@webiny/api-headless-cms 6.3.0 → 6.4.0-beta.0

package/crud/AccessControl/AccessControl.js

@@ -1,499 +1,344 @@
 import { NotAuthorizedError } from "../../utils/errors.js";
-export class AccessControl {
-  constructor({
-    getIdentity,
-    getGroupsPermissions,
-    getModelsPermissions,
-    getEntriesPermissions,
-    listAllGroups
-  }) {
-    this.getIdentity = getIdentity;
-    this.getGroupsPermissions = getGroupsPermissions;
-    this.getModelsPermissions = getModelsPermissions;
-    this.getEntriesPermissions = getEntriesPermissions;
-    this.fullAccessPermissions = ["*", "cms.*"];
-    this.listAllGroupsCallback = listAllGroups;
-    this.allGroups = null;
-  }
-
-  /**
-   * Groups-related methods below. 👇
-   * - canAccessGroup
-   * - ensureCanAccessGroup
-   * - canAccessNonOwnedGroups
-   * - canAccessOnlyOwnedGroups
-   * - getGroupsAccessControlList
-   * - hasFullAccessToGroups
-   */
-
-  async canAccessGroup(params = {}) {
-    const acl = await this.getGroupsAccessControlList(params);
-    const canRead = acl.find(ace => ace.rwd?.includes("r"));
-    if (!canRead) {
-      return false;
+class AccessControl {
+    constructor({ getIdentity, getGroupsPermissions, getModelsPermissions, getEntriesPermissions, listAllGroups }){
+        this.getIdentity = getIdentity;
+        this.getGroupsPermissions = getGroupsPermissions;
+        this.getModelsPermissions = getModelsPermissions;
+        this.getEntriesPermissions = getEntriesPermissions;
+        this.fullAccessPermissions = [
+            "*",
+            "cms.*"
+        ];
+        this.listAllGroupsCallback = listAllGroups;
+        this.allGroups = null;
     }
-    const {
-      rwd
-    } = params;
-    if (rwd) {
-      const hasRwd = acl.find(ace => ace.rwd.includes(rwd));
-      if (!hasRwd) {
-        return false;
-      }
+    async canAccessGroup(params = {}) {
+        const acl = await this.getGroupsAccessControlList(params);
+        const canRead = acl.find((ace)=>ace.rwd?.includes("r"));
+        if (!canRead) return false;
+        const { rwd } = params;
+        if (rwd) {
+            const hasRwd = acl.find((ace)=>ace.rwd.includes(rwd));
+            if (!hasRwd) return false;
+        }
+        return true;
     }
-    return true;
-  }
-  async canAccessNonOwnedGroups(params) {
-    const acl = await this.getGroupsAccessControlList(params);
-    return acl.some(ace => ace.canAccessNonOwned);
-  }
-  async canAccessOnlyOwnedGroups(params) {
-    const canAccessNonOwned = await this.canAccessNonOwnedGroups(params);
-    return !canAccessNonOwned;
-  }
-  async getGroupsAccessControlList(params) {
-    if (await this.hasFullAccessToGroups()) {
-      return [{
-        rwd: "rwd",
-        canAccessNonOwned: true,
-        canAccessOnlyOwned: false
-      }];
+    async canAccessNonOwnedGroups(params) {
+        const acl = await this.getGroupsAccessControlList(params);
+        return acl.some((ace)=>ace.canAccessNonOwned);
     }
-    const groupsPermissionsList = await this.getGroupsPermissions();
-    const acl = [];
-    for (const groupsPermissions of groupsPermissionsList) {
-      if (groupsPermissions.own) {
-        if ("group" in params) {
-          const modelGroupCreatedBy = params.group?.createdBy;
-          if (!modelGroupCreatedBy) {
-            continue;
-          }
-          const identity = await this.getIdentity();
-          if (modelGroupCreatedBy.id !== identity.id) {
-            continue;
-          }
-        }
-        acl.push({
-          rwd: "rwd",
-          canAccessNonOwned: false,
-          canAccessOnlyOwned: true
-        });
-      }
-      if (groupsPermissions.groups) {
-        if ("group" in params) {
-          const {
-            group
-          } = params;
-          if (!group) {
-            continue;
-          }
-          const {
-            groups
-          } = groupsPermissions;
-          if (!Array.isArray(groups)) {
-            continue;
-          }
-          if (!groups.includes(group.id)) {
-            continue;
-          }
+    async canAccessOnlyOwnedGroups(params) {
+        const canAccessNonOwned = await this.canAccessNonOwnedGroups(params);
+        return !canAccessNonOwned;
+    }
+    async getGroupsAccessControlList(params) {
+        if (await this.hasFullAccessToGroups()) return [
+            {
+                rwd: "rwd",
+                canAccessNonOwned: true,
+                canAccessOnlyOwned: false
+            }
+        ];
+        const groupsPermissionsList = await this.getGroupsPermissions();
+        const acl = [];
+        for (const groupsPermissions of groupsPermissionsList){
+            if (groupsPermissions.own) {
+                if ("group" in params) {
+                    const modelGroupCreatedBy = params.group?.createdBy;
+                    if (!modelGroupCreatedBy) continue;
+                    const identity = await this.getIdentity();
+                    if (modelGroupCreatedBy.id !== identity.id) continue;
+                }
+                acl.push({
+                    rwd: "rwd",
+                    canAccessNonOwned: false,
+                    canAccessOnlyOwned: true
+                });
+            }
+            if (groupsPermissions.groups) {
+                if ("group" in params) {
+                    const { group } = params;
+                    if (!group) continue;
+                    const { groups } = groupsPermissions;
+                    if (!Array.isArray(groups)) continue;
+                    if (!groups.includes(group.id)) continue;
+                }
+            }
+            acl.push({
+                rwd: groupsPermissions.rwd,
+                canAccessNonOwned: true,
+                canAccessOnlyOwned: false
+            });
         }
-      }
-      acl.push({
-        rwd: groupsPermissions.rwd,
-        canAccessNonOwned: true,
-        canAccessOnlyOwned: false
-      });
+        return acl;
     }
-    return acl;
-  }
-  async hasFullAccessToGroups() {
-    const permissions = await this.getGroupsPermissions();
-    return permissions.some(p => this.fullAccessPermissions.filter(Boolean).includes(p.name));
-  }
-
-  /**
-   * Models-related methods below. 👇
-   * - canAccessModel
-   * - ensureCanAccessModel
-   * - canAccessNonOwnedModels
-   * - canAccessOnlyOwnedModels
-   * - getModelsAccessControlList
-   * - hasFullAccessToModels
-   */
-
-  async canAccessModel(params) {
-    const acl = await this.getModelsAccessControlList(params);
-    const canRead = acl.find(ace => ace.rwd.includes("r"));
-    if (!canRead) {
-      return false;
+    async hasFullAccessToGroups() {
+        const permissions = await this.getGroupsPermissions();
+        return permissions.some((p)=>this.fullAccessPermissions.filter(Boolean).includes(p.name));
     }
-    const {
-      rwd
-    } = params;
-    if (rwd) {
-      const hasRwd = acl.find(ace => ace.rwd.includes(rwd));
-      if (!hasRwd) {
-        return false;
-      }
+    async canAccessModel(params) {
+        const acl = await this.getModelsAccessControlList(params);
+        const canRead = acl.find((ace)=>ace.rwd.includes("r"));
+        if (!canRead) return false;
+        const { rwd } = params;
+        if (rwd) {
+            const hasRwd = acl.find((ace)=>ace.rwd.includes(rwd));
+            if (!hasRwd) return false;
+        }
+        return true;
     }
-    return true;
-  }
-  async ensureCanAccessModel(params = {}) {
-    const canAccess = await this.canAccessModel(params);
-    if (canAccess) {
-      return;
+    async ensureCanAccessModel(params = {}) {
+        const canAccess = await this.canAccessModel(params);
+        if (canAccess) return;
+        if ("model" in params) {
+            let modelName = "(could not determine name)";
+            if (params.model?.name) modelName = `"${params.model.name}"`;
+            throw new NotAuthorizedError(`Not allowed to access content model ${modelName}.`);
+        }
+        throw new NotAuthorizedError("Not allowed to access content models.");
     }
-    if ("model" in params) {
-      let modelName = "(could not determine name)";
-      if (params.model?.name) {
-        modelName = `"${params.model.name}"`;
-      }
-      throw new NotAuthorizedError(`Not allowed to access content model ${modelName}.`);
+    async canAccessNonOwnedModels(params) {
+        const acl = await this.getModelsAccessControlList(params);
+        return acl.some((ace)=>ace.canAccessNonOwned);
     }
-    throw new NotAuthorizedError(`Not allowed to access content models.`);
-  }
-  async canAccessNonOwnedModels(params) {
-    const acl = await this.getModelsAccessControlList(params);
-    return acl.some(ace => ace.canAccessNonOwned);
-  }
-  async canAccessOnlyOwnedModels(params) {
-    const canAccessNonOwned = await this.canAccessNonOwnedModels(params);
-    return !canAccessNonOwned;
-  }
-  async getModelsAccessControlList(params) {
-    if (await this.hasFullAccessToModels(params)) {
-      return [{
-        rwd: "rwd",
-        canAccessNonOwned: true,
-        canAccessOnlyOwned: false
-      }];
+    async canAccessOnlyOwnedModels(params) {
+        const canAccessNonOwned = await this.canAccessNonOwnedModels(params);
+        return !canAccessNonOwned;
     }
-    const groupsPermissionsList = await this.getGroupsPermissions();
-    const acl = [];
-    for (let i = 0; i < groupsPermissionsList.length; i++) {
-      const groupsPermissions = groupsPermissionsList[i];
-      const modelsPermissionsList = await this.getModelsPermissions();
-      const relatedModelPermissions = modelsPermissionsList.find(permissions => permissions._src === groupsPermissions._src);
-      if (!relatedModelPermissions) {
-        continue;
-      }
-      if (groupsPermissions.own) {
-        if ("model" in params) {
-          const {
-            model
-          } = params;
-          if (!model) {
-            continue;
-          }
-          const group = await this.getGroup(model.group);
-          if (!group) {
-            continue;
-          }
-          const modelGroupCreatedBy = group.createdBy;
-          if (!modelGroupCreatedBy) {
-            continue;
-          }
-          const identity = await this.getIdentity();
-          if (modelGroupCreatedBy.id !== identity.id) {
-            continue;
-          }
+    async getModelsAccessControlList(params) {
+        if (await this.hasFullAccessToModels(params)) return [
+            {
+                rwd: "rwd",
+                canAccessNonOwned: true,
+                canAccessOnlyOwned: false
+            }
+        ];
+        const groupsPermissionsList = await this.getGroupsPermissions();
+        const acl = [];
+        for(let i = 0; i < groupsPermissionsList.length; i++){
+            const groupsPermissions = groupsPermissionsList[i];
+            const modelsPermissionsList = await this.getModelsPermissions();
+            const relatedModelPermissions = modelsPermissionsList.find((permissions)=>permissions._src === groupsPermissions._src);
+            if (!relatedModelPermissions) continue;
+            if (groupsPermissions.own) {
+                if ("model" in params) {
+                    const { model } = params;
+                    if (!model) continue;
+                    const group = await this.getGroup(model.group);
+                    if (!group) continue;
+                    const modelGroupCreatedBy = group.createdBy;
+                    if (!modelGroupCreatedBy) continue;
+                    const identity = await this.getIdentity();
+                    if (modelGroupCreatedBy.id !== identity.id) continue;
+                }
+                acl.push({
+                    rwd: "rwd",
+                    canAccessNonOwned: false,
+                    canAccessOnlyOwned: true
+                });
+                continue;
+            }
+            if (groupsPermissions.groups) {
+                if ("model" in params) {
+                    const { model } = params;
+                    if (!model) continue;
+                    if (!Array.isArray(groupsPermissions.groups)) continue;
+                    if (!groupsPermissions.groups.includes(model.group)) continue;
+                }
+            }
+            const fullAccess = !relatedModelPermissions.rwd && !relatedModelPermissions.own && !relatedModelPermissions.models;
+            if (fullAccess) {
+                acl.push({
+                    rwd: "rwd",
+                    canAccessNonOwned: true,
+                    canAccessOnlyOwned: false
+                });
+                continue;
+            }
+            if (relatedModelPermissions.own) {
+                if ("model" in params) {
+                    if (!params.model) continue;
+                    const modelCreatedBy = params.model.createdBy;
+                    if (!modelCreatedBy) continue;
+                    const identity = await this.getIdentity();
+                    if (modelCreatedBy.id !== identity.id) continue;
+                }
+                acl.push({
+                    rwd: "rwd",
+                    canAccessNonOwned: false,
+                    canAccessOnlyOwned: true
+                });
+                continue;
+            }
+            if (relatedModelPermissions.models) {
+                const { models } = relatedModelPermissions;
+                if ("model" in params) {
+                    if (!params.model) continue;
+                    if (!Array.isArray(models)) continue;
+                    if (!models.includes(params.model.modelId)) continue;
+                }
+            }
+            acl.push({
+                rwd: relatedModelPermissions.rwd,
+                canAccessNonOwned: true,
+                canAccessOnlyOwned: false
+            });
         }
-        acl.push({
-          rwd: "rwd",
-          canAccessNonOwned: false,
-          canAccessOnlyOwned: true
-        });
-        continue;
-      }
-      if (groupsPermissions.groups) {
-        if ("model" in params) {
-          const {
-            model
-          } = params;
-          if (!model) {
-            continue;
-          }
-          if (!Array.isArray(groupsPermissions.groups)) {
-            continue;
-          }
-          if (!groupsPermissions.groups.includes(model.group)) {
-            continue;
-          }
+        return acl;
+    }
+    async hasFullAccessToModels(params) {
+        const { model } = params;
+        if (model) {
+            if (this.modelAuthorizationDisabled({
+                model
+            })) return true;
         }
-      }
-      const fullAccess = !relatedModelPermissions.rwd && !relatedModelPermissions.own && !relatedModelPermissions.models;
-      if (fullAccess) {
-        acl.push({
-          rwd: "rwd",
-          canAccessNonOwned: true,
-          canAccessOnlyOwned: false
-        });
-        continue;
-      }
-      if (relatedModelPermissions.own) {
-        if ("model" in params) {
-          if (!params.model) {
-            continue;
-          }
-          const modelCreatedBy = params.model.createdBy;
-          if (!modelCreatedBy) {
-            continue;
-          }
-          const identity = await this.getIdentity();
-          if (modelCreatedBy.id !== identity.id) {
-            continue;
-          }
+        const permissions = await this.getModelsPermissions();
+        return permissions.some((p)=>this.fullAccessPermissions.filter(Boolean).includes(p.name));
+    }
+    async canAccessEntry(params) {
+        const acl = await this.getEntriesAccessControlList(params);
+        const canRead = acl.find((ace)=>ace.rwd.includes("r"));
+        if (!canRead) return false;
+        const { rwd } = params;
+        if (rwd) {
+            const hasRwd = acl.find((ace)=>ace.rwd.includes(rwd));
+            if (!hasRwd) return false;
         }
-        acl.push({
-          rwd: "rwd",
-          canAccessNonOwned: false,
-          canAccessOnlyOwned: true
-        });
-        continue;
-      }
-      if (relatedModelPermissions.models) {
-        const {
-          models
-        } = relatedModelPermissions;
-        if ("model" in params) {
-          if (!params.model) {
-            continue;
-          }
-          if (!Array.isArray(models)) {
-            continue;
-          }
-          if (!models.includes(params.model.modelId)) {
-            continue;
-          }
+        const { pw } = params;
+        if (pw) {
+            const hasPw = acl.find((ace)=>ace.pw?.includes(pw));
+            if (!hasPw) return false;
         }
-      }
-      acl.push({
-        rwd: relatedModelPermissions.rwd,
-        canAccessNonOwned: true,
-        canAccessOnlyOwned: false
-      });
-    }
-    return acl;
-  }
-  async hasFullAccessToModels(params) {
-    const {
-      model
-    } = params;
-    if (model) {
-      if (this.modelAuthorizationDisabled({
-        model
-      })) {
         return true;
-      }
     }
-    const permissions = await this.getModelsPermissions();
-    return permissions.some(p => this.fullAccessPermissions.filter(Boolean).includes(p.name));
-  }
-
-  /**
-   * Entries-related methods below. 👇
-   * - canAccessEntry
-   * - ensureCanAccessEntry
-   * - canAccessNonOwnedEntries
-   * - canAccessOnlyOwnedEntries
-   * - getEntriesAccessControlList
-   * - hasFullAccessToEntries
-   */
-
-  async canAccessEntry(params) {
-    const acl = await this.getEntriesAccessControlList(params);
-    const canRead = acl.find(ace => ace.rwd.includes("r"));
-    if (!canRead) {
-      return false;
+    async ensureCanAccessEntry(params) {
+        const canAccess = await this.canAccessEntry(params);
+        if (!canAccess) {
+            if (params.entry) throw new NotAuthorizedError(`Not allowed to access entry "${params.entry.entryId}".`);
+            throw new NotAuthorizedError(`Not allowed to access "${params.model.modelId}" entries.`);
+        }
     }
-    const {
-      rwd
-    } = params;
-    if (rwd) {
-      const hasRwd = acl.find(ace => ace.rwd.includes(rwd));
-      if (!hasRwd) {
-        return false;
-      }
+    async canAccessNonOwnedEntries(params) {
+        const acl = await this.getEntriesAccessControlList(params);
+        return acl.some((ace)=>ace.canAccessNonOwned);
     }
-    const {
-      pw
-    } = params;
-    if (pw) {
-      const hasPw = acl.find(ace => ace.pw?.includes(pw));
-      if (!hasPw) {
-        return false;
-      }
+    async canAccessOnlyOwnedEntries(params) {
+        const canAccessNonOwned = await this.canAccessNonOwnedEntries(params);
+        return !canAccessNonOwned;
     }
-    return true;
-  }
-  async ensureCanAccessEntry(params) {
-    const canAccess = await this.canAccessEntry(params);
-    if (!canAccess) {
-      if (params.entry) {
-        throw new NotAuthorizedError(`Not allowed to access entry "${params.entry.entryId}".`);
-      }
-      throw new NotAuthorizedError(`Not allowed to access "${params.model.modelId}" entries.`);
+    async getEntriesAccessControlList(params) {
+        if (await this.hasFullAccessToEntries(params)) return [
+            {
+                rwd: "rwd",
+                pw: "pu",
+                canAccessNonOwned: true,
+                canAccessOnlyOwned: false
+            }
+        ];
+        const { model } = params;
+        const groupsPermissionsList = await this.getGroupsPermissions();
+        const acl = [];
+        for(let i = 0; i < groupsPermissionsList.length; i++){
+            const groupPermissions = groupsPermissionsList[i];
+            const modelsPermissionsList = await this.getModelsPermissions();
+            const relatedModelsPermissions = modelsPermissionsList.find((permissions)=>permissions._src === groupPermissions._src);
+            if (!relatedModelsPermissions) continue;
+            const entriesPermissionsList = await this.getEntriesPermissions();
+            const relatedEntriesPermissions = entriesPermissionsList.find((permissions)=>permissions._src === groupPermissions._src);
+            if (!relatedEntriesPermissions) continue;
+            if (groupPermissions.own) {
+                const group = await this.getGroup(model.group);
+                if (!group) continue;
+                const groupCreatedBy = group.createdBy;
+                if (!groupCreatedBy) continue;
+                const identity = await this.getIdentity();
+                if (groupCreatedBy.id !== identity.id) continue;
+                acl.push({
+                    rwd: "rwd",
+                    canAccessNonOwned: false,
+                    canAccessOnlyOwned: true,
+                    pw: relatedEntriesPermissions.pw
+                });
+                continue;
+            }
+            if (groupPermissions.groups) {
+                const { groups } = groupPermissions;
+                if (!Array.isArray(groups)) continue;
+                if (!groups.includes(model.group)) continue;
+            }
+            if (relatedModelsPermissions.own) {
+                const modelCreatedBy = model.createdBy;
+                if (!modelCreatedBy) continue;
+                const identity = await this.getIdentity();
+                if (modelCreatedBy.id !== identity.id) continue;
+                acl.push({
+                    rwd: "rwd",
+                    canAccessNonOwned: false,
+                    canAccessOnlyOwned: true,
+                    pw: relatedEntriesPermissions.pw
+                });
+            }
+            if (relatedModelsPermissions.models) {
+                if (!Array.isArray(relatedModelsPermissions.models)) continue;
+                if (!relatedModelsPermissions.models.includes(model.modelId)) continue;
+            }
+            const fullAccess = !relatedEntriesPermissions.rwd && !relatedEntriesPermissions.own && !relatedEntriesPermissions.models;
+            if (fullAccess) {
+                acl.push({
+                    rwd: "rwd",
+                    canAccessNonOwned: false,
+                    canAccessOnlyOwned: true,
+                    pw: "pu"
+                });
+                continue;
+            }
+            if (relatedEntriesPermissions.own) {
+                if ("entry" in params) {
+                    const entryCreatedBy = params.entry?.createdBy;
+                    if (!entryCreatedBy) continue;
+                    const identity = await this.getIdentity();
+                    if (entryCreatedBy.id !== identity.id) continue;
+                }
+                acl.push({
+                    rwd: relatedEntriesPermissions.rwd,
+                    canAccessNonOwned: false,
+                    canAccessOnlyOwned: true,
+                    pw: relatedEntriesPermissions.pw
+                });
+                continue;
+            }
+            acl.push({
+                rwd: relatedEntriesPermissions.rwd,
+                canAccessNonOwned: true,
+                canAccessOnlyOwned: false,
+                pw: relatedEntriesPermissions.pw
+            });
+        }
+        return acl;
     }
-  }
-  async canAccessNonOwnedEntries(params) {
-    const acl = await this.getEntriesAccessControlList(params);
-    return acl.some(ace => ace.canAccessNonOwned);
-  }
-  async canAccessOnlyOwnedEntries(params) {
-    const canAccessNonOwned = await this.canAccessNonOwnedEntries(params);
-    return !canAccessNonOwned;
-  }
-  async getEntriesAccessControlList(params) {
-    if (await this.hasFullAccessToEntries(params)) {
-      return [{
-        rwd: "rwd",
-        pw: "pu",
-        canAccessNonOwned: true,
-        canAccessOnlyOwned: false
-      }];
+    async hasFullAccessToEntries(params) {
+        if (this.modelAuthorizationDisabled(params)) return true;
+        const permissions = await this.getEntriesPermissions();
+        return permissions.some((p)=>this.fullAccessPermissions.filter(Boolean).includes(p.name));
     }
-
-    // We need a map of groups slugs to ids, to perform checks on models
-    const {
-      model
-    } = params;
-    const groupsPermissionsList = await this.getGroupsPermissions();
-    const acl = [];
-    for (let i = 0; i < groupsPermissionsList.length; i++) {
-      const groupPermissions = groupsPermissionsList[i];
-      const modelsPermissionsList = await this.getModelsPermissions();
-      const relatedModelsPermissions = modelsPermissionsList.find(permissions => permissions._src === groupPermissions._src);
-      if (!relatedModelsPermissions) {
-        continue;
-      }
-      const entriesPermissionsList = await this.getEntriesPermissions();
-      const relatedEntriesPermissions = entriesPermissionsList.find(permissions => permissions._src === groupPermissions._src);
-      if (!relatedEntriesPermissions) {
-        continue;
-      }
-      if (groupPermissions.own) {
-        const group = await this.getGroup(model.group);
-        if (!group) {
-          continue;
-        }
-        const groupCreatedBy = group.createdBy;
-        if (!groupCreatedBy) {
-          continue;
-        }
-        const identity = await this.getIdentity();
-        if (groupCreatedBy.id !== identity.id) {
-          continue;
+    modelAuthorizationDisabled(params) {
+        if ("authorization" in params.model) {
+            const { authorization } = params.model;
+            if ("boolean" == typeof authorization) return false === authorization;
+            return authorization?.permissions === false;
         }
-        acl.push({
-          rwd: "rwd",
-          canAccessNonOwned: false,
-          canAccessOnlyOwned: true,
-          pw: relatedEntriesPermissions.pw
-        });
-        continue;
-      }
-      if (groupPermissions.groups) {
-        const {
-          groups
-        } = groupPermissions;
-        if (!Array.isArray(groups)) {
-          continue;
-        }
-        if (!groups.includes(model.group)) {
-          continue;
-        }
-      }
-      if (relatedModelsPermissions.own) {
-        const modelCreatedBy = model.createdBy;
-        if (!modelCreatedBy) {
-          continue;
-        }
-        const identity = await this.getIdentity();
-        if (modelCreatedBy.id !== identity.id) {
-          continue;
-        }
-        acl.push({
-          rwd: "rwd",
-          canAccessNonOwned: false,
-          canAccessOnlyOwned: true,
-          pw: relatedEntriesPermissions.pw
-        });
-      }
-      if (relatedModelsPermissions.models) {
-        if (!Array.isArray(relatedModelsPermissions.models)) {
-          continue;
-        }
-        if (!relatedModelsPermissions.models.includes(model.modelId)) {
-          continue;
-        }
-      }
-      const fullAccess = !relatedEntriesPermissions.rwd && !relatedEntriesPermissions.own && !relatedEntriesPermissions.models;
-      if (fullAccess) {
-        acl.push({
-          rwd: "rwd",
-          canAccessNonOwned: false,
-          canAccessOnlyOwned: true,
-          pw: "pu"
-        });
-        continue;
-      }
-      if (relatedEntriesPermissions.own) {
-        if ("entry" in params) {
-          const entryCreatedBy = params.entry?.createdBy;
-          if (!entryCreatedBy) {
-            continue;
-          }
-          const identity = await this.getIdentity();
-          if (entryCreatedBy.id !== identity.id) {
-            continue;
-          }
-        }
-        acl.push({
-          rwd: relatedEntriesPermissions.rwd,
-          canAccessNonOwned: false,
-          canAccessOnlyOwned: true,
-          pw: relatedEntriesPermissions.pw
-        });
-        continue;
-      }
-      acl.push({
-        rwd: relatedEntriesPermissions.rwd,
-        canAccessNonOwned: true,
-        canAccessOnlyOwned: false,
-        pw: relatedEntriesPermissions.pw
-      });
-    }
-    return acl;
-  }
-  async hasFullAccessToEntries(params) {
-    if (this.modelAuthorizationDisabled(params)) {
-      return true;
+        return false;
     }
-    const permissions = await this.getEntriesPermissions();
-    return permissions.some(p => this.fullAccessPermissions.filter(Boolean).includes(p.name));
-  }
-  modelAuthorizationDisabled(params) {
-    if ("authorization" in params.model) {
-      const {
-        authorization
-      } = params.model;
-      if (typeof authorization === "boolean") {
-        return authorization === false;
-      }
-      return authorization?.permissions === false;
+    async listAllGroups() {
+        if (null === this.allGroups) this.allGroups = this.listAllGroupsCallback();
+        return this.allGroups;
     }
-    return false;
-  }
-  async listAllGroups() {
-    if (this.allGroups === null) {
-      this.allGroups = this.listAllGroupsCallback();
+    async getGroup(slug) {
+        const groups = await this.listAllGroups();
+        return groups.find((group)=>group.slug === slug);
     }
-    return this.allGroups;
-  }
-  async getGroup(slug) {
-    const groups = await this.listAllGroups();
-    return groups.find(group => group.slug === slug);
-  }
 }
+export { AccessControl };
 
 //# sourceMappingURL=AccessControl.js.map