npm - @webiny/api-headless-cms - Versions diffs - 0.0.0-unstable.e53eceafb5 → 0.0.0-unstable.e6f0dc8ca7 - Mend

@webiny/api-headless-cms 0.0.0-unstable.e53eceafb5 → 0.0.0-unstable.e6f0dc8ca7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2160) hide show

package/crud/AccessControl/AccessControl.d.ts CHANGED Viewed

@@ -1,10 +1,10 @@
-import type { SecurityIdentity } from "@webiny/api-security/types";
-import type { CmsEntry, CmsEntryPermission, CmsGroup, CmsGroupPermission, CmsModel, CmsModelPermission } from "../../types";
+import type { CmsEntry, CmsEntryPermission, CmsGroup, CmsGroupPermission, CmsModel, CmsModelPermission } from "../../types/index.js";
+import type { SecurityIdentity } from "@webiny/api-core/types/security.js";
 export interface AccessControlParams {
-    getIdentity: () => SecurityIdentity | Promise<SecurityIdentity>;
-    getGroupsPermissions: () => CmsGroupPermission[] | Promise<CmsGroupPermission[]>;
-    getModelsPermissions: () => CmsModelPermission[] | Promise<CmsModelPermission[]>;
-    getEntriesPermissions: () => CmsEntryPermission[] | Promise<CmsEntryPermission[]>;
+    getIdentity: () => Promise<SecurityIdentity>;
+    getGroupsPermissions: () => Promise<CmsGroupPermission[]>;
+    getModelsPermissions: () => Promise<CmsModelPermission[]>;
+    getEntriesPermissions: () => Promise<CmsEntryPermission[]>;
     listAllGroups: () => Promise<CmsGroup[]>;
 }
 interface GetGroupsAccessControlListParams {
@@ -20,29 +20,19 @@ interface CanAccessModelParams extends GetModelsAccessControlListParams {
     rwd?: string;
 }
 interface GetEntriesAccessControlListParams {
-    model: Pick<CmsModel, "modelId" | "createdBy" | "group" | "locale" | "authorization">;
+    model: Pick<CmsModel, "modelId" | "createdBy" | "group" | "authorization">;
     entry?: Pick<CmsEntry, "entryId" | "createdBy">;
 }
 export interface CanAccessEntryParams extends GetEntriesAccessControlListParams {
     rwd?: string;
     pw?: string;
 }
-interface AccessControlEntry {
-    rwd: string;
-    canAccessNonOwned: boolean;
-    canAccessOnlyOwned: boolean;
-}
-type AccessControlList = AccessControlEntry[];
-interface EntriesAccessControlEntry extends AccessControlEntry {
-    pw?: string;
-}
-type EntriesAccessControlList = EntriesAccessControlEntry[];
 export declare class AccessControl {
-    getIdentity: AccessControlParams["getIdentity"];
-    getGroupsPermissions: AccessControlParams["getGroupsPermissions"];
-    getModelsPermissions: AccessControlParams["getModelsPermissions"];
-    getEntriesPermissions: AccessControlParams["getEntriesPermissions"];
-    listAllGroupsCallback: AccessControlParams["listAllGroups"];
+    private getIdentity;
+    private getGroupsPermissions;
+    private getModelsPermissions;
+    private getEntriesPermissions;
+    private listAllGroupsCallback;
     private fullAccessPermissions;
     private allGroups;
     constructor({ getIdentity, getGroupsPermissions, getModelsPermissions, getEntriesPermissions, listAllGroups }: AccessControlParams);
@@ -56,11 +46,10 @@ export declare class AccessControl {
      * - hasFullAccessToGroups
      */
     canAccessGroup(params?: CanAccessGroupParams): Promise<boolean>;
-    ensureCanAccessGroup(params?: CanAccessGroupParams): Promise<void>;
-    canAccessNonOwnedGroups(params: GetGroupsAccessControlListParams): Promise<boolean>;
-    canAccessOnlyOwnedGroups(params: GetGroupsAccessControlListParams): Promise<boolean>;
-    getGroupsAccessControlList(params: GetGroupsAccessControlListParams): Promise<AccessControlList>;
-    hasFullAccessToGroups(): Promise<boolean>;
+    private canAccessNonOwnedGroups;
+    private canAccessOnlyOwnedGroups;
+    private getGroupsAccessControlList;
+    private hasFullAccessToGroups;
     /**
      * Models-related methods below. 👇
      * - canAccessModel
@@ -71,11 +60,11 @@ export declare class AccessControl {
      * - hasFullAccessToModels
      */
     canAccessModel(params: CanAccessModelParams): Promise<boolean>;
-    ensureCanAccessModel(params?: CanAccessModelParams): Promise<void>;
-    canAccessNonOwnedModels(params: GetModelsAccessControlListParams): Promise<boolean>;
-    canAccessOnlyOwnedModels(params: GetModelsAccessControlListParams): Promise<boolean>;
-    getModelsAccessControlList(params: GetModelsAccessControlListParams): Promise<AccessControlList>;
-    hasFullAccessToModels(params: GetModelsAccessControlListParams): Promise<boolean>;
+    private ensureCanAccessModel;
+    private canAccessNonOwnedModels;
+    private canAccessOnlyOwnedModels;
+    private getModelsAccessControlList;
+    private hasFullAccessToModels;
     /**
      * Entries-related methods below. 👇
      * - canAccessEntry
@@ -86,13 +75,13 @@ export declare class AccessControl {
      * - hasFullAccessToEntries
      */
     canAccessEntry(params: CanAccessEntryParams): Promise<boolean>;
-    ensureCanAccessEntry(params: CanAccessEntryParams): Promise<void>;
-    canAccessNonOwnedEntries(params: GetEntriesAccessControlListParams): Promise<boolean>;
+    private ensureCanAccessEntry;
+    private canAccessNonOwnedEntries;
     canAccessOnlyOwnedEntries(params: GetEntriesAccessControlListParams): Promise<boolean>;
-    getEntriesAccessControlList(params: GetEntriesAccessControlListParams): Promise<EntriesAccessControlList>;
-    hasFullAccessToEntries(params: GetEntriesAccessControlListParams): Promise<boolean>;
+    private getEntriesAccessControlList;
+    private hasFullAccessToEntries;
     private modelAuthorizationDisabled;
-    listAllGroups(): Promise<CmsGroup[]>;
-    getGroup(id: string): Promise<CmsGroup | undefined>;
+    private listAllGroups;
+    private getGroup;
 }
 export {};

package/crud/AccessControl/AccessControl.js CHANGED Viewed

@@ -1,11 +1,5 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.AccessControl = void 0;
-var _apiSecurity = require("@webiny/api-security");
-class AccessControl {
+import { NotAuthorizedError } from "../../utils/errors.js";
+export class AccessControl {
   constructor({
     getIdentity,
     getGroupsPermissions,
@@ -49,28 +43,6 @@ class AccessControl {
     }
     return true;
   }
-  async ensureCanAccessGroup(params = {}) {
-    const canAccess = await this.canAccessGroup(params);
-    if (canAccess) {
-      return;
-    }
-    if ("group" in params) {
-      let groupName = "(could not determine name)";
-      if (params.group?.name) {
-        groupName = `"${params.group.name}"`;
-      }
-      throw new _apiSecurity.NotAuthorizedError({
-        data: {
-          reason: `Not allowed to access content model group ${groupName}.`
-        }
-      });
-    }
-    throw new _apiSecurity.NotAuthorizedError({
-      data: {
-        reason: `Not allowed to access content model groups.`
-      }
-    });
-  }
   async canAccessNonOwnedGroups(params) {
     const acl = await this.getGroupsAccessControlList(params);
     return acl.some(ace => ace.canAccessNonOwned);
@@ -118,10 +90,10 @@ class AccessControl {
           const {
             groups
           } = groupsPermissions;
-          if (!Array.isArray(groups[group.locale])) {
+          if (!Array.isArray(groups)) {
             continue;
           }
-          if (!groups[group.locale].includes(group.id)) {
+          if (!groups.includes(group.id)) {
             continue;
           }
         }
@@ -176,17 +148,9 @@ class AccessControl {
       if (params.model?.name) {
         modelName = `"${params.model.name}"`;
       }
-      throw new _apiSecurity.NotAuthorizedError({
-        data: {
-          reason: `Not allowed to access content model ${modelName}.`
-        }
-      });
+      throw new NotAuthorizedError(`Not allowed to access content model ${modelName}.`);
     }
-    throw new _apiSecurity.NotAuthorizedError({
-      data: {
-        reason: `Not allowed to access content models.`
-      }
-    });
+    throw new NotAuthorizedError(`Not allowed to access content models.`);
   }
   async canAccessNonOwnedModels(params) {
     const acl = await this.getModelsAccessControlList(params);
@@ -221,7 +185,7 @@ class AccessControl {
           if (!model) {
             continue;
           }
-          const group = await this.getGroup(model.group.id);
+          const group = await this.getGroup(model.group);
           if (!group) {
             continue;
           }
@@ -249,10 +213,10 @@ class AccessControl {
           if (!model) {
             continue;
           }
-          if (!Array.isArray(groupsPermissions.groups[model.locale])) {
+          if (!Array.isArray(groupsPermissions.groups)) {
             continue;
           }
-          if (!groupsPermissions.groups[model.locale].includes(model.group.id)) {
+          if (!groupsPermissions.groups.includes(model.group)) {
             continue;
           }
         }
@@ -295,10 +259,10 @@ class AccessControl {
           if (!params.model) {
             continue;
           }
-          if (!Array.isArray(models[params.model.locale])) {
+          if (!Array.isArray(models)) {
             continue;
           }
-          if (!models[params.model.locale].includes(params.model.modelId)) {
+          if (!models.includes(params.model.modelId)) {
             continue;
           }
         }
@@ -366,17 +330,9 @@ class AccessControl {
     const canAccess = await this.canAccessEntry(params);
     if (!canAccess) {
       if (params.entry) {
-        throw new _apiSecurity.NotAuthorizedError({
-          data: {
-            reason: `Not allowed to access entry "${params.entry.entryId}".`
-          }
-        });
+        throw new NotAuthorizedError(`Not allowed to access entry "${params.entry.entryId}".`);
       }
-      throw new _apiSecurity.NotAuthorizedError({
-        data: {
-          reason: `Not allowed to access "${params.model.modelId}" entries.`
-        }
-      });
+      throw new NotAuthorizedError(`Not allowed to access "${params.model.modelId}" entries.`);
     }
   }
   async canAccessNonOwnedEntries(params) {
@@ -396,6 +352,8 @@ class AccessControl {
         canAccessOnlyOwned: false
       }];
     }
+    // We need a map of groups slugs to ids, to perform checks on models
     const {
       model
     } = params;
@@ -414,7 +372,7 @@ class AccessControl {
         continue;
       }
       if (groupPermissions.own) {
-        const group = await this.getGroup(model.group.id);
+        const group = await this.getGroup(model.group);
         if (!group) {
           continue;
         }
@@ -438,10 +396,10 @@ class AccessControl {
         const {
           groups
         } = groupPermissions;
-        if (!Array.isArray(groups[model.locale])) {
+        if (!Array.isArray(groups)) {
           continue;
         }
-        if (!groups[model.locale].includes(model.group.id)) {
+        if (!groups.includes(model.group)) {
           continue;
         }
       }
@@ -462,10 +420,10 @@ class AccessControl {
         });
       }
       if (relatedModelsPermissions.models) {
-        if (!Array.isArray(relatedModelsPermissions.models[model.locale])) {
+        if (!Array.isArray(relatedModelsPermissions.models)) {
           continue;
         }
-        if (!relatedModelsPermissions.models[model.locale].includes(model.modelId)) {
+        if (!relatedModelsPermissions.models.includes(model.modelId)) {
           continue;
         }
       }
@@ -532,11 +490,10 @@ class AccessControl {
     }
     return this.allGroups;
   }
-  async getGroup(id) {
+  async getGroup(slug) {
     const groups = await this.listAllGroups();
-    return groups.find(group => group.id === id);
+    return groups.find(group => group.slug === slug);
   }
 }
-exports.AccessControl = AccessControl;
 //# sourceMappingURL=AccessControl.js.map

package/crud/AccessControl/AccessControl.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"names":["_apiSecurity","require","AccessControl","constructor","getIdentity","getGroupsPermissions","getModelsPermissions","getEntriesPermissions","listAllGroups","fullAccessPermissions","listAllGroupsCallback","allGroups","canAccessGroup","params","acl","getGroupsAccessControlList","canRead","find","ace","rwd","includes","hasRwd","ensureCanAccessGroup","canAccess","groupName","group","name","NotAuthorizedError","data","reason","canAccessNonOwnedGroups","some","canAccessNonOwned","canAccessOnlyOwnedGroups","hasFullAccessToGroups","canAccessOnlyOwned","groupsPermissionsList","groupsPermissions","own","modelGroupCreatedBy","createdBy","identity","id","push","groups","Array","isArray","locale","permissions","p","filter","Boolean","canAccessModel","getModelsAccessControlList","ensureCanAccessModel","modelName","model","canAccessNonOwnedModels","canAccessOnlyOwnedModels","hasFullAccessToModels","i","length","modelsPermissionsList","relatedModelPermissions","_src","getGroup","fullAccess","models","modelCreatedBy","modelId","modelAuthorizationDisabled","canAccessEntry","getEntriesAccessControlList","pw","hasPw","ensureCanAccessEntry","entry","entryId","canAccessNonOwnedEntries","canAccessOnlyOwnedEntries","hasFullAccessToEntries","groupPermissions","relatedModelsPermissions","entriesPermissionsList","relatedEntriesPermissions","groupCreatedBy","entryCreatedBy","authorization","exports"],"sources":["AccessControl.ts"],"sourcesContent":["import { NotAuthorizedError } from \"@webiny/api-security\";\nimport type { SecurityIdentity } from \"@webiny/api-security/types\";\nimport type {\n CmsEntry,\n CmsEntryPermission,\n CmsGroup,\n CmsGroupPermission,\n CmsModel,\n CmsModelPermission\n} from \"~/types\";\n\nexport interface AccessControlParams {\n getIdentity: () => SecurityIdentity \| Promise<SecurityIdentity>;\n getGroupsPermissions: () => CmsGroupPermission[] \| Promise<CmsGroupPermission[]>;\n getModelsPermissions: () => CmsModelPermission[] \| Promise<CmsModelPermission[]>;\n getEntriesPermissions: () => CmsEntryPermission[] \| Promise<CmsEntryPermission[]>;\n listAllGroups: () => Promise<CmsGroup[]>;\n}\n\ninterface GetGroupsAccessControlListParams {\n group?: CmsGroup;\n}\n\ninterface CanAccessGroupParams extends GetGroupsAccessControlListParams {\n rwd?: string;\n}\n\ninterface GetModelsAccessControlListParams {\n model?: CmsModel;\n}\n\ninterface CanAccessModelParams extends GetModelsAccessControlListParams {\n rwd?: string;\n}\n\ninterface GetEntriesAccessControlListParams {\n model: Pick<CmsModel, \"modelId\" \| \"createdBy\" \| \"group\" \| \"locale\" \| \"authorization\">;\n entry?: Pick<CmsEntry, \"entryId\" \| \"createdBy\">;\n}\n\nexport interface CanAccessEntryParams extends GetEntriesAccessControlListParams {\n rwd?: string;\n pw?: string;\n}\n\ninterface AccessControlEntry {\n rwd: string;\n canAccessNonOwned: boolean;\n canAccessOnlyOwned: boolean;\n}\n\ntype AccessControlList = AccessControlEntry[];\n\ninterface EntriesAccessControlEntry extends AccessControlEntry {\n pw?: string;\n}\n\ntype EntriesAccessControlList = EntriesAccessControlEntry[];\n\ninterface IModelAuthorizationDisabledParams {\n model: Pick<CmsModel, \"authorization\">;\n}\n\nexport class AccessControl {\n getIdentity: AccessControlParams[\"getIdentity\"];\n getGroupsPermissions: AccessControlParams[\"getGroupsPermissions\"];\n getModelsPermissions: AccessControlParams[\"getModelsPermissions\"];\n getEntriesPermissions: AccessControlParams[\"getEntriesPermissions\"];\n listAllGroupsCallback: AccessControlParams[\"listAllGroups\"];\n\n private fullAccessPermissions: string[];\n private allGroups: null \| CmsGroup[] \| Promise<CmsGroup[]>;\n\n constructor({\n getIdentity,\n getGroupsPermissions,\n getModelsPermissions,\n getEntriesPermissions,\n listAllGroups\n }: AccessControlParams) {\n this.getIdentity = getIdentity;\n this.getGroupsPermissions = getGroupsPermissions;\n this.getModelsPermissions = getModelsPermissions;\n this.getEntriesPermissions = getEntriesPermissions;\n this.fullAccessPermissions = [\"\", \"cms.\"];\n this.listAllGroupsCallback = listAllGroups;\n this.allGroups = null;\n }\n\n /*\n Groups-related methods below. 👇\n * - canAccessGroup\n * - ensureCanAccessGroup\n * - canAccessNonOwnedGroups\n * - canAccessOnlyOwnedGroups\n * - getGroupsAccessControlList\n * - hasFullAccessToGroups\n /\n\n async canAccessGroup(params: CanAccessGroupParams = {}) {\n const acl = await this.getGroupsAccessControlList(params);\n\n const canRead = acl.find(ace => ace.rwd?.includes(\"r\"));\n if (!canRead) {\n return false;\n }\n\n const { rwd } = params;\n if (rwd) {\n const hasRwd = acl.find(ace => ace.rwd.includes(rwd));\n if (!hasRwd) {\n return false;\n }\n }\n\n return true;\n }\n\n async ensureCanAccessGroup(params: CanAccessGroupParams = {}) {\n const canAccess = await this.canAccessGroup(params);\n if (canAccess) {\n return;\n }\n\n if (\"group\" in params) {\n let groupName = \"(could not determine name)\";\n if (params.group?.name) {\n groupName = `\"${params.group.name}\"`;\n }\n\n throw new NotAuthorizedError({\n data: {\n reason: `Not allowed to access content model group ${groupName}.`\n }\n });\n }\n\n throw new NotAuthorizedError({\n data: {\n reason: `Not allowed to access content model groups.`\n }\n });\n }\n\n async canAccessNonOwnedGroups(params: GetGroupsAccessControlListParams) {\n const acl = await this.getGroupsAccessControlList(params);\n return acl.some(ace => ace.canAccessNonOwned);\n }\n\n async canAccessOnlyOwnedGroups(params: GetGroupsAccessControlListParams) {\n const canAccessNonOwned = await this.canAccessNonOwnedGroups(params);\n return !canAccessNonOwned;\n }\n\n async getGroupsAccessControlList(\n params: GetGroupsAccessControlListParams\n ): Promise<AccessControlList> {\n if (await this.hasFullAccessToGroups()) {\n return [{ rwd: \"rwd\", canAccessNonOwned: true, canAccessOnlyOwned: false }];\n }\n\n const groupsPermissionsList = await this.getGroupsPermissions();\n const acl: AccessControlList = [];\n\n for (const groupsPermissions of groupsPermissionsList) {\n if (groupsPermissions.own) {\n if (\"group\" in params) {\n const modelGroupCreatedBy = params.group?.createdBy;\n if (!modelGroupCreatedBy) {\n continue;\n }\n\n const identity = await this.getIdentity();\n\n if (modelGroupCreatedBy.id !== identity.id) {\n continue;\n }\n }\n\n acl.push({\n rwd: \"rwd\",\n canAccessNonOwned: false,\n canAccessOnlyOwned: true\n });\n }\n\n if (groupsPermissions.groups) {\n if (\"group\" in params) {\n const { group } = params;\n if (!group) {\n continue;\n }\n\n const { groups } = groupsPermissions;\n if (!Array.isArray(groups[group.locale])) {\n continue;\n }\n\n if (!groups[group.locale].includes(group.id)) {\n continue;\n }\n }\n }\n\n acl.push({\n rwd: groupsPermissions.rwd as string,\n canAccessNonOwned: true,\n canAccessOnlyOwned: false\n });\n }\n\n return acl;\n }\n\n async hasFullAccessToGroups() {\n const permissions = await this.getGroupsPermissions();\n return permissions.some(p => this.fullAccessPermissions.filter(Boolean).includes(p.name));\n }\n\n /\n Models-related methods below. 👇\n * - canAccessModel\n * - ensureCanAccessModel\n * - canAccessNonOwnedModels\n * - canAccessOnlyOwnedModels\n * - getModelsAccessControlList\n * - hasFullAccessToModels\n /\n\n async canAccessModel(params: CanAccessModelParams) {\n const acl = await this.getModelsAccessControlList(params);\n\n const canRead = acl.find(ace => ace.rwd.includes(\"r\"));\n if (!canRead) {\n return false;\n }\n\n const { rwd } = params;\n if (rwd) {\n const hasRwd = acl.find(ace => ace.rwd.includes(rwd));\n if (!hasRwd) {\n return false;\n }\n }\n\n return true;\n }\n\n async ensureCanAccessModel(params: CanAccessModelParams = {}) {\n const canAccess = await this.canAccessModel(params);\n if (canAccess) {\n return;\n }\n\n if (\"model\" in params) {\n let modelName = \"(could not determine name)\";\n if (params.model?.name) {\n modelName = `\"${params.model.name}\"`;\n }\n\n throw new NotAuthorizedError({\n data: {\n reason: `Not allowed to access content model ${modelName}.`\n }\n });\n }\n\n throw new NotAuthorizedError({\n data: {\n reason: `Not allowed to access content models.`\n }\n });\n }\n\n async canAccessNonOwnedModels(params: GetModelsAccessControlListParams) {\n const acl = await this.getModelsAccessControlList(params);\n return acl.some(ace => ace.canAccessNonOwned);\n }\n\n async canAccessOnlyOwnedModels(params: GetModelsAccessControlListParams) {\n const canAccessNonOwned = await this.canAccessNonOwnedModels(params);\n return !canAccessNonOwned;\n }\n\n async getModelsAccessControlList(\n params: GetModelsAccessControlListParams\n ): Promise<AccessControlList> {\n if (await this.hasFullAccessToModels(params)) {\n return [{ rwd: \"rwd\", canAccessNonOwned: true, canAccessOnlyOwned: false }];\n }\n\n const groupsPermissionsList = await this.getGroupsPermissions();\n const acl: AccessControlList = [];\n\n for (let i = 0; i < groupsPermissionsList.length; i++) {\n const groupsPermissions = groupsPermissionsList[i];\n\n const modelsPermissionsList = await this.getModelsPermissions();\n const relatedModelPermissions = modelsPermissionsList.find(\n permissions => permissions._src === groupsPermissions._src\n );\n\n if (!relatedModelPermissions) {\n continue;\n }\n\n if (groupsPermissions.own) {\n if (\"model\" in params) {\n const { model } = params;\n if (!model) {\n continue;\n }\n\n const group = await this.getGroup(model.group.id);\n if (!group) {\n continue;\n }\n\n const modelGroupCreatedBy = group.createdBy;\n if (!modelGroupCreatedBy) {\n continue;\n }\n\n const identity = await this.getIdentity();\n if (modelGroupCreatedBy.id !== identity.id) {\n continue;\n }\n }\n\n acl.push({\n rwd: \"rwd\",\n canAccessNonOwned: false,\n canAccessOnlyOwned: true\n });\n\n continue;\n }\n\n if (groupsPermissions.groups) {\n if (\"model\" in params) {\n const { model } = params;\n if (!model) {\n continue;\n }\n\n if (!Array.isArray(groupsPermissions.groups[model.locale])) {\n continue;\n }\n\n if (!groupsPermissions.groups[model.locale].includes(model.group.id)) {\n continue;\n }\n }\n }\n\n const fullAccess =\n !relatedModelPermissions.rwd &&\n !relatedModelPermissions.own &&\n !relatedModelPermissions.models;\n\n if (fullAccess) {\n acl.push({\n rwd: \"rwd\",\n canAccessNonOwned: true,\n canAccessOnlyOwned: false\n });\n\n continue;\n }\n\n if (relatedModelPermissions.own) {\n if (\"model\" in params) {\n if (!params.model) {\n continue;\n }\n\n const modelCreatedBy = params.model.createdBy;\n if (!modelCreatedBy) {\n continue;\n }\n\n const identity = await this.getIdentity();\n if (modelCreatedBy.id !== identity.id) {\n continue;\n }\n }\n\n acl.push({\n rwd: \"rwd\",\n canAccessNonOwned: false,\n canAccessOnlyOwned: true\n });\n\n continue;\n }\n\n if (relatedModelPermissions.models) {\n const { models } = relatedModelPermissions;\n if (\"model\" in params) {\n if (!params.model) {\n continue;\n }\n\n if (!Array.isArray(models[params.model.locale])) {\n continue;\n }\n\n if (!models[params.model.locale].includes(params.model.modelId)) {\n continue;\n }\n }\n }\n\n acl.push({\n rwd: relatedModelPermissions.rwd as string,\n canAccessNonOwned: true,\n canAccessOnlyOwned: false\n });\n }\n\n return acl;\n }\n\n async hasFullAccessToModels(params: GetModelsAccessControlListParams) {\n const { model } = params;\n if (model) {\n if (this.modelAuthorizationDisabled({ model })) {\n return true;\n }\n }\n\n const permissions = await this.getModelsPermissions();\n return permissions.some(p => this.fullAccessPermissions.filter(Boolean).includes(p.name));\n }\n\n /\n Entries-related methods below. 👇\n * - canAccessEntry\n * - ensureCanAccessEntry\n * - canAccessNonOwnedEntries\n * - canAccessOnlyOwnedEntries\n * - getEntriesAccessControlList\n * - hasFullAccessToEntries\n */\n\n async canAccessEntry(params: CanAccessEntryParams) {\n const acl = await this.getEntriesAccessControlList(params);\n\n const canRead = acl.find(ace => ace.rwd.includes(\"r\"));\n if (!canRead) {\n return false;\n }\n\n const { rwd } = params;\n if (rwd) {\n const hasRwd = acl.find(ace => ace.rwd.includes(rwd));\n if (!hasRwd) {\n return false;\n }\n }\n\n const { pw } = params;\n if (pw) {\n const hasPw = acl.find(ace => ace.pw?.includes(pw));\n if (!hasPw) {\n return false;\n }\n }\n\n return true;\n }\n\n async ensureCanAccessEntry(params: CanAccessEntryParams) {\n const canAccess = await this.canAccessEntry(params);\n if (!canAccess) {\n if (params.entry) {\n throw new NotAuthorizedError({\n data: {\n reason: `Not allowed to access entry \"${params.entry.entryId}\".`\n }\n });\n }\n\n throw new NotAuthorizedError({\n data: {\n reason: `Not allowed to access \"${params.model.modelId}\" entries.`\n }\n });\n }\n }\n\n async canAccessNonOwnedEntries(params: GetEntriesAccessControlListParams) {\n const acl = await this.getEntriesAccessControlList(params);\n return acl.some(ace => ace.canAccessNonOwned);\n }\n\n async canAccessOnlyOwnedEntries(params: GetEntriesAccessControlListParams) {\n const canAccessNonOwned = await this.canAccessNonOwnedEntries(params);\n return !canAccessNonOwned;\n }\n\n async getEntriesAccessControlList(\n params: GetEntriesAccessControlListParams\n ): Promise<EntriesAccessControlList> {\n if (await this.hasFullAccessToEntries(params)) {\n return [{ rwd: \"rwd\", pw: \"pu\", canAccessNonOwned: true, canAccessOnlyOwned: false }];\n }\n\n const { model } = params;\n const groupsPermissionsList = await this.getGroupsPermissions();\n const acl: EntriesAccessControlList = [];\n\n for (let i = 0; i < groupsPermissionsList.length; i++) {\n const groupPermissions = groupsPermissionsList[i];\n\n const modelsPermissionsList = await this.getModelsPermissions();\n const relatedModelsPermissions = modelsPermissionsList.find(\n permissions => permissions._src === groupPermissions._src\n );\n\n if (!relatedModelsPermissions) {\n continue;\n }\n\n const entriesPermissionsList = await this.getEntriesPermissions();\n const relatedEntriesPermissions = entriesPermissionsList.find(\n permissions => permissions._src === groupPermissions._src\n );\n\n if (!relatedEntriesPermissions) {\n continue;\n }\n\n if (groupPermissions.own) {\n const group = await this.getGroup(model.group.id);\n if (!group) {\n continue;\n }\n\n const groupCreatedBy = group.createdBy;\n if (!groupCreatedBy) {\n continue;\n }\n\n const identity = await this.getIdentity();\n if (groupCreatedBy.id !== identity.id) {\n continue;\n }\n\n acl.push({\n rwd: \"rwd\",\n canAccessNonOwned: false,\n canAccessOnlyOwned: true,\n pw: relatedEntriesPermissions.pw\n });\n\n continue;\n }\n\n if (groupPermissions.groups) {\n const { groups } = groupPermissions;\n\n if (!Array.isArray(groups[model.locale])) {\n continue;\n }\n\n if (!groups[model.locale].includes(model.group.id)) {\n continue;\n }\n }\n\n if (relatedModelsPermissions.own) {\n const modelCreatedBy = model.createdBy;\n if (!modelCreatedBy) {\n continue;\n }\n\n const identity = await this.getIdentity();\n if (modelCreatedBy.id !== identity.id) {\n continue;\n }\n\n acl.push({\n rwd: \"rwd\",\n canAccessNonOwned: false,\n canAccessOnlyOwned: true,\n pw: relatedEntriesPermissions.pw\n });\n }\n\n if (relatedModelsPermissions.models) {\n if (!Array.isArray(relatedModelsPermissions.models[model.locale])) {\n continue;\n }\n\n if (!relatedModelsPermissions.models[model.locale].includes(model.modelId)) {\n continue;\n }\n }\n\n const fullAccess =\n !relatedEntriesPermissions.rwd &&\n !relatedEntriesPermissions.own &&\n !relatedEntriesPermissions.models;\n\n if (fullAccess) {\n acl.push({\n rwd: \"rwd\",\n canAccessNonOwned: false,\n canAccessOnlyOwned: true,\n pw: \"pu\"\n });\n\n continue;\n }\n\n if (relatedEntriesPermissions.own) {\n if (\"entry\" in params) {\n const entryCreatedBy = params.entry?.createdBy;\n if (!entryCreatedBy) {\n continue;\n }\n\n const identity = await this.getIdentity();\n if (entryCreatedBy.id !== identity.id) {\n continue;\n }\n }\n\n acl.push({\n rwd: relatedEntriesPermissions.rwd,\n canAccessNonOwned: false,\n canAccessOnlyOwned: true,\n pw: relatedEntriesPermissions.pw\n });\n\n continue;\n }\n\n acl.push({\n rwd: relatedEntriesPermissions.rwd,\n canAccessNonOwned: true,\n canAccessOnlyOwned: false,\n pw: relatedEntriesPermissions.pw\n });\n }\n\n return acl;\n }\n\n async hasFullAccessToEntries(params: GetEntriesAccessControlListParams) {\n if (this.modelAuthorizationDisabled(params)) {\n return true;\n }\n\n const permissions = await this.getEntriesPermissions();\n return permissions.some(p => this.fullAccessPermissions.filter(Boolean).includes(p.name));\n }\n\n private modelAuthorizationDisabled(params: IModelAuthorizationDisabledParams) {\n if (\"authorization\" in params.model) {\n const { authorization } = params.model;\n if (typeof authorization === \"boolean\") {\n return authorization === false;\n }\n\n return authorization?.permissions === false;\n }\n\n return false;\n }\n\n async listAllGroups(): Promise<CmsGroup[]> {\n if (this.allGroups === null) {\n this.allGroups = this.listAllGroupsCallback();\n }\n\n return this.allGroups;\n }\n\n async getGroup(id: string): Promise<CmsGroup \| undefined> {\n const groups = await this.listAllGroups();\n return groups.find(group => group.id === id);\n }\n}\n"],"mappings":";;;;;;AAAA,IAAAA,YAAA,GAAAC,OAAA;AA+DO,MAAMC,aAAa,CAAC;EAUvBC,WAAWA,CAAC;IACRC,WAAW;IACXC,oBAAoB;IACpBC,oBAAoB;IACpBC,qBAAqB;IACrBC;EACiB,CAAC,EAAE;IACpB,IAAI,CAACJ,WAAW,GAAGA,WAAW;IAC9B,IAAI,CAACC,oBAAoB,GAAGA,oBAAoB;IAChD,IAAI,CAACC,oBAAoB,GAAGA,oBAAoB;IAChD,IAAI,CAACC,qBAAqB,GAAGA,qBAAqB;IAClD,IAAI,CAACE,qBAAqB,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC;IAC3C,IAAI,CAACC,qBAAqB,GAAGF,aAAa;IAC1C,IAAI,CAACG,SAAS,GAAG,IAAI;EACzB;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;EAEI,MAAMC,cAAcA,CAACC,MAA4B,GAAG,CAAC,CAAC,EAAE;IACpD,MAAMC,GAAG,GAAG,MAAM,IAAI,CAACC,0BAA0B,CAACF,MAAM,CAAC;IAEzD,MAAMG,OAAO,GAAGF,GAAG,CAACG,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACC,GAAG,EAAEC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,CAACJ,OAAO,EAAE;MACV,OAAO,KAAK;IAChB;IAEA,MAAM;MAAEG;IAAI,CAAC,GAAGN,MAAM;IACtB,IAAIM,GAAG,EAAE;MACL,MAAME,MAAM,GAAGP,GAAG,CAACG,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACC,GAAG,CAACC,QAAQ,CAACD,GAAG,CAAC,CAAC;MACrD,IAAI,CAACE,MAAM,EAAE;QACT,OAAO,KAAK;MAChB;IACJ;IAEA,OAAO,IAAI;EACf;EAEA,MAAMC,oBAAoBA,CAACT,MAA4B,GAAG,CAAC,CAAC,EAAE;IAC1D,MAAMU,SAAS,GAAG,MAAM,IAAI,CAACX,cAAc,CAACC,MAAM,CAAC;IACnD,IAAIU,SAAS,EAAE;MACX;IACJ;IAEA,IAAI,OAAO,IAAIV,MAAM,EAAE;MACnB,IAAIW,SAAS,GAAG,4BAA4B;MAC5C,IAAIX,MAAM,CAACY,KAAK,EAAEC,IAAI,EAAE;QACpBF,SAAS,GAAG,IAAIX,MAAM,CAACY,KAAK,CAACC,IAAI,GAAG;MACxC;MAEA,MAAM,IAAIC,+BAAkB,CAAC;QACzBC,IAAI,EAAE;UACFC,MAAM,EAAE,6CAA6CL,SAAS;QAClE;MACJ,CAAC,CAAC;IACN;IAEA,MAAM,IAAIG,+BAAkB,CAAC;MACzBC,IAAI,EAAE;QACFC,MAAM,EAAE;MACZ;IACJ,CAAC,CAAC;EACN;EAEA,MAAMC,uBAAuBA,CAACjB,MAAwC,EAAE;IACpE,MAAMC,GAAG,GAAG,MAAM,IAAI,CAACC,0BAA0B,CAACF,MAAM,CAAC;IACzD,OAAOC,GAAG,CAACiB,IAAI,CAACb,GAAG,IAAIA,GAAG,CAACc,iBAAiB,CAAC;EACjD;EAEA,MAAMC,wBAAwBA,CAACpB,MAAwC,EAAE;IACrE,MAAMmB,iBAAiB,GAAG,MAAM,IAAI,CAACF,uBAAuB,CAACjB,MAAM,CAAC;IACpE,OAAO,CAACmB,iBAAiB;EAC7B;EAEA,MAAMjB,0BAA0BA,CAC5BF,MAAwC,EACd;IAC1B,IAAI,MAAM,IAAI,CAACqB,qBAAqB,CAAC,CAAC,EAAE;MACpC,OAAO,CAAC;QAAEf,GAAG,EAAE,KAAK;QAAEa,iBAAiB,EAAE,IAAI;QAAEG,kBAAkB,EAAE;MAAM,CAAC,CAAC;IAC/E;IAEA,MAAMC,qBAAqB,GAAG,MAAM,IAAI,CAAC/B,oBAAoB,CAAC,CAAC;IAC/D,MAAMS,GAAsB,GAAG,EAAE;IAEjC,KAAK,MAAMuB,iBAAiB,IAAID,qBAAqB,EAAE;MACnD,IAAIC,iBAAiB,CAACC,GAAG,EAAE;QACvB,IAAI,OAAO,IAAIzB,MAAM,EAAE;UACnB,MAAM0B,mBAAmB,GAAG1B,MAAM,CAACY,KAAK,EAAEe,SAAS;UACnD,IAAI,CAACD,mBAAmB,EAAE;YACtB;UACJ;UAEA,MAAME,QAAQ,GAAG,MAAM,IAAI,CAACrC,WAAW,CAAC,CAAC;UAEzC,IAAImC,mBAAmB,CAACG,EAAE,KAAKD,QAAQ,CAACC,EAAE,EAAE;YACxC;UACJ;QACJ;QAEA5B,GAAG,CAAC6B,IAAI,CAAC;UACLxB,GAAG,EAAE,KAAK;UACVa,iBAAiB,EAAE,KAAK;UACxBG,kBAAkB,EAAE;QACxB,CAAC,CAAC;MACN;MAEA,IAAIE,iBAAiB,CAACO,MAAM,EAAE;QAC1B,IAAI,OAAO,IAAI/B,MAAM,EAAE;UACnB,MAAM;YAAEY;UAAM,CAAC,GAAGZ,MAAM;UACxB,IAAI,CAACY,KAAK,EAAE;YACR;UACJ;UAEA,MAAM;YAAEmB;UAAO,CAAC,GAAGP,iBAAiB;UACpC,IAAI,CAACQ,KAAK,CAACC,OAAO,CAACF,MAAM,CAACnB,KAAK,CAACsB,MAAM,CAAC,CAAC,EAAE;YACtC;UACJ;UAEA,IAAI,CAACH,MAAM,CAACnB,KAAK,CAACsB,MAAM,CAAC,CAAC3B,QAAQ,CAACK,KAAK,CAACiB,EAAE,CAAC,EAAE;YAC1C;UACJ;QACJ;MACJ;MAEA5B,GAAG,CAAC6B,IAAI,CAAC;QACLxB,GAAG,EAAEkB,iBAAiB,CAAClB,GAAa;QACpCa,iBAAiB,EAAE,IAAI;QACvBG,kBAAkB,EAAE;MACxB,CAAC,CAAC;IACN;IAEA,OAAOrB,GAAG;EACd;EAEA,MAAMoB,qBAAqBA,CAAA,EAAG;IAC1B,MAAMc,WAAW,GAAG,MAAM,IAAI,CAAC3C,oBAAoB,CAAC,CAAC;IACrD,OAAO2C,WAAW,CAACjB,IAAI,CAACkB,CAAC,IAAI,IAAI,CAACxC,qBAAqB,CAACyC,MAAM,CAACC,OAAO,CAAC,CAAC/B,QAAQ,CAAC6B,CAAC,CAACvB,IAAI,CAAC,CAAC;EAC7F;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;EAEI,MAAM0B,cAAcA,CAACvC,MAA4B,EAAE;IAC/C,MAAMC,GAAG,GAAG,MAAM,IAAI,CAACuC,0BAA0B,CAACxC,MAAM,CAAC;IAEzD,MAAMG,OAAO,GAAGF,GAAG,CAACG,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACC,GAAG,CAACC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,CAACJ,OAAO,EAAE;MACV,OAAO,KAAK;IAChB;IAEA,MAAM;MAAEG;IAAI,CAAC,GAAGN,MAAM;IACtB,IAAIM,GAAG,EAAE;MACL,MAAME,MAAM,GAAGP,GAAG,CAACG,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACC,GAAG,CAACC,QAAQ,CAACD,GAAG,CAAC,CAAC;MACrD,IAAI,CAACE,MAAM,EAAE;QACT,OAAO,KAAK;MAChB;IACJ;IAEA,OAAO,IAAI;EACf;EAEA,MAAMiC,oBAAoBA,CAACzC,MAA4B,GAAG,CAAC,CAAC,EAAE;IAC1D,MAAMU,SAAS,GAAG,MAAM,IAAI,CAAC6B,cAAc,CAACvC,MAAM,CAAC;IACnD,IAAIU,SAAS,EAAE;MACX;IACJ;IAEA,IAAI,OAAO,IAAIV,MAAM,EAAE;MACnB,IAAI0C,SAAS,GAAG,4BAA4B;MAC5C,IAAI1C,MAAM,CAAC2C,KAAK,EAAE9B,IAAI,EAAE;QACpB6B,SAAS,GAAG,IAAI1C,MAAM,CAAC2C,KAAK,CAAC9B,IAAI,GAAG;MACxC;MAEA,MAAM,IAAIC,+BAAkB,CAAC;QACzBC,IAAI,EAAE;UACFC,MAAM,EAAE,uCAAuC0B,SAAS;QAC5D;MACJ,CAAC,CAAC;IACN;IAEA,MAAM,IAAI5B,+BAAkB,CAAC;MACzBC,IAAI,EAAE;QACFC,MAAM,EAAE;MACZ;IACJ,CAAC,CAAC;EACN;EAEA,MAAM4B,uBAAuBA,CAAC5C,MAAwC,EAAE;IACpE,MAAMC,GAAG,GAAG,MAAM,IAAI,CAACuC,0BAA0B,CAACxC,MAAM,CAAC;IACzD,OAAOC,GAAG,CAACiB,IAAI,CAACb,GAAG,IAAIA,GAAG,CAACc,iBAAiB,CAAC;EACjD;EAEA,MAAM0B,wBAAwBA,CAAC7C,MAAwC,EAAE;IACrE,MAAMmB,iBAAiB,GAAG,MAAM,IAAI,CAACyB,uBAAuB,CAAC5C,MAAM,CAAC;IACpE,OAAO,CAACmB,iBAAiB;EAC7B;EAEA,MAAMqB,0BAA0BA,CAC5BxC,MAAwC,EACd;IAC1B,IAAI,MAAM,IAAI,CAAC8C,qBAAqB,CAAC9C,MAAM,CAAC,EAAE;MAC1C,OAAO,CAAC;QAAEM,GAAG,EAAE,KAAK;QAAEa,iBAAiB,EAAE,IAAI;QAAEG,kBAAkB,EAAE;MAAM,CAAC,CAAC;IAC/E;IAEA,MAAMC,qBAAqB,GAAG,MAAM,IAAI,CAAC/B,oBAAoB,CAAC,CAAC;IAC/D,MAAMS,GAAsB,GAAG,EAAE;IAEjC,KAAK,IAAI8C,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAGxB,qBAAqB,CAACyB,MAAM,EAAED,CAAC,EAAE,EAAE;MACnD,MAAMvB,iBAAiB,GAAGD,qBAAqB,CAACwB,CAAC,CAAC;MAElD,MAAME,qBAAqB,GAAG,MAAM,IAAI,CAACxD,oBAAoB,CAAC,CAAC;MAC/D,MAAMyD,uBAAuB,GAAGD,qBAAqB,CAAC7C,IAAI,CACtD+B,WAAW,IAAIA,WAAW,CAACgB,IAAI,KAAK3B,iBAAiB,CAAC2B,IAC1D,CAAC;MAED,IAAI,CAACD,uBAAuB,EAAE;QAC1B;MACJ;MAEA,IAAI1B,iBAAiB,CAACC,GAAG,EAAE;QACvB,IAAI,OAAO,IAAIzB,MAAM,EAAE;UACnB,MAAM;YAAE2C;UAAM,CAAC,GAAG3C,MAAM;UACxB,IAAI,CAAC2C,KAAK,EAAE;YACR;UACJ;UAEA,MAAM/B,KAAK,GAAG,MAAM,IAAI,CAACwC,QAAQ,CAACT,KAAK,CAAC/B,KAAK,CAACiB,EAAE,CAAC;UACjD,IAAI,CAACjB,KAAK,EAAE;YACR;UACJ;UAEA,MAAMc,mBAAmB,GAAGd,KAAK,CAACe,SAAS;UAC3C,IAAI,CAACD,mBAAmB,EAAE;YACtB;UACJ;UAEA,MAAME,QAAQ,GAAG,MAAM,IAAI,CAACrC,WAAW,CAAC,CAAC;UACzC,IAAImC,mBAAmB,CAACG,EAAE,KAAKD,QAAQ,CAACC,EAAE,EAAE;YACxC;UACJ;QACJ;QAEA5B,GAAG,CAAC6B,IAAI,CAAC;UACLxB,GAAG,EAAE,KAAK;UACVa,iBAAiB,EAAE,KAAK;UACxBG,kBAAkB,EAAE;QACxB,CAAC,CAAC;QAEF;MACJ;MAEA,IAAIE,iBAAiB,CAACO,MAAM,EAAE;QAC1B,IAAI,OAAO,IAAI/B,MAAM,EAAE;UACnB,MAAM;YAAE2C;UAAM,CAAC,GAAG3C,MAAM;UACxB,IAAI,CAAC2C,KAAK,EAAE;YACR;UACJ;UAEA,IAAI,CAACX,KAAK,CAACC,OAAO,CAACT,iBAAiB,CAACO,MAAM,CAACY,KAAK,CAACT,MAAM,CAAC,CAAC,EAAE;YACxD;UACJ;UAEA,IAAI,CAACV,iBAAiB,CAACO,MAAM,CAACY,KAAK,CAACT,MAAM,CAAC,CAAC3B,QAAQ,CAACoC,KAAK,CAAC/B,KAAK,CAACiB,EAAE,CAAC,EAAE;YAClE;UACJ;QACJ;MACJ;MAEA,MAAMwB,UAAU,GACZ,CAACH,uBAAuB,CAAC5C,GAAG,IAC5B,CAAC4C,uBAAuB,CAACzB,GAAG,IAC5B,CAACyB,uBAAuB,CAACI,MAAM;MAEnC,IAAID,UAAU,EAAE;QACZpD,GAAG,CAAC6B,IAAI,CAAC;UACLxB,GAAG,EAAE,KAAK;UACVa,iBAAiB,EAAE,IAAI;UACvBG,kBAAkB,EAAE;QACxB,CAAC,CAAC;QAEF;MACJ;MAEA,IAAI4B,uBAAuB,CAACzB,GAAG,EAAE;QAC7B,IAAI,OAAO,IAAIzB,MAAM,EAAE;UACnB,IAAI,CAACA,MAAM,CAAC2C,KAAK,EAAE;YACf;UACJ;UAEA,MAAMY,cAAc,GAAGvD,MAAM,CAAC2C,KAAK,CAAChB,SAAS;UAC7C,IAAI,CAAC4B,cAAc,EAAE;YACjB;UACJ;UAEA,MAAM3B,QAAQ,GAAG,MAAM,IAAI,CAACrC,WAAW,CAAC,CAAC;UACzC,IAAIgE,cAAc,CAAC1B,EAAE,KAAKD,QAAQ,CAACC,EAAE,EAAE;YACnC;UACJ;QACJ;QAEA5B,GAAG,CAAC6B,IAAI,CAAC;UACLxB,GAAG,EAAE,KAAK;UACVa,iBAAiB,EAAE,KAAK;UACxBG,kBAAkB,EAAE;QACxB,CAAC,CAAC;QAEF;MACJ;MAEA,IAAI4B,uBAAuB,CAACI,MAAM,EAAE;QAChC,MAAM;UAAEA;QAAO,CAAC,GAAGJ,uBAAuB;QAC1C,IAAI,OAAO,IAAIlD,MAAM,EAAE;UACnB,IAAI,CAACA,MAAM,CAAC2C,KAAK,EAAE;YACf;UACJ;UAEA,IAAI,CAACX,KAAK,CAACC,OAAO,CAACqB,MAAM,CAACtD,MAAM,CAAC2C,KAAK,CAACT,MAAM,CAAC,CAAC,EAAE;YAC7C;UACJ;UAEA,IAAI,CAACoB,MAAM,CAACtD,MAAM,CAAC2C,KAAK,CAACT,MAAM,CAAC,CAAC3B,QAAQ,CAACP,MAAM,CAAC2C,KAAK,CAACa,OAAO,CAAC,EAAE;YAC7D;UACJ;QACJ;MACJ;MAEAvD,GAAG,CAAC6B,IAAI,CAAC;QACLxB,GAAG,EAAE4C,uBAAuB,CAAC5C,GAAa;QAC1Ca,iBAAiB,EAAE,IAAI;QACvBG,kBAAkB,EAAE;MACxB,CAAC,CAAC;IACN;IAEA,OAAOrB,GAAG;EACd;EAEA,MAAM6C,qBAAqBA,CAAC9C,MAAwC,EAAE;IAClE,MAAM;MAAE2C;IAAM,CAAC,GAAG3C,MAAM;IACxB,IAAI2C,KAAK,EAAE;MACP,IAAI,IAAI,CAACc,0BAA0B,CAAC;QAAEd;MAAM,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;IACJ;IAEA,MAAMR,WAAW,GAAG,MAAM,IAAI,CAAC1C,oBAAoB,CAAC,CAAC;IACrD,OAAO0C,WAAW,CAACjB,IAAI,CAACkB,CAAC,IAAI,IAAI,CAACxC,qBAAqB,CAACyC,MAAM,CAACC,OAAO,CAAC,CAAC/B,QAAQ,CAAC6B,CAAC,CAACvB,IAAI,CAAC,CAAC;EAC7F;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;EAEI,MAAM6C,cAAcA,CAAC1D,MAA4B,EAAE;IAC/C,MAAMC,GAAG,GAAG,MAAM,IAAI,CAAC0D,2BAA2B,CAAC3D,MAAM,CAAC;IAE1D,MAAMG,OAAO,GAAGF,GAAG,CAACG,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACC,GAAG,CAACC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,CAACJ,OAAO,EAAE;MACV,OAAO,KAAK;IAChB;IAEA,MAAM;MAAEG;IAAI,CAAC,GAAGN,MAAM;IACtB,IAAIM,GAAG,EAAE;MACL,MAAME,MAAM,GAAGP,GAAG,CAACG,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACC,GAAG,CAACC,QAAQ,CAACD,GAAG,CAAC,CAAC;MACrD,IAAI,CAACE,MAAM,EAAE;QACT,OAAO,KAAK;MAChB;IACJ;IAEA,MAAM;MAAEoD;IAAG,CAAC,GAAG5D,MAAM;IACrB,IAAI4D,EAAE,EAAE;MACJ,MAAMC,KAAK,GAAG5D,GAAG,CAACG,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACuD,EAAE,EAAErD,QAAQ,CAACqD,EAAE,CAAC,CAAC;MACnD,IAAI,CAACC,KAAK,EAAE;QACR,OAAO,KAAK;MAChB;IACJ;IAEA,OAAO,IAAI;EACf;EAEA,MAAMC,oBAAoBA,CAAC9D,MAA4B,EAAE;IACrD,MAAMU,SAAS,GAAG,MAAM,IAAI,CAACgD,cAAc,CAAC1D,MAAM,CAAC;IACnD,IAAI,CAACU,SAAS,EAAE;MACZ,IAAIV,MAAM,CAAC+D,KAAK,EAAE;QACd,MAAM,IAAIjD,+BAAkB,CAAC;UACzBC,IAAI,EAAE;YACFC,MAAM,EAAE,gCAAgChB,MAAM,CAAC+D,KAAK,CAACC,OAAO;UAChE;QACJ,CAAC,CAAC;MACN;MAEA,MAAM,IAAIlD,+BAAkB,CAAC;QACzBC,IAAI,EAAE;UACFC,MAAM,EAAE,0BAA0BhB,MAAM,CAAC2C,KAAK,CAACa,OAAO;QAC1D;MACJ,CAAC,CAAC;IACN;EACJ;EAEA,MAAMS,wBAAwBA,CAACjE,MAAyC,EAAE;IACtE,MAAMC,GAAG,GAAG,MAAM,IAAI,CAAC0D,2BAA2B,CAAC3D,MAAM,CAAC;IAC1D,OAAOC,GAAG,CAACiB,IAAI,CAACb,GAAG,IAAIA,GAAG,CAACc,iBAAiB,CAAC;EACjD;EAEA,MAAM+C,yBAAyBA,CAAClE,MAAyC,EAAE;IACvE,MAAMmB,iBAAiB,GAAG,MAAM,IAAI,CAAC8C,wBAAwB,CAACjE,MAAM,CAAC;IACrE,OAAO,CAACmB,iBAAiB;EAC7B;EAEA,MAAMwC,2BAA2BA,CAC7B3D,MAAyC,EACR;IACjC,IAAI,MAAM,IAAI,CAACmE,sBAAsB,CAACnE,MAAM,CAAC,EAAE;MAC3C,OAAO,CAAC;QAAEM,GAAG,EAAE,KAAK;QAAEsD,EAAE,EAAE,IAAI;QAAEzC,iBAAiB,EAAE,IAAI;QAAEG,kBAAkB,EAAE;MAAM,CAAC,CAAC;IACzF;IAEA,MAAM;MAAEqB;IAAM,CAAC,GAAG3C,MAAM;IACxB,MAAMuB,qBAAqB,GAAG,MAAM,IAAI,CAAC/B,oBAAoB,CAAC,CAAC;IAC/D,MAAMS,GAA6B,GAAG,EAAE;IAExC,KAAK,IAAI8C,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAGxB,qBAAqB,CAACyB,MAAM,EAAED,CAAC,EAAE,EAAE;MACnD,MAAMqB,gBAAgB,GAAG7C,qBAAqB,CAACwB,CAAC,CAAC;MAEjD,MAAME,qBAAqB,GAAG,MAAM,IAAI,CAACxD,oBAAoB,CAAC,CAAC;MAC/D,MAAM4E,wBAAwB,GAAGpB,qBAAqB,CAAC7C,IAAI,CACvD+B,WAAW,IAAIA,WAAW,CAACgB,IAAI,KAAKiB,gBAAgB,CAACjB,IACzD,CAAC;MAED,IAAI,CAACkB,wBAAwB,EAAE;QAC3B;MACJ;MAEA,MAAMC,sBAAsB,GAAG,MAAM,IAAI,CAAC5E,qBAAqB,CAAC,CAAC;MACjE,MAAM6E,yBAAyB,GAAGD,sBAAsB,CAAClE,IAAI,CACzD+B,WAAW,IAAIA,WAAW,CAACgB,IAAI,KAAKiB,gBAAgB,CAACjB,IACzD,CAAC;MAED,IAAI,CAACoB,yBAAyB,EAAE;QAC5B;MACJ;MAEA,IAAIH,gBAAgB,CAAC3C,GAAG,EAAE;QACtB,MAAMb,KAAK,GAAG,MAAM,IAAI,CAACwC,QAAQ,CAACT,KAAK,CAAC/B,KAAK,CAACiB,EAAE,CAAC;QACjD,IAAI,CAACjB,KAAK,EAAE;UACR;QACJ;QAEA,MAAM4D,cAAc,GAAG5D,KAAK,CAACe,SAAS;QACtC,IAAI,CAAC6C,cAAc,EAAE;UACjB;QACJ;QAEA,MAAM5C,QAAQ,GAAG,MAAM,IAAI,CAACrC,WAAW,CAAC,CAAC;QACzC,IAAIiF,cAAc,CAAC3C,EAAE,KAAKD,QAAQ,CAACC,EAAE,EAAE;UACnC;QACJ;QAEA5B,GAAG,CAAC6B,IAAI,CAAC;UACLxB,GAAG,EAAE,KAAK;UACVa,iBAAiB,EAAE,KAAK;UACxBG,kBAAkB,EAAE,IAAI;UACxBsC,EAAE,EAAEW,yBAAyB,CAACX;QAClC,CAAC,CAAC;QAEF;MACJ;MAEA,IAAIQ,gBAAgB,CAACrC,MAAM,EAAE;QACzB,MAAM;UAAEA;QAAO,CAAC,GAAGqC,gBAAgB;QAEnC,IAAI,CAACpC,KAAK,CAACC,OAAO,CAACF,MAAM,CAACY,KAAK,CAACT,MAAM,CAAC,CAAC,EAAE;UACtC;QACJ;QAEA,IAAI,CAACH,MAAM,CAACY,KAAK,CAACT,MAAM,CAAC,CAAC3B,QAAQ,CAACoC,KAAK,CAAC/B,KAAK,CAACiB,EAAE,CAAC,EAAE;UAChD;QACJ;MACJ;MAEA,IAAIwC,wBAAwB,CAAC5C,GAAG,EAAE;QAC9B,MAAM8B,cAAc,GAAGZ,KAAK,CAAChB,SAAS;QACtC,IAAI,CAAC4B,cAAc,EAAE;UACjB;QACJ;QAEA,MAAM3B,QAAQ,GAAG,MAAM,IAAI,CAACrC,WAAW,CAAC,CAAC;QACzC,IAAIgE,cAAc,CAAC1B,EAAE,KAAKD,QAAQ,CAACC,EAAE,EAAE;UACnC;QACJ;QAEA5B,GAAG,CAAC6B,IAAI,CAAC;UACLxB,GAAG,EAAE,KAAK;UACVa,iBAAiB,EAAE,KAAK;UACxBG,kBAAkB,EAAE,IAAI;UACxBsC,EAAE,EAAEW,yBAAyB,CAACX;QAClC,CAAC,CAAC;MACN;MAEA,IAAIS,wBAAwB,CAACf,MAAM,EAAE;QACjC,IAAI,CAACtB,KAAK,CAACC,OAAO,CAACoC,wBAAwB,CAACf,MAAM,CAACX,KAAK,CAACT,MAAM,CAAC,CAAC,EAAE;UAC/D;QACJ;QAEA,IAAI,CAACmC,wBAAwB,CAACf,MAAM,CAACX,KAAK,CAACT,MAAM,CAAC,CAAC3B,QAAQ,CAACoC,KAAK,CAACa,OAAO,CAAC,EAAE;UACxE;QACJ;MACJ;MAEA,MAAMH,UAAU,GACZ,CAACkB,yBAAyB,CAACjE,GAAG,IAC9B,CAACiE,yBAAyB,CAAC9C,GAAG,IAC9B,CAAC8C,yBAAyB,CAACjB,MAAM;MAErC,IAAID,UAAU,EAAE;QACZpD,GAAG,CAAC6B,IAAI,CAAC;UACLxB,GAAG,EAAE,KAAK;UACVa,iBAAiB,EAAE,KAAK;UACxBG,kBAAkB,EAAE,IAAI;UACxBsC,EAAE,EAAE;QACR,CAAC,CAAC;QAEF;MACJ;MAEA,IAAIW,yBAAyB,CAAC9C,GAAG,EAAE;QAC/B,IAAI,OAAO,IAAIzB,MAAM,EAAE;UACnB,MAAMyE,cAAc,GAAGzE,MAAM,CAAC+D,KAAK,EAAEpC,SAAS;UAC9C,IAAI,CAAC8C,cAAc,EAAE;YACjB;UACJ;UAEA,MAAM7C,QAAQ,GAAG,MAAM,IAAI,CAACrC,WAAW,CAAC,CAAC;UACzC,IAAIkF,cAAc,CAAC5C,EAAE,KAAKD,QAAQ,CAACC,EAAE,EAAE;YACnC;UACJ;QACJ;QAEA5B,GAAG,CAAC6B,IAAI,CAAC;UACLxB,GAAG,EAAEiE,yBAAyB,CAACjE,GAAG;UAClCa,iBAAiB,EAAE,KAAK;UACxBG,kBAAkB,EAAE,IAAI;UACxBsC,EAAE,EAAEW,yBAAyB,CAACX;QAClC,CAAC,CAAC;QAEF;MACJ;MAEA3D,GAAG,CAAC6B,IAAI,CAAC;QACLxB,GAAG,EAAEiE,yBAAyB,CAACjE,GAAG;QAClCa,iBAAiB,EAAE,IAAI;QACvBG,kBAAkB,EAAE,KAAK;QACzBsC,EAAE,EAAEW,yBAAyB,CAACX;MAClC,CAAC,CAAC;IACN;IAEA,OAAO3D,GAAG;EACd;EAEA,MAAMkE,sBAAsBA,CAACnE,MAAyC,EAAE;IACpE,IAAI,IAAI,CAACyD,0BAA0B,CAACzD,MAAM,CAAC,EAAE;MACzC,OAAO,IAAI;IACf;IAEA,MAAMmC,WAAW,GAAG,MAAM,IAAI,CAACzC,qBAAqB,CAAC,CAAC;IACtD,OAAOyC,WAAW,CAACjB,IAAI,CAACkB,CAAC,IAAI,IAAI,CAACxC,qBAAqB,CAACyC,MAAM,CAACC,OAAO,CAAC,CAAC/B,QAAQ,CAAC6B,CAAC,CAACvB,IAAI,CAAC,CAAC;EAC7F;EAEQ4C,0BAA0BA,CAACzD,MAAyC,EAAE;IAC1E,IAAI,eAAe,IAAIA,MAAM,CAAC2C,KAAK,EAAE;MACjC,MAAM;QAAE+B;MAAc,CAAC,GAAG1E,MAAM,CAAC2C,KAAK;MACtC,IAAI,OAAO+B,aAAa,KAAK,SAAS,EAAE;QACpC,OAAOA,aAAa,KAAK,KAAK;MAClC;MAEA,OAAOA,aAAa,EAAEvC,WAAW,KAAK,KAAK;IAC/C;IAEA,OAAO,KAAK;EAChB;EAEA,MAAMxC,aAAaA,CAAA,EAAwB;IACvC,IAAI,IAAI,CAACG,SAAS,KAAK,IAAI,EAAE;MACzB,IAAI,CAACA,SAAS,GAAG,IAAI,CAACD,qBAAqB,CAAC,CAAC;IACjD;IAEA,OAAO,IAAI,CAACC,SAAS;EACzB;EAEA,MAAMsD,QAAQA,CAACvB,EAAU,EAAiC;IACtD,MAAME,MAAM,GAAG,MAAM,IAAI,CAACpC,aAAa,CAAC,CAAC;IACzC,OAAOoC,MAAM,CAAC3B,IAAI,CAACQ,KAAK,IAAIA,KAAK,CAACiB,EAAE,KAAKA,EAAE,CAAC;EAChD;AACJ;AAAC8C,OAAA,CAAAtF,aAAA,GAAAA,aAAA","ignoreList":[]}
1	+ {"version":3,"names":["NotAuthorizedError","AccessControl","constructor","getIdentity","getGroupsPermissions","getModelsPermissions","getEntriesPermissions","listAllGroups","fullAccessPermissions","listAllGroupsCallback","allGroups","canAccessGroup","params","acl","getGroupsAccessControlList","canRead","find","ace","rwd","includes","hasRwd","canAccessNonOwnedGroups","some","canAccessNonOwned","canAccessOnlyOwnedGroups","hasFullAccessToGroups","canAccessOnlyOwned","groupsPermissionsList","groupsPermissions","own","modelGroupCreatedBy","group","createdBy","identity","id","push","groups","Array","isArray","permissions","p","filter","Boolean","name","canAccessModel","getModelsAccessControlList","ensureCanAccessModel","canAccess","modelName","model","canAccessNonOwnedModels","canAccessOnlyOwnedModels","hasFullAccessToModels","i","length","modelsPermissionsList","relatedModelPermissions","_src","getGroup","fullAccess","models","modelCreatedBy","modelId","modelAuthorizationDisabled","canAccessEntry","getEntriesAccessControlList","pw","hasPw","ensureCanAccessEntry","entry","entryId","canAccessNonOwnedEntries","canAccessOnlyOwnedEntries","hasFullAccessToEntries","groupPermissions","relatedModelsPermissions","entriesPermissionsList","relatedEntriesPermissions","groupCreatedBy","entryCreatedBy","authorization","slug"],"sources":["AccessControl.ts"],"sourcesContent":["import type {\n CmsEntry,\n CmsEntryPermission,\n CmsGroup,\n CmsGroupPermission,\n CmsModel,\n CmsModelPermission\n} from \"~/types/index.js\";\nimport type { SecurityIdentity } from \"@webiny/api-core/types/security.js\";\nimport { NotAuthorizedError } from \"~/utils/errors.js\";\n\nexport interface AccessControlParams {\n getIdentity: () => Promise<SecurityIdentity>;\n getGroupsPermissions: () => Promise<CmsGroupPermission[]>;\n getModelsPermissions: () => Promise<CmsModelPermission[]>;\n getEntriesPermissions: () => Promise<CmsEntryPermission[]>;\n listAllGroups: () => Promise<CmsGroup[]>;\n}\n\ninterface GetGroupsAccessControlListParams {\n group?: CmsGroup;\n}\n\ninterface CanAccessGroupParams extends GetGroupsAccessControlListParams {\n rwd?: string;\n}\n\ninterface GetModelsAccessControlListParams {\n model?: CmsModel;\n}\n\ninterface CanAccessModelParams extends GetModelsAccessControlListParams {\n rwd?: string;\n}\n\ninterface GetEntriesAccessControlListParams {\n model: Pick<CmsModel, \"modelId\" \| \"createdBy\" \| \"group\" \| \"authorization\">;\n entry?: Pick<CmsEntry, \"entryId\" \| \"createdBy\">;\n}\n\nexport interface CanAccessEntryParams extends GetEntriesAccessControlListParams {\n rwd?: string;\n pw?: string;\n}\n\ninterface AccessControlEntry {\n rwd: string;\n canAccessNonOwned: boolean;\n canAccessOnlyOwned: boolean;\n}\n\ntype AccessControlList = AccessControlEntry[];\n\ninterface EntriesAccessControlEntry extends AccessControlEntry {\n pw?: string;\n}\n\ntype EntriesAccessControlList = EntriesAccessControlEntry[];\n\ninterface IModelAuthorizationDisabledParams {\n model: Pick<CmsModel, \"authorization\">;\n}\n\nexport class AccessControl {\n private getIdentity: AccessControlParams[\"getIdentity\"];\n private getGroupsPermissions: AccessControlParams[\"getGroupsPermissions\"];\n private getModelsPermissions: AccessControlParams[\"getModelsPermissions\"];\n private getEntriesPermissions: AccessControlParams[\"getEntriesPermissions\"];\n private listAllGroupsCallback: AccessControlParams[\"listAllGroups\"];\n\n private fullAccessPermissions: string[];\n private allGroups: null \| Promise<CmsGroup[]>;\n\n constructor({\n getIdentity,\n getGroupsPermissions,\n getModelsPermissions,\n getEntriesPermissions,\n listAllGroups\n }: AccessControlParams) {\n this.getIdentity = getIdentity;\n this.getGroupsPermissions = getGroupsPermissions;\n this.getModelsPermissions = getModelsPermissions;\n this.getEntriesPermissions = getEntriesPermissions;\n this.fullAccessPermissions = [\"\", \"cms.\"];\n this.listAllGroupsCallback = listAllGroups;\n this.allGroups = null;\n }\n\n /*\n Groups-related methods below. 👇\n * - canAccessGroup\n * - ensureCanAccessGroup\n * - canAccessNonOwnedGroups\n * - canAccessOnlyOwnedGroups\n * - getGroupsAccessControlList\n * - hasFullAccessToGroups\n /\n\n async canAccessGroup(params: CanAccessGroupParams = {}) {\n const acl = await this.getGroupsAccessControlList(params);\n\n const canRead = acl.find(ace => ace.rwd?.includes(\"r\"));\n if (!canRead) {\n return false;\n }\n\n const { rwd } = params;\n if (rwd) {\n const hasRwd = acl.find(ace => ace.rwd.includes(rwd));\n if (!hasRwd) {\n return false;\n }\n }\n\n return true;\n }\n\n private async canAccessNonOwnedGroups(params: GetGroupsAccessControlListParams) {\n const acl = await this.getGroupsAccessControlList(params);\n return acl.some(ace => ace.canAccessNonOwned);\n }\n\n private async canAccessOnlyOwnedGroups(params: GetGroupsAccessControlListParams) {\n const canAccessNonOwned = await this.canAccessNonOwnedGroups(params);\n return !canAccessNonOwned;\n }\n\n private async getGroupsAccessControlList(\n params: GetGroupsAccessControlListParams\n ): Promise<AccessControlList> {\n if (await this.hasFullAccessToGroups()) {\n return [{ rwd: \"rwd\", canAccessNonOwned: true, canAccessOnlyOwned: false }];\n }\n\n const groupsPermissionsList = await this.getGroupsPermissions();\n const acl: AccessControlList = [];\n\n for (const groupsPermissions of groupsPermissionsList) {\n if (groupsPermissions.own) {\n if (\"group\" in params) {\n const modelGroupCreatedBy = params.group?.createdBy;\n if (!modelGroupCreatedBy) {\n continue;\n }\n\n const identity = await this.getIdentity();\n\n if (modelGroupCreatedBy.id !== identity.id) {\n continue;\n }\n }\n\n acl.push({\n rwd: \"rwd\",\n canAccessNonOwned: false,\n canAccessOnlyOwned: true\n });\n }\n\n if (groupsPermissions.groups) {\n if (\"group\" in params) {\n const { group } = params;\n if (!group) {\n continue;\n }\n\n const { groups } = groupsPermissions;\n if (!Array.isArray(groups)) {\n continue;\n }\n\n if (!groups.includes(group.id)) {\n continue;\n }\n }\n }\n\n acl.push({\n rwd: groupsPermissions.rwd as string,\n canAccessNonOwned: true,\n canAccessOnlyOwned: false\n });\n }\n\n return acl;\n }\n\n private async hasFullAccessToGroups() {\n const permissions = await this.getGroupsPermissions();\n return permissions.some(p => this.fullAccessPermissions.filter(Boolean).includes(p.name));\n }\n\n /\n Models-related methods below. 👇\n * - canAccessModel\n * - ensureCanAccessModel\n * - canAccessNonOwnedModels\n * - canAccessOnlyOwnedModels\n * - getModelsAccessControlList\n * - hasFullAccessToModels\n /\n\n async canAccessModel(params: CanAccessModelParams) {\n const acl = await this.getModelsAccessControlList(params);\n\n const canRead = acl.find(ace => ace.rwd.includes(\"r\"));\n if (!canRead) {\n return false;\n }\n\n const { rwd } = params;\n if (rwd) {\n const hasRwd = acl.find(ace => ace.rwd.includes(rwd));\n if (!hasRwd) {\n return false;\n }\n }\n\n return true;\n }\n\n private async ensureCanAccessModel(params: CanAccessModelParams = {}) {\n const canAccess = await this.canAccessModel(params);\n if (canAccess) {\n return;\n }\n\n if (\"model\" in params) {\n let modelName = \"(could not determine name)\";\n if (params.model?.name) {\n modelName = `\"${params.model.name}\"`;\n }\n\n throw new NotAuthorizedError(`Not allowed to access content model ${modelName}.`);\n }\n\n throw new NotAuthorizedError(`Not allowed to access content models.`);\n }\n\n private async canAccessNonOwnedModels(params: GetModelsAccessControlListParams) {\n const acl = await this.getModelsAccessControlList(params);\n return acl.some(ace => ace.canAccessNonOwned);\n }\n\n private async canAccessOnlyOwnedModels(params: GetModelsAccessControlListParams) {\n const canAccessNonOwned = await this.canAccessNonOwnedModels(params);\n return !canAccessNonOwned;\n }\n\n private async getModelsAccessControlList(\n params: GetModelsAccessControlListParams\n ): Promise<AccessControlList> {\n if (await this.hasFullAccessToModels(params)) {\n return [{ rwd: \"rwd\", canAccessNonOwned: true, canAccessOnlyOwned: false }];\n }\n\n const groupsPermissionsList = await this.getGroupsPermissions();\n const acl: AccessControlList = [];\n\n for (let i = 0; i < groupsPermissionsList.length; i++) {\n const groupsPermissions = groupsPermissionsList[i];\n\n const modelsPermissionsList = await this.getModelsPermissions();\n const relatedModelPermissions = modelsPermissionsList.find(\n permissions => permissions._src === groupsPermissions._src\n );\n\n if (!relatedModelPermissions) {\n continue;\n }\n\n if (groupsPermissions.own) {\n if (\"model\" in params) {\n const { model } = params;\n if (!model) {\n continue;\n }\n\n const group = await this.getGroup(model.group);\n if (!group) {\n continue;\n }\n\n const modelGroupCreatedBy = group.createdBy;\n if (!modelGroupCreatedBy) {\n continue;\n }\n\n const identity = await this.getIdentity();\n if (modelGroupCreatedBy.id !== identity.id) {\n continue;\n }\n }\n\n acl.push({\n rwd: \"rwd\",\n canAccessNonOwned: false,\n canAccessOnlyOwned: true\n });\n\n continue;\n }\n\n if (groupsPermissions.groups) {\n if (\"model\" in params) {\n const { model } = params;\n if (!model) {\n continue;\n }\n\n if (!Array.isArray(groupsPermissions.groups)) {\n continue;\n }\n\n if (!groupsPermissions.groups.includes(model.group)) {\n continue;\n }\n }\n }\n\n const fullAccess =\n !relatedModelPermissions.rwd &&\n !relatedModelPermissions.own &&\n !relatedModelPermissions.models;\n\n if (fullAccess) {\n acl.push({\n rwd: \"rwd\",\n canAccessNonOwned: true,\n canAccessOnlyOwned: false\n });\n\n continue;\n }\n\n if (relatedModelPermissions.own) {\n if (\"model\" in params) {\n if (!params.model) {\n continue;\n }\n\n const modelCreatedBy = params.model.createdBy;\n if (!modelCreatedBy) {\n continue;\n }\n\n const identity = await this.getIdentity();\n if (modelCreatedBy.id !== identity.id) {\n continue;\n }\n }\n\n acl.push({\n rwd: \"rwd\",\n canAccessNonOwned: false,\n canAccessOnlyOwned: true\n });\n\n continue;\n }\n\n if (relatedModelPermissions.models) {\n const { models } = relatedModelPermissions;\n if (\"model\" in params) {\n if (!params.model) {\n continue;\n }\n\n if (!Array.isArray(models)) {\n continue;\n }\n\n if (!models.includes(params.model.modelId)) {\n continue;\n }\n }\n }\n\n acl.push({\n rwd: relatedModelPermissions.rwd as string,\n canAccessNonOwned: true,\n canAccessOnlyOwned: false\n });\n }\n\n return acl;\n }\n\n private async hasFullAccessToModels(params: GetModelsAccessControlListParams) {\n const { model } = params;\n if (model) {\n if (this.modelAuthorizationDisabled({ model })) {\n return true;\n }\n }\n\n const permissions = await this.getModelsPermissions();\n return permissions.some(p => this.fullAccessPermissions.filter(Boolean).includes(p.name));\n }\n\n /\n Entries-related methods below. 👇\n * - canAccessEntry\n * - ensureCanAccessEntry\n * - canAccessNonOwnedEntries\n * - canAccessOnlyOwnedEntries\n * - getEntriesAccessControlList\n * - hasFullAccessToEntries\n */\n\n async canAccessEntry(params: CanAccessEntryParams) {\n const acl = await this.getEntriesAccessControlList(params);\n\n const canRead = acl.find(ace => ace.rwd.includes(\"r\"));\n if (!canRead) {\n return false;\n }\n\n const { rwd } = params;\n if (rwd) {\n const hasRwd = acl.find(ace => ace.rwd.includes(rwd));\n if (!hasRwd) {\n return false;\n }\n }\n\n const { pw } = params;\n if (pw) {\n const hasPw = acl.find(ace => ace.pw?.includes(pw));\n if (!hasPw) {\n return false;\n }\n }\n\n return true;\n }\n\n private async ensureCanAccessEntry(params: CanAccessEntryParams) {\n const canAccess = await this.canAccessEntry(params);\n if (!canAccess) {\n if (params.entry) {\n throw new NotAuthorizedError(\n `Not allowed to access entry \"${params.entry.entryId}\".`\n );\n }\n\n throw new NotAuthorizedError(\n `Not allowed to access \"${params.model.modelId}\" entries.`\n );\n }\n }\n\n private async canAccessNonOwnedEntries(params: GetEntriesAccessControlListParams) {\n const acl = await this.getEntriesAccessControlList(params);\n return acl.some(ace => ace.canAccessNonOwned);\n }\n\n async canAccessOnlyOwnedEntries(params: GetEntriesAccessControlListParams) {\n const canAccessNonOwned = await this.canAccessNonOwnedEntries(params);\n return !canAccessNonOwned;\n }\n\n private async getEntriesAccessControlList(\n params: GetEntriesAccessControlListParams\n ): Promise<EntriesAccessControlList> {\n if (await this.hasFullAccessToEntries(params)) {\n return [{ rwd: \"rwd\", pw: \"pu\", canAccessNonOwned: true, canAccessOnlyOwned: false }];\n }\n\n // We need a map of groups slugs to ids, to perform checks on models\n const { model } = params;\n const groupsPermissionsList = await this.getGroupsPermissions();\n const acl: EntriesAccessControlList = [];\n\n for (let i = 0; i < groupsPermissionsList.length; i++) {\n const groupPermissions = groupsPermissionsList[i];\n\n const modelsPermissionsList = await this.getModelsPermissions();\n const relatedModelsPermissions = modelsPermissionsList.find(\n permissions => permissions._src === groupPermissions._src\n );\n\n if (!relatedModelsPermissions) {\n continue;\n }\n\n const entriesPermissionsList = await this.getEntriesPermissions();\n const relatedEntriesPermissions = entriesPermissionsList.find(\n permissions => permissions._src === groupPermissions._src\n );\n\n if (!relatedEntriesPermissions) {\n continue;\n }\n\n if (groupPermissions.own) {\n const group = await this.getGroup(model.group);\n if (!group) {\n continue;\n }\n\n const groupCreatedBy = group.createdBy;\n if (!groupCreatedBy) {\n continue;\n }\n\n const identity = await this.getIdentity();\n if (groupCreatedBy.id !== identity.id) {\n continue;\n }\n\n acl.push({\n rwd: \"rwd\",\n canAccessNonOwned: false,\n canAccessOnlyOwned: true,\n pw: relatedEntriesPermissions.pw\n });\n\n continue;\n }\n\n if (groupPermissions.groups) {\n const { groups } = groupPermissions;\n\n if (!Array.isArray(groups)) {\n continue;\n }\n\n if (!groups.includes(model.group)) {\n continue;\n }\n }\n\n if (relatedModelsPermissions.own) {\n const modelCreatedBy = model.createdBy;\n if (!modelCreatedBy) {\n continue;\n }\n\n const identity = await this.getIdentity();\n if (modelCreatedBy.id !== identity.id) {\n continue;\n }\n\n acl.push({\n rwd: \"rwd\",\n canAccessNonOwned: false,\n canAccessOnlyOwned: true,\n pw: relatedEntriesPermissions.pw\n });\n }\n\n if (relatedModelsPermissions.models) {\n if (!Array.isArray(relatedModelsPermissions.models)) {\n continue;\n }\n\n if (!relatedModelsPermissions.models.includes(model.modelId)) {\n continue;\n }\n }\n\n const fullAccess =\n !relatedEntriesPermissions.rwd &&\n !relatedEntriesPermissions.own &&\n !relatedEntriesPermissions.models;\n\n if (fullAccess) {\n acl.push({\n rwd: \"rwd\",\n canAccessNonOwned: false,\n canAccessOnlyOwned: true,\n pw: \"pu\"\n });\n\n continue;\n }\n\n if (relatedEntriesPermissions.own) {\n if (\"entry\" in params) {\n const entryCreatedBy = params.entry?.createdBy;\n if (!entryCreatedBy) {\n continue;\n }\n\n const identity = await this.getIdentity();\n if (entryCreatedBy.id !== identity.id) {\n continue;\n }\n }\n\n acl.push({\n rwd: relatedEntriesPermissions.rwd,\n canAccessNonOwned: false,\n canAccessOnlyOwned: true,\n pw: relatedEntriesPermissions.pw\n });\n\n continue;\n }\n\n acl.push({\n rwd: relatedEntriesPermissions.rwd,\n canAccessNonOwned: true,\n canAccessOnlyOwned: false,\n pw: relatedEntriesPermissions.pw\n });\n }\n\n return acl;\n }\n\n private async hasFullAccessToEntries(params: GetEntriesAccessControlListParams) {\n if (this.modelAuthorizationDisabled(params)) {\n return true;\n }\n\n const permissions = await this.getEntriesPermissions();\n return permissions.some(p => this.fullAccessPermissions.filter(Boolean).includes(p.name));\n }\n\n private modelAuthorizationDisabled(params: IModelAuthorizationDisabledParams) {\n if (\"authorization\" in params.model) {\n const { authorization } = params.model;\n if (typeof authorization === \"boolean\") {\n return authorization === false;\n }\n\n return authorization?.permissions === false;\n }\n\n return false;\n }\n\n private async listAllGroups(): Promise<CmsGroup[]> {\n if (this.allGroups === null) {\n this.allGroups = this.listAllGroupsCallback();\n }\n\n return this.allGroups;\n }\n\n private async getGroup(slug: string): Promise<CmsGroup \| undefined> {\n const groups = await this.listAllGroups();\n return groups.find(group => group.slug === slug);\n }\n}\n"],"mappings":"AASA,SAASA,kBAAkB;AAsD3B,OAAO,MAAMC,aAAa,CAAC;EAUvBC,WAAWA,CAAC;IACRC,WAAW;IACXC,oBAAoB;IACpBC,oBAAoB;IACpBC,qBAAqB;IACrBC;EACiB,CAAC,EAAE;IACpB,IAAI,CAACJ,WAAW,GAAGA,WAAW;IAC9B,IAAI,CAACC,oBAAoB,GAAGA,oBAAoB;IAChD,IAAI,CAACC,oBAAoB,GAAGA,oBAAoB;IAChD,IAAI,CAACC,qBAAqB,GAAGA,qBAAqB;IAClD,IAAI,CAACE,qBAAqB,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC;IAC3C,IAAI,CAACC,qBAAqB,GAAGF,aAAa;IAC1C,IAAI,CAACG,SAAS,GAAG,IAAI;EACzB;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;EAEI,MAAMC,cAAcA,CAACC,MAA4B,GAAG,CAAC,CAAC,EAAE;IACpD,MAAMC,GAAG,GAAG,MAAM,IAAI,CAACC,0BAA0B,CAACF,MAAM,CAAC;IAEzD,MAAMG,OAAO,GAAGF,GAAG,CAACG,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACC,GAAG,EAAEC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,CAACJ,OAAO,EAAE;MACV,OAAO,KAAK;IAChB;IAEA,MAAM;MAAEG;IAAI,CAAC,GAAGN,MAAM;IACtB,IAAIM,GAAG,EAAE;MACL,MAAME,MAAM,GAAGP,GAAG,CAACG,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACC,GAAG,CAACC,QAAQ,CAACD,GAAG,CAAC,CAAC;MACrD,IAAI,CAACE,MAAM,EAAE;QACT,OAAO,KAAK;MAChB;IACJ;IAEA,OAAO,IAAI;EACf;EAEA,MAAcC,uBAAuBA,CAACT,MAAwC,EAAE;IAC5E,MAAMC,GAAG,GAAG,MAAM,IAAI,CAACC,0BAA0B,CAACF,MAAM,CAAC;IACzD,OAAOC,GAAG,CAACS,IAAI,CAACL,GAAG,IAAIA,GAAG,CAACM,iBAAiB,CAAC;EACjD;EAEA,MAAcC,wBAAwBA,CAACZ,MAAwC,EAAE;IAC7E,MAAMW,iBAAiB,GAAG,MAAM,IAAI,CAACF,uBAAuB,CAACT,MAAM,CAAC;IACpE,OAAO,CAACW,iBAAiB;EAC7B;EAEA,MAAcT,0BAA0BA,CACpCF,MAAwC,EACd;IAC1B,IAAI,MAAM,IAAI,CAACa,qBAAqB,CAAC,CAAC,EAAE;MACpC,OAAO,CAAC;QAAEP,GAAG,EAAE,KAAK;QAAEK,iBAAiB,EAAE,IAAI;QAAEG,kBAAkB,EAAE;MAAM,CAAC,CAAC;IAC/E;IAEA,MAAMC,qBAAqB,GAAG,MAAM,IAAI,CAACvB,oBAAoB,CAAC,CAAC;IAC/D,MAAMS,GAAsB,GAAG,EAAE;IAEjC,KAAK,MAAMe,iBAAiB,IAAID,qBAAqB,EAAE;MACnD,IAAIC,iBAAiB,CAACC,GAAG,EAAE;QACvB,IAAI,OAAO,IAAIjB,MAAM,EAAE;UACnB,MAAMkB,mBAAmB,GAAGlB,MAAM,CAACmB,KAAK,EAAEC,SAAS;UACnD,IAAI,CAACF,mBAAmB,EAAE;YACtB;UACJ;UAEA,MAAMG,QAAQ,GAAG,MAAM,IAAI,CAAC9B,WAAW,CAAC,CAAC;UAEzC,IAAI2B,mBAAmB,CAACI,EAAE,KAAKD,QAAQ,CAACC,EAAE,EAAE;YACxC;UACJ;QACJ;QAEArB,GAAG,CAACsB,IAAI,CAAC;UACLjB,GAAG,EAAE,KAAK;UACVK,iBAAiB,EAAE,KAAK;UACxBG,kBAAkB,EAAE;QACxB,CAAC,CAAC;MACN;MAEA,IAAIE,iBAAiB,CAACQ,MAAM,EAAE;QAC1B,IAAI,OAAO,IAAIxB,MAAM,EAAE;UACnB,MAAM;YAAEmB;UAAM,CAAC,GAAGnB,MAAM;UACxB,IAAI,CAACmB,KAAK,EAAE;YACR;UACJ;UAEA,MAAM;YAAEK;UAAO,CAAC,GAAGR,iBAAiB;UACpC,IAAI,CAACS,KAAK,CAACC,OAAO,CAACF,MAAM,CAAC,EAAE;YACxB;UACJ;UAEA,IAAI,CAACA,MAAM,CAACjB,QAAQ,CAACY,KAAK,CAACG,EAAE,CAAC,EAAE;YAC5B;UACJ;QACJ;MACJ;MAEArB,GAAG,CAACsB,IAAI,CAAC;QACLjB,GAAG,EAAEU,iBAAiB,CAACV,GAAa;QACpCK,iBAAiB,EAAE,IAAI;QACvBG,kBAAkB,EAAE;MACxB,CAAC,CAAC;IACN;IAEA,OAAOb,GAAG;EACd;EAEA,MAAcY,qBAAqBA,CAAA,EAAG;IAClC,MAAMc,WAAW,GAAG,MAAM,IAAI,CAACnC,oBAAoB,CAAC,CAAC;IACrD,OAAOmC,WAAW,CAACjB,IAAI,CAACkB,CAAC,IAAI,IAAI,CAAChC,qBAAqB,CAACiC,MAAM,CAACC,OAAO,CAAC,CAACvB,QAAQ,CAACqB,CAAC,CAACG,IAAI,CAAC,CAAC;EAC7F;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;EAEI,MAAMC,cAAcA,CAAChC,MAA4B,EAAE;IAC/C,MAAMC,GAAG,GAAG,MAAM,IAAI,CAACgC,0BAA0B,CAACjC,MAAM,CAAC;IAEzD,MAAMG,OAAO,GAAGF,GAAG,CAACG,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACC,GAAG,CAACC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,CAACJ,OAAO,EAAE;MACV,OAAO,KAAK;IAChB;IAEA,MAAM;MAAEG;IAAI,CAAC,GAAGN,MAAM;IACtB,IAAIM,GAAG,EAAE;MACL,MAAME,MAAM,GAAGP,GAAG,CAACG,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACC,GAAG,CAACC,QAAQ,CAACD,GAAG,CAAC,CAAC;MACrD,IAAI,CAACE,MAAM,EAAE;QACT,OAAO,KAAK;MAChB;IACJ;IAEA,OAAO,IAAI;EACf;EAEA,MAAc0B,oBAAoBA,CAAClC,MAA4B,GAAG,CAAC,CAAC,EAAE;IAClE,MAAMmC,SAAS,GAAG,MAAM,IAAI,CAACH,cAAc,CAAChC,MAAM,CAAC;IACnD,IAAImC,SAAS,EAAE;MACX;IACJ;IAEA,IAAI,OAAO,IAAInC,MAAM,EAAE;MACnB,IAAIoC,SAAS,GAAG,4BAA4B;MAC5C,IAAIpC,MAAM,CAACqC,KAAK,EAAEN,IAAI,EAAE;QACpBK,SAAS,GAAG,IAAIpC,MAAM,CAACqC,KAAK,CAACN,IAAI,GAAG;MACxC;MAEA,MAAM,IAAI3C,kBAAkB,CAAC,uCAAuCgD,SAAS,GAAG,CAAC;IACrF;IAEA,MAAM,IAAIhD,kBAAkB,CAAC,uCAAuC,CAAC;EACzE;EAEA,MAAckD,uBAAuBA,CAACtC,MAAwC,EAAE;IAC5E,MAAMC,GAAG,GAAG,MAAM,IAAI,CAACgC,0BAA0B,CAACjC,MAAM,CAAC;IACzD,OAAOC,GAAG,CAACS,IAAI,CAACL,GAAG,IAAIA,GAAG,CAACM,iBAAiB,CAAC;EACjD;EAEA,MAAc4B,wBAAwBA,CAACvC,MAAwC,EAAE;IAC7E,MAAMW,iBAAiB,GAAG,MAAM,IAAI,CAAC2B,uBAAuB,CAACtC,MAAM,CAAC;IACpE,OAAO,CAACW,iBAAiB;EAC7B;EAEA,MAAcsB,0BAA0BA,CACpCjC,MAAwC,EACd;IAC1B,IAAI,MAAM,IAAI,CAACwC,qBAAqB,CAACxC,MAAM,CAAC,EAAE;MAC1C,OAAO,CAAC;QAAEM,GAAG,EAAE,KAAK;QAAEK,iBAAiB,EAAE,IAAI;QAAEG,kBAAkB,EAAE;MAAM,CAAC,CAAC;IAC/E;IAEA,MAAMC,qBAAqB,GAAG,MAAM,IAAI,CAACvB,oBAAoB,CAAC,CAAC;IAC/D,MAAMS,GAAsB,GAAG,EAAE;IAEjC,KAAK,IAAIwC,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAG1B,qBAAqB,CAAC2B,MAAM,EAAED,CAAC,EAAE,EAAE;MACnD,MAAMzB,iBAAiB,GAAGD,qBAAqB,CAAC0B,CAAC,CAAC;MAElD,MAAME,qBAAqB,GAAG,MAAM,IAAI,CAAClD,oBAAoB,CAAC,CAAC;MAC/D,MAAMmD,uBAAuB,GAAGD,qBAAqB,CAACvC,IAAI,CACtDuB,WAAW,IAAIA,WAAW,CAACkB,IAAI,KAAK7B,iBAAiB,CAAC6B,IAC1D,CAAC;MAED,IAAI,CAACD,uBAAuB,EAAE;QAC1B;MACJ;MAEA,IAAI5B,iBAAiB,CAACC,GAAG,EAAE;QACvB,IAAI,OAAO,IAAIjB,MAAM,EAAE;UACnB,MAAM;YAAEqC;UAAM,CAAC,GAAGrC,MAAM;UACxB,IAAI,CAACqC,KAAK,EAAE;YACR;UACJ;UAEA,MAAMlB,KAAK,GAAG,MAAM,IAAI,CAAC2B,QAAQ,CAACT,KAAK,CAAClB,KAAK,CAAC;UAC9C,IAAI,CAACA,KAAK,EAAE;YACR;UACJ;UAEA,MAAMD,mBAAmB,GAAGC,KAAK,CAACC,SAAS;UAC3C,IAAI,CAACF,mBAAmB,EAAE;YACtB;UACJ;UAEA,MAAMG,QAAQ,GAAG,MAAM,IAAI,CAAC9B,WAAW,CAAC,CAAC;UACzC,IAAI2B,mBAAmB,CAACI,EAAE,KAAKD,QAAQ,CAACC,EAAE,EAAE;YACxC;UACJ;QACJ;QAEArB,GAAG,CAACsB,IAAI,CAAC;UACLjB,GAAG,EAAE,KAAK;UACVK,iBAAiB,EAAE,KAAK;UACxBG,kBAAkB,EAAE;QACxB,CAAC,CAAC;QAEF;MACJ;MAEA,IAAIE,iBAAiB,CAACQ,MAAM,EAAE;QAC1B,IAAI,OAAO,IAAIxB,MAAM,EAAE;UACnB,MAAM;YAAEqC;UAAM,CAAC,GAAGrC,MAAM;UACxB,IAAI,CAACqC,KAAK,EAAE;YACR;UACJ;UAEA,IAAI,CAACZ,KAAK,CAACC,OAAO,CAACV,iBAAiB,CAACQ,MAAM,CAAC,EAAE;YAC1C;UACJ;UAEA,IAAI,CAACR,iBAAiB,CAACQ,MAAM,CAACjB,QAAQ,CAAC8B,KAAK,CAAClB,KAAK,CAAC,EAAE;YACjD;UACJ;QACJ;MACJ;MAEA,MAAM4B,UAAU,GACZ,CAACH,uBAAuB,CAACtC,GAAG,IAC5B,CAACsC,uBAAuB,CAAC3B,GAAG,IAC5B,CAAC2B,uBAAuB,CAACI,MAAM;MAEnC,IAAID,UAAU,EAAE;QACZ9C,GAAG,CAACsB,IAAI,CAAC;UACLjB,GAAG,EAAE,KAAK;UACVK,iBAAiB,EAAE,IAAI;UACvBG,kBAAkB,EAAE;QACxB,CAAC,CAAC;QAEF;MACJ;MAEA,IAAI8B,uBAAuB,CAAC3B,GAAG,EAAE;QAC7B,IAAI,OAAO,IAAIjB,MAAM,EAAE;UACnB,IAAI,CAACA,MAAM,CAACqC,KAAK,EAAE;YACf;UACJ;UAEA,MAAMY,cAAc,GAAGjD,MAAM,CAACqC,KAAK,CAACjB,SAAS;UAC7C,IAAI,CAAC6B,cAAc,EAAE;YACjB;UACJ;UAEA,MAAM5B,QAAQ,GAAG,MAAM,IAAI,CAAC9B,WAAW,CAAC,CAAC;UACzC,IAAI0D,cAAc,CAAC3B,EAAE,KAAKD,QAAQ,CAACC,EAAE,EAAE;YACnC;UACJ;QACJ;QAEArB,GAAG,CAACsB,IAAI,CAAC;UACLjB,GAAG,EAAE,KAAK;UACVK,iBAAiB,EAAE,KAAK;UACxBG,kBAAkB,EAAE;QACxB,CAAC,CAAC;QAEF;MACJ;MAEA,IAAI8B,uBAAuB,CAACI,MAAM,EAAE;QAChC,MAAM;UAAEA;QAAO,CAAC,GAAGJ,uBAAuB;QAC1C,IAAI,OAAO,IAAI5C,MAAM,EAAE;UACnB,IAAI,CAACA,MAAM,CAACqC,KAAK,EAAE;YACf;UACJ;UAEA,IAAI,CAACZ,KAAK,CAACC,OAAO,CAACsB,MAAM,CAAC,EAAE;YACxB;UACJ;UAEA,IAAI,CAACA,MAAM,CAACzC,QAAQ,CAACP,MAAM,CAACqC,KAAK,CAACa,OAAO,CAAC,EAAE;YACxC;UACJ;QACJ;MACJ;MAEAjD,GAAG,CAACsB,IAAI,CAAC;QACLjB,GAAG,EAAEsC,uBAAuB,CAACtC,GAAa;QAC1CK,iBAAiB,EAAE,IAAI;QACvBG,kBAAkB,EAAE;MACxB,CAAC,CAAC;IACN;IAEA,OAAOb,GAAG;EACd;EAEA,MAAcuC,qBAAqBA,CAACxC,MAAwC,EAAE;IAC1E,MAAM;MAAEqC;IAAM,CAAC,GAAGrC,MAAM;IACxB,IAAIqC,KAAK,EAAE;MACP,IAAI,IAAI,CAACc,0BAA0B,CAAC;QAAEd;MAAM,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;IACJ;IAEA,MAAMV,WAAW,GAAG,MAAM,IAAI,CAAClC,oBAAoB,CAAC,CAAC;IACrD,OAAOkC,WAAW,CAACjB,IAAI,CAACkB,CAAC,IAAI,IAAI,CAAChC,qBAAqB,CAACiC,MAAM,CAACC,OAAO,CAAC,CAACvB,QAAQ,CAACqB,CAAC,CAACG,IAAI,CAAC,CAAC;EAC7F;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;EAEI,MAAMqB,cAAcA,CAACpD,MAA4B,EAAE;IAC/C,MAAMC,GAAG,GAAG,MAAM,IAAI,CAACoD,2BAA2B,CAACrD,MAAM,CAAC;IAE1D,MAAMG,OAAO,GAAGF,GAAG,CAACG,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACC,GAAG,CAACC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,CAACJ,OAAO,EAAE;MACV,OAAO,KAAK;IAChB;IAEA,MAAM;MAAEG;IAAI,CAAC,GAAGN,MAAM;IACtB,IAAIM,GAAG,EAAE;MACL,MAAME,MAAM,GAAGP,GAAG,CAACG,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACC,GAAG,CAACC,QAAQ,CAACD,GAAG,CAAC,CAAC;MACrD,IAAI,CAACE,MAAM,EAAE;QACT,OAAO,KAAK;MAChB;IACJ;IAEA,MAAM;MAAE8C;IAAG,CAAC,GAAGtD,MAAM;IACrB,IAAIsD,EAAE,EAAE;MACJ,MAAMC,KAAK,GAAGtD,GAAG,CAACG,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACiD,EAAE,EAAE/C,QAAQ,CAAC+C,EAAE,CAAC,CAAC;MACnD,IAAI,CAACC,KAAK,EAAE;QACR,OAAO,KAAK;MAChB;IACJ;IAEA,OAAO,IAAI;EACf;EAEA,MAAcC,oBAAoBA,CAACxD,MAA4B,EAAE;IAC7D,MAAMmC,SAAS,GAAG,MAAM,IAAI,CAACiB,cAAc,CAACpD,MAAM,CAAC;IACnD,IAAI,CAACmC,SAAS,EAAE;MACZ,IAAInC,MAAM,CAACyD,KAAK,EAAE;QACd,MAAM,IAAIrE,kBAAkB,CACxB,gCAAgCY,MAAM,CAACyD,KAAK,CAACC,OAAO,IACxD,CAAC;MACL;MAEA,MAAM,IAAItE,kBAAkB,CACxB,0BAA0BY,MAAM,CAACqC,KAAK,CAACa,OAAO,YAClD,CAAC;IACL;EACJ;EAEA,MAAcS,wBAAwBA,CAAC3D,MAAyC,EAAE;IAC9E,MAAMC,GAAG,GAAG,MAAM,IAAI,CAACoD,2BAA2B,CAACrD,MAAM,CAAC;IAC1D,OAAOC,GAAG,CAACS,IAAI,CAACL,GAAG,IAAIA,GAAG,CAACM,iBAAiB,CAAC;EACjD;EAEA,MAAMiD,yBAAyBA,CAAC5D,MAAyC,EAAE;IACvE,MAAMW,iBAAiB,GAAG,MAAM,IAAI,CAACgD,wBAAwB,CAAC3D,MAAM,CAAC;IACrE,OAAO,CAACW,iBAAiB;EAC7B;EAEA,MAAc0C,2BAA2BA,CACrCrD,MAAyC,EACR;IACjC,IAAI,MAAM,IAAI,CAAC6D,sBAAsB,CAAC7D,MAAM,CAAC,EAAE;MAC3C,OAAO,CAAC;QAAEM,GAAG,EAAE,KAAK;QAAEgD,EAAE,EAAE,IAAI;QAAE3C,iBAAiB,EAAE,IAAI;QAAEG,kBAAkB,EAAE;MAAM,CAAC,CAAC;IACzF;;IAEA;IACA,MAAM;MAAEuB;IAAM,CAAC,GAAGrC,MAAM;IACxB,MAAMe,qBAAqB,GAAG,MAAM,IAAI,CAACvB,oBAAoB,CAAC,CAAC;IAC/D,MAAMS,GAA6B,GAAG,EAAE;IAExC,KAAK,IAAIwC,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAG1B,qBAAqB,CAAC2B,MAAM,EAAED,CAAC,EAAE,EAAE;MACnD,MAAMqB,gBAAgB,GAAG/C,qBAAqB,CAAC0B,CAAC,CAAC;MAEjD,MAAME,qBAAqB,GAAG,MAAM,IAAI,CAAClD,oBAAoB,CAAC,CAAC;MAC/D,MAAMsE,wBAAwB,GAAGpB,qBAAqB,CAACvC,IAAI,CACvDuB,WAAW,IAAIA,WAAW,CAACkB,IAAI,KAAKiB,gBAAgB,CAACjB,IACzD,CAAC;MAED,IAAI,CAACkB,wBAAwB,EAAE;QAC3B;MACJ;MAEA,MAAMC,sBAAsB,GAAG,MAAM,IAAI,CAACtE,qBAAqB,CAAC,CAAC;MACjE,MAAMuE,yBAAyB,GAAGD,sBAAsB,CAAC5D,IAAI,CACzDuB,WAAW,IAAIA,WAAW,CAACkB,IAAI,KAAKiB,gBAAgB,CAACjB,IACzD,CAAC;MAED,IAAI,CAACoB,yBAAyB,EAAE;QAC5B;MACJ;MAEA,IAAIH,gBAAgB,CAAC7C,GAAG,EAAE;QACtB,MAAME,KAAK,GAAG,MAAM,IAAI,CAAC2B,QAAQ,CAACT,KAAK,CAAClB,KAAK,CAAC;QAC9C,IAAI,CAACA,KAAK,EAAE;UACR;QACJ;QAEA,MAAM+C,cAAc,GAAG/C,KAAK,CAACC,SAAS;QACtC,IAAI,CAAC8C,cAAc,EAAE;UACjB;QACJ;QAEA,MAAM7C,QAAQ,GAAG,MAAM,IAAI,CAAC9B,WAAW,CAAC,CAAC;QACzC,IAAI2E,cAAc,CAAC5C,EAAE,KAAKD,QAAQ,CAACC,EAAE,EAAE;UACnC;QACJ;QAEArB,GAAG,CAACsB,IAAI,CAAC;UACLjB,GAAG,EAAE,KAAK;UACVK,iBAAiB,EAAE,KAAK;UACxBG,kBAAkB,EAAE,IAAI;UACxBwC,EAAE,EAAEW,yBAAyB,CAACX;QAClC,CAAC,CAAC;QAEF;MACJ;MAEA,IAAIQ,gBAAgB,CAACtC,MAAM,EAAE;QACzB,MAAM;UAAEA;QAAO,CAAC,GAAGsC,gBAAgB;QAEnC,IAAI,CAACrC,KAAK,CAACC,OAAO,CAACF,MAAM,CAAC,EAAE;UACxB;QACJ;QAEA,IAAI,CAACA,MAAM,CAACjB,QAAQ,CAAC8B,KAAK,CAAClB,KAAK,CAAC,EAAE;UAC/B;QACJ;MACJ;MAEA,IAAI4C,wBAAwB,CAAC9C,GAAG,EAAE;QAC9B,MAAMgC,cAAc,GAAGZ,KAAK,CAACjB,SAAS;QACtC,IAAI,CAAC6B,cAAc,EAAE;UACjB;QACJ;QAEA,MAAM5B,QAAQ,GAAG,MAAM,IAAI,CAAC9B,WAAW,CAAC,CAAC;QACzC,IAAI0D,cAAc,CAAC3B,EAAE,KAAKD,QAAQ,CAACC,EAAE,EAAE;UACnC;QACJ;QAEArB,GAAG,CAACsB,IAAI,CAAC;UACLjB,GAAG,EAAE,KAAK;UACVK,iBAAiB,EAAE,KAAK;UACxBG,kBAAkB,EAAE,IAAI;UACxBwC,EAAE,EAAEW,yBAAyB,CAACX;QAClC,CAAC,CAAC;MACN;MAEA,IAAIS,wBAAwB,CAACf,MAAM,EAAE;QACjC,IAAI,CAACvB,KAAK,CAACC,OAAO,CAACqC,wBAAwB,CAACf,MAAM,CAAC,EAAE;UACjD;QACJ;QAEA,IAAI,CAACe,wBAAwB,CAACf,MAAM,CAACzC,QAAQ,CAAC8B,KAAK,CAACa,OAAO,CAAC,EAAE;UAC1D;QACJ;MACJ;MAEA,MAAMH,UAAU,GACZ,CAACkB,yBAAyB,CAAC3D,GAAG,IAC9B,CAAC2D,yBAAyB,CAAChD,GAAG,IAC9B,CAACgD,yBAAyB,CAACjB,MAAM;MAErC,IAAID,UAAU,EAAE;QACZ9C,GAAG,CAACsB,IAAI,CAAC;UACLjB,GAAG,EAAE,KAAK;UACVK,iBAAiB,EAAE,KAAK;UACxBG,kBAAkB,EAAE,IAAI;UACxBwC,EAAE,EAAE;QACR,CAAC,CAAC;QAEF;MACJ;MAEA,IAAIW,yBAAyB,CAAChD,GAAG,EAAE;QAC/B,IAAI,OAAO,IAAIjB,MAAM,EAAE;UACnB,MAAMmE,cAAc,GAAGnE,MAAM,CAACyD,KAAK,EAAErC,SAAS;UAC9C,IAAI,CAAC+C,cAAc,EAAE;YACjB;UACJ;UAEA,MAAM9C,QAAQ,GAAG,MAAM,IAAI,CAAC9B,WAAW,CAAC,CAAC;UACzC,IAAI4E,cAAc,CAAC7C,EAAE,KAAKD,QAAQ,CAACC,EAAE,EAAE;YACnC;UACJ;QACJ;QAEArB,GAAG,CAACsB,IAAI,CAAC;UACLjB,GAAG,EAAE2D,yBAAyB,CAAC3D,GAAG;UAClCK,iBAAiB,EAAE,KAAK;UACxBG,kBAAkB,EAAE,IAAI;UACxBwC,EAAE,EAAEW,yBAAyB,CAACX;QAClC,CAAC,CAAC;QAEF;MACJ;MAEArD,GAAG,CAACsB,IAAI,CAAC;QACLjB,GAAG,EAAE2D,yBAAyB,CAAC3D,GAAG;QAClCK,iBAAiB,EAAE,IAAI;QACvBG,kBAAkB,EAAE,KAAK;QACzBwC,EAAE,EAAEW,yBAAyB,CAACX;MAClC,CAAC,CAAC;IACN;IAEA,OAAOrD,GAAG;EACd;EAEA,MAAc4D,sBAAsBA,CAAC7D,MAAyC,EAAE;IAC5E,IAAI,IAAI,CAACmD,0BAA0B,CAACnD,MAAM,CAAC,EAAE;MACzC,OAAO,IAAI;IACf;IAEA,MAAM2B,WAAW,GAAG,MAAM,IAAI,CAACjC,qBAAqB,CAAC,CAAC;IACtD,OAAOiC,WAAW,CAACjB,IAAI,CAACkB,CAAC,IAAI,IAAI,CAAChC,qBAAqB,CAACiC,MAAM,CAACC,OAAO,CAAC,CAACvB,QAAQ,CAACqB,CAAC,CAACG,IAAI,CAAC,CAAC;EAC7F;EAEQoB,0BAA0BA,CAACnD,MAAyC,EAAE;IAC1E,IAAI,eAAe,IAAIA,MAAM,CAACqC,KAAK,EAAE;MACjC,MAAM;QAAE+B;MAAc,CAAC,GAAGpE,MAAM,CAACqC,KAAK;MACtC,IAAI,OAAO+B,aAAa,KAAK,SAAS,EAAE;QACpC,OAAOA,aAAa,KAAK,KAAK;MAClC;MAEA,OAAOA,aAAa,EAAEzC,WAAW,KAAK,KAAK;IAC/C;IAEA,OAAO,KAAK;EAChB;EAEA,MAAchC,aAAaA,CAAA,EAAwB;IAC/C,IAAI,IAAI,CAACG,SAAS,KAAK,IAAI,EAAE;MACzB,IAAI,CAACA,SAAS,GAAG,IAAI,CAACD,qBAAqB,CAAC,CAAC;IACjD;IAEA,OAAO,IAAI,CAACC,SAAS;EACzB;EAEA,MAAcgD,QAAQA,CAACuB,IAAY,EAAiC;IAChE,MAAM7C,MAAM,GAAG,MAAM,IAAI,CAAC7B,aAAa,CAAC,CAAC;IACzC,OAAO6B,MAAM,CAACpB,IAAI,CAACe,KAAK,IAAIA,KAAK,CAACkD,IAAI,KAAKA,IAAI,CAAC;EACpD;AACJ","ignoreList":[]}

package/crud/AccessControl/README.md CHANGED Viewed

@@ -14,15 +14,15 @@ All of the above is handled by the `AccessControl` class, which provides a set o
 2. `canAccessModel` (`ensureCanAccessModel`): checks if a user has the necessary permissions to access a content model (takes into consideration the content model group permissions).
 3. `canAccessEntry` (`ensureCanAccessEntry`): checks if a user has the necessary permissions to access a content entry (takes into consideration the content model and content model group permissions).
-Note that all of these methods can accept an exact entity instance if needed, but it's not required. Both has its own use cases.
+Note that all of these methods can accept an exact entity instance if needed, but it's not required. Both has its own use cases.
-For example, when checking if a user can access (read) a content entry, you can pass the entry instance to the `canAccessEntry` method, and it will check if the user has the necessary permissions to access that specific entry. On the other hand, if the entry instance was not passed, the method would check if the user has the necessary permissions to access (read) entries of the given content model.
+For example, when checking if a user can access (read) a content entry, you can pass the entry instance to the `canAccessEntry` method, and it will check if the user has the necessary permissions to access that specific entry. On the other hand, if the entry instance was not passed, the method would check if the user has the necessary permissions to access (read) entries of the given content model.
-Note that, whenever possible, the entry should be passed to the method, as it's more secure and provides more accurate results. For example, it is possible to receive a `true` response when checking if a user can access a specific content model, but still receive `false` when the model was not passed (when checking if user can access / read models in general).
+Note that, whenever possible, the entry should be passed to the method, as it's more secure and provides more accurate results. For example, it is possible to receive a `true` response when checking if a user can access a specific content model, but still receive `false` when the model was not passed (when checking if user can access / read models in general).
 ## Folder Level Permissions
-With Folder Level Permissions, a user can be part of a team, that may have multiple roles that provide different Headless CMS-related permissions (more information [here](https://www.webiny.com/docs/enterprise/aacl/teams#overview)).
+With Folder Level Permissions, a user can be part of a team, that may have multiple roles that provide different Headless CMS-related permissions (more information [here](https://www.webiny.com/docs/enterprise/aacl/teams#overview)).
 The Access Control class is aware of this and ensures that only permissions objects from a single role are taken into consideration when checking if a user has the necessary permissions to perform a specific action. If permission objects from a single role do not provide the necessary permissions, the next role is checked, and so on.
@@ -44,4 +44,4 @@ When choosing "Only models created by the user" access scope via the `cms.conten
 <img src="./models-own.png">
-Note that only the entry publishing actions-related permissions are not automatically set here. They need to be defined when defining the role explicitly.
+Note that only the entry publishing actions-related permissions are not automatically set here. They need to be defined when defining the role explicitly.

package/crud/contentEntry/entryDataFactories/createEntryData.d.ts CHANGED Viewed

@@ -1,20 +1,19 @@
-import type { CmsContext, CmsEntry, CmsModel, CreateCmsEntryInput, CreateCmsEntryOptionsInput } from "../../../types";
-import type { I18NLocale } from "@webiny/api-i18n/types";
-import type { SecurityIdentity } from "@webiny/api-security/types";
-import type { Tenant } from "@webiny/api-tenancy/types";
-import type { AccessControl } from "../../AccessControl/AccessControl";
-type CreateEntryDataParams = {
+import type { CmsContext, CmsEntry, CmsEntryValues, CmsModel, CreateCmsEntryInput, CreateCmsEntryOptionsInput } from "../../../types/index.js";
+import type { AccessControl } from "../../../crud/AccessControl/AccessControl.js";
+import type { SecurityIdentity } from "@webiny/api-core/types/security.js";
+import type { Tenant } from "@webiny/api-core/types/tenancy.js";
+interface CreateEntryDataParams<TValues extends CmsEntryValues = CmsEntryValues> {
     model: CmsModel;
-    rawInput: CreateCmsEntryInput;
+    rawInput: CreateCmsEntryInput<TValues>;
     options?: CreateCmsEntryOptionsInput;
     context: CmsContext;
     getIdentity: () => SecurityIdentity;
     getTenant: () => Tenant;
-    getLocale: () => I18NLocale;
     accessControl: AccessControl;
-};
-export declare const createEntryData: ({ model, rawInput, options, context, getIdentity: getSecurityIdentity, getLocale, getTenant, accessControl }: CreateEntryDataParams) => Promise<{
-    entry: CmsEntry;
-    input: Record<string, any>;
-}>;
+}
+interface ICreateEntryDataResponse<TValues extends CmsEntryValues = CmsEntryValues> {
+    entry: CmsEntry<TValues>;
+    input: CreateCmsEntryInput<TValues>;
+}
+export declare const createEntryData: <TValues extends CmsEntryValues = CmsEntryValues>({ model, rawInput, options, context, getIdentity: getSecurityIdentity, getTenant, accessControl }: CreateEntryDataParams<TValues>) => Promise<ICreateEntryDataResponse<TValues>>;
 export {};