@webiny/api-headless-cms 0.0.0-unstable.ecd8734205 → 0.0.0-unstable.f6dc066313

package/crud/AccessControl/AccessControl.js

@@ -0,0 +1,499 @@
+import { NotAuthorizedError } from "../../utils/errors.js";
+export class AccessControl {
+  constructor({
+    getIdentity,
+    getGroupsPermissions,
+    getModelsPermissions,
+    getEntriesPermissions,
+    listAllGroups
+  }) {
+    this.getIdentity = getIdentity;
+    this.getGroupsPermissions = getGroupsPermissions;
+    this.getModelsPermissions = getModelsPermissions;
+    this.getEntriesPermissions = getEntriesPermissions;
+    this.fullAccessPermissions = ["*", "cms.*"];
+    this.listAllGroupsCallback = listAllGroups;
+    this.allGroups = null;
+  }
+
+  /**
+   * Groups-related methods below. 👇
+   * - canAccessGroup
+   * - ensureCanAccessGroup
+   * - canAccessNonOwnedGroups
+   * - canAccessOnlyOwnedGroups
+   * - getGroupsAccessControlList
+   * - hasFullAccessToGroups
+   */
+
+  async canAccessGroup(params = {}) {
+    const acl = await this.getGroupsAccessControlList(params);
+    const canRead = acl.find(ace => ace.rwd?.includes("r"));
+    if (!canRead) {
+      return false;
+    }
+    const {
+      rwd
+    } = params;
+    if (rwd) {
+      const hasRwd = acl.find(ace => ace.rwd.includes(rwd));
+      if (!hasRwd) {
+        return false;
+      }
+    }
+    return true;
+  }
+  async canAccessNonOwnedGroups(params) {
+    const acl = await this.getGroupsAccessControlList(params);
+    return acl.some(ace => ace.canAccessNonOwned);
+  }
+  async canAccessOnlyOwnedGroups(params) {
+    const canAccessNonOwned = await this.canAccessNonOwnedGroups(params);
+    return !canAccessNonOwned;
+  }
+  async getGroupsAccessControlList(params) {
+    if (await this.hasFullAccessToGroups()) {
+      return [{
+        rwd: "rwd",
+        canAccessNonOwned: true,
+        canAccessOnlyOwned: false
+      }];
+    }
+    const groupsPermissionsList = await this.getGroupsPermissions();
+    const acl = [];
+    for (const groupsPermissions of groupsPermissionsList) {
+      if (groupsPermissions.own) {
+        if ("group" in params) {
+          const modelGroupCreatedBy = params.group?.createdBy;
+          if (!modelGroupCreatedBy) {
+            continue;
+          }
+          const identity = await this.getIdentity();
+          if (modelGroupCreatedBy.id !== identity.id) {
+            continue;
+          }
+        }
+        acl.push({
+          rwd: "rwd",
+          canAccessNonOwned: false,
+          canAccessOnlyOwned: true
+        });
+      }
+      if (groupsPermissions.groups) {
+        if ("group" in params) {
+          const {
+            group
+          } = params;
+          if (!group) {
+            continue;
+          }
+          const {
+            groups
+          } = groupsPermissions;
+          if (!Array.isArray(groups)) {
+            continue;
+          }
+          if (!groups.includes(group.id)) {
+            continue;
+          }
+        }
+      }
+      acl.push({
+        rwd: groupsPermissions.rwd,
+        canAccessNonOwned: true,
+        canAccessOnlyOwned: false
+      });
+    }
+    return acl;
+  }
+  async hasFullAccessToGroups() {
+    const permissions = await this.getGroupsPermissions();
+    return permissions.some(p => this.fullAccessPermissions.filter(Boolean).includes(p.name));
+  }
+
+  /**
+   * Models-related methods below. 👇
+   * - canAccessModel
+   * - ensureCanAccessModel
+   * - canAccessNonOwnedModels
+   * - canAccessOnlyOwnedModels
+   * - getModelsAccessControlList
+   * - hasFullAccessToModels
+   */
+
+  async canAccessModel(params) {
+    const acl = await this.getModelsAccessControlList(params);
+    const canRead = acl.find(ace => ace.rwd.includes("r"));
+    if (!canRead) {
+      return false;
+    }
+    const {
+      rwd
+    } = params;
+    if (rwd) {
+      const hasRwd = acl.find(ace => ace.rwd.includes(rwd));
+      if (!hasRwd) {
+        return false;
+      }
+    }
+    return true;
+  }
+  async ensureCanAccessModel(params = {}) {
+    const canAccess = await this.canAccessModel(params);
+    if (canAccess) {
+      return;
+    }
+    if ("model" in params) {
+      let modelName = "(could not determine name)";
+      if (params.model?.name) {
+        modelName = `"${params.model.name}"`;
+      }
+      throw new NotAuthorizedError(`Not allowed to access content model ${modelName}.`);
+    }
+    throw new NotAuthorizedError(`Not allowed to access content models.`);
+  }
+  async canAccessNonOwnedModels(params) {
+    const acl = await this.getModelsAccessControlList(params);
+    return acl.some(ace => ace.canAccessNonOwned);
+  }
+  async canAccessOnlyOwnedModels(params) {
+    const canAccessNonOwned = await this.canAccessNonOwnedModels(params);
+    return !canAccessNonOwned;
+  }
+  async getModelsAccessControlList(params) {
+    if (await this.hasFullAccessToModels(params)) {
+      return [{
+        rwd: "rwd",
+        canAccessNonOwned: true,
+        canAccessOnlyOwned: false
+      }];
+    }
+    const groupsPermissionsList = await this.getGroupsPermissions();
+    const acl = [];
+    for (let i = 0; i < groupsPermissionsList.length; i++) {
+      const groupsPermissions = groupsPermissionsList[i];
+      const modelsPermissionsList = await this.getModelsPermissions();
+      const relatedModelPermissions = modelsPermissionsList.find(permissions => permissions._src === groupsPermissions._src);
+      if (!relatedModelPermissions) {
+        continue;
+      }
+      if (groupsPermissions.own) {
+        if ("model" in params) {
+          const {
+            model
+          } = params;
+          if (!model) {
+            continue;
+          }
+          const group = await this.getGroup(model.group);
+          if (!group) {
+            continue;
+          }
+          const modelGroupCreatedBy = group.createdBy;
+          if (!modelGroupCreatedBy) {
+            continue;
+          }
+          const identity = await this.getIdentity();
+          if (modelGroupCreatedBy.id !== identity.id) {
+            continue;
+          }
+        }
+        acl.push({
+          rwd: "rwd",
+          canAccessNonOwned: false,
+          canAccessOnlyOwned: true
+        });
+        continue;
+      }
+      if (groupsPermissions.groups) {
+        if ("model" in params) {
+          const {
+            model
+          } = params;
+          if (!model) {
+            continue;
+          }
+          if (!Array.isArray(groupsPermissions.groups)) {
+            continue;
+          }
+          if (!groupsPermissions.groups.includes(model.group)) {
+            continue;
+          }
+        }
+      }
+      const fullAccess = !relatedModelPermissions.rwd && !relatedModelPermissions.own && !relatedModelPermissions.models;
+      if (fullAccess) {
+        acl.push({
+          rwd: "rwd",
+          canAccessNonOwned: true,
+          canAccessOnlyOwned: false
+        });
+        continue;
+      }
+      if (relatedModelPermissions.own) {
+        if ("model" in params) {
+          if (!params.model) {
+            continue;
+          }
+          const modelCreatedBy = params.model.createdBy;
+          if (!modelCreatedBy) {
+            continue;
+          }
+          const identity = await this.getIdentity();
+          if (modelCreatedBy.id !== identity.id) {
+            continue;
+          }
+        }
+        acl.push({
+          rwd: "rwd",
+          canAccessNonOwned: false,
+          canAccessOnlyOwned: true
+        });
+        continue;
+      }
+      if (relatedModelPermissions.models) {
+        const {
+          models
+        } = relatedModelPermissions;
+        if ("model" in params) {
+          if (!params.model) {
+            continue;
+          }
+          if (!Array.isArray(models)) {
+            continue;
+          }
+          if (!models.includes(params.model.modelId)) {
+            continue;
+          }
+        }
+      }
+      acl.push({
+        rwd: relatedModelPermissions.rwd,
+        canAccessNonOwned: true,
+        canAccessOnlyOwned: false
+      });
+    }
+    return acl;
+  }
+  async hasFullAccessToModels(params) {
+    const {
+      model
+    } = params;
+    if (model) {
+      if (this.modelAuthorizationDisabled({
+        model
+      })) {
+        return true;
+      }
+    }
+    const permissions = await this.getModelsPermissions();
+    return permissions.some(p => this.fullAccessPermissions.filter(Boolean).includes(p.name));
+  }
+
+  /**
+   * Entries-related methods below. 👇
+   * - canAccessEntry
+   * - ensureCanAccessEntry
+   * - canAccessNonOwnedEntries
+   * - canAccessOnlyOwnedEntries
+   * - getEntriesAccessControlList
+   * - hasFullAccessToEntries
+   */
+
+  async canAccessEntry(params) {
+    const acl = await this.getEntriesAccessControlList(params);
+    const canRead = acl.find(ace => ace.rwd.includes("r"));
+    if (!canRead) {
+      return false;
+    }
+    const {
+      rwd
+    } = params;
+    if (rwd) {
+      const hasRwd = acl.find(ace => ace.rwd.includes(rwd));
+      if (!hasRwd) {
+        return false;
+      }
+    }
+    const {
+      pw
+    } = params;
+    if (pw) {
+      const hasPw = acl.find(ace => ace.pw?.includes(pw));
+      if (!hasPw) {
+        return false;
+      }
+    }
+    return true;
+  }
+  async ensureCanAccessEntry(params) {
+    const canAccess = await this.canAccessEntry(params);
+    if (!canAccess) {
+      if (params.entry) {
+        throw new NotAuthorizedError(`Not allowed to access entry "${params.entry.entryId}".`);
+      }
+      throw new NotAuthorizedError(`Not allowed to access "${params.model.modelId}" entries.`);
+    }
+  }
+  async canAccessNonOwnedEntries(params) {
+    const acl = await this.getEntriesAccessControlList(params);
+    return acl.some(ace => ace.canAccessNonOwned);
+  }
+  async canAccessOnlyOwnedEntries(params) {
+    const canAccessNonOwned = await this.canAccessNonOwnedEntries(params);
+    return !canAccessNonOwned;
+  }
+  async getEntriesAccessControlList(params) {
+    if (await this.hasFullAccessToEntries(params)) {
+      return [{
+        rwd: "rwd",
+        pw: "pu",
+        canAccessNonOwned: true,
+        canAccessOnlyOwned: false
+      }];
+    }
+
+    // We need a map of groups slugs to ids, to perform checks on models
+    const {
+      model
+    } = params;
+    const groupsPermissionsList = await this.getGroupsPermissions();
+    const acl = [];
+    for (let i = 0; i < groupsPermissionsList.length; i++) {
+      const groupPermissions = groupsPermissionsList[i];
+      const modelsPermissionsList = await this.getModelsPermissions();
+      const relatedModelsPermissions = modelsPermissionsList.find(permissions => permissions._src === groupPermissions._src);
+      if (!relatedModelsPermissions) {
+        continue;
+      }
+      const entriesPermissionsList = await this.getEntriesPermissions();
+      const relatedEntriesPermissions = entriesPermissionsList.find(permissions => permissions._src === groupPermissions._src);
+      if (!relatedEntriesPermissions) {
+        continue;
+      }
+      if (groupPermissions.own) {
+        const group = await this.getGroup(model.group);
+        if (!group) {
+          continue;
+        }
+        const groupCreatedBy = group.createdBy;
+        if (!groupCreatedBy) {
+          continue;
+        }
+        const identity = await this.getIdentity();
+        if (groupCreatedBy.id !== identity.id) {
+          continue;
+        }
+        acl.push({
+          rwd: "rwd",
+          canAccessNonOwned: false,
+          canAccessOnlyOwned: true,
+          pw: relatedEntriesPermissions.pw
+        });
+        continue;
+      }
+      if (groupPermissions.groups) {
+        const {
+          groups
+        } = groupPermissions;
+        if (!Array.isArray(groups)) {
+          continue;
+        }
+        if (!groups.includes(model.group)) {
+          continue;
+        }
+      }
+      if (relatedModelsPermissions.own) {
+        const modelCreatedBy = model.createdBy;
+        if (!modelCreatedBy) {
+          continue;
+        }
+        const identity = await this.getIdentity();
+        if (modelCreatedBy.id !== identity.id) {
+          continue;
+        }
+        acl.push({
+          rwd: "rwd",
+          canAccessNonOwned: false,
+          canAccessOnlyOwned: true,
+          pw: relatedEntriesPermissions.pw
+        });
+      }
+      if (relatedModelsPermissions.models) {
+        if (!Array.isArray(relatedModelsPermissions.models)) {
+          continue;
+        }
+        if (!relatedModelsPermissions.models.includes(model.modelId)) {
+          continue;
+        }
+      }
+      const fullAccess = !relatedEntriesPermissions.rwd && !relatedEntriesPermissions.own && !relatedEntriesPermissions.models;
+      if (fullAccess) {
+        acl.push({
+          rwd: "rwd",
+          canAccessNonOwned: false,
+          canAccessOnlyOwned: true,
+          pw: "pu"
+        });
+        continue;
+      }
+      if (relatedEntriesPermissions.own) {
+        if ("entry" in params) {
+          const entryCreatedBy = params.entry?.createdBy;
+          if (!entryCreatedBy) {
+            continue;
+          }
+          const identity = await this.getIdentity();
+          if (entryCreatedBy.id !== identity.id) {
+            continue;
+          }
+        }
+        acl.push({
+          rwd: relatedEntriesPermissions.rwd,
+          canAccessNonOwned: false,
+          canAccessOnlyOwned: true,
+          pw: relatedEntriesPermissions.pw
+        });
+        continue;
+      }
+      acl.push({
+        rwd: relatedEntriesPermissions.rwd,
+        canAccessNonOwned: true,
+        canAccessOnlyOwned: false,
+        pw: relatedEntriesPermissions.pw
+      });
+    }
+    return acl;
+  }
+  async hasFullAccessToEntries(params) {
+    if (this.modelAuthorizationDisabled(params)) {
+      return true;
+    }
+    const permissions = await this.getEntriesPermissions();
+    return permissions.some(p => this.fullAccessPermissions.filter(Boolean).includes(p.name));
+  }
+  modelAuthorizationDisabled(params) {
+    if ("authorization" in params.model) {
+      const {
+        authorization
+      } = params.model;
+      if (typeof authorization === "boolean") {
+        return authorization === false;
+      }
+      return authorization?.permissions === false;
+    }
+    return false;
+  }
+  async listAllGroups() {
+    if (this.allGroups === null) {
+      this.allGroups = this.listAllGroupsCallback();
+    }
+    return this.allGroups;
+  }
+  async getGroup(slug) {
+    const groups = await this.listAllGroups();
+    return groups.find(group => group.slug === slug);
+  }
+}
+
+//# sourceMappingURL=AccessControl.js.map

package/crud/AccessControl/AccessControl.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["NotAuthorizedError","AccessControl","constructor","getIdentity","getGroupsPermissions","getModelsPermissions","getEntriesPermissions","listAllGroups","fullAccessPermissions","listAllGroupsCallback","allGroups","canAccessGroup","params","acl","getGroupsAccessControlList","canRead","find","ace","rwd","includes","hasRwd","canAccessNonOwnedGroups","some","canAccessNonOwned","canAccessOnlyOwnedGroups","hasFullAccessToGroups","canAccessOnlyOwned","groupsPermissionsList","groupsPermissions","own","modelGroupCreatedBy","group","createdBy","identity","id","push","groups","Array","isArray","permissions","p","filter","Boolean","name","canAccessModel","getModelsAccessControlList","ensureCanAccessModel","canAccess","modelName","model","canAccessNonOwnedModels","canAccessOnlyOwnedModels","hasFullAccessToModels","i","length","modelsPermissionsList","relatedModelPermissions","_src","getGroup","fullAccess","models","modelCreatedBy","modelId","modelAuthorizationDisabled","canAccessEntry","getEntriesAccessControlList","pw","hasPw","ensureCanAccessEntry","entry","entryId","canAccessNonOwnedEntries","canAccessOnlyOwnedEntries","hasFullAccessToEntries","groupPermissions","relatedModelsPermissions","entriesPermissionsList","relatedEntriesPermissions","groupCreatedBy","entryCreatedBy","authorization","slug"],"sources":["AccessControl.ts"],"sourcesContent":["import type {\n    CmsEntry,\n    CmsEntryPermission,\n    CmsGroup,\n    CmsGroupPermission,\n    CmsModel,\n    CmsModelPermission\n} from \"~/types/index.js\";\nimport type { SecurityIdentity } from \"@webiny/api-core/types/security.js\";\nimport { NotAuthorizedError } from \"~/utils/errors.js\";\n\nexport interface AccessControlParams {\n    getIdentity: () => Promise<SecurityIdentity>;\n    getGroupsPermissions: () => Promise<CmsGroupPermission[]>;\n    getModelsPermissions: () => Promise<CmsModelPermission[]>;\n    getEntriesPermissions: () => Promise<CmsEntryPermission[]>;\n    listAllGroups: () => Promise<CmsGroup[]>;\n}\n\ninterface GetGroupsAccessControlListParams {\n    group?: CmsGroup;\n}\n\ninterface CanAccessGroupParams extends GetGroupsAccessControlListParams {\n    rwd?: string;\n}\n\ninterface GetModelsAccessControlListParams {\n    model?: CmsModel;\n}\n\ninterface CanAccessModelParams extends GetModelsAccessControlListParams {\n    rwd?: string;\n}\n\ninterface GetEntriesAccessControlListParams {\n    model: Pick<CmsModel, \"modelId\" | \"createdBy\" | \"group\" | \"authorization\">;\n    entry?: Pick<CmsEntry, \"entryId\" | \"createdBy\">;\n}\n\nexport interface CanAccessEntryParams extends GetEntriesAccessControlListParams {\n    rwd?: string;\n    pw?: string;\n}\n\ninterface AccessControlEntry {\n    rwd: string;\n    canAccessNonOwned: boolean;\n    canAccessOnlyOwned: boolean;\n}\n\ntype AccessControlList = AccessControlEntry[];\n\ninterface EntriesAccessControlEntry extends AccessControlEntry {\n    pw?: string;\n}\n\ntype EntriesAccessControlList = EntriesAccessControlEntry[];\n\ninterface IModelAuthorizationDisabledParams {\n    model: Pick<CmsModel, \"authorization\">;\n}\n\nexport class AccessControl {\n    getIdentity: AccessControlParams[\"getIdentity\"];\n    getGroupsPermissions: AccessControlParams[\"getGroupsPermissions\"];\n    getModelsPermissions: AccessControlParams[\"getModelsPermissions\"];\n    getEntriesPermissions: AccessControlParams[\"getEntriesPermissions\"];\n    listAllGroupsCallback: AccessControlParams[\"listAllGroups\"];\n\n    private fullAccessPermissions: string[];\n    private allGroups: null | Promise<CmsGroup[]>;\n\n    constructor({\n        getIdentity,\n        getGroupsPermissions,\n        getModelsPermissions,\n        getEntriesPermissions,\n        listAllGroups\n    }: AccessControlParams) {\n        this.getIdentity = getIdentity;\n        this.getGroupsPermissions = getGroupsPermissions;\n        this.getModelsPermissions = getModelsPermissions;\n        this.getEntriesPermissions = getEntriesPermissions;\n        this.fullAccessPermissions = [\"*\", \"cms.*\"];\n        this.listAllGroupsCallback = listAllGroups;\n        this.allGroups = null;\n    }\n\n    /**\n     * Groups-related methods below. 👇\n     * - canAccessGroup\n     * - ensureCanAccessGroup\n     * - canAccessNonOwnedGroups\n     * - canAccessOnlyOwnedGroups\n     * - getGroupsAccessControlList\n     * - hasFullAccessToGroups\n     */\n\n    async canAccessGroup(params: CanAccessGroupParams = {}) {\n        const acl = await this.getGroupsAccessControlList(params);\n\n        const canRead = acl.find(ace => ace.rwd?.includes(\"r\"));\n        if (!canRead) {\n            return false;\n        }\n\n        const { rwd } = params;\n        if (rwd) {\n            const hasRwd = acl.find(ace => ace.rwd.includes(rwd));\n            if (!hasRwd) {\n                return false;\n            }\n        }\n\n        return true;\n    }\n\n    async canAccessNonOwnedGroups(params: GetGroupsAccessControlListParams) {\n        const acl = await this.getGroupsAccessControlList(params);\n        return acl.some(ace => ace.canAccessNonOwned);\n    }\n\n    async canAccessOnlyOwnedGroups(params: GetGroupsAccessControlListParams) {\n        const canAccessNonOwned = await this.canAccessNonOwnedGroups(params);\n        return !canAccessNonOwned;\n    }\n\n    async getGroupsAccessControlList(\n        params: GetGroupsAccessControlListParams\n    ): Promise<AccessControlList> {\n        if (await this.hasFullAccessToGroups()) {\n            return [{ rwd: \"rwd\", canAccessNonOwned: true, canAccessOnlyOwned: false }];\n        }\n\n        const groupsPermissionsList = await this.getGroupsPermissions();\n        const acl: AccessControlList = [];\n\n        for (const groupsPermissions of groupsPermissionsList) {\n            if (groupsPermissions.own) {\n                if (\"group\" in params) {\n                    const modelGroupCreatedBy = params.group?.createdBy;\n                    if (!modelGroupCreatedBy) {\n                        continue;\n                    }\n\n                    const identity = await this.getIdentity();\n\n                    if (modelGroupCreatedBy.id !== identity.id) {\n                        continue;\n                    }\n                }\n\n                acl.push({\n                    rwd: \"rwd\",\n                    canAccessNonOwned: false,\n                    canAccessOnlyOwned: true\n                });\n            }\n\n            if (groupsPermissions.groups) {\n                if (\"group\" in params) {\n                    const { group } = params;\n                    if (!group) {\n                        continue;\n                    }\n\n                    const { groups } = groupsPermissions;\n                    if (!Array.isArray(groups)) {\n                        continue;\n                    }\n\n                    if (!groups.includes(group.id)) {\n                        continue;\n                    }\n                }\n            }\n\n            acl.push({\n                rwd: groupsPermissions.rwd as string,\n                canAccessNonOwned: true,\n                canAccessOnlyOwned: false\n            });\n        }\n\n        return acl;\n    }\n\n    async hasFullAccessToGroups() {\n        const permissions = await this.getGroupsPermissions();\n        return permissions.some(p => this.fullAccessPermissions.filter(Boolean).includes(p.name));\n    }\n\n    /**\n     * Models-related methods below. 👇\n     * - canAccessModel\n     * - ensureCanAccessModel\n     * - canAccessNonOwnedModels\n     * - canAccessOnlyOwnedModels\n     * - getModelsAccessControlList\n     * - hasFullAccessToModels\n     */\n\n    async canAccessModel(params: CanAccessModelParams) {\n        const acl = await this.getModelsAccessControlList(params);\n\n        const canRead = acl.find(ace => ace.rwd.includes(\"r\"));\n        if (!canRead) {\n            return false;\n        }\n\n        const { rwd } = params;\n        if (rwd) {\n            const hasRwd = acl.find(ace => ace.rwd.includes(rwd));\n            if (!hasRwd) {\n                return false;\n            }\n        }\n\n        return true;\n    }\n\n    async ensureCanAccessModel(params: CanAccessModelParams = {}) {\n        const canAccess = await this.canAccessModel(params);\n        if (canAccess) {\n            return;\n        }\n\n        if (\"model\" in params) {\n            let modelName = \"(could not determine name)\";\n            if (params.model?.name) {\n                modelName = `\"${params.model.name}\"`;\n            }\n\n            throw new NotAuthorizedError(`Not allowed to access content model ${modelName}.`);\n        }\n\n        throw new NotAuthorizedError(`Not allowed to access content models.`);\n    }\n\n    async canAccessNonOwnedModels(params: GetModelsAccessControlListParams) {\n        const acl = await this.getModelsAccessControlList(params);\n        return acl.some(ace => ace.canAccessNonOwned);\n    }\n\n    async canAccessOnlyOwnedModels(params: GetModelsAccessControlListParams) {\n        const canAccessNonOwned = await this.canAccessNonOwnedModels(params);\n        return !canAccessNonOwned;\n    }\n\n    async getModelsAccessControlList(\n        params: GetModelsAccessControlListParams\n    ): Promise<AccessControlList> {\n        if (await this.hasFullAccessToModels(params)) {\n            return [{ rwd: \"rwd\", canAccessNonOwned: true, canAccessOnlyOwned: false }];\n        }\n\n        const groupsPermissionsList = await this.getGroupsPermissions();\n        const acl: AccessControlList = [];\n\n        for (let i = 0; i < groupsPermissionsList.length; i++) {\n            const groupsPermissions = groupsPermissionsList[i];\n\n            const modelsPermissionsList = await this.getModelsPermissions();\n            const relatedModelPermissions = modelsPermissionsList.find(\n                permissions => permissions._src === groupsPermissions._src\n            );\n\n            if (!relatedModelPermissions) {\n                continue;\n            }\n\n            if (groupsPermissions.own) {\n                if (\"model\" in params) {\n                    const { model } = params;\n                    if (!model) {\n                        continue;\n                    }\n\n                    const group = await this.getGroup(model.group);\n                    if (!group) {\n                        continue;\n                    }\n\n                    const modelGroupCreatedBy = group.createdBy;\n                    if (!modelGroupCreatedBy) {\n                        continue;\n                    }\n\n                    const identity = await this.getIdentity();\n                    if (modelGroupCreatedBy.id !== identity.id) {\n                        continue;\n                    }\n                }\n\n                acl.push({\n                    rwd: \"rwd\",\n                    canAccessNonOwned: false,\n                    canAccessOnlyOwned: true\n                });\n\n                continue;\n            }\n\n            if (groupsPermissions.groups) {\n                if (\"model\" in params) {\n                    const { model } = params;\n                    if (!model) {\n                        continue;\n                    }\n\n                    if (!Array.isArray(groupsPermissions.groups)) {\n                        continue;\n                    }\n\n                    if (!groupsPermissions.groups.includes(model.group)) {\n                        continue;\n                    }\n                }\n            }\n\n            const fullAccess =\n                !relatedModelPermissions.rwd &&\n                !relatedModelPermissions.own &&\n                !relatedModelPermissions.models;\n\n            if (fullAccess) {\n                acl.push({\n                    rwd: \"rwd\",\n                    canAccessNonOwned: true,\n                    canAccessOnlyOwned: false\n                });\n\n                continue;\n            }\n\n            if (relatedModelPermissions.own) {\n                if (\"model\" in params) {\n                    if (!params.model) {\n                        continue;\n                    }\n\n                    const modelCreatedBy = params.model.createdBy;\n                    if (!modelCreatedBy) {\n                        continue;\n                    }\n\n                    const identity = await this.getIdentity();\n                    if (modelCreatedBy.id !== identity.id) {\n                        continue;\n                    }\n                }\n\n                acl.push({\n                    rwd: \"rwd\",\n                    canAccessNonOwned: false,\n                    canAccessOnlyOwned: true\n                });\n\n                continue;\n            }\n\n            if (relatedModelPermissions.models) {\n                const { models } = relatedModelPermissions;\n                if (\"model\" in params) {\n                    if (!params.model) {\n                        continue;\n                    }\n\n                    if (!Array.isArray(models)) {\n                        continue;\n                    }\n\n                    if (!models.includes(params.model.modelId)) {\n                        continue;\n                    }\n                }\n            }\n\n            acl.push({\n                rwd: relatedModelPermissions.rwd as string,\n                canAccessNonOwned: true,\n                canAccessOnlyOwned: false\n            });\n        }\n\n        return acl;\n    }\n\n    async hasFullAccessToModels(params: GetModelsAccessControlListParams) {\n        const { model } = params;\n        if (model) {\n            if (this.modelAuthorizationDisabled({ model })) {\n                return true;\n            }\n        }\n\n        const permissions = await this.getModelsPermissions();\n        return permissions.some(p => this.fullAccessPermissions.filter(Boolean).includes(p.name));\n    }\n\n    /**\n     * Entries-related methods below. 👇\n     * - canAccessEntry\n     * - ensureCanAccessEntry\n     * - canAccessNonOwnedEntries\n     * - canAccessOnlyOwnedEntries\n     * - getEntriesAccessControlList\n     * - hasFullAccessToEntries\n     */\n\n    async canAccessEntry(params: CanAccessEntryParams) {\n        const acl = await this.getEntriesAccessControlList(params);\n\n        const canRead = acl.find(ace => ace.rwd.includes(\"r\"));\n        if (!canRead) {\n            return false;\n        }\n\n        const { rwd } = params;\n        if (rwd) {\n            const hasRwd = acl.find(ace => ace.rwd.includes(rwd));\n            if (!hasRwd) {\n                return false;\n            }\n        }\n\n        const { pw } = params;\n        if (pw) {\n            const hasPw = acl.find(ace => ace.pw?.includes(pw));\n            if (!hasPw) {\n                return false;\n            }\n        }\n\n        return true;\n    }\n\n    async ensureCanAccessEntry(params: CanAccessEntryParams) {\n        const canAccess = await this.canAccessEntry(params);\n        if (!canAccess) {\n            if (params.entry) {\n                throw new NotAuthorizedError(\n                    `Not allowed to access entry \"${params.entry.entryId}\".`\n                );\n            }\n\n            throw new NotAuthorizedError(\n                `Not allowed to access \"${params.model.modelId}\" entries.`\n            );\n        }\n    }\n\n    async canAccessNonOwnedEntries(params: GetEntriesAccessControlListParams) {\n        const acl = await this.getEntriesAccessControlList(params);\n        return acl.some(ace => ace.canAccessNonOwned);\n    }\n\n    async canAccessOnlyOwnedEntries(params: GetEntriesAccessControlListParams) {\n        const canAccessNonOwned = await this.canAccessNonOwnedEntries(params);\n        return !canAccessNonOwned;\n    }\n\n    async getEntriesAccessControlList(\n        params: GetEntriesAccessControlListParams\n    ): Promise<EntriesAccessControlList> {\n        if (await this.hasFullAccessToEntries(params)) {\n            return [{ rwd: \"rwd\", pw: \"pu\", canAccessNonOwned: true, canAccessOnlyOwned: false }];\n        }\n\n        // We need a map of groups slugs to ids, to perform checks on models\n        const { model } = params;\n        const groupsPermissionsList = await this.getGroupsPermissions();\n        const acl: EntriesAccessControlList = [];\n\n        for (let i = 0; i < groupsPermissionsList.length; i++) {\n            const groupPermissions = groupsPermissionsList[i];\n\n            const modelsPermissionsList = await this.getModelsPermissions();\n            const relatedModelsPermissions = modelsPermissionsList.find(\n                permissions => permissions._src === groupPermissions._src\n            );\n\n            if (!relatedModelsPermissions) {\n                continue;\n            }\n\n            const entriesPermissionsList = await this.getEntriesPermissions();\n            const relatedEntriesPermissions = entriesPermissionsList.find(\n                permissions => permissions._src === groupPermissions._src\n            );\n\n            if (!relatedEntriesPermissions) {\n                continue;\n            }\n\n            if (groupPermissions.own) {\n                const group = await this.getGroup(model.group);\n                if (!group) {\n                    continue;\n                }\n\n                const groupCreatedBy = group.createdBy;\n                if (!groupCreatedBy) {\n                    continue;\n                }\n\n                const identity = await this.getIdentity();\n                if (groupCreatedBy.id !== identity.id) {\n                    continue;\n                }\n\n                acl.push({\n                    rwd: \"rwd\",\n                    canAccessNonOwned: false,\n                    canAccessOnlyOwned: true,\n                    pw: relatedEntriesPermissions.pw\n                });\n\n                continue;\n            }\n\n            if (groupPermissions.groups) {\n                const { groups } = groupPermissions;\n\n                if (!Array.isArray(groups)) {\n                    continue;\n                }\n\n                if (!groups.includes(model.group)) {\n                    continue;\n                }\n            }\n\n            if (relatedModelsPermissions.own) {\n                const modelCreatedBy = model.createdBy;\n                if (!modelCreatedBy) {\n                    continue;\n                }\n\n                const identity = await this.getIdentity();\n                if (modelCreatedBy.id !== identity.id) {\n                    continue;\n                }\n\n                acl.push({\n                    rwd: \"rwd\",\n                    canAccessNonOwned: false,\n                    canAccessOnlyOwned: true,\n                    pw: relatedEntriesPermissions.pw\n                });\n            }\n\n            if (relatedModelsPermissions.models) {\n                if (!Array.isArray(relatedModelsPermissions.models)) {\n                    continue;\n                }\n\n                if (!relatedModelsPermissions.models.includes(model.modelId)) {\n                    continue;\n                }\n            }\n\n            const fullAccess =\n                !relatedEntriesPermissions.rwd &&\n                !relatedEntriesPermissions.own &&\n                !relatedEntriesPermissions.models;\n\n            if (fullAccess) {\n                acl.push({\n                    rwd: \"rwd\",\n                    canAccessNonOwned: false,\n                    canAccessOnlyOwned: true,\n                    pw: \"pu\"\n                });\n\n                continue;\n            }\n\n            if (relatedEntriesPermissions.own) {\n                if (\"entry\" in params) {\n                    const entryCreatedBy = params.entry?.createdBy;\n                    if (!entryCreatedBy) {\n                        continue;\n                    }\n\n                    const identity = await this.getIdentity();\n                    if (entryCreatedBy.id !== identity.id) {\n                        continue;\n                    }\n                }\n\n                acl.push({\n                    rwd: relatedEntriesPermissions.rwd,\n                    canAccessNonOwned: false,\n                    canAccessOnlyOwned: true,\n                    pw: relatedEntriesPermissions.pw\n                });\n\n                continue;\n            }\n\n            acl.push({\n                rwd: relatedEntriesPermissions.rwd,\n                canAccessNonOwned: true,\n                canAccessOnlyOwned: false,\n                pw: relatedEntriesPermissions.pw\n            });\n        }\n\n        return acl;\n    }\n\n    async hasFullAccessToEntries(params: GetEntriesAccessControlListParams) {\n        if (this.modelAuthorizationDisabled(params)) {\n            return true;\n        }\n\n        const permissions = await this.getEntriesPermissions();\n        return permissions.some(p => this.fullAccessPermissions.filter(Boolean).includes(p.name));\n    }\n\n    private modelAuthorizationDisabled(params: IModelAuthorizationDisabledParams) {\n        if (\"authorization\" in params.model) {\n            const { authorization } = params.model;\n            if (typeof authorization === \"boolean\") {\n                return authorization === false;\n            }\n\n            return authorization?.permissions === false;\n        }\n\n        return false;\n    }\n\n    private async listAllGroups(): Promise<CmsGroup[]> {\n        if (this.allGroups === null) {\n            this.allGroups = this.listAllGroupsCallback();\n        }\n\n        return this.allGroups;\n    }\n\n    private async getGroup(slug: string): Promise<CmsGroup | undefined> {\n        const groups = await this.listAllGroups();\n        return groups.find(group => group.slug === slug);\n    }\n}\n"],"mappings":"AASA,SAASA,kBAAkB;AAsD3B,OAAO,MAAMC,aAAa,CAAC;EAUvBC,WAAWA,CAAC;IACRC,WAAW;IACXC,oBAAoB;IACpBC,oBAAoB;IACpBC,qBAAqB;IACrBC;EACiB,CAAC,EAAE;IACpB,IAAI,CAACJ,WAAW,GAAGA,WAAW;IAC9B,IAAI,CAACC,oBAAoB,GAAGA,oBAAoB;IAChD,IAAI,CAACC,oBAAoB,GAAGA,oBAAoB;IAChD,IAAI,CAACC,qBAAqB,GAAGA,qBAAqB;IAClD,IAAI,CAACE,qBAAqB,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC;IAC3C,IAAI,CAACC,qBAAqB,GAAGF,aAAa;IAC1C,IAAI,CAACG,SAAS,GAAG,IAAI;EACzB;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;EAEI,MAAMC,cAAcA,CAACC,MAA4B,GAAG,CAAC,CAAC,EAAE;IACpD,MAAMC,GAAG,GAAG,MAAM,IAAI,CAACC,0BAA0B,CAACF,MAAM,CAAC;IAEzD,MAAMG,OAAO,GAAGF,GAAG,CAACG,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACC,GAAG,EAAEC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,CAACJ,OAAO,EAAE;MACV,OAAO,KAAK;IAChB;IAEA,MAAM;MAAEG;IAAI,CAAC,GAAGN,MAAM;IACtB,IAAIM,GAAG,EAAE;MACL,MAAME,MAAM,GAAGP,GAAG,CAACG,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACC,GAAG,CAACC,QAAQ,CAACD,GAAG,CAAC,CAAC;MACrD,IAAI,CAACE,MAAM,EAAE;QACT,OAAO,KAAK;MAChB;IACJ;IAEA,OAAO,IAAI;EACf;EAEA,MAAMC,uBAAuBA,CAACT,MAAwC,EAAE;IACpE,MAAMC,GAAG,GAAG,MAAM,IAAI,CAACC,0BAA0B,CAACF,MAAM,CAAC;IACzD,OAAOC,GAAG,CAACS,IAAI,CAACL,GAAG,IAAIA,GAAG,CAACM,iBAAiB,CAAC;EACjD;EAEA,MAAMC,wBAAwBA,CAACZ,MAAwC,EAAE;IACrE,MAAMW,iBAAiB,GAAG,MAAM,IAAI,CAACF,uBAAuB,CAACT,MAAM,CAAC;IACpE,OAAO,CAACW,iBAAiB;EAC7B;EAEA,MAAMT,0BAA0BA,CAC5BF,MAAwC,EACd;IAC1B,IAAI,MAAM,IAAI,CAACa,qBAAqB,CAAC,CAAC,EAAE;MACpC,OAAO,CAAC;QAAEP,GAAG,EAAE,KAAK;QAAEK,iBAAiB,EAAE,IAAI;QAAEG,kBAAkB,EAAE;MAAM,CAAC,CAAC;IAC/E;IAEA,MAAMC,qBAAqB,GAAG,MAAM,IAAI,CAACvB,oBAAoB,CAAC,CAAC;IAC/D,MAAMS,GAAsB,GAAG,EAAE;IAEjC,KAAK,MAAMe,iBAAiB,IAAID,qBAAqB,EAAE;MACnD,IAAIC,iBAAiB,CAACC,GAAG,EAAE;QACvB,IAAI,OAAO,IAAIjB,MAAM,EAAE;UACnB,MAAMkB,mBAAmB,GAAGlB,MAAM,CAACmB,KAAK,EAAEC,SAAS;UACnD,IAAI,CAACF,mBAAmB,EAAE;YACtB;UACJ;UAEA,MAAMG,QAAQ,GAAG,MAAM,IAAI,CAAC9B,WAAW,CAAC,CAAC;UAEzC,IAAI2B,mBAAmB,CAACI,EAAE,KAAKD,QAAQ,CAACC,EAAE,EAAE;YACxC;UACJ;QACJ;QAEArB,GAAG,CAACsB,IAAI,CAAC;UACLjB,GAAG,EAAE,KAAK;UACVK,iBAAiB,EAAE,KAAK;UACxBG,kBAAkB,EAAE;QACxB,CAAC,CAAC;MACN;MAEA,IAAIE,iBAAiB,CAACQ,MAAM,EAAE;QAC1B,IAAI,OAAO,IAAIxB,MAAM,EAAE;UACnB,MAAM;YAAEmB;UAAM,CAAC,GAAGnB,MAAM;UACxB,IAAI,CAACmB,KAAK,EAAE;YACR;UACJ;UAEA,MAAM;YAAEK;UAAO,CAAC,GAAGR,iBAAiB;UACpC,IAAI,CAACS,KAAK,CAACC,OAAO,CAACF,MAAM,CAAC,EAAE;YACxB;UACJ;UAEA,IAAI,CAACA,MAAM,CAACjB,QAAQ,CAACY,KAAK,CAACG,EAAE,CAAC,EAAE;YAC5B;UACJ;QACJ;MACJ;MAEArB,GAAG,CAACsB,IAAI,CAAC;QACLjB,GAAG,EAAEU,iBAAiB,CAACV,GAAa;QACpCK,iBAAiB,EAAE,IAAI;QACvBG,kBAAkB,EAAE;MACxB,CAAC,CAAC;IACN;IAEA,OAAOb,GAAG;EACd;EAEA,MAAMY,qBAAqBA,CAAA,EAAG;IAC1B,MAAMc,WAAW,GAAG,MAAM,IAAI,CAACnC,oBAAoB,CAAC,CAAC;IACrD,OAAOmC,WAAW,CAACjB,IAAI,CAACkB,CAAC,IAAI,IAAI,CAAChC,qBAAqB,CAACiC,MAAM,CAACC,OAAO,CAAC,CAACvB,QAAQ,CAACqB,CAAC,CAACG,IAAI,CAAC,CAAC;EAC7F;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;EAEI,MAAMC,cAAcA,CAAChC,MAA4B,EAAE;IAC/C,MAAMC,GAAG,GAAG,MAAM,IAAI,CAACgC,0BAA0B,CAACjC,MAAM,CAAC;IAEzD,MAAMG,OAAO,GAAGF,GAAG,CAACG,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACC,GAAG,CAACC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,CAACJ,OAAO,EAAE;MACV,OAAO,KAAK;IAChB;IAEA,MAAM;MAAEG;IAAI,CAAC,GAAGN,MAAM;IACtB,IAAIM,GAAG,EAAE;MACL,MAAME,MAAM,GAAGP,GAAG,CAACG,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACC,GAAG,CAACC,QAAQ,CAACD,GAAG,CAAC,CAAC;MACrD,IAAI,CAACE,MAAM,EAAE;QACT,OAAO,KAAK;MAChB;IACJ;IAEA,OAAO,IAAI;EACf;EAEA,MAAM0B,oBAAoBA,CAAClC,MAA4B,GAAG,CAAC,CAAC,EAAE;IAC1D,MAAMmC,SAAS,GAAG,MAAM,IAAI,CAACH,cAAc,CAAChC,MAAM,CAAC;IACnD,IAAImC,SAAS,EAAE;MACX;IACJ;IAEA,IAAI,OAAO,IAAInC,MAAM,EAAE;MACnB,IAAIoC,SAAS,GAAG,4BAA4B;MAC5C,IAAIpC,MAAM,CAACqC,KAAK,EAAEN,IAAI,EAAE;QACpBK,SAAS,GAAG,IAAIpC,MAAM,CAACqC,KAAK,CAACN,IAAI,GAAG;MACxC;MAEA,MAAM,IAAI3C,kBAAkB,CAAC,uCAAuCgD,SAAS,GAAG,CAAC;IACrF;IAEA,MAAM,IAAIhD,kBAAkB,CAAC,uCAAuC,CAAC;EACzE;EAEA,MAAMkD,uBAAuBA,CAACtC,MAAwC,EAAE;IACpE,MAAMC,GAAG,GAAG,MAAM,IAAI,CAACgC,0BAA0B,CAACjC,MAAM,CAAC;IACzD,OAAOC,GAAG,CAACS,IAAI,CAACL,GAAG,IAAIA,GAAG,CAACM,iBAAiB,CAAC;EACjD;EAEA,MAAM4B,wBAAwBA,CAACvC,MAAwC,EAAE;IACrE,MAAMW,iBAAiB,GAAG,MAAM,IAAI,CAAC2B,uBAAuB,CAACtC,MAAM,CAAC;IACpE,OAAO,CAACW,iBAAiB;EAC7B;EAEA,MAAMsB,0BAA0BA,CAC5BjC,MAAwC,EACd;IAC1B,IAAI,MAAM,IAAI,CAACwC,qBAAqB,CAACxC,MAAM,CAAC,EAAE;MAC1C,OAAO,CAAC;QAAEM,GAAG,EAAE,KAAK;QAAEK,iBAAiB,EAAE,IAAI;QAAEG,kBAAkB,EAAE;MAAM,CAAC,CAAC;IAC/E;IAEA,MAAMC,qBAAqB,GAAG,MAAM,IAAI,CAACvB,oBAAoB,CAAC,CAAC;IAC/D,MAAMS,GAAsB,GAAG,EAAE;IAEjC,KAAK,IAAIwC,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAG1B,qBAAqB,CAAC2B,MAAM,EAAED,CAAC,EAAE,EAAE;MACnD,MAAMzB,iBAAiB,GAAGD,qBAAqB,CAAC0B,CAAC,CAAC;MAElD,MAAME,qBAAqB,GAAG,MAAM,IAAI,CAAClD,oBAAoB,CAAC,CAAC;MAC/D,MAAMmD,uBAAuB,GAAGD,qBAAqB,CAACvC,IAAI,CACtDuB,WAAW,IAAIA,WAAW,CAACkB,IAAI,KAAK7B,iBAAiB,CAAC6B,IAC1D,CAAC;MAED,IAAI,CAACD,uBAAuB,EAAE;QAC1B;MACJ;MAEA,IAAI5B,iBAAiB,CAACC,GAAG,EAAE;QACvB,IAAI,OAAO,IAAIjB,MAAM,EAAE;UACnB,MAAM;YAAEqC;UAAM,CAAC,GAAGrC,MAAM;UACxB,IAAI,CAACqC,KAAK,EAAE;YACR;UACJ;UAEA,MAAMlB,KAAK,GAAG,MAAM,IAAI,CAAC2B,QAAQ,CAACT,KAAK,CAAClB,KAAK,CAAC;UAC9C,IAAI,CAACA,KAAK,EAAE;YACR;UACJ;UAEA,MAAMD,mBAAmB,GAAGC,KAAK,CAACC,SAAS;UAC3C,IAAI,CAACF,mBAAmB,EAAE;YACtB;UACJ;UAEA,MAAMG,QAAQ,GAAG,MAAM,IAAI,CAAC9B,WAAW,CAAC,CAAC;UACzC,IAAI2B,mBAAmB,CAACI,EAAE,KAAKD,QAAQ,CAACC,EAAE,EAAE;YACxC;UACJ;QACJ;QAEArB,GAAG,CAACsB,IAAI,CAAC;UACLjB,GAAG,EAAE,KAAK;UACVK,iBAAiB,EAAE,KAAK;UACxBG,kBAAkB,EAAE;QACxB,CAAC,CAAC;QAEF;MACJ;MAEA,IAAIE,iBAAiB,CAACQ,MAAM,EAAE;QAC1B,IAAI,OAAO,IAAIxB,MAAM,EAAE;UACnB,MAAM;YAAEqC;UAAM,CAAC,GAAGrC,MAAM;UACxB,IAAI,CAACqC,KAAK,EAAE;YACR;UACJ;UAEA,IAAI,CAACZ,KAAK,CAACC,OAAO,CAACV,iBAAiB,CAACQ,MAAM,CAAC,EAAE;YAC1C;UACJ;UAEA,IAAI,CAACR,iBAAiB,CAACQ,MAAM,CAACjB,QAAQ,CAAC8B,KAAK,CAAClB,KAAK,CAAC,EAAE;YACjD;UACJ;QACJ;MACJ;MAEA,MAAM4B,UAAU,GACZ,CAACH,uBAAuB,CAACtC,GAAG,IAC5B,CAACsC,uBAAuB,CAAC3B,GAAG,IAC5B,CAAC2B,uBAAuB,CAACI,MAAM;MAEnC,IAAID,UAAU,EAAE;QACZ9C,GAAG,CAACsB,IAAI,CAAC;UACLjB,GAAG,EAAE,KAAK;UACVK,iBAAiB,EAAE,IAAI;UACvBG,kBAAkB,EAAE;QACxB,CAAC,CAAC;QAEF;MACJ;MAEA,IAAI8B,uBAAuB,CAAC3B,GAAG,EAAE;QAC7B,IAAI,OAAO,IAAIjB,MAAM,EAAE;UACnB,IAAI,CAACA,MAAM,CAACqC,KAAK,EAAE;YACf;UACJ;UAEA,MAAMY,cAAc,GAAGjD,MAAM,CAACqC,KAAK,CAACjB,SAAS;UAC7C,IAAI,CAAC6B,cAAc,EAAE;YACjB;UACJ;UAEA,MAAM5B,QAAQ,GAAG,MAAM,IAAI,CAAC9B,WAAW,CAAC,CAAC;UACzC,IAAI0D,cAAc,CAAC3B,EAAE,KAAKD,QAAQ,CAACC,EAAE,EAAE;YACnC;UACJ;QACJ;QAEArB,GAAG,CAACsB,IAAI,CAAC;UACLjB,GAAG,EAAE,KAAK;UACVK,iBAAiB,EAAE,KAAK;UACxBG,kBAAkB,EAAE;QACxB,CAAC,CAAC;QAEF;MACJ;MAEA,IAAI8B,uBAAuB,CAACI,MAAM,EAAE;QAChC,MAAM;UAAEA;QAAO,CAAC,GAAGJ,uBAAuB;QAC1C,IAAI,OAAO,IAAI5C,MAAM,EAAE;UACnB,IAAI,CAACA,MAAM,CAACqC,KAAK,EAAE;YACf;UACJ;UAEA,IAAI,CAACZ,KAAK,CAACC,OAAO,CAACsB,MAAM,CAAC,EAAE;YACxB;UACJ;UAEA,IAAI,CAACA,MAAM,CAACzC,QAAQ,CAACP,MAAM,CAACqC,KAAK,CAACa,OAAO,CAAC,EAAE;YACxC;UACJ;QACJ;MACJ;MAEAjD,GAAG,CAACsB,IAAI,CAAC;QACLjB,GAAG,EAAEsC,uBAAuB,CAACtC,GAAa;QAC1CK,iBAAiB,EAAE,IAAI;QACvBG,kBAAkB,EAAE;MACxB,CAAC,CAAC;IACN;IAEA,OAAOb,GAAG;EACd;EAEA,MAAMuC,qBAAqBA,CAACxC,MAAwC,EAAE;IAClE,MAAM;MAAEqC;IAAM,CAAC,GAAGrC,MAAM;IACxB,IAAIqC,KAAK,EAAE;MACP,IAAI,IAAI,CAACc,0BAA0B,CAAC;QAAEd;MAAM,CAAC,CAAC,EAAE;QAC5C,OAAO,IAAI;MACf;IACJ;IAEA,MAAMV,WAAW,GAAG,MAAM,IAAI,CAAClC,oBAAoB,CAAC,CAAC;IACrD,OAAOkC,WAAW,CAACjB,IAAI,CAACkB,CAAC,IAAI,IAAI,CAAChC,qBAAqB,CAACiC,MAAM,CAACC,OAAO,CAAC,CAACvB,QAAQ,CAACqB,CAAC,CAACG,IAAI,CAAC,CAAC;EAC7F;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;EAEI,MAAMqB,cAAcA,CAACpD,MAA4B,EAAE;IAC/C,MAAMC,GAAG,GAAG,MAAM,IAAI,CAACoD,2BAA2B,CAACrD,MAAM,CAAC;IAE1D,MAAMG,OAAO,GAAGF,GAAG,CAACG,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACC,GAAG,CAACC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,CAACJ,OAAO,EAAE;MACV,OAAO,KAAK;IAChB;IAEA,MAAM;MAAEG;IAAI,CAAC,GAAGN,MAAM;IACtB,IAAIM,GAAG,EAAE;MACL,MAAME,MAAM,GAAGP,GAAG,CAACG,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACC,GAAG,CAACC,QAAQ,CAACD,GAAG,CAAC,CAAC;MACrD,IAAI,CAACE,MAAM,EAAE;QACT,OAAO,KAAK;MAChB;IACJ;IAEA,MAAM;MAAE8C;IAAG,CAAC,GAAGtD,MAAM;IACrB,IAAIsD,EAAE,EAAE;MACJ,MAAMC,KAAK,GAAGtD,GAAG,CAACG,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACiD,EAAE,EAAE/C,QAAQ,CAAC+C,EAAE,CAAC,CAAC;MACnD,IAAI,CAACC,KAAK,EAAE;QACR,OAAO,KAAK;MAChB;IACJ;IAEA,OAAO,IAAI;EACf;EAEA,MAAMC,oBAAoBA,CAACxD,MAA4B,EAAE;IACrD,MAAMmC,SAAS,GAAG,MAAM,IAAI,CAACiB,cAAc,CAACpD,MAAM,CAAC;IACnD,IAAI,CAACmC,SAAS,EAAE;MACZ,IAAInC,MAAM,CAACyD,KAAK,EAAE;QACd,MAAM,IAAIrE,kBAAkB,CACxB,gCAAgCY,MAAM,CAACyD,KAAK,CAACC,OAAO,IACxD,CAAC;MACL;MAEA,MAAM,IAAItE,kBAAkB,CACxB,0BAA0BY,MAAM,CAACqC,KAAK,CAACa,OAAO,YAClD,CAAC;IACL;EACJ;EAEA,MAAMS,wBAAwBA,CAAC3D,MAAyC,EAAE;IACtE,MAAMC,GAAG,GAAG,MAAM,IAAI,CAACoD,2BAA2B,CAACrD,MAAM,CAAC;IAC1D,OAAOC,GAAG,CAACS,IAAI,CAACL,GAAG,IAAIA,GAAG,CAACM,iBAAiB,CAAC;EACjD;EAEA,MAAMiD,yBAAyBA,CAAC5D,MAAyC,EAAE;IACvE,MAAMW,iBAAiB,GAAG,MAAM,IAAI,CAACgD,wBAAwB,CAAC3D,MAAM,CAAC;IACrE,OAAO,CAACW,iBAAiB;EAC7B;EAEA,MAAM0C,2BAA2BA,CAC7BrD,MAAyC,EACR;IACjC,IAAI,MAAM,IAAI,CAAC6D,sBAAsB,CAAC7D,MAAM,CAAC,EAAE;MAC3C,OAAO,CAAC;QAAEM,GAAG,EAAE,KAAK;QAAEgD,EAAE,EAAE,IAAI;QAAE3C,iBAAiB,EAAE,IAAI;QAAEG,kBAAkB,EAAE;MAAM,CAAC,CAAC;IACzF;;IAEA;IACA,MAAM;MAAEuB;IAAM,CAAC,GAAGrC,MAAM;IACxB,MAAMe,qBAAqB,GAAG,MAAM,IAAI,CAACvB,oBAAoB,CAAC,CAAC;IAC/D,MAAMS,GAA6B,GAAG,EAAE;IAExC,KAAK,IAAIwC,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAG1B,qBAAqB,CAAC2B,MAAM,EAAED,CAAC,EAAE,EAAE;MACnD,MAAMqB,gBAAgB,GAAG/C,qBAAqB,CAAC0B,CAAC,CAAC;MAEjD,MAAME,qBAAqB,GAAG,MAAM,IAAI,CAAClD,oBAAoB,CAAC,CAAC;MAC/D,MAAMsE,wBAAwB,GAAGpB,qBAAqB,CAACvC,IAAI,CACvDuB,WAAW,IAAIA,WAAW,CAACkB,IAAI,KAAKiB,gBAAgB,CAACjB,IACzD,CAAC;MAED,IAAI,CAACkB,wBAAwB,EAAE;QAC3B;MACJ;MAEA,MAAMC,sBAAsB,GAAG,MAAM,IAAI,CAACtE,qBAAqB,CAAC,CAAC;MACjE,MAAMuE,yBAAyB,GAAGD,sBAAsB,CAAC5D,IAAI,CACzDuB,WAAW,IAAIA,WAAW,CAACkB,IAAI,KAAKiB,gBAAgB,CAACjB,IACzD,CAAC;MAED,IAAI,CAACoB,yBAAyB,EAAE;QAC5B;MACJ;MAEA,IAAIH,gBAAgB,CAAC7C,GAAG,EAAE;QACtB,MAAME,KAAK,GAAG,MAAM,IAAI,CAAC2B,QAAQ,CAACT,KAAK,CAAClB,KAAK,CAAC;QAC9C,IAAI,CAACA,KAAK,EAAE;UACR;QACJ;QAEA,MAAM+C,cAAc,GAAG/C,KAAK,CAACC,SAAS;QACtC,IAAI,CAAC8C,cAAc,EAAE;UACjB;QACJ;QAEA,MAAM7C,QAAQ,GAAG,MAAM,IAAI,CAAC9B,WAAW,CAAC,CAAC;QACzC,IAAI2E,cAAc,CAAC5C,EAAE,KAAKD,QAAQ,CAACC,EAAE,EAAE;UACnC;QACJ;QAEArB,GAAG,CAACsB,IAAI,CAAC;UACLjB,GAAG,EAAE,KAAK;UACVK,iBAAiB,EAAE,KAAK;UACxBG,kBAAkB,EAAE,IAAI;UACxBwC,EAAE,EAAEW,yBAAyB,CAACX;QAClC,CAAC,CAAC;QAEF;MACJ;MAEA,IAAIQ,gBAAgB,CAACtC,MAAM,EAAE;QACzB,MAAM;UAAEA;QAAO,CAAC,GAAGsC,gBAAgB;QAEnC,IAAI,CAACrC,KAAK,CAACC,OAAO,CAACF,MAAM,CAAC,EAAE;UACxB;QACJ;QAEA,IAAI,CAACA,MAAM,CAACjB,QAAQ,CAAC8B,KAAK,CAAClB,KAAK,CAAC,EAAE;UAC/B;QACJ;MACJ;MAEA,IAAI4C,wBAAwB,CAAC9C,GAAG,EAAE;QAC9B,MAAMgC,cAAc,GAAGZ,KAAK,CAACjB,SAAS;QACtC,IAAI,CAAC6B,cAAc,EAAE;UACjB;QACJ;QAEA,MAAM5B,QAAQ,GAAG,MAAM,IAAI,CAAC9B,WAAW,CAAC,CAAC;QACzC,IAAI0D,cAAc,CAAC3B,EAAE,KAAKD,QAAQ,CAACC,EAAE,EAAE;UACnC;QACJ;QAEArB,GAAG,CAACsB,IAAI,CAAC;UACLjB,GAAG,EAAE,KAAK;UACVK,iBAAiB,EAAE,KAAK;UACxBG,kBAAkB,EAAE,IAAI;UACxBwC,EAAE,EAAEW,yBAAyB,CAACX;QAClC,CAAC,CAAC;MACN;MAEA,IAAIS,wBAAwB,CAACf,MAAM,EAAE;QACjC,IAAI,CAACvB,KAAK,CAACC,OAAO,CAACqC,wBAAwB,CAACf,MAAM,CAAC,EAAE;UACjD;QACJ;QAEA,IAAI,CAACe,wBAAwB,CAACf,MAAM,CAACzC,QAAQ,CAAC8B,KAAK,CAACa,OAAO,CAAC,EAAE;UAC1D;QACJ;MACJ;MAEA,MAAMH,UAAU,GACZ,CAACkB,yBAAyB,CAAC3D,GAAG,IAC9B,CAAC2D,yBAAyB,CAAChD,GAAG,IAC9B,CAACgD,yBAAyB,CAACjB,MAAM;MAErC,IAAID,UAAU,EAAE;QACZ9C,GAAG,CAACsB,IAAI,CAAC;UACLjB,GAAG,EAAE,KAAK;UACVK,iBAAiB,EAAE,KAAK;UACxBG,kBAAkB,EAAE,IAAI;UACxBwC,EAAE,EAAE;QACR,CAAC,CAAC;QAEF;MACJ;MAEA,IAAIW,yBAAyB,CAAChD,GAAG,EAAE;QAC/B,IAAI,OAAO,IAAIjB,MAAM,EAAE;UACnB,MAAMmE,cAAc,GAAGnE,MAAM,CAACyD,KAAK,EAAErC,SAAS;UAC9C,IAAI,CAAC+C,cAAc,EAAE;YACjB;UACJ;UAEA,MAAM9C,QAAQ,GAAG,MAAM,IAAI,CAAC9B,WAAW,CAAC,CAAC;UACzC,IAAI4E,cAAc,CAAC7C,EAAE,KAAKD,QAAQ,CAACC,EAAE,EAAE;YACnC;UACJ;QACJ;QAEArB,GAAG,CAACsB,IAAI,CAAC;UACLjB,GAAG,EAAE2D,yBAAyB,CAAC3D,GAAG;UAClCK,iBAAiB,EAAE,KAAK;UACxBG,kBAAkB,EAAE,IAAI;UACxBwC,EAAE,EAAEW,yBAAyB,CAACX;QAClC,CAAC,CAAC;QAEF;MACJ;MAEArD,GAAG,CAACsB,IAAI,CAAC;QACLjB,GAAG,EAAE2D,yBAAyB,CAAC3D,GAAG;QAClCK,iBAAiB,EAAE,IAAI;QACvBG,kBAAkB,EAAE,KAAK;QACzBwC,EAAE,EAAEW,yBAAyB,CAACX;MAClC,CAAC,CAAC;IACN;IAEA,OAAOrD,GAAG;EACd;EAEA,MAAM4D,sBAAsBA,CAAC7D,MAAyC,EAAE;IACpE,IAAI,IAAI,CAACmD,0BAA0B,CAACnD,MAAM,CAAC,EAAE;MACzC,OAAO,IAAI;IACf;IAEA,MAAM2B,WAAW,GAAG,MAAM,IAAI,CAACjC,qBAAqB,CAAC,CAAC;IACtD,OAAOiC,WAAW,CAACjB,IAAI,CAACkB,CAAC,IAAI,IAAI,CAAChC,qBAAqB,CAACiC,MAAM,CAACC,OAAO,CAAC,CAACvB,QAAQ,CAACqB,CAAC,CAACG,IAAI,CAAC,CAAC;EAC7F;EAEQoB,0BAA0BA,CAACnD,MAAyC,EAAE;IAC1E,IAAI,eAAe,IAAIA,MAAM,CAACqC,KAAK,EAAE;MACjC,MAAM;QAAE+B;MAAc,CAAC,GAAGpE,MAAM,CAACqC,KAAK;MACtC,IAAI,OAAO+B,aAAa,KAAK,SAAS,EAAE;QACpC,OAAOA,aAAa,KAAK,KAAK;MAClC;MAEA,OAAOA,aAAa,EAAEzC,WAAW,KAAK,KAAK;IAC/C;IAEA,OAAO,KAAK;EAChB;EAEA,MAAchC,aAAaA,CAAA,EAAwB;IAC/C,IAAI,IAAI,CAACG,SAAS,KAAK,IAAI,EAAE;MACzB,IAAI,CAACA,SAAS,GAAG,IAAI,CAACD,qBAAqB,CAAC,CAAC;IACjD;IAEA,OAAO,IAAI,CAACC,SAAS;EACzB;EAEA,MAAcgD,QAAQA,CAACuB,IAAY,EAAiC;IAChE,MAAM7C,MAAM,GAAG,MAAM,IAAI,CAAC7B,aAAa,CAAC,CAAC;IACzC,OAAO6B,MAAM,CAACpB,IAAI,CAACe,KAAK,IAAIA,KAAK,CAACkD,IAAI,KAAKA,IAAI,CAAC;EACpD;AACJ","ignoreList":[]}

package/crud/AccessControl/README.md

@@ -0,0 +1,47 @@
+# How Access Control Works
+
+With Headless CMS, checking base permissions (access control) is a bit more interesting because the three types of permissions objects are related to each other. The three types of permissions are:
+
+1. `cms.contentModelGroup`
+2. `cms.contentModel`
+3. `cms.contentEntry`
+
+So, for example, when checking if a user can create content entries, it's not enough to check if the user has the `cms.contentEntry` permission. We also need to check if the user has the `cms.contentModel` permission for the content model the entry belongs to, and if the user has the `cms.contentModelGroup` permission for the content model group the content model belongs to.
+
+All of the above is handled by the `AccessControl` class, which provides a set of methods to check if a user has the necessary permissions to perform a specific action. The main methods that are used in CRUD operations-related code are:
+
+1. `canAccessGroup` (`ensureCanAccessGroup`): checks if a user has the necessary permissions to access a content model group.
+2. `canAccessModel` (`ensureCanAccessModel`): checks if a user has the necessary permissions to access a content model (takes into consideration the content model group permissions).
+3. `canAccessEntry` (`ensureCanAccessEntry`): checks if a user has the necessary permissions to access a content entry (takes into consideration the content model and content model group permissions).
+
+Note that all of these methods can accept an exact entity instance if needed, but it's not required. Both has its own use cases.
+
+For example, when checking if a user can access (read) a content entry, you can pass the entry instance to the `canAccessEntry` method, and it will check if the user has the necessary permissions to access that specific entry. On the other hand, if the entry instance was not passed, the method would check if the user has the necessary permissions to access (read) entries of the given content model.
+
+Note that, whenever possible, the entry should be passed to the method, as it's more secure and provides more accurate results. For example, it is possible to receive a `true` response when checking if a user can access a specific content model, but still receive `false` when the model was not passed (when checking if user can access / read models in general).
+
+## Folder Level Permissions
+
+With Folder Level Permissions, a user can be part of a team, that may have multiple roles that provide different Headless CMS-related permissions (more information [here](https://www.webiny.com/docs/enterprise/aacl/teams#overview)).
+
+The Access Control class is aware of this and ensures that only permissions objects from a single role are taken into consideration when checking if a user has the necessary permissions to perform a specific action. If permission objects from a single role do not provide the necessary permissions, the next role is checked, and so on.
+
+In order to achieve this, we're using the `_src` property that's assigned to each permission object. This property contains the role ID, and is used to filter out permissions objects that belong to a different role.
+
+## Interesting Permissions-related Logic
+
+### Only groups created by the user
+
+When choosing "Only groups created by the user" access scope via the `cms.contentModelGroup` permission, the user that possesses this permission can not only fully (r/w/d) access content models that belong to the content model groups that the user has created, but also content entries that belong to those content models.
+
+<img src="./groups-own.png">
+
+Note that only the entry publishing actions-related permissions are not automatically set here. They need to be defined when defining the role explicitly.
+
+### Only models created by the user
+
+When choosing "Only models created by the user" access scope via the `cms.contentModel` permission, the user that possesses this permission can not only fully (r/w/d) access content models that the user has created, but also content entries that belong to those content models.
+
+<img src="./models-own.png">
+
+Note that only the entry publishing actions-related permissions are not automatically set here. They need to be defined when defining the role explicitly.

package/crud/contentEntry/entryDataFactories/createEntryData.d.ts

@@ -0,0 +1,19 @@
+import type { CmsContext, CmsEntry, CmsEntryValues, CmsModel, CreateCmsEntryInput, CreateCmsEntryOptionsInput } from "../../../types/index.js";
+import type { AccessControl } from "../../../crud/AccessControl/AccessControl.js";
+import type { SecurityIdentity } from "@webiny/api-core/types/security.js";
+import type { Tenant } from "@webiny/api-core/types/tenancy.js";
+interface CreateEntryDataParams<TValues extends CmsEntryValues = CmsEntryValues> {
+    model: CmsModel;
+    rawInput: CreateCmsEntryInput<TValues>;
+    options?: CreateCmsEntryOptionsInput;
+    context: CmsContext;
+    getIdentity: () => SecurityIdentity;
+    getTenant: () => Tenant;
+    accessControl: AccessControl;
+}
+interface ICreateEntryDataResponse<TValues extends CmsEntryValues = CmsEntryValues> {
+    entry: CmsEntry<TValues>;
+    input: CreateCmsEntryInput<TValues>;
+}
+export declare const createEntryData: <TValues extends CmsEntryValues = CmsEntryValues>({ model, rawInput, options, context, getIdentity: getSecurityIdentity, getTenant, accessControl }: CreateEntryDataParams<TValues>) => Promise<ICreateEntryDataResponse<TValues>>;
+export {};