@webiny/api-website-builder-workflows 0.0.0-unstable.9f53ea597d → 0.0.0-unstable.a85ef555b2

package/features/hooks/DeleteReviewsOnPageRevisionDelete.js

@@ -0,0 +1,44 @@
+import { PageRevisionAfterDeleteEventHandler } from "@webiny/api-website-builder/features/pages/DeletePageRevision/index.js";
+import { Logger } from "@webiny/api-core/features/logger/index.js";
+import { DeleteTargetReviewsUseCase } from "@webiny/api-workflows/features/review/DeleteTargetReviews/index.js";
+import { WB_PAGE_NAMESPACE } from "../../constants.js";
+import { hasErrorSource } from "@webiny/api-workflows/domain/hasErrorSource.js";
+class DeleteReviewsOnPageRevisionDeleteImpl {
+    constructor(deleteTargetReviews, logger){
+        this.deleteTargetReviews = deleteTargetReviews;
+        this.logger = logger;
+    }
+    async handle(event) {
+        const { page } = event.payload;
+        try {
+            const deleted = await this.deleteTargetReviews.execute({
+                model: WB_PAGE_NAMESPACE,
+                targetIds: [
+                    page.entryId
+                ],
+                targetRevisionId: page.id
+            });
+            if (deleted.isFail()) this.logger.error({
+                err: hasErrorSource(deleted.error) ? deleted.error.source : deleted.error,
+                model: WB_PAGE_NAMESPACE,
+                targetRevisionId: page.id
+            }, "Could not delete the reviews of a deleted page revision; they are left orphaned.");
+        } catch (error) {
+            this.logger.error({
+                err: error,
+                model: WB_PAGE_NAMESPACE,
+                targetRevisionId: page.id
+            }, "Could not delete the reviews of a deleted page revision; they are left orphaned.");
+        }
+    }
+}
+const DeleteReviewsOnPageRevisionDelete = PageRevisionAfterDeleteEventHandler.createImplementation({
+    implementation: DeleteReviewsOnPageRevisionDeleteImpl,
+    dependencies: [
+        DeleteTargetReviewsUseCase,
+        Logger
+    ]
+});
+export { DeleteReviewsOnPageRevisionDelete };
+
+//# sourceMappingURL=DeleteReviewsOnPageRevisionDelete.js.map

package/features/hooks/DeleteReviewsOnPageRevisionDelete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/hooks/DeleteReviewsOnPageRevisionDelete.js","sources":["../../../src/features/hooks/DeleteReviewsOnPageRevisionDelete.ts"],"sourcesContent":["import { PageRevisionAfterDeleteEventHandler } from \"@webiny/api-website-builder/features/pages/DeletePageRevision/index.js\";\nimport { Logger } from \"@webiny/api-core/features/logger/index.js\";\nimport { DeleteTargetReviewsUseCase } from \"@webiny/api-workflows/features/review/DeleteTargetReviews/index.js\";\nimport { WB_PAGE_NAMESPACE } from \"~/constants.js\";\nimport { hasErrorSource } from \"@webiny/api-workflows/domain/hasErrorSource.js\";\n\n/*\n * Deletes the reviews of a deleted page revision with their assignment records (spec 9.3, R56,\n * R235). Deleting the only revision also publishes the page-delete event, which\n * `DeleteReviewsOnPageDelete` handles for every revision. A failure (a failed result or a throw)\n * is logged, not thrown: the revision is already deleted (R81).\n */\nclass DeleteReviewsOnPageRevisionDeleteImpl\n    implements PageRevisionAfterDeleteEventHandler.Interface\n{\n    public constructor(\n        private deleteTargetReviews: DeleteTargetReviewsUseCase.Interface,\n        private logger: Logger.Interface\n    ) {}\n\n    public async handle(event: PageRevisionAfterDeleteEventHandler.Event): Promise<void> {\n        const { page } = event.payload;\n\n        try {\n            const deleted = await this.deleteTargetReviews.execute({\n                model: WB_PAGE_NAMESPACE,\n                targetIds: [page.entryId],\n                targetRevisionId: page.id\n            });\n            if (deleted.isFail()) {\n                this.logger.error(\n                    {\n                        err: hasErrorSource(deleted.error) ? deleted.error.source : deleted.error,\n                        model: WB_PAGE_NAMESPACE,\n                        targetRevisionId: page.id\n                    },\n                    \"Could not delete the reviews of a deleted page revision; they are left orphaned.\"\n                );\n            }\n        } catch (error) {\n            this.logger.error(\n                { err: error, model: WB_PAGE_NAMESPACE, targetRevisionId: page.id },\n                \"Could not delete the reviews of a deleted page revision; they are left orphaned.\"\n            );\n        }\n    }\n}\n\nexport const DeleteReviewsOnPageRevisionDelete =\n    PageRevisionAfterDeleteEventHandler.createImplementation({\n        implementation: DeleteReviewsOnPageRevisionDeleteImpl,\n        dependencies: [DeleteTargetReviewsUseCase, Logger]\n    });\n"],"names":["DeleteReviewsOnPageRevisionDeleteImpl","deleteTargetReviews","logger","event","page","deleted","WB_PAGE_NAMESPACE","hasErrorSource","error","DeleteReviewsOnPageRevisionDelete","PageRevisionAfterDeleteEventHandler","DeleteTargetReviewsUseCase","Logger"],"mappings":";;;;;AAYA,MAAMA;IAGF,YACYC,mBAAyD,EACzDC,MAAwB,CAClC;aAFUD,mBAAmB,GAAnBA;aACAC,MAAM,GAANA;IACT;IAEH,MAAa,OAAOC,KAAgD,EAAiB;QACjF,MAAM,EAAEC,IAAI,EAAE,GAAGD,MAAM,OAAO;QAE9B,IAAI;YACA,MAAME,UAAU,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC;gBACnD,OAAOC;gBACP,WAAW;oBAACF,KAAK,OAAO;iBAAC;gBACzB,kBAAkBA,KAAK,EAAE;YAC7B;YACA,IAAIC,QAAQ,MAAM,IACd,IAAI,CAAC,MAAM,CAAC,KAAK,CACb;gBACI,KAAKE,eAAeF,QAAQ,KAAK,IAAIA,QAAQ,KAAK,CAAC,MAAM,GAAGA,QAAQ,KAAK;gBACzE,OAAOC;gBACP,kBAAkBF,KAAK,EAAE;YAC7B,GACA;QAGZ,EAAE,OAAOI,OAAO;YACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CACb;gBAAE,KAAKA;gBAAO,OAAOF;gBAAmB,kBAAkBF,KAAK,EAAE;YAAC,GAClE;QAER;IACJ;AACJ;AAEO,MAAMK,oCACTC,oCAAoC,oBAAoB,CAAC;IACrD,gBAAgBV;IAChB,cAAc;QAACW;QAA4BC;KAAO;AACtD"}

package/features/hooks/NullReviewStateOnGraduatedVariantDecorator.d.ts

@@ -0,0 +1,27 @@
+import { IdentityContext } from "@webiny/api-core/features/security/IdentityContext/index.js";
+import { Logger } from "@webiny/api-core/features/logger/index.js";
+import { UpdateEntrySystemUseCase } from "@webiny/api-headless-cms/features/contentEntry/UpdateEntrySystem/index.js";
+import { PageModelProvider } from "@webiny/api-website-builder/domain/page/abstractions.js";
+import { GraduateVariantUseCase } from "@webiny/api-website-builder/features/experiments/GraduateVariant/index.js";
+/**
+ * A graduated variant is a new page revision, so it starts without a review state (spec 4.5,
+ * D59). Graduation creates the revision through the CMS directly and the page model publishes no
+ * CMS entry events, so no revision-create rule runs. After a successful graduation this clears
+ * the revision's `system.workflow` with the same system write the review sync uses (only the
+ * system write runs without authorization). The revision and the graduated experiment already
+ * exist, so a failed write is logged with the page id, not returned, and the page keeps the
+ * copied state.
+ */
+declare class NullReviewStateOnGraduatedVariantDecoratorImpl implements GraduateVariantUseCase.Interface {
+    private identityContext;
+    private pageModelProvider;
+    private updateEntrySystem;
+    private logger;
+    private decoratee;
+    constructor(identityContext: IdentityContext.Interface, pageModelProvider: PageModelProvider.Interface, updateEntrySystem: UpdateEntrySystemUseCase.Interface, logger: Logger.Interface, decoratee: GraduateVariantUseCase.Interface);
+    execute(params: GraduateVariantUseCase.Params): GraduateVariantUseCase.Return;
+}
+export declare const NullReviewStateOnGraduatedVariantDecorator: typeof NullReviewStateOnGraduatedVariantDecoratorImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/api-website-builder/features/experiments/GraduateVariant/abstractions/GraduateVariantUseCase").IGraduateVariantUseCase>;
+};
+export {};

package/features/hooks/NullReviewStateOnGraduatedVariantDecorator.js

@@ -0,0 +1,53 @@
+import { Result } from "@webiny/feature/api";
+import { IdentityContext } from "@webiny/api-core/features/security/IdentityContext/index.js";
+import { Logger } from "@webiny/api-core/features/logger/index.js";
+import { UpdateEntrySystemUseCase } from "@webiny/api-headless-cms/features/contentEntry/UpdateEntrySystem/index.js";
+import { PageModelProvider } from "@webiny/api-website-builder/domain/page/abstractions.js";
+import { GraduateVariantUseCase } from "@webiny/api-website-builder/features/experiments/GraduateVariant/index.js";
+class NullReviewStateOnGraduatedVariantDecoratorImpl {
+    constructor(identityContext, pageModelProvider, updateEntrySystem, logger, decoratee){
+        this.identityContext = identityContext;
+        this.pageModelProvider = pageModelProvider;
+        this.updateEntrySystem = updateEntrySystem;
+        this.logger = logger;
+        this.decoratee = decoratee;
+    }
+    async execute(params) {
+        const result = await this.decoratee.execute(params);
+        if (result.isFail()) return result;
+        const page = result.value;
+        const system = page.system;
+        if (!system?.workflow) return result;
+        const model = await this.pageModelProvider.get();
+        const updated = await this.identityContext.withoutAuthorization(()=>this.updateEntrySystem.execute(model, page.id, {
+                workflow: null
+            }));
+        if (updated.isFail()) {
+            this.logger.error({
+                err: updated.error,
+                pageId: page.id
+            }, "Could not clear the review state of a graduated variant revision; it keeps the copied state.");
+            return result;
+        }
+        const cleared = {
+            ...page.system,
+            workflow: null
+        };
+        return Result.ok({
+            ...page,
+            system: cleared
+        });
+    }
+}
+const NullReviewStateOnGraduatedVariantDecorator = GraduateVariantUseCase.createDecorator({
+    decorator: NullReviewStateOnGraduatedVariantDecoratorImpl,
+    dependencies: [
+        IdentityContext,
+        PageModelProvider,
+        UpdateEntrySystemUseCase,
+        Logger
+    ]
+});
+export { NullReviewStateOnGraduatedVariantDecorator };
+
+//# sourceMappingURL=NullReviewStateOnGraduatedVariantDecorator.js.map

package/features/hooks/NullReviewStateOnGraduatedVariantDecorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/hooks/NullReviewStateOnGraduatedVariantDecorator.js","sources":["../../../src/features/hooks/NullReviewStateOnGraduatedVariantDecorator.ts"],"sourcesContent":["import { Result } from \"@webiny/feature/api\";\nimport { IdentityContext } from \"@webiny/api-core/features/security/IdentityContext/index.js\";\nimport { Logger } from \"@webiny/api-core/features/logger/index.js\";\nimport { UpdateEntrySystemUseCase } from \"@webiny/api-headless-cms/features/contentEntry/UpdateEntrySystem/index.js\";\nimport { PageModelProvider } from \"@webiny/api-website-builder/domain/page/abstractions.js\";\nimport { GraduateVariantUseCase } from \"@webiny/api-website-builder/features/experiments/GraduateVariant/index.js\";\n\n// The part of `system` this decorator reads; the CMS type leaves `system` open for extension.\ninterface PageSystemWithWorkflow {\n    workflow?: unknown;\n}\n\n/**\n * A graduated variant is a new page revision, so it starts without a review state (spec 4.5,\n * D59). Graduation creates the revision through the CMS directly and the page model publishes no\n * CMS entry events, so no revision-create rule runs. After a successful graduation this clears\n * the revision's `system.workflow` with the same system write the review sync uses (only the\n * system write runs without authorization). The revision and the graduated experiment already\n * exist, so a failed write is logged with the page id, not returned, and the page keeps the\n * copied state.\n */\nclass NullReviewStateOnGraduatedVariantDecoratorImpl implements GraduateVariantUseCase.Interface {\n    public constructor(\n        private identityContext: IdentityContext.Interface,\n        private pageModelProvider: PageModelProvider.Interface,\n        private updateEntrySystem: UpdateEntrySystemUseCase.Interface,\n        private logger: Logger.Interface,\n        private decoratee: GraduateVariantUseCase.Interface\n    ) {}\n\n    public async execute(params: GraduateVariantUseCase.Params): GraduateVariantUseCase.Return {\n        const result = await this.decoratee.execute(params);\n        if (result.isFail()) {\n            return result;\n        }\n        const page = result.value;\n        const system: PageSystemWithWorkflow | undefined = page.system;\n        if (!system?.workflow) {\n            return result;\n        }\n\n        const model = await this.pageModelProvider.get();\n        const updated = await this.identityContext.withoutAuthorization(() => {\n            return this.updateEntrySystem.execute(model, page.id, { workflow: null });\n        });\n        if (updated.isFail()) {\n            this.logger.error(\n                { err: updated.error, pageId: page.id },\n                \"Could not clear the review state of a graduated variant revision; it keeps the copied state.\"\n            );\n            return result;\n        }\n        const cleared = { ...page.system, workflow: null };\n        return Result.ok({ ...page, system: cleared });\n    }\n}\n\nexport const NullReviewStateOnGraduatedVariantDecorator = GraduateVariantUseCase.createDecorator({\n    decorator: NullReviewStateOnGraduatedVariantDecoratorImpl,\n    dependencies: [IdentityContext, PageModelProvider, UpdateEntrySystemUseCase, Logger]\n});\n"],"names":["NullReviewStateOnGraduatedVariantDecoratorImpl","identityContext","pageModelProvider","updateEntrySystem","logger","decoratee","params","result","page","system","model","updated","cleared","Result","NullReviewStateOnGraduatedVariantDecorator","GraduateVariantUseCase","IdentityContext","PageModelProvider","UpdateEntrySystemUseCase","Logger"],"mappings":";;;;;;AAqBA,MAAMA;IACF,YACYC,eAA0C,EAC1CC,iBAA8C,EAC9CC,iBAAqD,EACrDC,MAAwB,EACxBC,SAA2C,CACrD;aALUJ,eAAe,GAAfA;aACAC,iBAAiB,GAAjBA;aACAC,iBAAiB,GAAjBA;aACAC,MAAM,GAANA;aACAC,SAAS,GAATA;IACT;IAEH,MAAa,QAAQC,MAAqC,EAAiC;QACvF,MAAMC,SAAS,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAACD;QAC5C,IAAIC,OAAO,MAAM,IACb,OAAOA;QAEX,MAAMC,OAAOD,OAAO,KAAK;QACzB,MAAME,SAA6CD,KAAK,MAAM;QAC9D,IAAI,CAACC,QAAQ,UACT,OAAOF;QAGX,MAAMG,QAAQ,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG;QAC9C,MAAMC,UAAU,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,IACrD,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAACD,OAAOF,KAAK,EAAE,EAAE;gBAAE,UAAU;YAAK;QAE3E,IAAIG,QAAQ,MAAM,IAAI;YAClB,IAAI,CAAC,MAAM,CAAC,KAAK,CACb;gBAAE,KAAKA,QAAQ,KAAK;gBAAE,QAAQH,KAAK,EAAE;YAAC,GACtC;YAEJ,OAAOD;QACX;QACA,MAAMK,UAAU;YAAE,GAAGJ,KAAK,MAAM;YAAE,UAAU;QAAK;QACjD,OAAOK,OAAO,EAAE,CAAC;YAAE,GAAGL,IAAI;YAAE,QAAQI;QAAQ;IAChD;AACJ;AAEO,MAAME,6CAA6CC,uBAAuB,eAAe,CAAC;IAC7F,WAAWf;IACX,cAAc;QAACgB;QAAiBC;QAAmBC;QAA0BC;KAAO;AACxF"}

package/features/hooks/NullReviewStateOnPageRevisionCreate.d.ts

@@ -0,0 +1,26 @@
+import { IdentityContext } from "@webiny/api-core/features/security/IdentityContext/index.js";
+import { Logger } from "@webiny/api-core/features/logger/index.js";
+import { UpdateEntrySystemUseCase } from "@webiny/api-headless-cms/features/contentEntry/UpdateEntrySystem/index.js";
+import { PageModelProvider } from "@webiny/api-website-builder/domain/page/abstractions.js";
+import { PageAfterCreateRevisionFromEventHandler } from "@webiny/api-website-builder/features/pages/CreatePageRevisionFrom/index.js";
+/**
+ * Every new page revision starts without a review state (spec 4.5, D59). The page model publishes
+ * no CMS entry events and the CMS copies `system` from the source revision, so after Website
+ * Builder creates the revision this clears its `system.workflow` with the same system write the
+ * review sync uses (only the system write runs without authorization), and updates the page the
+ * use case returns. The revision already exists, so a failed write is logged with the page id,
+ * not thrown: the revision keeps the copied state, which stays visible in the log instead of a
+ * failed request that a retry would turn into another revision.
+ */
+declare class NullReviewStateOnPageRevisionCreateImpl implements PageAfterCreateRevisionFromEventHandler.Interface {
+    private identityContext;
+    private pageModelProvider;
+    private updateEntrySystem;
+    private logger;
+    constructor(identityContext: IdentityContext.Interface, pageModelProvider: PageModelProvider.Interface, updateEntrySystem: UpdateEntrySystemUseCase.Interface, logger: Logger.Interface);
+    handle(event: PageAfterCreateRevisionFromEventHandler.Event): Promise<void>;
+}
+export declare const NullReviewStateOnPageRevisionCreate: typeof NullReviewStateOnPageRevisionCreateImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/api-core/features/eventPublisher").IEventHandler<import("@webiny/api-core/features/eventPublisher").DomainEvent<import("@webiny/api-website-builder/features/pages/CreatePageRevisionFrom/abstractions").PageAfterCreateRevisionFromPayload>>>;
+};
+export {};

package/features/hooks/NullReviewStateOnPageRevisionCreate.js

@@ -0,0 +1,43 @@
+import { IdentityContext } from "@webiny/api-core/features/security/IdentityContext/index.js";
+import { Logger } from "@webiny/api-core/features/logger/index.js";
+import { UpdateEntrySystemUseCase } from "@webiny/api-headless-cms/features/contentEntry/UpdateEntrySystem/index.js";
+import { PageModelProvider } from "@webiny/api-website-builder/domain/page/abstractions.js";
+import { PageAfterCreateRevisionFromEventHandler } from "@webiny/api-website-builder/features/pages/CreatePageRevisionFrom/index.js";
+class NullReviewStateOnPageRevisionCreateImpl {
+    constructor(identityContext, pageModelProvider, updateEntrySystem, logger){
+        this.identityContext = identityContext;
+        this.pageModelProvider = pageModelProvider;
+        this.updateEntrySystem = updateEntrySystem;
+        this.logger = logger;
+    }
+    async handle(event) {
+        const { page } = event.payload;
+        const system = page.system;
+        if (!system?.workflow) return;
+        const model = await this.pageModelProvider.get();
+        const updated = await this.identityContext.withoutAuthorization(()=>this.updateEntrySystem.execute(model, page.id, {
+                workflow: null
+            }));
+        if (updated.isFail()) return void this.logger.error({
+            err: updated.error,
+            pageId: page.id
+        }, "Could not clear the review state of a new page revision; it keeps the copied state.");
+        const cleared = {
+            ...page.system,
+            workflow: null
+        };
+        page.system = cleared;
+    }
+}
+const NullReviewStateOnPageRevisionCreate = PageAfterCreateRevisionFromEventHandler.createImplementation({
+    implementation: NullReviewStateOnPageRevisionCreateImpl,
+    dependencies: [
+        IdentityContext,
+        PageModelProvider,
+        UpdateEntrySystemUseCase,
+        Logger
+    ]
+});
+export { NullReviewStateOnPageRevisionCreate };
+
+//# sourceMappingURL=NullReviewStateOnPageRevisionCreate.js.map

package/features/hooks/NullReviewStateOnPageRevisionCreate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/hooks/NullReviewStateOnPageRevisionCreate.js","sources":["../../../src/features/hooks/NullReviewStateOnPageRevisionCreate.ts"],"sourcesContent":["import { IdentityContext } from \"@webiny/api-core/features/security/IdentityContext/index.js\";\nimport { Logger } from \"@webiny/api-core/features/logger/index.js\";\nimport { UpdateEntrySystemUseCase } from \"@webiny/api-headless-cms/features/contentEntry/UpdateEntrySystem/index.js\";\nimport { PageModelProvider } from \"@webiny/api-website-builder/domain/page/abstractions.js\";\nimport { PageAfterCreateRevisionFromEventHandler } from \"@webiny/api-website-builder/features/pages/CreatePageRevisionFrom/index.js\";\n\n// The part of `system` this handler reads; the CMS type leaves `system` open for extension.\ninterface PageSystemWithWorkflow {\n    workflow?: unknown;\n}\n\n/**\n * Every new page revision starts without a review state (spec 4.5, D59). The page model publishes\n * no CMS entry events and the CMS copies `system` from the source revision, so after Website\n * Builder creates the revision this clears its `system.workflow` with the same system write the\n * review sync uses (only the system write runs without authorization), and updates the page the\n * use case returns. The revision already exists, so a failed write is logged with the page id,\n * not thrown: the revision keeps the copied state, which stays visible in the log instead of a\n * failed request that a retry would turn into another revision.\n */\nclass NullReviewStateOnPageRevisionCreateImpl\n    implements PageAfterCreateRevisionFromEventHandler.Interface\n{\n    public constructor(\n        private identityContext: IdentityContext.Interface,\n        private pageModelProvider: PageModelProvider.Interface,\n        private updateEntrySystem: UpdateEntrySystemUseCase.Interface,\n        private logger: Logger.Interface\n    ) {}\n\n    public async handle(event: PageAfterCreateRevisionFromEventHandler.Event): Promise<void> {\n        const { page } = event.payload;\n        const system: PageSystemWithWorkflow | undefined = page.system;\n        if (!system?.workflow) {\n            return;\n        }\n\n        const model = await this.pageModelProvider.get();\n        const updated = await this.identityContext.withoutAuthorization(() => {\n            return this.updateEntrySystem.execute(model, page.id, { workflow: null });\n        });\n        if (updated.isFail()) {\n            this.logger.error(\n                { err: updated.error, pageId: page.id },\n                \"Could not clear the review state of a new page revision; it keeps the copied state.\"\n            );\n            return;\n        }\n        const cleared = { ...page.system, workflow: null };\n        page.system = cleared;\n    }\n}\n\nexport const NullReviewStateOnPageRevisionCreate =\n    PageAfterCreateRevisionFromEventHandler.createImplementation({\n        implementation: NullReviewStateOnPageRevisionCreateImpl,\n        dependencies: [IdentityContext, PageModelProvider, UpdateEntrySystemUseCase, Logger]\n    });\n"],"names":["NullReviewStateOnPageRevisionCreateImpl","identityContext","pageModelProvider","updateEntrySystem","logger","event","page","system","model","updated","cleared","NullReviewStateOnPageRevisionCreate","PageAfterCreateRevisionFromEventHandler","IdentityContext","PageModelProvider","UpdateEntrySystemUseCase","Logger"],"mappings":";;;;;AAoBA,MAAMA;IAGF,YACYC,eAA0C,EAC1CC,iBAA8C,EAC9CC,iBAAqD,EACrDC,MAAwB,CAClC;aAJUH,eAAe,GAAfA;aACAC,iBAAiB,GAAjBA;aACAC,iBAAiB,GAAjBA;aACAC,MAAM,GAANA;IACT;IAEH,MAAa,OAAOC,KAAoD,EAAiB;QACrF,MAAM,EAAEC,IAAI,EAAE,GAAGD,MAAM,OAAO;QAC9B,MAAME,SAA6CD,KAAK,MAAM;QAC9D,IAAI,CAACC,QAAQ,UACT;QAGJ,MAAMC,QAAQ,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG;QAC9C,MAAMC,UAAU,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,IACrD,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAACD,OAAOF,KAAK,EAAE,EAAE;gBAAE,UAAU;YAAK;QAE3E,IAAIG,QAAQ,MAAM,IAAI,YAClB,IAAI,CAAC,MAAM,CAAC,KAAK,CACb;YAAE,KAAKA,QAAQ,KAAK;YAAE,QAAQH,KAAK,EAAE;QAAC,GACtC;QAIR,MAAMI,UAAU;YAAE,GAAGJ,KAAK,MAAM;YAAE,UAAU;QAAK;QACjDA,KAAK,MAAM,GAAGI;IAClB;AACJ;AAEO,MAAMC,sCACTC,wCAAwC,oBAAoB,CAAC;IACzD,gBAAgBZ;IAChB,cAAc;QAACa;QAAiBC;QAAmBC;QAA0BC;KAAO;AACxF"}

package/features/hooks/RequireApprovedReviewOnPagePublish.d.ts

@@ -0,0 +1,20 @@
+import { PageBeforePublishEventHandler } from "@webiny/api-website-builder/features/pages/PublishPage/index.js";
+import { GetBoundWorkflowUseCase } from "@webiny/api-workflows/features/workflow/GetBoundWorkflow/index.js";
+import { GetActiveTargetReviewUseCase } from "@webiny/api-workflows/features/review/GetActiveTargetReview/index.js";
+/**
+ * Publish rule of the `wb.page` adapter (spec 5.1, D79, D121, R53): with a pages workflow, a page
+ * revision is published only with its active review approved. Lookup failures block. The CMS
+ * adapter's publish rule skips pages (private model, R52). Creating a page revision as published is
+ * not a publish and is not blocked (D134 point 2). The throw rejects `PublishPageUseCase` (A26);
+ * WB's page resolvers and the scheduler's publish action keep its code and data (R103).
+ */
+declare class RequireApprovedReviewOnPagePublishImpl implements PageBeforePublishEventHandler.Interface {
+    private getBoundWorkflow;
+    private getActiveTargetReview;
+    constructor(getBoundWorkflow: GetBoundWorkflowUseCase.Interface, getActiveTargetReview: GetActiveTargetReviewUseCase.Interface);
+    handle(event: PageBeforePublishEventHandler.Event): Promise<void>;
+}
+export declare const RequireApprovedReviewOnPagePublish: typeof RequireApprovedReviewOnPagePublishImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/api-core/features/eventPublisher").IEventHandler<import("@webiny/api-core/features/eventPublisher").DomainEvent<import("@webiny/api-website-builder/features/pages/PublishPage/abstractions").PageBeforePublishPayload>>>;
+};
+export {};

package/features/hooks/RequireApprovedReviewOnPagePublish.js

@@ -0,0 +1,42 @@
+import { PageBeforePublishEventHandler } from "@webiny/api-website-builder/features/pages/PublishPage/index.js";
+import { GetBoundWorkflowUseCase } from "@webiny/api-workflows/features/workflow/GetBoundWorkflow/index.js";
+import { GetActiveTargetReviewUseCase } from "@webiny/api-workflows/features/review/GetActiveTargetReview/index.js";
+import { ReviewPublishBlockedError } from "@webiny/api-workflows/domain/review/errors.js";
+import { WB_PAGE_NAMESPACE } from "../../constants.js";
+class RequireApprovedReviewOnPagePublishImpl {
+    constructor(getBoundWorkflow, getActiveTargetReview){
+        this.getBoundWorkflow = getBoundWorkflow;
+        this.getActiveTargetReview = getActiveTargetReview;
+    }
+    async handle(event) {
+        const { page } = event.payload;
+        const bound = await this.getBoundWorkflow.execute({
+            model: WB_PAGE_NAMESPACE
+        });
+        if (bound.isFail()) throw bound.error;
+        const workflow = bound.value;
+        if (!workflow) return;
+        const review = await this.getActiveTargetReview.execute({
+            model: WB_PAGE_NAMESPACE,
+            targetRevisionId: page.id
+        });
+        if (review.isFail()) throw review.error;
+        if (review.value?.state === "approved") return;
+        throw new ReviewPublishBlockedError({
+            model: WB_PAGE_NAMESPACE,
+            targetRevisionId: page.id,
+            workflowId: workflow.id,
+            reviewState: review.value?.state ?? null
+        });
+    }
+}
+const RequireApprovedReviewOnPagePublish = PageBeforePublishEventHandler.createImplementation({
+    implementation: RequireApprovedReviewOnPagePublishImpl,
+    dependencies: [
+        GetBoundWorkflowUseCase,
+        GetActiveTargetReviewUseCase
+    ]
+});
+export { RequireApprovedReviewOnPagePublish };
+
+//# sourceMappingURL=RequireApprovedReviewOnPagePublish.js.map

package/features/hooks/RequireApprovedReviewOnPagePublish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/hooks/RequireApprovedReviewOnPagePublish.js","sources":["../../../src/features/hooks/RequireApprovedReviewOnPagePublish.ts"],"sourcesContent":["import { PageBeforePublishEventHandler } from \"@webiny/api-website-builder/features/pages/PublishPage/index.js\";\nimport { GetBoundWorkflowUseCase } from \"@webiny/api-workflows/features/workflow/GetBoundWorkflow/index.js\";\nimport { GetActiveTargetReviewUseCase } from \"@webiny/api-workflows/features/review/GetActiveTargetReview/index.js\";\nimport { ReviewPublishBlockedError } from \"@webiny/api-workflows/domain/review/errors.js\";\nimport { WB_PAGE_NAMESPACE } from \"~/constants.js\";\n\n/**\n * Publish rule of the `wb.page` adapter (spec 5.1, D79, D121, R53): with a pages workflow, a page\n * revision is published only with its active review approved. Lookup failures block. The CMS\n * adapter's publish rule skips pages (private model, R52). Creating a page revision as published is\n * not a publish and is not blocked (D134 point 2). The throw rejects `PublishPageUseCase` (A26);\n * WB's page resolvers and the scheduler's publish action keep its code and data (R103).\n */\nclass RequireApprovedReviewOnPagePublishImpl implements PageBeforePublishEventHandler.Interface {\n    public constructor(\n        private getBoundWorkflow: GetBoundWorkflowUseCase.Interface,\n        private getActiveTargetReview: GetActiveTargetReviewUseCase.Interface\n    ) {}\n\n    public async handle(event: PageBeforePublishEventHandler.Event): Promise<void> {\n        const { page } = event.payload;\n\n        const bound = await this.getBoundWorkflow.execute({ model: WB_PAGE_NAMESPACE });\n        if (bound.isFail()) {\n            throw bound.error;\n        }\n        const workflow = bound.value;\n        if (!workflow) {\n            return;\n        }\n\n        const review = await this.getActiveTargetReview.execute({\n            model: WB_PAGE_NAMESPACE,\n            targetRevisionId: page.id\n        });\n        if (review.isFail()) {\n            throw review.error;\n        }\n        if (review.value?.state === \"approved\") {\n            return;\n        }\n\n        throw new ReviewPublishBlockedError({\n            model: WB_PAGE_NAMESPACE,\n            targetRevisionId: page.id,\n            workflowId: workflow.id,\n            reviewState: review.value?.state ?? null\n        });\n    }\n}\n\nexport const RequireApprovedReviewOnPagePublish =\n    PageBeforePublishEventHandler.createImplementation({\n        implementation: RequireApprovedReviewOnPagePublishImpl,\n        dependencies: [GetBoundWorkflowUseCase, GetActiveTargetReviewUseCase]\n    });\n"],"names":["RequireApprovedReviewOnPagePublishImpl","getBoundWorkflow","getActiveTargetReview","event","page","bound","WB_PAGE_NAMESPACE","workflow","review","ReviewPublishBlockedError","RequireApprovedReviewOnPagePublish","PageBeforePublishEventHandler","GetBoundWorkflowUseCase","GetActiveTargetReviewUseCase"],"mappings":";;;;;AAaA,MAAMA;IACF,YACYC,gBAAmD,EACnDC,qBAA6D,CACvE;aAFUD,gBAAgB,GAAhBA;aACAC,qBAAqB,GAArBA;IACT;IAEH,MAAa,OAAOC,KAA0C,EAAiB;QAC3E,MAAM,EAAEC,IAAI,EAAE,GAAGD,MAAM,OAAO;QAE9B,MAAME,QAAQ,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YAAE,OAAOC;QAAkB;QAC7E,IAAID,MAAM,MAAM,IACZ,MAAMA,MAAM,KAAK;QAErB,MAAME,WAAWF,MAAM,KAAK;QAC5B,IAAI,CAACE,UACD;QAGJ,MAAMC,SAAS,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;YACpD,OAAOF;YACP,kBAAkBF,KAAK,EAAE;QAC7B;QACA,IAAII,OAAO,MAAM,IACb,MAAMA,OAAO,KAAK;QAEtB,IAAIA,OAAO,KAAK,EAAE,UAAU,YACxB;QAGJ,MAAM,IAAIC,0BAA0B;YAChC,OAAOH;YACP,kBAAkBF,KAAK,EAAE;YACzB,YAAYG,SAAS,EAAE;YACvB,aAAaC,OAAO,KAAK,EAAE,SAAS;QACxC;IACJ;AACJ;AAEO,MAAME,qCACTC,8BAA8B,oBAAoB,CAAC;IAC/C,gBAAgBX;IAChB,cAAc;QAACY;QAAyBC;KAA6B;AACzE"}

package/features/hooks/feature.d.ts

@@ -0,0 +1,9 @@
+/**
+ * `wb.page` adapter rules on the Website Builder page events (R52). The page model publishes no
+ * CMS entry events, so every page rule, the save block and the revision-create reset included,
+ * listens here.
+ */
+export declare const WbHooksFeature: {
+    name: string;
+    register(container: import("@webiny/di").Container): void;
+};

package/features/hooks/feature.js

@@ -0,0 +1,31 @@
+import { createFeature } from "@webiny/feature/api";
+import { RequireApprovedReviewOnPagePublish } from "./RequireApprovedReviewOnPagePublish.js";
+import { BlockPageMoveWhileInReview } from "./BlockPageMoveWhileInReview.js";
+import { BlockPageTrashWhileInReview } from "./BlockPageTrashWhileInReview.js";
+import { BlockPageDeleteWhileInReview } from "./BlockPageDeleteWhileInReview.js";
+import { DeleteReviewsOnPageDelete } from "./DeleteReviewsOnPageDelete.js";
+import { BlockPageRevisionDeleteWhileInReview } from "./BlockPageRevisionDeleteWhileInReview.js";
+import { DeleteReviewsOnPageRevisionDelete } from "./DeleteReviewsOnPageRevisionDelete.js";
+import { BlockPageUpdateWhileInReview } from "./BlockPageUpdateWhileInReview.js";
+import { BlockPageFolderChangeWhileInReview } from "./BlockPageFolderChangeWhileInReview.js";
+import { NullReviewStateOnPageRevisionCreate } from "./NullReviewStateOnPageRevisionCreate.js";
+import { NullReviewStateOnGraduatedVariantDecorator } from "./NullReviewStateOnGraduatedVariantDecorator.js";
+const WbHooksFeature = createFeature({
+    name: "WebsiteBuilderWorkflows/Hooks",
+    register (container) {
+        container.register(RequireApprovedReviewOnPagePublish);
+        container.register(BlockPageMoveWhileInReview);
+        container.register(BlockPageUpdateWhileInReview);
+        container.register(BlockPageFolderChangeWhileInReview);
+        container.register(NullReviewStateOnPageRevisionCreate);
+        container.registerDecorator(NullReviewStateOnGraduatedVariantDecorator);
+        container.register(BlockPageTrashWhileInReview);
+        container.register(BlockPageDeleteWhileInReview);
+        container.register(DeleteReviewsOnPageDelete);
+        container.register(BlockPageRevisionDeleteWhileInReview);
+        container.register(DeleteReviewsOnPageRevisionDelete);
+    }
+});
+export { WbHooksFeature };
+
+//# sourceMappingURL=feature.js.map

package/features/hooks/feature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/hooks/feature.js","sources":["../../../src/features/hooks/feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { RequireApprovedReviewOnPagePublish } from \"./RequireApprovedReviewOnPagePublish.js\";\nimport { BlockPageMoveWhileInReview } from \"./BlockPageMoveWhileInReview.js\";\nimport { BlockPageTrashWhileInReview } from \"./BlockPageTrashWhileInReview.js\";\nimport { BlockPageDeleteWhileInReview } from \"./BlockPageDeleteWhileInReview.js\";\nimport { DeleteReviewsOnPageDelete } from \"./DeleteReviewsOnPageDelete.js\";\nimport { BlockPageRevisionDeleteWhileInReview } from \"./BlockPageRevisionDeleteWhileInReview.js\";\nimport { DeleteReviewsOnPageRevisionDelete } from \"./DeleteReviewsOnPageRevisionDelete.js\";\nimport { BlockPageUpdateWhileInReview } from \"./BlockPageUpdateWhileInReview.js\";\nimport { BlockPageFolderChangeWhileInReview } from \"./BlockPageFolderChangeWhileInReview.js\";\nimport { NullReviewStateOnPageRevisionCreate } from \"./NullReviewStateOnPageRevisionCreate.js\";\nimport { NullReviewStateOnGraduatedVariantDecorator } from \"./NullReviewStateOnGraduatedVariantDecorator.js\";\n\n/**\n * `wb.page` adapter rules on the Website Builder page events (R52). The page model publishes no\n * CMS entry events, so every page rule, the save block and the revision-create reset included,\n * listens here.\n */\nexport const WbHooksFeature = createFeature({\n    name: \"WebsiteBuilderWorkflows/Hooks\",\n    register(container) {\n        container.register(RequireApprovedReviewOnPagePublish);\n        container.register(BlockPageMoveWhileInReview);\n        // The save block (R54), its folder-change twin (D84) and the new-revision reset (D59).\n        container.register(BlockPageUpdateWhileInReview);\n        container.register(BlockPageFolderChangeWhileInReview);\n        container.register(NullReviewStateOnPageRevisionCreate);\n        // A graduated variant is a new revision created through the CMS directly (D59).\n        container.registerDecorator(NullReviewStateOnGraduatedVariantDecorator);\n        // Trash and delete (D134, R73) and review cleanup after a page delete (R56, R81).\n        container.register(BlockPageTrashWhileInReview);\n        container.register(BlockPageDeleteWhileInReview);\n        container.register(DeleteReviewsOnPageDelete);\n        // The page revision delete (R235): the same block and cleanup for one revision.\n        container.register(BlockPageRevisionDeleteWhileInReview);\n        container.register(DeleteReviewsOnPageRevisionDelete);\n    }\n});\n"],"names":["WbHooksFeature","createFeature","container","RequireApprovedReviewOnPagePublish","BlockPageMoveWhileInReview","BlockPageUpdateWhileInReview","BlockPageFolderChangeWhileInReview","NullReviewStateOnPageRevisionCreate","NullReviewStateOnGraduatedVariantDecorator","BlockPageTrashWhileInReview","BlockPageDeleteWhileInReview","DeleteReviewsOnPageDelete","BlockPageRevisionDeleteWhileInReview","DeleteReviewsOnPageRevisionDelete"],"mappings":";;;;;;;;;;;;AAkBO,MAAMA,iBAAiBC,cAAc;IACxC,MAAM;IACN,UAASC,SAAS;QACdA,UAAU,QAAQ,CAACC;QACnBD,UAAU,QAAQ,CAACE;QAEnBF,UAAU,QAAQ,CAACG;QACnBH,UAAU,QAAQ,CAACI;QACnBJ,UAAU,QAAQ,CAACK;QAEnBL,UAAU,iBAAiB,CAACM;QAE5BN,UAAU,QAAQ,CAACO;QACnBP,UAAU,QAAQ,CAACQ;QACnBR,UAAU,QAAQ,CAACS;QAEnBT,UAAU,QAAQ,CAACU;QACnBV,UAAU,QAAQ,CAACW;IACvB;AACJ"}

package/features/target/WbPageAccess/WbPageAccess.d.ts

@@ -0,0 +1,27 @@
+import { WbPermissions } from "@webiny/api-website-builder/features/permissions/abstractions.js";
+import { IdentityContext } from "@webiny/api-core/features/security/IdentityContext/index.js";
+import { FolderLevelPermissions } from "@webiny/api-aco/features/flp/FolderLevelPermissions/index.js";
+import type { FolderReadRule } from "@webiny/api-headless-cms-workflows/features/target/FolderReadRule.js";
+import type { WbPageTarget } from "../WbPageTargetReader/abstractions.js";
+import { WbPageAccess as Abstraction } from "./abstractions.js";
+/**
+ * Write and delete include read, because WB loads the page through `GetPageByIdUseCase` before it
+ * updates or trashes it (R82). Folder-level permissions as the ACO CMS decorators apply them to
+ * page entries, inline in each check, as `CmsEntryAccess` does (R78).
+ */
+declare class WbPageAccessImpl implements Abstraction.Interface {
+    private permissions;
+    private identityContext;
+    private folderLevelPermissions;
+    constructor(permissions: WbPermissions.Interface, identityContext: IdentityContext.Interface, folderLevelPermissions: FolderLevelPermissions.Interface);
+    canWriteAnyPage(): Promise<boolean>;
+    canDeleteAnyPage(): Promise<boolean>;
+    canRead(target: WbPageTarget, folderRule?: FolderReadRule): Promise<boolean>;
+    canReadInFolder(folderId: string | null, folderRule?: FolderReadRule): Promise<boolean>;
+    canWrite(target: WbPageTarget): Promise<boolean>;
+    canDelete(target: WbPageTarget): Promise<boolean>;
+}
+export declare const WbPageAccess: typeof WbPageAccessImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("./abstractions.js").IWbPageAccess>;
+};
+export {};

package/features/target/WbPageAccess/WbPageAccess.js

@@ -0,0 +1,84 @@
+import { WbPermissions } from "@webiny/api-website-builder/features/permissions/abstractions.js";
+import { IdentityContext } from "@webiny/api-core/features/security/IdentityContext/index.js";
+import { FolderLevelPermissions } from "@webiny/api-aco/features/flp/FolderLevelPermissions/index.js";
+import { ROOT_FOLDER } from "@webiny/api-website-builder/constants.js";
+import { WbPageAccess } from "./abstractions.js";
+class WbPageAccessImpl {
+    constructor(permissions, identityContext, folderLevelPermissions){
+        this.permissions = permissions;
+        this.identityContext = identityContext;
+        this.folderLevelPermissions = folderLevelPermissions;
+    }
+    canWriteAnyPage() {
+        return this.permissions.canEdit("page");
+    }
+    canDeleteAnyPage() {
+        const identity = this.identityContext.getIdentity();
+        return this.permissions.canDelete("page", {
+            createdBy: {
+                id: identity.id
+            }
+        });
+    }
+    async canRead(target, folderRule) {
+        if (!await this.permissions.canRead("page")) return false;
+        if (!await this.permissions.canAccess("page", target.page)) return false;
+        if (!this.folderLevelPermissions.canUseFolderLevelPermissions()) return true;
+        const folderId = target.page.location.folderId;
+        if (!folderId || folderId === ROOT_FOLDER) return true;
+        if (folderRule) return folderRule.canReadFolder(folderId);
+        const permissions = await this.folderLevelPermissions.getFolderLevelPermissions(folderId);
+        return this.folderLevelPermissions.canAccessFolderContent({
+            permissions,
+            rwd: "r"
+        });
+    }
+    async canReadInFolder(folderId, folderRule) {
+        if (!await this.permissions.canRead("page")) return false;
+        if (!this.folderLevelPermissions.canUseFolderLevelPermissions()) return true;
+        if (!folderId || folderId === ROOT_FOLDER) return true;
+        if (folderRule) return folderRule.canReadFolder(folderId);
+        const permissions = await this.folderLevelPermissions.getFolderLevelPermissions(folderId);
+        return this.folderLevelPermissions.canAccessFolderContent({
+            permissions,
+            rwd: "r"
+        });
+    }
+    async canWrite(target) {
+        if (!await this.permissions.canRead("page")) return false;
+        if (!await this.permissions.canAccess("page", target.page)) return false;
+        if (!await this.permissions.canEdit("page", target.page)) return false;
+        if (!this.folderLevelPermissions.canUseFolderLevelPermissions()) return true;
+        const folderId = target.page.location.folderId;
+        if (!folderId || folderId === ROOT_FOLDER) return true;
+        const permissions = await this.folderLevelPermissions.getFolderLevelPermissions(folderId);
+        return this.folderLevelPermissions.canAccessFolderContent({
+            permissions,
+            rwd: "w"
+        });
+    }
+    async canDelete(target) {
+        if (!await this.permissions.canRead("page")) return false;
+        if (!await this.permissions.canAccess("page", target.page)) return false;
+        if (!await this.permissions.canDelete("page", target.page)) return false;
+        if (!this.folderLevelPermissions.canUseFolderLevelPermissions()) return true;
+        const folderId = target.page.location.folderId;
+        if (!folderId || folderId === ROOT_FOLDER) return true;
+        const permissions = await this.folderLevelPermissions.getFolderLevelPermissions(folderId);
+        return this.folderLevelPermissions.canAccessFolderContent({
+            permissions,
+            rwd: "d"
+        });
+    }
+}
+const WbPageAccess_WbPageAccess = WbPageAccess.createImplementation({
+    implementation: WbPageAccessImpl,
+    dependencies: [
+        WbPermissions,
+        IdentityContext,
+        FolderLevelPermissions
+    ]
+});
+export { WbPageAccess_WbPageAccess as WbPageAccess };
+
+//# sourceMappingURL=WbPageAccess.js.map

package/features/target/WbPageAccess/WbPageAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/target/WbPageAccess/WbPageAccess.js","sources":["../../../../src/features/target/WbPageAccess/WbPageAccess.ts"],"sourcesContent":["import { WbPermissions } from \"@webiny/api-website-builder/features/permissions/abstractions.js\";\nimport { IdentityContext } from \"@webiny/api-core/features/security/IdentityContext/index.js\";\nimport { FolderLevelPermissions } from \"@webiny/api-aco/features/flp/FolderLevelPermissions/index.js\";\nimport { ROOT_FOLDER } from \"@webiny/api-website-builder/constants.js\";\nimport type { FolderReadRule } from \"@webiny/api-headless-cms-workflows/features/target/FolderReadRule.js\";\nimport type { WbPageTarget } from \"../WbPageTargetReader/abstractions.js\";\nimport { WbPageAccess as Abstraction } from \"./abstractions.js\";\n\n/**\n * Write and delete include read, because WB loads the page through `GetPageByIdUseCase` before it\n * updates or trashes it (R82). Folder-level permissions as the ACO CMS decorators apply them to\n * page entries, inline in each check, as `CmsEntryAccess` does (R78).\n */\nclass WbPageAccessImpl implements Abstraction.Interface {\n    public constructor(\n        private permissions: WbPermissions.Interface,\n        private identityContext: IdentityContext.Interface,\n        private folderLevelPermissions: FolderLevelPermissions.Interface\n    ) {}\n\n    public canWriteAnyPage(): Promise<boolean> {\n        return this.permissions.canEdit(\"page\");\n    }\n\n    public canDeleteAnyPage(): Promise<boolean> {\n        // Entity-level `canDelete` treats an own-only permission as \"no item, no match\"; passing\n        // the current identity as creator makes any delete permission pass.\n        const identity = this.identityContext.getIdentity();\n        return this.permissions.canDelete(\"page\", { createdBy: { id: identity.id } });\n    }\n\n    public async canRead(target: WbPageTarget, folderRule?: FolderReadRule): Promise<boolean> {\n        if (!(await this.permissions.canRead(\"page\"))) {\n            return false;\n        }\n        if (!(await this.permissions.canAccess(\"page\", target.page))) {\n            return false;\n        }\n        // Folder-level permissions are skipped when FLP is not in use for the identity (e.g. API\n        // keys) or the page is in the root folder, as the ACO CMS decorators do.\n        if (!this.folderLevelPermissions.canUseFolderLevelPermissions()) {\n            return true;\n        }\n        const folderId = target.page.location.folderId;\n        if (!folderId || folderId === ROOT_FOLDER) {\n            return true;\n        }\n        if (folderRule) {\n            return folderRule.canReadFolder(folderId);\n        }\n        const permissions = await this.folderLevelPermissions.getFolderLevelPermissions(folderId);\n        return this.folderLevelPermissions.canAccessFolderContent({ permissions, rwd: \"r\" });\n    }\n\n    public async canReadInFolder(\n        folderId: string | null,\n        folderRule?: FolderReadRule\n    ): Promise<boolean> {\n        if (!(await this.permissions.canRead(\"page\"))) {\n            return false;\n        }\n        // Folder-level permissions are skipped when FLP is not in use for the identity (e.g. API\n        // keys) or for the root folder, as the ACO CMS decorators do.\n        if (!this.folderLevelPermissions.canUseFolderLevelPermissions()) {\n            return true;\n        }\n        if (!folderId || folderId === ROOT_FOLDER) {\n            return true;\n        }\n        if (folderRule) {\n            return folderRule.canReadFolder(folderId);\n        }\n        const permissions = await this.folderLevelPermissions.getFolderLevelPermissions(folderId);\n        return this.folderLevelPermissions.canAccessFolderContent({ permissions, rwd: \"r\" });\n    }\n\n    public async canWrite(target: WbPageTarget): Promise<boolean> {\n        if (!(await this.permissions.canRead(\"page\"))) {\n            return false;\n        }\n        if (!(await this.permissions.canAccess(\"page\", target.page))) {\n            return false;\n        }\n        if (!(await this.permissions.canEdit(\"page\", target.page))) {\n            return false;\n        }\n        // Folder-level permissions are skipped when FLP is not in use for the identity (e.g. API\n        // keys) or the page is in the root folder, as the ACO CMS decorators do.\n        if (!this.folderLevelPermissions.canUseFolderLevelPermissions()) {\n            return true;\n        }\n        const folderId = target.page.location.folderId;\n        if (!folderId || folderId === ROOT_FOLDER) {\n            return true;\n        }\n        const permissions = await this.folderLevelPermissions.getFolderLevelPermissions(folderId);\n        return this.folderLevelPermissions.canAccessFolderContent({ permissions, rwd: \"w\" });\n    }\n\n    public async canDelete(target: WbPageTarget): Promise<boolean> {\n        if (!(await this.permissions.canRead(\"page\"))) {\n            return false;\n        }\n        if (!(await this.permissions.canAccess(\"page\", target.page))) {\n            return false;\n        }\n        if (!(await this.permissions.canDelete(\"page\", target.page))) {\n            return false;\n        }\n        // Folder-level permissions are skipped when FLP is not in use for the identity (e.g. API\n        // keys) or the page is in the root folder, as the ACO CMS decorators do.\n        if (!this.folderLevelPermissions.canUseFolderLevelPermissions()) {\n            return true;\n        }\n        const folderId = target.page.location.folderId;\n        if (!folderId || folderId === ROOT_FOLDER) {\n            return true;\n        }\n        const permissions = await this.folderLevelPermissions.getFolderLevelPermissions(folderId);\n        return this.folderLevelPermissions.canAccessFolderContent({ permissions, rwd: \"d\" });\n    }\n}\n\nexport const WbPageAccess = Abstraction.createImplementation({\n    implementation: WbPageAccessImpl,\n    dependencies: [WbPermissions, IdentityContext, FolderLevelPermissions]\n});\n"],"names":["WbPageAccessImpl","permissions","identityContext","folderLevelPermissions","identity","target","folderRule","folderId","ROOT_FOLDER","WbPageAccess","Abstraction","WbPermissions","IdentityContext","FolderLevelPermissions"],"mappings":";;;;;AAaA,MAAMA;IACF,YACYC,WAAoC,EACpCC,eAA0C,EAC1CC,sBAAwD,CAClE;aAHUF,WAAW,GAAXA;aACAC,eAAe,GAAfA;aACAC,sBAAsB,GAAtBA;IACT;IAEI,kBAAoC;QACvC,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;IACpC;IAEO,mBAAqC;QAGxC,MAAMC,WAAW,IAAI,CAAC,eAAe,CAAC,WAAW;QACjD,OAAO,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQ;YAAE,WAAW;gBAAE,IAAIA,SAAS,EAAE;YAAC;QAAE;IAC/E;IAEA,MAAa,QAAQC,MAAoB,EAAEC,UAA2B,EAAoB;QACtF,IAAI,CAAE,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,SACjC,OAAO;QAEX,IAAI,CAAE,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQD,OAAO,IAAI,GACtD,OAAO;QAIX,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,4BAA4B,IACzD,OAAO;QAEX,MAAME,WAAWF,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ;QAC9C,IAAI,CAACE,YAAYA,aAAaC,aAC1B,OAAO;QAEX,IAAIF,YACA,OAAOA,WAAW,aAAa,CAACC;QAEpC,MAAMN,cAAc,MAAM,IAAI,CAAC,sBAAsB,CAAC,yBAAyB,CAACM;QAChF,OAAO,IAAI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;YAAEN;YAAa,KAAK;QAAI;IACtF;IAEA,MAAa,gBACTM,QAAuB,EACvBD,UAA2B,EACX;QAChB,IAAI,CAAE,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,SACjC,OAAO;QAIX,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,4BAA4B,IACzD,OAAO;QAEX,IAAI,CAACC,YAAYA,aAAaC,aAC1B,OAAO;QAEX,IAAIF,YACA,OAAOA,WAAW,aAAa,CAACC;QAEpC,MAAMN,cAAc,MAAM,IAAI,CAAC,sBAAsB,CAAC,yBAAyB,CAACM;QAChF,OAAO,IAAI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;YAAEN;YAAa,KAAK;QAAI;IACtF;IAEA,MAAa,SAASI,MAAoB,EAAoB;QAC1D,IAAI,CAAE,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,SACjC,OAAO;QAEX,IAAI,CAAE,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQA,OAAO,IAAI,GACtD,OAAO;QAEX,IAAI,CAAE,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQA,OAAO,IAAI,GACpD,OAAO;QAIX,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,4BAA4B,IACzD,OAAO;QAEX,MAAME,WAAWF,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ;QAC9C,IAAI,CAACE,YAAYA,aAAaC,aAC1B,OAAO;QAEX,MAAMP,cAAc,MAAM,IAAI,CAAC,sBAAsB,CAAC,yBAAyB,CAACM;QAChF,OAAO,IAAI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;YAAEN;YAAa,KAAK;QAAI;IACtF;IAEA,MAAa,UAAUI,MAAoB,EAAoB;QAC3D,IAAI,CAAE,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,SACjC,OAAO;QAEX,IAAI,CAAE,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQA,OAAO,IAAI,GACtD,OAAO;QAEX,IAAI,CAAE,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQA,OAAO,IAAI,GACtD,OAAO;QAIX,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,4BAA4B,IACzD,OAAO;QAEX,MAAME,WAAWF,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ;QAC9C,IAAI,CAACE,YAAYA,aAAaC,aAC1B,OAAO;QAEX,MAAMP,cAAc,MAAM,IAAI,CAAC,sBAAsB,CAAC,yBAAyB,CAACM;QAChF,OAAO,IAAI,CAAC,sBAAsB,CAAC,sBAAsB,CAAC;YAAEN;YAAa,KAAK;QAAI;IACtF;AACJ;AAEO,MAAMQ,4BAAeC,aAAAA,oBAAgC,CAAC;IACzD,gBAAgBV;IAChB,cAAc;QAACW;QAAeC;QAAiBC;KAAuB;AAC1E"}

package/features/target/WbPageAccess/abstractions.d.ts

@@ -0,0 +1,39 @@
+import type { FolderReadRule } from "@webiny/api-headless-cms-workflows/features/target/FolderReadRule.js";
+import type { WbPageTarget } from "../WbPageTargetReader/abstractions.js";
+export interface IWbPageAccess {
+    /**
+     * Entity-level write permission (any page), as WB checks it before loading a page; lets the
+     * request wrapper refuse before it reads anything (R75).
+     */
+    canWriteAnyPage(): Promise<boolean>;
+    /**
+     * Entity-level delete permission (any page; an own-only permission passes), checked before
+     * anything is read so the cancel-for-delete wrapper reveals nothing (R86).
+     */
+    canDeleteAnyPage(): Promise<boolean>;
+    /**
+     * Read access of the current identity (review actions, get review). With `folderRule`, the
+     * folder is decided by the rule (folder permissions loaded once for many checks, Q79), so the
+     * check reads nothing; without it, the folder's permissions are read for this check.
+     */
+    canRead(target: WbPageTarget, folderRule?: FolderReadRule): Promise<boolean>;
+    /**
+     * Read access of the current identity to pages in a folder, without a page (the routing
+     * inspector, R121): `wb.page` read plus folder content read. Root (`null` or `"root"`) or FLP
+     * not in use: the page read only. No own-only check without a page (A47).
+     */
+    canReadInFolder(folderId: string | null, folderRule?: FolderReadRule): Promise<boolean>;
+    /** Write access of the current identity (request a review, D77); includes read (R82). */
+    canWrite(target: WbPageTarget): Promise<boolean>;
+    /** Delete access of the current identity (trash, delete, cancel-for-delete, D134). */
+    canDelete(target: WbPageTarget): Promise<boolean>;
+}
+/**
+ * Website Builder's own page access for the current identity (R47, A25): `wb.page` permissions
+ * (incl. own-only) as `GetPageByIdUseCase`, `UpdatePageUseCase` and `TrashPageUseCase` check them,
+ * plus folder-level permissions on the page's folder.
+ */
+export declare const WbPageAccess: import("@webiny/di").Abstraction<IWbPageAccess>;
+export declare namespace WbPageAccess {
+    type Interface = IWbPageAccess;
+}

package/features/target/WbPageAccess/abstractions.js

@@ -0,0 +1,5 @@
+import { createAbstraction } from "@webiny/feature/api";
+const WbPageAccess = createAbstraction("WbPageAccess");
+export { WbPageAccess };
+
+//# sourceMappingURL=abstractions.js.map

package/features/target/WbPageAccess/abstractions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/target/WbPageAccess/abstractions.js","sources":["../../../../src/features/target/WbPageAccess/abstractions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport type { FolderReadRule } from \"@webiny/api-headless-cms-workflows/features/target/FolderReadRule.js\";\nimport type { WbPageTarget } from \"../WbPageTargetReader/abstractions.js\";\n\nexport interface IWbPageAccess {\n    /**\n     * Entity-level write permission (any page), as WB checks it before loading a page; lets the\n     * request wrapper refuse before it reads anything (R75).\n     */\n    canWriteAnyPage(): Promise<boolean>;\n    /**\n     * Entity-level delete permission (any page; an own-only permission passes), checked before\n     * anything is read so the cancel-for-delete wrapper reveals nothing (R86).\n     */\n    canDeleteAnyPage(): Promise<boolean>;\n    /**\n     * Read access of the current identity (review actions, get review). With `folderRule`, the\n     * folder is decided by the rule (folder permissions loaded once for many checks, Q79), so the\n     * check reads nothing; without it, the folder's permissions are read for this check.\n     */\n    canRead(target: WbPageTarget, folderRule?: FolderReadRule): Promise<boolean>;\n\n    /**\n     * Read access of the current identity to pages in a folder, without a page (the routing\n     * inspector, R121): `wb.page` read plus folder content read. Root (`null` or `\"root\"`) or FLP\n     * not in use: the page read only. No own-only check without a page (A47).\n     */\n    canReadInFolder(folderId: string | null, folderRule?: FolderReadRule): Promise<boolean>;\n    /** Write access of the current identity (request a review, D77); includes read (R82). */\n    canWrite(target: WbPageTarget): Promise<boolean>;\n    /** Delete access of the current identity (trash, delete, cancel-for-delete, D134). */\n    canDelete(target: WbPageTarget): Promise<boolean>;\n}\n\n/**\n * Website Builder's own page access for the current identity (R47, A25): `wb.page` permissions\n * (incl. own-only) as `GetPageByIdUseCase`, `UpdatePageUseCase` and `TrashPageUseCase` check them,\n * plus folder-level permissions on the page's folder.\n */\nexport const WbPageAccess = createAbstraction<IWbPageAccess>(\"WbPageAccess\");\n\nexport namespace WbPageAccess {\n    export type Interface = IWbPageAccess;\n}\n"],"names":["WbPageAccess","createAbstraction"],"mappings":";AAuCO,MAAMA,eAAeC,kBAAiC"}

package/features/target/WbPageAccess/index.d.ts

@@ -0,0 +1 @@
+export { WbPageAccess } from "./abstractions.js";

package/features/target/WbPageAccess/index.js

@@ -0,0 +1 @@
+export { WbPageAccess } from "./abstractions.js";

package/features/target/WbPageDeniedFolders/WbPageDeniedFolders.d.ts

@@ -0,0 +1,20 @@
+import { IdentityContext } from "@webiny/api-core/features/security/IdentityContext/index.js";
+import { FolderLevelPermissions } from "@webiny/api-aco/features/flp/FolderLevelPermissions/index.js";
+import type { FolderReadRule } from "@webiny/api-headless-cms-workflows/features/target/FolderReadRule.js";
+import { WbPageDeniedFolders as Abstraction } from "./abstractions.js";
+/**
+ * Registered per request, so the cache lives for one request. Keyed by identity id, because
+ * `withIdentity` can switch the identity mid-request.
+ */
+declare class WbPageDeniedFoldersImpl implements Abstraction.Interface {
+    private identityContext;
+    private folderLevelPermissions;
+    private readonly cache;
+    constructor(identityContext: IdentityContext.Interface, folderLevelPermissions: FolderLevelPermissions.Interface);
+    listDeniedFolderIds(): Promise<string[]>;
+    createFolderReadRule(): Promise<FolderReadRule>;
+}
+export declare const WbPageDeniedFolders: typeof WbPageDeniedFoldersImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("./abstractions.js").IWbPageDeniedFolders>;
+};
+export {};