@webiny/api-headless-cms 0.0.0-unstable.de38392959 → 0.0.0-unstable.e0bfc55d5a

package/crud/contentEntry.crud.js

@@ -16,20 +16,14 @@ var _afterDelete = require("./contentEntry/afterDelete");
 var _entryStorage = require("../utils/entryStorage");
 var _searchableFields = require("./contentEntry/searchableFields");
 var _filterAsync = require("../utils/filterAsync");
-var _apiSecurity = require("@webiny/api-security");
 var _constants = require("../constants");
 var _entryDataFactories = require("./contentEntry/entryDataFactories");
-const createSort = sort => {
-  if (Array.isArray(sort) && sort.filter(Boolean).length > 0) {
-    return sort;
-  }
-  return ["revisionCreatedOn_DESC"];
-};
+var _useCases = require("./contentEntry/useCases");
+var _ContentEntryTraverser = require("../utils/contentEntryTraverser/ContentEntryTraverser");
 const createContentEntryCrud = params => {
   const {
     storageOperations,
-    entriesPermissions,
-    modelsPermissions,
+    accessControl,
     context,
     getIdentity: getSecurityIdentity,
     getTenant,
@@ -92,6 +86,13 @@ const createContentEntryCrud = params => {
   const onEntryAfterDelete = (0, _pubsub.createTopic)("cms.onEntryAfterDelete");
   const onEntryDeleteError = (0, _pubsub.createTopic)("cms.onEntryDeleteError");
 
+  /**
+   * Restore from bin
+   */
+  const onEntryBeforeRestoreFromBin = (0, _pubsub.createTopic)("cms.onEntryBeforeRestoreFromBin");
+  const onEntryAfterRestoreFromBin = (0, _pubsub.createTopic)("cms.onEntryAfterRestoreFromBin");
+  const onEntryRestoreFromBinError = (0, _pubsub.createTopic)("cms.onEntryRestoreFromBinError");
+
   /**
    * Delete revision
    */
@@ -130,61 +131,155 @@ const createContentEntryCrud = params => {
     context,
     onEntryAfterDelete
   });
+  const transformEntryFromStorageCallable = (0, _entryStorage.createTransformEntryCallable)({
+    context
+  });
+  /**
+   * List entries
+   */
+  const {
+    listEntriesUseCase,
+    listLatestUseCase,
+    listDeletedUseCase,
+    listPublishedUseCase,
+    getEntryUseCase
+  } = (0, _useCases.listEntriesUseCases)({
+    transform: transformEntryFromStorageCallable,
+    operation: storageOperations.entries.list,
+    accessControl,
+    topics: {
+      onEntryBeforeList
+    },
+    context,
+    getIdentity: getSecurityIdentity
+  });
 
   /**
-   * A helper to delete the entire entry.
+   * Get entries by ids
    */
-  const deleteEntryHelper = async params => {
-    const {
-      model,
-      entry
-    } = params;
-    try {
-      await onEntryBeforeDelete.publish({
-        entry,
-        model
-      });
-      await storageOperations.entries.delete(model, {
-        entry
-      });
-      await onEntryAfterDelete.publish({
-        entry,
-        model
-      });
-    } catch (ex) {
-      await onEntryDeleteError.publish({
-        entry,
-        model,
-        error: ex
-      });
-      throw new _error.default(ex.message || "Could not delete entry.", ex.code || "DELETE_ERROR", {
-        entry
-      });
-    }
-  };
+  const {
+    getEntriesByIdsUseCase
+  } = (0, _useCases.getEntriesByIdsUseCases)({
+    transform: transformEntryFromStorageCallable,
+    operation: storageOperations.entries.getByIds,
+    accessControl
+  });
+
   /**
-   * A helper to get entries by revision IDs
+   * Get latest entries by ids
    */
-  const getEntriesByIds = async (model, ids) => {
-    return context.benchmark.measure("headlessCms.crud.entries.getEntriesByIds", async () => {
-      await entriesPermissions.ensure({
-        rwd: "r"
-      });
-      await modelsPermissions.ensureCanAccessModel({
-        model
-      });
-      const entries = await storageOperations.entries.getByIds(model, {
-        ids
-      });
-      return (0, _filterAsync.filterAsync)(entries, async entry => {
-        return entriesPermissions.ensure({
-          owns: entry.revisionCreatedBy
-        }, {
-          throw: false
-        });
-      });
-    });
-  };
+  const {
+    getLatestEntriesByIdsUseCase
+  } = (0, _useCases.getLatestEntriesByIdsUseCases)({
+    transform: transformEntryFromStorageCallable,
+    operation: storageOperations.entries.getLatestByIds,
+    accessControl
+  });
+
+  /**
+   * Get published entries by ids
+   */
+  const {
+    getPublishedEntriesByIdsUseCase
+  } = (0, _useCases.getPublishedEntriesByIdsUseCases)({
+    transform: transformEntryFromStorageCallable,
+    operation: storageOperations.entries.getPublishedByIds,
+    accessControl
+  });
+
+  /**
+   * Get revisions by entryId
+   */
+  const {
+    getRevisionsByEntryIdUseCase
+  } = (0, _useCases.getRevisionsByEntryIdUseCases)({
+    transform: transformEntryFromStorageCallable,
+    operation: storageOperations.entries.getRevisions,
+    accessControl
+  });
+
+  /**
+   * Get revision by id
+   */
+  const {
+    getRevisionByIdUseCase
+  } = (0, _useCases.getRevisionByIdUseCases)({
+    transform: transformEntryFromStorageCallable,
+    operation: storageOperations.entries.getRevisionById
+  });
+
+  /**
+   * Get latest revision by entryId
+   */
+  const {
+    getLatestRevisionByEntryIdUseCase,
+    getLatestRevisionByEntryIdWithDeletedUseCase,
+    getLatestRevisionByEntryIdDeletedUseCase
+  } = (0, _useCases.getLatestRevisionByEntryIdUseCases)({
+    transform: transformEntryFromStorageCallable,
+    operation: storageOperations.entries.getLatestRevisionByEntryId
+  });
+
+  /**
+   * Get previous revision by entryId
+   */
+  const {
+    getPreviousRevisionByEntryIdUseCase
+  } = (0, _useCases.getPreviousRevisionByEntryIdUseCases)({
+    transform: transformEntryFromStorageCallable,
+    operation: storageOperations.entries.getPreviousRevision
+  });
+
+  /**
+   * Get published revision by entryId
+   */
+  const {
+    getPublishedRevisionByEntryIdUseCase
+  } = (0, _useCases.getPublishedRevisionByEntryIdUseCases)({
+    transform: transformEntryFromStorageCallable,
+    operation: storageOperations.entries.getPublishedRevisionByEntryId
+  });
+
+  /**
+   * Delete entry
+   */
+  const {
+    deleteEntryUseCase,
+    moveEntryToBinUseCase,
+    deleteEntryOperation
+  } = (0, _useCases.deleteEntryUseCases)({
+    deleteOperation: storageOperations.entries.delete,
+    moveToBinOperation: storageOperations.entries.moveToBin,
+    getEntry: getLatestRevisionByEntryIdUseCase,
+    getEntryWithDeleted: getLatestRevisionByEntryIdWithDeletedUseCase,
+    getIdentity: getSecurityIdentity,
+    topics: {
+      onEntryBeforeDelete,
+      onEntryAfterDelete,
+      onEntryDeleteError
+    },
+    accessControl,
+    context
+  });
+
+  /**
+   * Restore entry from bin
+   */
+  const {
+    restoreEntryFromBinUseCase
+  } = (0, _useCases.restoreEntryFromBinUseCases)({
+    transform: transformEntryFromStorageCallable,
+    getEntry: getLatestRevisionByEntryIdDeletedUseCase,
+    getIdentity: getSecurityIdentity,
+    restoreOperation: storageOperations.entries.restoreFromBin,
+    topics: {
+      onEntryBeforeRestoreFromBin,
+      onEntryAfterRestoreFromBin,
+      onEntryRestoreFromBinError
+    },
+    accessControl,
+    context
+  });
   const getEntryById = async (model, id) => {
     const where = {
       id
@@ -193,172 +288,20 @@ const createContentEntryCrud = params => {
       where,
       model
     });
-    const [entry] = await getEntriesByIds(model, [id]);
+    const [entry] = await getEntriesByIdsUseCase.execute(model, {
+      ids: [id]
+    });
     if (!entry) {
       throw new _handlerGraphql.NotFoundError(`Entry by ID "${id}" not found.`);
     }
+    // TODO figure out without casting
     return entry;
   };
-  const getPublishedEntriesByIds = async (model, ids) => {
-    await entriesPermissions.ensure({
-      rwd: "r"
-    });
-    await modelsPermissions.ensureCanAccessModel({
-      model
-    });
-    const entries = await storageOperations.entries.getPublishedByIds(model, {
-      ids
-    });
-    return (0, _filterAsync.filterAsync)(entries, async entry => {
-      return entriesPermissions.ensure({
-        owns: entry.revisionCreatedBy
-      }, {
-        throw: false
-      });
-    });
-  };
-  const getLatestEntriesByIds = async (model, ids) => {
-    await entriesPermissions.ensure({
-      rwd: "r"
-    });
-    await modelsPermissions.ensureCanAccessModel({
-      model
-    });
-    const entries = await storageOperations.entries.getLatestByIds(model, {
-      ids
-    });
-    return (0, _filterAsync.filterAsync)(entries, async entry => {
-      return entriesPermissions.ensure({
-        owns: entry.revisionCreatedBy
-      }, {
-        throw: false
-      });
-    });
-  };
-  const getEntry = async (model, params) => {
-    await entriesPermissions.ensure({
-      rwd: "r"
-    });
-    const {
-      where,
-      sort
-    } = params;
-    await onEntryBeforeGet.publish({
-      where,
-      model
-    });
-    const [items] = await listEntries(model, {
-      where,
-      sort,
-      limit: 1
-    });
-    const item = items.shift();
-    if (!item) {
-      throw new _handlerGraphql.NotFoundError(`Entry not found!`);
-    }
-    return item;
-  };
-  const getEntryRevisions = async (model, entryId) => {
-    return storageOperations.entries.getRevisions(model, {
-      id: entryId
-    });
-  };
-  const listEntries = async (model, params) => {
-    try {
-      await entriesPermissions.ensure({
-        rwd: "r"
-      });
-    } catch {
-      throw new _apiSecurity.NotAuthorizedError({
-        data: {
-          reason: 'Not allowed to perform "read" on "cms.contentEntry".'
-        }
-      });
-    }
-    await modelsPermissions.ensureCanAccessModel({
-      model
-    });
-    const {
-      where: initialWhere,
-      limit: initialLimit
-    } = params;
-    const limit = initialLimit && initialLimit > 0 ? initialLimit : 50;
-    const where = {
-      ...initialWhere
-    };
-    /**
-     * Possibly only get records which are owned by current user.
-     * Or if searching for the owner set that value - in the case that user can see other entries than their own.
-     */
-    if (await entriesPermissions.canAccessOnlyOwnRecords()) {
-      where.createdBy = getSecurityIdentity().id;
-    }
-
-    /**
-     * Where must contain either latest or published keys.
-     * We cannot list entries without one of those
-     */
-    if (where.latest && where.published) {
-      throw new _error.default("Cannot list entries that are both published and latest.", "LIST_ENTRIES_ERROR", {
-        where
-      });
-    } else if (!where.latest && !where.published) {
-      throw new _error.default("Cannot list entries if we do not have latest or published defined.", "LIST_ENTRIES_ERROR", {
-        where
-      });
-    }
-    const fields = (0, _searchableFields.getSearchableFields)({
-      fields: model.fields,
-      plugins: context.plugins,
-      input: params.fields || []
-    });
-    try {
-      await onEntryBeforeList.publish({
-        where,
-        model
-      });
-      const {
-        hasMoreItems,
-        totalCount,
-        cursor,
-        items
-      } = await storageOperations.entries.list(model, {
-        ...params,
-        sort: createSort(params.sort),
-        limit,
-        where,
-        fields
-      });
-      const meta = {
-        hasMoreItems,
-        totalCount,
-        /**
-         * Cursor should be null if there are no more items to load.
-         * Just make sure of that, disregarding what is returned from the storageOperations.entries.list method.
-         */
-        cursor: hasMoreItems ? cursor : null
-      };
-      return [items, meta];
-    } catch (ex) {
-      throw new _error.default("Error while fetching entries from storage.", "LIST_ENTRIES_ERROR", {
-        params,
-        error: {
-          message: ex.message,
-          code: ex.code,
-          data: ex.data
-        },
-        model,
-        fields
-      });
-    }
-  };
   const createEntry = async (model, rawInput, options) => {
-    await entriesPermissions.ensure({
+    await accessControl.ensureCanAccessEntry({
+      model,
       rwd: "w"
     });
-    await modelsPermissions.ensureCanAccessModel({
-      model
-    });
     const {
       entry,
       input
@@ -370,7 +313,12 @@ const createContentEntryCrud = params => {
       getLocale,
       getTenant,
       getIdentity: getSecurityIdentity,
-      entriesPermissions
+      accessControl
+    });
+    await accessControl.ensureCanAccessEntry({
+      model,
+      entry,
+      rwd: "w"
     });
     let storageEntry = null;
     try {
@@ -407,12 +355,10 @@ const createContentEntryCrud = params => {
     }
   };
   const createEntryRevisionFrom = async (model, sourceId, rawInput, options) => {
-    await entriesPermissions.ensure({
+    await accessControl.ensureCanAccessEntry({
+      model,
       rwd: "w"
     });
-    await modelsPermissions.ensureCanAccessModel({
-      model
-    });
 
     /**
      * Entries are identified by a common parent ID + Revision number.
@@ -420,10 +366,10 @@ const createContentEntryCrud = params => {
     const {
       id: uniqueId
     } = (0, _utils.parseIdentifier)(sourceId);
-    const originalStorageEntry = await storageOperations.entries.getRevisionById(model, {
+    const originalStorageEntry = await getRevisionByIdUseCase.execute(model, {
       id: sourceId
     });
-    const latestStorageEntry = await storageOperations.entries.getLatestRevisionByEntryId(model, {
+    const latestStorageEntry = await getLatestRevisionByEntryIdUseCase.execute(model, {
       id: uniqueId
     });
     if (!originalStorageEntry) {
@@ -437,9 +383,6 @@ const createContentEntryCrud = params => {
      * We need to convert data from DB to its original form before using it further.
      */
     const originalEntry = await (0, _entryStorage.entryFromStorageTransform)(context, model, originalStorageEntry);
-    await entriesPermissions.ensure({
-      owns: originalEntry.createdBy
-    });
     const {
       entry,
       input
@@ -453,7 +396,13 @@ const createContentEntryCrud = params => {
       getTenant,
       getLocale,
       originalEntry,
-      latestStorageEntry
+      latestStorageEntry,
+      accessControl
+    });
+    await accessControl.ensureCanAccessEntry({
+      model,
+      entry,
+      rwd: "w"
     });
     let storageEntry = null;
     try {
@@ -494,17 +443,15 @@ const createContentEntryCrud = params => {
     }
   };
   const updateEntry = async (model, id, rawInput, metaInput, options) => {
-    await entriesPermissions.ensure({
+    await accessControl.ensureCanAccessEntry({
+      model,
       rwd: "w"
     });
-    await modelsPermissions.ensureCanAccessModel({
-      model
-    });
 
     /**
      * The entry we are going to update.
      */
-    const originalStorageEntry = await storageOperations.entries.getRevisionById(model, {
+    const originalStorageEntry = await getRevisionByIdUseCase.execute(model, {
       id
     });
     if (!originalStorageEntry) {
@@ -514,9 +461,6 @@ const createContentEntryCrud = params => {
       throw new _error.default(`Cannot update entry because it's locked.`, "CONTENT_ENTRY_UPDATE_ERROR");
     }
     const originalEntry = await (0, _entryStorage.entryFromStorageTransform)(context, model, originalStorageEntry);
-    await entriesPermissions.ensure({
-      owns: originalEntry.revisionCreatedBy
-    });
     const {
       entry,
       input
@@ -531,6 +475,11 @@ const createContentEntryCrud = params => {
       originalEntry,
       metaInput
     });
+    await accessControl.ensureCanAccessEntry({
+      model,
+      entry,
+      rwd: "w"
+    });
     let storageEntry = null;
     try {
       await onEntryBeforeUpdate.publish({
@@ -569,19 +518,17 @@ const createContentEntryCrud = params => {
     }
   };
   const validateEntry = async (model, id, inputData) => {
-    await entriesPermissions.ensure({
+    await accessControl.ensureCanAccessEntry({
+      model,
       rwd: "w"
     });
-    await modelsPermissions.ensureCanAccessModel({
-      model
-    });
     const input = (0, _entryDataFactories.mapAndCleanUpdatedInputData)(model, inputData || {});
     let originalEntry;
     if (id) {
       /**
        * The entry we are going to update.
        */
-      const originalStorageEntry = await storageOperations.entries.getRevisionById(model, {
+      const originalStorageEntry = await getRevisionByIdUseCase.execute(model, {
         id
       });
       if (!originalStorageEntry) {
@@ -589,6 +536,11 @@ const createContentEntryCrud = params => {
       }
       originalEntry = await (0, _entryStorage.entryFromStorageTransform)(context, model, originalStorageEntry);
     }
+    await accessControl.ensureCanAccessEntry({
+      model,
+      entry: originalEntry,
+      rwd: "w"
+    });
     const result = await (0, _entryDataValidation.validateModelEntryData)({
       context,
       model,
@@ -598,22 +550,27 @@ const createContentEntryCrud = params => {
     return result.length > 0 ? result : [];
   };
   const moveEntry = async (model, id, folderId) => {
-    await entriesPermissions.ensure({
+    await accessControl.ensureCanAccessEntry({
+      model,
       rwd: "w"
     });
-    await modelsPermissions.ensureCanAccessModel({
-      model
-    });
+
     /**
      * The entry we are going to move to another folder.
      */
-    const originalStorageEntry = await storageOperations.entries.getRevisionById(model, {
+    const originalStorageEntry = await getRevisionByIdUseCase.execute(model, {
       id
     });
     if (!originalStorageEntry) {
       throw new _handlerGraphql.NotFoundError(`Entry "${id}" of model "${model.modelId}" was not found.`);
     }
     const entry = await (0, _entryStorage.entryFromStorageTransform)(context, model, originalStorageEntry);
+    await accessControl.ensureCanAccessEntry({
+      model,
+      entry,
+      rwd: "w"
+    });
+
     /**
      * No need to continue if the entry is already in the requested folder.
      */
@@ -647,23 +604,28 @@ const createContentEntryCrud = params => {
     }
   };
   const republishEntry = async (model, id) => {
-    await entriesPermissions.ensure({
-      rwd: "w"
-    });
-    await modelsPermissions.ensureCanAccessModel({
-      model
+    await accessControl.ensureCanAccessEntry({
+      model,
+      rwd: "w",
+      pw: "p"
     });
 
     /**
      * Fetch the entry from the storage.
      */
-    const originalStorageEntry = await storageOperations.entries.getRevisionById(model, {
+    const originalStorageEntry = await getRevisionByIdUseCase.execute(model, {
       id
     });
     if (!originalStorageEntry) {
       throw new _handlerGraphql.NotFoundError(`Entry "${id}" was not found!`);
     }
     const originalEntry = await (0, _entryStorage.entryFromStorageTransform)(context, model, originalStorageEntry);
+    await accessControl.ensureCanAccessEntry({
+      model,
+      entry: originalEntry,
+      rwd: "w",
+      pw: "p"
+    });
     const {
       entry
     } = await (0, _entryDataFactories.createRepublishEntryData)({
@@ -716,42 +678,41 @@ const createContentEntryCrud = params => {
     }
   };
   const deleteEntryRevision = async (model, revisionId) => {
-    await entriesPermissions.ensure({
+    await accessControl.ensureCanAccessEntry({
+      model,
       rwd: "d"
     });
-    await modelsPermissions.ensureCanAccessModel({
-      model
-    });
     const {
       id: entryId,
       version
     } = (0, _utils.parseIdentifier)(revisionId);
-    const storageEntryToDelete = await storageOperations.entries.getRevisionById(model, {
+    const storageEntryToDelete = await getRevisionByIdUseCase.execute(model, {
       id: revisionId
     });
-    const latestStorageEntry = await storageOperations.entries.getLatestRevisionByEntryId(model, {
+    const latestStorageEntry = await getLatestRevisionByEntryIdUseCase.execute(model, {
       id: entryId
     });
-    const storagePreviousEntry = await storageOperations.entries.getPreviousRevision(model, {
+    const storagePreviousEntry = await getPreviousRevisionByEntryIdUseCase.execute(model, {
       entryId,
       version: version
     });
     if (!storageEntryToDelete) {
       throw new _handlerGraphql.NotFoundError(`Entry "${revisionId}" was not found!`);
     }
-    await entriesPermissions.ensure({
-      owns: storageEntryToDelete.revisionCreatedBy
-    });
     const latestEntryRevisionId = latestStorageEntry ? latestStorageEntry.id : null;
     const entryToDelete = await (0, _entryStorage.entryFromStorageTransform)(context, model, storageEntryToDelete);
+    await accessControl.ensureCanAccessEntry({
+      model,
+      entry: entryToDelete,
+      rwd: "d"
+    });
 
     /**
      * If targeted record is the latest entry record and there is no previous one, we need
      * to run full delete with hooks. In this case, `deleteRevision` hooks are not fired.
      */
     if (entryToDelete.id === latestEntryRevisionId && !storagePreviousEntry) {
-      return await deleteEntryHelper({
-        model,
+      return await deleteEntryOperation.execute(model, {
         entry: entryToDelete
       });
     }
@@ -829,12 +790,10 @@ const createContentEntryCrud = params => {
         entries: ids
       });
     }
-    await entriesPermissions.ensure({
+    await accessControl.ensureCanAccessEntry({
+      model,
       rwd: "d"
     });
-    await modelsPermissions.ensureCanAccessModel({
-      model
-    });
     const {
       items: entries
     } = await storageOperations.entries.list(model, {
@@ -848,10 +807,9 @@ const createContentEntryCrud = params => {
      * We do not want to allow deleting entries that user does not own or cannot access.
      */
     const items = (await (0, _filterAsync.filterAsync)(entries, async entry => {
-      return entriesPermissions.ensure({
-        owns: entry.createdBy
-      }, {
-        throw: false
+      return accessControl.canAccessEntry({
+        model,
+        entry: entry
       });
     })).map(entry => entry.id);
     try {
@@ -886,73 +844,39 @@ const createContentEntryCrud = params => {
       });
     }
   };
-  const deleteEntry = async (model, id, options) => {
-    await entriesPermissions.ensure({
-      rwd: "d"
-    });
-    await modelsPermissions.ensureCanAccessModel({
-      model
-    });
+  const deleteEntry = async (model, id, options = {}) => {
     const {
-      force
-    } = options || {};
-    const storageEntry = await storageOperations.entries.getLatestRevisionByEntryId(model, {
-      id
-    });
-    /**
-     * If there is no entry, and we do not force the deletion, just throw an error.
-     */
-    if (!storageEntry && !force) {
-      throw new _handlerGraphql.NotFoundError(`Entry "${id}" was not found!`);
-    }
+      permanently = true
+    } = options;
+
     /**
-     * In the case we are forcing the deletion, we do not need the storageEntry to exist as it might be an error when loading single database record.
-     *
-     * This happens, sometimes, in the Elasticsearch system as the entry might get deleted from the DynamoDB but not from the Elasticsearch.
-     * This is due to high load on the Elasticsearch at the time of the deletion.
+     * If the 'permanently' flag is set to false, the entry must be moved to the bin; otherwise, deleted.
      */
-    //
-    else if (!storageEntry && force) {
-      const {
-        id: entryId
-      } = (0, _utils.parseIdentifier)(id);
-      return await deleteEntryHelper({
-        model,
-        entry: {
-          id,
-          entryId
-        }
-      });
+    if (!permanently) {
+      return await moveEntryToBinUseCase.execute(model, id, options);
     }
-    await entriesPermissions.ensure({
-      owns: storageEntry.createdBy
-    });
-    const entry = await (0, _entryStorage.entryFromStorageTransform)(context, model, storageEntry);
-    return await deleteEntryHelper({
-      model,
-      entry
-    });
+    return await deleteEntryUseCase.execute(model, id, options);
   };
   const publishEntry = async (model, id) => {
-    await entriesPermissions.ensure({
+    await accessControl.ensureCanAccessEntry({
+      model,
       pw: "p"
     });
-    await modelsPermissions.ensureCanAccessModel({
-      model
-    });
-    const originalStorageEntry = await storageOperations.entries.getRevisionById(model, {
+    const originalStorageEntry = await getRevisionByIdUseCase.execute(model, {
       id
     });
     if (!originalStorageEntry) {
       throw new _handlerGraphql.NotFoundError(`Entry "${id}" in the model "${model.modelId}" was not found.`);
     }
-    await entriesPermissions.ensure({
-      owns: originalStorageEntry.revisionCreatedBy
-    });
     const originalEntry = await (0, _entryStorage.entryFromStorageTransform)(context, model, originalStorageEntry);
+    await accessControl.ensureCanAccessEntry({
+      model,
+      entry: originalEntry,
+      pw: "p"
+    });
 
     // We need the latest entry to get the latest entry-level meta fields.
-    const latestStorageEntry = await storageOperations.entries.getLatestRevisionByEntryId(model, {
+    const latestStorageEntry = await getLatestRevisionByEntryIdUseCase.execute(model, {
       id: originalEntry.entryId
     });
     if (!latestStorageEntry) {
@@ -1004,13 +928,14 @@ const createContentEntryCrud = params => {
     }
   };
   const unpublishEntry = async (model, id) => {
-    await entriesPermissions.ensure({
+    await accessControl.ensureCanAccessEntry({
+      model,
       pw: "u"
     });
     const {
       id: entryId
     } = (0, _utils.parseIdentifier)(id);
-    const originalStorageEntry = await storageOperations.entries.getPublishedRevisionByEntryId(model, {
+    const originalStorageEntry = await getPublishedRevisionByEntryIdUseCase.execute(model, {
       id: entryId
     });
     if (!originalStorageEntry) {
@@ -1021,10 +946,12 @@ const createContentEntryCrud = params => {
         entry: originalStorageEntry
       });
     }
-    await entriesPermissions.ensure({
-      owns: originalStorageEntry.revisionCreatedBy
-    });
     const originalEntry = await (0, _entryStorage.entryFromStorageTransform)(context, model, originalStorageEntry);
+    await accessControl.ensureCanAccessEntry({
+      model,
+      entry: originalEntry,
+      pw: "u"
+    });
     const {
       entry
     } = await (0, _entryDataFactories.createUnpublishEntryData)({
@@ -1065,10 +992,7 @@ const createContentEntryCrud = params => {
     }
   };
   const getUniqueFieldValues = async (model, params) => {
-    await entriesPermissions.ensure({
-      rwd: "r"
-    });
-    await modelsPermissions.ensureCanAccessModel({
+    await accessControl.ensureCanAccessEntry({
       model
     });
     const {
@@ -1082,7 +1006,9 @@ const createContentEntryCrud = params => {
      * Possibly only get records which are owned by current user.
      * Or if searching for the owner set that value - in the case that user can see other entries than their own.
      */
-    if (await entriesPermissions.canAccessOnlyOwnRecords()) {
+    if (await accessControl.canAccessOnlyOwnedEntries({
+      model
+    })) {
       where.createdBy = getSecurityIdentity().id;
     }
 
@@ -1130,7 +1056,17 @@ const createContentEntryCrud = params => {
       });
     }
   };
+  const getEntryTraverser = async modelId => {
+    const modelAstConverter = context.cms.getModelToAstConverter();
+    const model = await context.cms.getModel(modelId);
+    if (!model) {
+      throw new Error(`Missing "${modelId}" model!`);
+    }
+    const modelAst = modelAstConverter.toAst(model);
+    return new _ContentEntryTraverser.ContentEntryTraverser(modelAst);
+  };
   return {
+    getEntryTraverser,
     onEntryBeforeCreate,
     onEntryAfterCreate,
     onEntryCreateError,
@@ -1146,6 +1082,9 @@ const createContentEntryCrud = params => {
     onEntryBeforeDelete,
     onEntryAfterDelete,
     onEntryDeleteError,
+    onEntryBeforeRestoreFromBin,
+    onEntryAfterRestoreFromBin,
+    onEntryRestoreFromBinError,
     onEntryRevisionBeforeDelete,
     onEntryRevisionAfterDelete,
     onEntryRevisionDeleteError,
@@ -1163,7 +1102,13 @@ const createContentEntryCrud = params => {
     /**
      * Get entries by exact revision IDs from the database.
      */
-    getEntriesByIds,
+    async getEntriesByIds(model, ids) {
+      return context.benchmark.measure("headlessCms.crud.entries.getEntriesByIds", async () => {
+        return getEntriesByIdsUseCase.execute(model, {
+          ids
+        });
+      });
+    },
     /**
      * Get a single entry by revision ID from the database.
      */
@@ -1177,7 +1122,9 @@ const createContentEntryCrud = params => {
      */
     async getPublishedEntriesByIds(model, ids) {
       return context.benchmark.measure("headlessCms.crud.entries.getPublishedEntriesByIds", async () => {
-        return getPublishedEntriesByIds(model, ids);
+        return getPublishedEntriesByIdsUseCase.execute(model, {
+          ids
+        });
       });
     },
     /**
@@ -1185,22 +1132,24 @@ const createContentEntryCrud = params => {
      */
     async getLatestEntriesByIds(model, ids) {
       return context.benchmark.measure("headlessCms.crud.entries.getLatestEntriesByIds", async () => {
-        return getLatestEntriesByIds(model, ids);
+        return await getLatestEntriesByIdsUseCase.execute(model, {
+          ids
+        });
       });
     },
     async getEntryRevisions(model, entryId) {
       return context.benchmark.measure("headlessCms.crud.entries.getEntryRevisions", async () => {
-        return getEntryRevisions(model, entryId);
+        return getRevisionsByEntryIdUseCase.execute(model, {
+          id: entryId
+        });
       });
     },
     /**
-     * TODO determine if this method is required at all.
-     *
      * @internal
      */
     async getEntry(model, params) {
       return context.benchmark.measure("headlessCms.crud.entries.getEntry", async () => {
-        return getEntry(model, params);
+        return await getEntryUseCase.execute(model, params);
       });
     },
     /**
@@ -1210,29 +1159,22 @@ const createContentEntryCrud = params => {
      */
     async listEntries(model, params) {
       return context.benchmark.measure("headlessCms.crud.entries.listEntries", async () => {
-        return listEntries(model, params);
+        return await listEntriesUseCase.execute(model, params);
       });
     },
     async listLatestEntries(model, params) {
-      const where = params?.where || {};
-      return this.listEntries(model, {
-        sort: ["createdOn_DESC"],
-        ...(params || {}),
-        where: {
-          ...where,
-          latest: true
-        }
+      return context.benchmark.measure("headlessCms.crud.entries.listLatestEntries", async () => {
+        return await listLatestUseCase.execute(model, params);
+      });
+    },
+    async listDeletedEntries(model, params) {
+      return context.benchmark.measure("headlessCms.crud.entries.listDeletedEntries", async () => {
+        return await listDeletedUseCase.execute(model, params);
       });
     },
     async listPublishedEntries(model, params) {
-      const where = params?.where || {};
-      return this.listEntries(model, {
-        sort: ["createdOn_DESC"],
-        ...(params || {}),
-        where: {
-          ...where,
-          published: true
-        }
+      return context.benchmark.measure("headlessCms.crud.entries.listPublishedEntries", async () => {
+        return await listPublishedUseCase.execute(model, params);
       });
     },
     async createEntry(model, input, options) {
@@ -1279,6 +1221,11 @@ const createContentEntryCrud = params => {
         return deleteEntry(model, entryId, options);
       });
     },
+    async restoreEntryFromBin(model, entryId) {
+      return context.benchmark.measure("headlessCms.crud.entries.restoreEntryFromBin", async () => {
+        return await restoreEntryFromBinUseCase.execute(model, entryId);
+      });
+    },
     async deleteMultipleEntries(model, ids) {
       return context.benchmark.measure("headlessCms.crud.entries.deleteMultipleEntries", async () => {
         return deleteMultipleEntries(model, ids);