,IAAI9C,+BAA+B,CAC/BC,0CAA0C,CAACuB,OAAO,CAACC,OAAO,CAC9D,CACJ,CAAC;IAED,MAAMM,iBAAiB,CAACgB,UAAU,CAACvB,OAAO,CAAC;IAE3C,MAAMwB,aAAa,GAAG,IAAIpD,aAAa,CAAC;MACpCqD,WAAW,EAAE,MAAAA,CAAA,KAAYzB,OAAO,CAACmB,QAAQ,CAACM,WAAW,CAAC,CAAC;MACvDC,oBAAoB,EAAEA,CAAA,KAAM1B,OAAO,CAACmB,QAAQ,CAACQ,cAAc,CAAC,uBAAuB,CAAC;MACpFC,oBAAoB,EAAEA,CAAA,KAAM5B,OAAO,CAACmB,QAAQ,CAACQ,cAAc,CAAC,kBAAkB,CAAC;MAC/EE,qBAAqB,EAAEA,CAAA,KAAM7B,OAAO,CAACmB,QAAQ,CAACQ,cAAc,CAAC,kBAAkB,CAAC;MAChFG,aAAa,EAAEA,CAAA,KAAM;QACjB,OAAO9B,OAAO,CAACmB,QAAQ,CAACC,oBAAoB,CAAC,MAAM;UAC/C,OAAOpB,OAAO,CAACY,GAAG,CAACmB,UAAU,CAAC,CAAC;QACnC,CAAC,CAAC;MACN;IACJ,CAAC,CAAC;IAEF/B,OAAO,CAACY,GAAG,GAAG;MACVT,IAAI;MACJU,IAAI,EAAEV,IAAI,KAAK,MAAM;MACrBW,OAAO,EAAEX,IAAI,KAAK,SAAS;MAC3BY,MAAM,EAAEZ,IAAI,KAAK,QAAQ;MACzBI,iBAAiB;MACjBiB,aAAa;MACbR,mBAAmB;MACnB,GAAG3C,qBAAqB,CAAC;QACrB2B;MACJ,CAAC,CAAC;MACF,GAAG1B,gBAAgB,CAAC;QAChB0B;MACJ,CAAC,CAAC;MACF,GAAGzB,sBAAsB,CAAC;QACtByB;MACJ,CAAC,CAAC;MACFgC,MAAM,EAAE;QACJ,GAAGtD,gBAAgB,CAACsB,OAAO;MAC/B,CAAC;MACDiC,SAAS,EAAE;QACP,GAAGtD,gBAAgB,CAACqB,OAAO;MAC/B;IACJ,CAAC;;IAED;IACAA,OAAO,CAACkC,SAAS,CAACC,gBAAgB,CAACjD,iBAAiB,EAAEqB,iBAAiB,CAAC;IACxEP,OAAO,CAACkC,SAAS,CAACC,gBAAgB,CAACpD,wBAAwB,EAAEyC,aAAa,CAAC;IAC3ExB,OAAO,CAACkC,SAAS,CAACC,gBAAgB,CAAClD,qBAAqB,EAAEe,OAAO,CAAC;IAClEA,OAAO,CAACkC,SAAS,CAACC,gBAAgB,CAAC9C,gBAAgB,EAAEW,OAAO,CAACC,OAAO,CAAC;IACrED,OAAO,CAACkC,SAAS,CAACC,gBAAgB,CAAC/C,uBAAuB,EAAE,CAACgD,KAAK,EAAEC,KAAK,KAAK;MAC1E,OAAO7C,uBAAuB,CAACQ,OAAO,EAAEoC,KAAK,EAAEC,KAAK,CAAC;IACzD,CAAC,CAAC;IACFrC,OAAO,CAACkC,SAAS,CAACC,gBAAgB,CAAChD,yBAAyB,EAAE,CAACiD,KAAK,EAAEC,KAAK,KAAK;MAC5E,OAAO9C,yBAAyB,CAACS,OAAO,EAAEoC,KAAK,EAAEC,KAAK,CAAC;IAC3D,CAAC,CAAC;IACFrC,OAAO,CAACkC,SAAS,CAACC,gBAAgB,CAAC7C,wBAAwB,EAAEgD,MAAM,IAAI;MACnE,OAAO7C,mBAAmB,CAAC;QACvBQ,OAAO,EAAED,OAAO,CAACC,OAAO;QACxBsC,MAAM,EAAED,MAAM,CAACC,MAAM;QACrBlB,KAAK,EAAE;MACX,CAAC,CAAC;IACN,CAAC,CAAC;;IAEF;IACAxC,mBAAmB,CAACyC,QAAQ,CAACtB,OAAO,CAACkC,SAAS,CAAC;IAC/CpD,qBAAqB,CAACwC,QAAQ,CAACtB,OAAO,CAACkC,SAAS,CAAC;IACjDvC,mBAAmB,CAAC2B,QAAQ,CAACtB,OAAO,CAACkC,SAAS,CAAC;IAC/CxC,wBAAwB,CAAC4B,QAAQ,CAACtB,OAAO,CAACkC,SAAS,CAAC;IACpDtC,mBAAmB,CAAC0B,QAAQ,CAACtB,OAAO,CAACkC,SAAS,CAAC;IAE/CrC,qBAAqB,CAACyB,QAAQ,CAACtB,OAAO,CAACkC,SAAS,CAAC;IACjDpC,oBAAoB,CAACwB,QAAQ,CAACtB,OAAO,CAACkC,SAAS,CAAC;IAEhD,IAAI,CAAC3B,iBAAiB,CAACiC,IAAI,EAAE;MACzB;IACJ;IACA,MAAMjC,iBAAiB,CAACiC,IAAI,CAACxC,OAAO,CAAC;EACzC,CAAC,CAAC;EAEFI,MAAM,CAACqC,IAAI,GAAG,mBAAmB;EAEjC,OAAOrC,MAAM;AACjB,CAAC","ignoreList":[]}

package/crud/AccessControl/AccessControl.d.ts

@@ -0,0 +1,97 @@
+import type { CmsEntry, CmsEntryPermission, CmsGroup, CmsGroupPermission, CmsModel, CmsModelPermission } from "../../types/index.js";
+import type { SecurityIdentity } from "@webiny/api-core/types/security.js";
+export interface AccessControlParams {
+    getIdentity: () => Promise<SecurityIdentity>;
+    getGroupsPermissions: () => Promise<CmsGroupPermission[]>;
+    getModelsPermissions: () => Promise<CmsModelPermission[]>;
+    getEntriesPermissions: () => Promise<CmsEntryPermission[]>;
+    listAllGroups: () => Promise<CmsGroup[]>;
+}
+interface GetGroupsAccessControlListParams {
+    group?: CmsGroup;
+}
+interface CanAccessGroupParams extends GetGroupsAccessControlListParams {
+    rwd?: string;
+}
+interface GetModelsAccessControlListParams {
+    model?: CmsModel;
+}
+interface CanAccessModelParams extends GetModelsAccessControlListParams {
+    rwd?: string;
+}
+interface GetEntriesAccessControlListParams {
+    model: Pick<CmsModel, "modelId" | "createdBy" | "group" | "authorization">;
+    entry?: Pick<CmsEntry, "entryId" | "createdBy">;
+}
+export interface CanAccessEntryParams extends GetEntriesAccessControlListParams {
+    rwd?: string;
+    pw?: string;
+}
+interface AccessControlEntry {
+    rwd: string;
+    canAccessNonOwned: boolean;
+    canAccessOnlyOwned: boolean;
+}
+type AccessControlList = AccessControlEntry[];
+interface EntriesAccessControlEntry extends AccessControlEntry {
+    pw?: string;
+}
+type EntriesAccessControlList = EntriesAccessControlEntry[];
+export declare class AccessControl {
+    getIdentity: AccessControlParams["getIdentity"];
+    getGroupsPermissions: AccessControlParams["getGroupsPermissions"];
+    getModelsPermissions: AccessControlParams["getModelsPermissions"];
+    getEntriesPermissions: AccessControlParams["getEntriesPermissions"];
+    listAllGroupsCallback: AccessControlParams["listAllGroups"];
+    private fullAccessPermissions;
+    private allGroups;
+    constructor({ getIdentity, getGroupsPermissions, getModelsPermissions, getEntriesPermissions, listAllGroups }: AccessControlParams);
+    /**
+     * Groups-related methods below. 👇
+     * - canAccessGroup
+     * - ensureCanAccessGroup
+     * - canAccessNonOwnedGroups
+     * - canAccessOnlyOwnedGroups
+     * - getGroupsAccessControlList
+     * - hasFullAccessToGroups
+     */
+    canAccessGroup(params?: CanAccessGroupParams): Promise<boolean>;
+    canAccessNonOwnedGroups(params: GetGroupsAccessControlListParams): Promise<boolean>;
+    canAccessOnlyOwnedGroups(params: GetGroupsAccessControlListParams): Promise<boolean>;
+    getGroupsAccessControlList(params: GetGroupsAccessControlListParams): Promise<AccessControlList>;
+    hasFullAccessToGroups(): Promise<boolean>;
+    /**
+     * Models-related methods below. 👇
+     * - canAccessModel
+     * - ensureCanAccessModel
+     * - canAccessNonOwnedModels
+     * - canAccessOnlyOwnedModels
+     * - getModelsAccessControlList
+     * - hasFullAccessToModels
+     */
+    canAccessModel(params: CanAccessModelParams): Promise<boolean>;
+    ensureCanAccessModel(params?: CanAccessModelParams): Promise<void>;
+    canAccessNonOwnedModels(params: GetModelsAccessControlListParams): Promise<boolean>;
+    canAccessOnlyOwnedModels(params: GetModelsAccessControlListParams): Promise<boolean>;
+    getModelsAccessControlList(params: GetModelsAccessControlListParams): Promise<AccessControlList>;
+    hasFullAccessToModels(params: GetModelsAccessControlListParams): Promise<boolean>;
+    /**
+     * Entries-related methods below. 👇
+     * - canAccessEntry
+     * - ensureCanAccessEntry
+     * - canAccessNonOwnedEntries
+     * - canAccessOnlyOwnedEntries
+     * - getEntriesAccessControlList
+     * - hasFullAccessToEntries
+     */
+    canAccessEntry(params: CanAccessEntryParams): Promise<boolean>;
+    ensureCanAccessEntry(params: CanAccessEntryParams): Promise<void>;
+    canAccessNonOwnedEntries(params: GetEntriesAccessControlListParams): Promise<boolean>;
+    canAccessOnlyOwnedEntries(params: GetEntriesAccessControlListParams): Promise<boolean>;
+    getEntriesAccessControlList(params: GetEntriesAccessControlListParams): Promise<EntriesAccessControlList>;
+    hasFullAccessToEntries(params: GetEntriesAccessControlListParams): Promise<boolean>;
+    private modelAuthorizationDisabled;
+    private listAllGroups;
+    private getGroup;
+}
+export {};

package/crud/AccessControl/AccessControl.js

@@ -0,0 +1,499 @@
+import { NotAuthorizedError } from "../../utils/errors.js";
+export class AccessControl {
+  constructor({
+    getIdentity,
+    getGroupsPermissions,
+    getModelsPermissions,
+    getEntriesPermissions,
+    listAllGroups
+  }) {
+    this.getIdentity = getIdentity;
+    this.getGroupsPermissions = getGroupsPermissions;
+    this.getModelsPermissions = getModelsPermissions;
+    this.getEntriesPermissions = getEntriesPermissions;
+    this.fullAccessPermissions = ["*", "cms.*"];
+    this.listAllGroupsCallback = listAllGroups;
+    this.allGroups = null;
+  }
+
+  /**
+   * Groups-related methods below. 👇
+   * - canAccessGroup
+   * - ensureCanAccessGroup
+   * - canAccessNonOwnedGroups
+   * - canAccessOnlyOwnedGroups
+   * - getGroupsAccessControlList
+   * - hasFullAccessToGroups
+   */
+
+  async canAccessGroup(params = {}) {
+    const acl = await this.getGroupsAccessControlList(params);
+    const canRead = acl.find(ace => ace.rwd?.includes("r"));
+    if (!canRead) {
+      return false;
+    }
+    const {
+      rwd
+    } = params;
+    if (rwd) {
+      const hasRwd = acl.find(ace => ace.rwd.includes(rwd));
+      if (!hasRwd) {
+        return false;
+      }
+    }
+    return true;
+  }
+  async canAccessNonOwnedGroups(params) {
+    const acl = await this.getGroupsAccessControlList(params);
+    return acl.some(ace => ace.canAccessNonOwned);
+  }
+  async canAccessOnlyOwnedGroups(params) {
+    const canAccessNonOwned = await this.canAccessNonOwnedGroups(params);
+    return !canAccessNonOwned;
+  }
+  async getGroupsAccessControlList(params) {
+    if (await this.hasFullAccessToGroups()) {
+      return [{
+        rwd: "rwd",
+        canAccessNonOwned: true,
+        canAccessOnlyOwned: false
+      }];
+    }
+    const groupsPermissionsList = await this.getGroupsPermissions();
+    const acl = [];
+    for (const groupsPermissions of groupsPermissionsList) {
+      if (groupsPermissions.own) {
+        if ("group" in params) {
+          const modelGroupCreatedBy = params.group?.createdBy;
+          if (!modelGroupCreatedBy) {
+            continue;
+          }
+          const identity = await this.getIdentity();
+          if (modelGroupCreatedBy.id !== identity.id) {
+            continue;
+          }
+        }
+        acl.push({
+          rwd: "rwd",
+          canAccessNonOwned: false,
+          canAccessOnlyOwned: true
+        });
+      }
+      if (groupsPermissions.groups) {
+        if ("group" in params) {
+          const {
+            group
+          } = params;
+          if (!group) {
+            continue;
+          }
+          const {
+            groups
+          } = groupsPermissions;
+          if (!Array.isArray(groups)) {
+            continue;
+          }
+          if (!groups.includes(group.id)) {
+            continue;
+          }
+        }
+      }
+      acl.push({
+        rwd: groupsPermissions.rwd,
+        canAccessNonOwned: true,
+        canAccessOnlyOwned: false
+      });
+    }
+    return acl;
+  }
+  async hasFullAccessToGroups() {
+    const permissions = await this.getGroupsPermissions();
+    return permissions.some(p => this.fullAccessPermissions.filter(Boolean).includes(p.name));
+  }
+
+  /**
+   * Models-related methods below. 👇
+   * - canAccessModel
+   * - ensureCanAccessModel
+   * - canAccessNonOwnedModels
+   * - canAccessOnlyOwnedModels
+   * - getModelsAccessControlList
+   * - hasFullAccessToModels
+   */
+
+  async canAccessModel(params) {
+    const acl = await this.getModelsAccessControlList(params);
+    const canRead = acl.find(ace => ace.rwd.includes("r"));
+    if (!canRead) {
+      return false;
+    }
+    const {
+      rwd
+    } = params;
+    if (rwd) {
+      const hasRwd = acl.find(ace => ace.rwd.includes(rwd));
+      if (!hasRwd) {
+        return false;
+      }
+    }
+    return true;
+  }
+  async ensureCanAccessModel(params = {}) {
+    const canAccess = await this.canAccessModel(params);
+    if (canAccess) {
+      return;
+    }
+    if ("model" in params) {
+      let modelName = "(could not determine name)";
+      if (params.model?.name) {
+        modelName = `"${params.model.name}"`;
+      }
+      throw new NotAuthorizedError(`Not allowed to access content model ${modelName}.`);
+    }
+    throw new NotAuthorizedError(`Not allowed to access content models.`);
+  }
+  async canAccessNonOwnedModels(params) {
+    const acl = await this.getModelsAccessControlList(params);
+    return acl.some(ace => ace.canAccessNonOwned);
+  }
+  async canAccessOnlyOwnedModels(params) {
+    const canAccessNonOwned = await this.canAccessNonOwnedModels(params);
+    return !canAccessNonOwned;
+  }
+  async getModelsAccessControlList(params) {
+    if (await this.hasFullAccessToModels(params)) {
+      return [{
+        rwd: "rwd",
+        canAccessNonOwned: true,
+        canAccessOnlyOwned: false
+      }];
+    }
+    const groupsPermissionsList = await this.getGroupsPermissions();
+    const acl = [];
+    for (let i = 0; i < groupsPermissionsList.length; i++) {
+      const groupsPermissions = groupsPermissionsList[i];
+      const modelsPermissionsList = await this.getModelsPermissions();
+      const relatedModelPermissions = modelsPermissionsList.find(permissions => permissions._src === groupsPermissions._src);
+      if (!relatedModelPermissions) {
+        continue;
+      }
+      if (groupsPermissions.own) {
+        if ("model" in params) {
+          const {
+            model
+          } = params;
+          if (!model) {
+            continue;
+          }
+          const group = await this.getGroup(model.group);
+          if (!group) {
+            continue;
+          }
+          const modelGroupCreatedBy = group.createdBy;
+          if (!modelGroupCreatedBy) {
+            continue;
+          }
+          const identity = await this.getIdentity();
+          if (modelGroupCreatedBy.id !== identity.id) {
+            continue;
+          }
+        }
+        acl.push({
+          rwd: "rwd",
+          canAccessNonOwned: false,
+          canAccessOnlyOwned: true
+        });
+        continue;
+      }
+      if (groupsPermissions.groups) {
+        if ("model" in params) {
+          const {
+            model
+          } = params;
+          if (!model) {
+            continue;
+          }
+          if (!Array.isArray(groupsPermissions.groups)) {
+            continue;
+          }
+          if (!groupsPermissions.groups.includes(model.group)) {
+            continue;
+          }
+        }
+      }
+      const fullAccess = !relatedModelPermissions.rwd && !relatedModelPermissions.own && !relatedModelPermissions.models;
+      if (fullAccess) {
+        acl.push({
+          rwd: "rwd",
+          canAccessNonOwned: true,
+          canAccessOnlyOwned: false
+        });
+        continue;
+      }
+      if (relatedModelPermissions.own) {
+        if ("model" in params) {
+          if (!params.model) {
+            continue;
+          }
+          const modelCreatedBy = params.model.createdBy;
+          if (!modelCreatedBy) {
+            continue;
+          }
+          const identity = await this.getIdentity();
+          if (modelCreatedBy.id !== identity.id) {
+            continue;
+          }
+        }
+        acl.push({
+          rwd: "rwd",
+          canAccessNonOwned: false,
+          canAccessOnlyOwned: true
+        });
+        continue;
+      }
+      if (relatedModelPermissions.models) {
+        const {
+          models
+        } = relatedModelPermissions;
+        if ("model" in params) {
+          if (!params.model) {
+            continue;
+          }
+          if (!Array.isArray(models)) {
+            continue;
+          }
+          if (!models.includes(params.model.modelId)) {
+            continue;
+          }
+        }
+      }
+      acl.push({
+        rwd: relatedModelPermissions.rwd,
+        canAccessNonOwned: true,
+        canAccessOnlyOwned: false
+      });
+    }
+    return acl;
+  }
+  async hasFullAccessToModels(params) {
+    const {
+      model
+    } = params;
+    if (model) {
+      if (this.modelAuthorizationDisabled({
+        model
+      })) {
+        return true;
+      }
+    }
+    const permissions = await this.getModelsPermissions();
+    return permissions.some(p => this.fullAccessPermissions.filter(Boolean).includes(p.name));
+  }
+
+  /**
+   * Entries-related methods below. 👇
+   * - canAccessEntry
+   * - ensureCanAccessEntry
+   * - canAccessNonOwnedEntries
+   * - canAccessOnlyOwnedEntries
+   * - getEntriesAccessControlList
+   * - hasFullAccessToEntries
+   */
+
+  async canAccessEntry(params) {
+    const acl = await this.getEntriesAccessControlList(params);
+    const canRead = acl.find(ace => ace.rwd.includes("r"));
+    if (!canRead) {
+      return false;
+    }
+    const {
+      rwd
+    } = params;
+    if (rwd) {
+      const hasRwd = acl.find(ace => ace.rwd.includes(rwd));
+      if (!hasRwd) {
+        return false;
+      }
+    }
+    const {
+      pw
+    } = params;
+    if (pw) {
+      const hasPw = acl.find(ace => ace.pw?.includes(pw));
+      if (!hasPw) {
+        return false;
+      }
+    }
+    return true;
+  }
+  async ensureCanAccessEntry(params) {
+    const canAccess = await this.canAccessEntry(params);
+    if (!canAccess) {
+      if (params.entry) {
+        throw new NotAuthorizedError(`Not allowed to access entry "${params.entry.entryId}".`);
+      }
+      throw new NotAuthorizedError(`Not allowed to access "${params.model.modelId}" entries.`);
+    }
+  }
+  async canAccessNonOwnedEntries(params) {
+    const acl = await this.getEntriesAccessControlList(params);
+    return acl.some(ace => ace.canAccessNonOwned);
+  }
+  async canAccessOnlyOwnedEntries(params) {
+    const canAccessNonOwned = await this.canAccessNonOwnedEntries(params);
+    return !canAccessNonOwned;
+  }
+  async getEntriesAccessControlList(params) {
+    if (await this.hasFullAccessToEntries(params)) {
+      return [{
+        rwd: "rwd",
+        pw: "pu",
+        canAccessNonOwned: true,
+        canAccessOnlyOwned: false
+      }];
+    }
+
+    // We need a map of groups slugs to ids, to perform checks on models
+    const {
+      model
+    } = params;
+    const groupsPermissionsList = await this.getGroupsPermissions();
+    const acl = [];
+    for (let i = 0; i < groupsPermissionsList.length; i++) {
+      const groupPermissions = groupsPermissionsList[i];
+      const modelsPermissionsList = await this.getModelsPermissions();
+      const relatedModelsPermissions = modelsPermissionsList.find(permissions => permissions._src === groupPermissions._src);
+      if (!relatedModelsPermissions) {
+        continue;
+      }
+      const entriesPermissionsList = await this.getEntriesPermissions();
+      const relatedEntriesPermissions = entriesPermissionsList.find(permissions => permissions._src === groupPermissions._src);
+      if (!relatedEntriesPermissions) {
+        continue;
+      }
+      if (groupPermissions.own) {
+        const group = await this.getGroup(model.group);
+        if (!group) {
+          continue;
+        }
+        const groupCreatedBy = group.createdBy;
+        if (!groupCreatedBy) {
+          continue;
+        }
+        const identity = await this.getIdentity();
+        if (groupCreatedBy.id !== identity.id) {
+          continue;
+        }
+        acl.push({
+          rwd: "rwd",
+          canAccessNonOwned: false,
+          canAccessOnlyOwned: true,
+          pw: relatedEntriesPermissions.pw
+        });
+        continue;
+      }
+      if (groupPermissions.groups) {
+        const {
+          groups
+        } = groupPermissions;
+        if (!Array.isArray(groups)) {
+          continue;
+        }
+        if (!groups.includes(model.group)) {
+          continue;
+        }
+      }
+      if (relatedModelsPermissions.own) {
+        const modelCreatedBy = model.createdBy;
+        if (!modelCreatedBy) {
+          continue;
+        }
+        const identity = await this.getIdentity();
+        if (modelCreatedBy.id !== identity.id) {
+          continue;
+        }
+        acl.push({
+          rwd: "rwd",
+          canAccessNonOwned: false,
+          canAccessOnlyOwned: true,
+          pw: relatedEntriesPermissions.pw
+        });
+      }
+      if (relatedModelsPermissions.models) {
+        if (!Array.isArray(relatedModelsPermissions.models)) {
+          continue;
+        }
+        if (!relatedModelsPermissions.models.includes(model.modelId)) {
+          continue;
+        }
+      }
+      const fullAccess = !relatedEntriesPermissions.rwd && !relatedEntriesPermissions.own && !relatedEntriesPermissions.models;
+      if (fullAccess) {
+        acl.push({
+          rwd: "rwd",
+          canAccessNonOwned: false,
+          canAccessOnlyOwned: true,
+          pw: "pu"
+        });
+        continue;
+      }
+      if (relatedEntriesPermissions.own) {
+        if ("entry" in params) {
+          const entryCreatedBy = params.entry?.createdBy;
+          if (!entryCreatedBy) {
+            continue;
+          }
+          const identity = await this.getIdentity();
+          if (entryCreatedBy.id !== identity.id) {
+            continue;
+          }
+        }
+        acl.push({
+          rwd: relatedEntriesPermissions.rwd,
+          canAccessNonOwned: false,
+          canAccessOnlyOwned: true,
+          pw: relatedEntriesPermissions.pw
+        });
+        continue;
+      }
+      acl.push({
+        rwd: relatedEntriesPermissions.rwd,
+        canAccessNonOwned: true,
+        canAccessOnlyOwned: false,
+        pw: relatedEntriesPermissions.pw
+      });
+    }
+    return acl;
+  }
+  async hasFullAccessToEntries(params) {
+    if (this.modelAuthorizationDisabled(params)) {
+      return true;
+    }
+    const permissions = await this.getEntriesPermissions();
+    return permissions.some(p => this.fullAccessPermissions.filter(Boolean).includes(p.name));
+  }
+  modelAuthorizationDisabled(params) {
+    if ("authorization" in params.model) {
+      const {
+        authorization
+      } = params.model;
+      if (typeof authorization === "boolean") {
+        return authorization === false;
+      }
+      return authorization?.permissions === false;
+    }
+    return false;
+  }
+  async listAllGroups() {
+    if (this.allGroups === null) {
+      this.allGroups = this.listAllGroupsCallback();
+    }
+    return this.allGroups;
+  }
+  async getGroup(slug) {
+    const groups = await this.listAllGroups();
+    return groups.find(group => group.slug === slug);
+  }
+}
+
+//# sourceMappingURL=AccessControl.js.map