@webiny/api-workflows 0.0.0-unstable.9f53ea597d → 0.0.0-unstable.a85ef555b2

package/features/config/ListWorkflowTeams/index.js

@@ -0,0 +1 @@
+export { ListWorkflowTeamsUseCase } from "./abstractions.js";

package/features/config/ListWorkflowUsers/ListWorkflowUsersUseCase.d.ts

@@ -0,0 +1,17 @@
+import { FeatureFlags } from "@webiny/api-core/features/featureFlags/abstractions.js";
+import { IdentityContext } from "@webiny/api-core/features/security/IdentityContext/index.js";
+import { ListUsersUseCase } from "@webiny/api-core/features/users/ListUsers/index.js";
+import { WorkflowEditorAccess } from "../../../features/permissions/WorkflowEditorAccess/index.js";
+import { ListWorkflowUsersUseCase as UseCase } from "./abstractions.js";
+declare class ListWorkflowUsersUseCaseImpl implements UseCase.Interface {
+    private editorAccess;
+    private featureFlags;
+    private identityContext;
+    private listUsers;
+    constructor(editorAccess: WorkflowEditorAccess.Interface, featureFlags: FeatureFlags.Interface, identityContext: IdentityContext.Interface, listUsers: ListUsersUseCase.Interface);
+    execute(input?: UseCase.Input): UseCase.Return;
+}
+export declare const ListWorkflowUsersUseCase: typeof ListWorkflowUsersUseCaseImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("./abstractions.js").IListWorkflowUsersUseCase>;
+};
+export {};

package/features/config/ListWorkflowUsers/ListWorkflowUsersUseCase.js

@@ -0,0 +1,105 @@
+import { Result } from "@webiny/feature/api";
+import { FeatureFlags } from "@webiny/api-core/features/featureFlags/abstractions.js";
+import { IdentityContext } from "@webiny/api-core/features/security/IdentityContext/index.js";
+import { ListUsersUseCase } from "@webiny/api-core/features/users/ListUsers/index.js";
+import { DEFAULT_USER_LIST_LIMIT, MAX_USER_LIST_LIMIT, TEAMS_FEATURE_FLAG } from "../../../constants.js";
+import { WorkflowLookupError, WorkflowValidationError } from "../../../domain/workflow/errors.js";
+import { WorkflowEditorAccess } from "../../permissions/WorkflowEditorAccess/index.js";
+import { ListWorkflowUsersUseCase } from "./abstractions.js";
+const toListedUser = (user, teamsEnabled)=>{
+    const teamIds = teamsEnabled ? [
+        ...user.teams ?? []
+    ] : [];
+    return {
+        id: user.id,
+        displayName: user.displayName,
+        teamIds
+    };
+};
+class ListWorkflowUsersUseCaseImpl {
+    constructor(editorAccess, featureFlags, identityContext, listUsers){
+        this.editorAccess = editorAccess;
+        this.featureFlags = featureFlags;
+        this.identityContext = identityContext;
+        this.listUsers = listUsers;
+    }
+    async execute(input = {}) {
+        const access = await this.editorAccess.check("list users");
+        if (access.isFail()) return Result.fail(access.error);
+        const ids = input.ids ? [
+            ...new Set(input.ids)
+        ] : null;
+        if (ids && 0 === ids.length) return Result.ok({
+            users: [],
+            missingIds: []
+        });
+        if (ids && ids.length > MAX_USER_LIST_LIMIT) return Result.fail(new WorkflowValidationError("Too many user ids."));
+        let teamsEnabled;
+        try {
+            teamsEnabled = this.featureFlags.get().isEnabled(TEAMS_FEATURE_FLAG);
+        } catch (error) {
+            return Result.fail(new WorkflowLookupError(error instanceof Error ? error : new Error(String(error))));
+        }
+        const teamIds = !ids && input.teamIds ? [
+            ...new Set(input.teamIds)
+        ] : null;
+        if (teamIds && (!teamsEnabled || 0 === teamIds.length)) return Result.ok({
+            users: [],
+            missingIds: []
+        });
+        const listInput = {};
+        if (ids) listInput.where = {
+            id_in: ids
+        };
+        if (teamIds) listInput.where = {
+            teams_in: teamIds
+        };
+        let listed;
+        try {
+            listed = await this.identityContext.withoutAuthorization(()=>this.listUsers.execute(listInput));
+        } catch (error) {
+            return Result.fail(new WorkflowLookupError(error instanceof Error ? error : new Error(String(error))));
+        }
+        if (listed.isFail()) return Result.fail(new WorkflowLookupError(listed.error));
+        if (ids) {
+            const byId = new Map(listed.value.map((user)=>[
+                    user.id,
+                    user
+                ]));
+            const users = [];
+            const missingIds = [];
+            for (const id of ids){
+                const user = byId.get(id);
+                if (user) users.push(toListedUser(user, teamsEnabled));
+                else missingIds.push(id);
+            }
+            return Result.ok({
+                users,
+                missingIds
+            });
+        }
+        const requestedLimit = "number" == typeof input.limit && Number.isFinite(input.limit) ? Math.floor(input.limit) : DEFAULT_USER_LIST_LIMIT;
+        const limit = Math.min(Math.max(requestedLimit, 1), MAX_USER_LIST_LIMIT);
+        const term = input.search?.trim().toLowerCase() ?? "";
+        const users = listed.value.filter((user)=>{
+            if (!term) return true;
+            return user.displayName.toLowerCase().includes(term) || user.email.toLowerCase().includes(term);
+        }).sort((a, b)=>a.displayName.localeCompare(b.displayName) || a.id.localeCompare(b.id)).slice(0, limit).map((user)=>toListedUser(user, teamsEnabled));
+        return Result.ok({
+            users,
+            missingIds: []
+        });
+    }
+}
+const ListWorkflowUsersUseCase_ListWorkflowUsersUseCase = ListWorkflowUsersUseCase.createImplementation({
+    implementation: ListWorkflowUsersUseCaseImpl,
+    dependencies: [
+        WorkflowEditorAccess,
+        FeatureFlags,
+        IdentityContext,
+        ListUsersUseCase
+    ]
+});
+export { ListWorkflowUsersUseCase_ListWorkflowUsersUseCase as ListWorkflowUsersUseCase };
+
+//# sourceMappingURL=ListWorkflowUsersUseCase.js.map

package/features/config/ListWorkflowUsers/ListWorkflowUsersUseCase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/config/ListWorkflowUsers/ListWorkflowUsersUseCase.js","sources":["../../../../src/features/config/ListWorkflowUsers/ListWorkflowUsersUseCase.ts"],"sourcesContent":["import { Result } from \"@webiny/feature/api\";\nimport { FeatureFlags } from \"@webiny/api-core/features/featureFlags/abstractions.js\";\nimport { IdentityContext } from \"@webiny/api-core/features/security/IdentityContext/index.js\";\nimport { ListUsersUseCase } from \"@webiny/api-core/features/users/ListUsers/index.js\";\nimport type { ListUsersInput } from \"@webiny/api-core/features/users/shared/types.js\";\nimport type { AdminUser } from \"@webiny/api-core/types/users.js\";\nimport { DEFAULT_USER_LIST_LIMIT } from \"~/constants.js\";\nimport { MAX_USER_LIST_LIMIT } from \"~/constants.js\";\nimport { TEAMS_FEATURE_FLAG } from \"~/constants.js\";\nimport type { WorkflowListedUser } from \"~/domain/config/types.js\";\nimport { WorkflowLookupError, WorkflowValidationError } from \"~/domain/workflow/errors.js\";\nimport { WorkflowEditorAccess } from \"~/features/permissions/WorkflowEditorAccess/index.js\";\nimport { ListWorkflowUsersUseCase as UseCase } from \"./abstractions.js\";\n\n/** The team ids are the user's own list, and only while teams are on (R286). */\nconst toListedUser = (user: AdminUser, teamsEnabled: boolean): WorkflowListedUser => {\n    const teamIds = teamsEnabled ? [...(user.teams ?? [])] : [];\n    return { id: user.id, displayName: user.displayName, teamIds };\n};\n\nclass ListWorkflowUsersUseCaseImpl implements UseCase.Interface {\n    constructor(\n        private editorAccess: WorkflowEditorAccess.Interface,\n        private featureFlags: FeatureFlags.Interface,\n        private identityContext: IdentityContext.Interface,\n        private listUsers: ListUsersUseCase.Interface\n    ) {}\n\n    async execute(input: UseCase.Input = {}): UseCase.Return {\n        const access = await this.editorAccess.check(\"list users\");\n        if (access.isFail()) {\n            return Result.fail(access.error);\n        }\n\n        const ids = input.ids ? [...new Set(input.ids)] : null;\n        if (ids && ids.length === 0) {\n            return Result.ok({ users: [], missingIds: [] });\n        }\n        // R126: counted after de-duplication, the number of ids the lookup asks for.\n        if (ids && ids.length > MAX_USER_LIST_LIMIT) {\n            return Result.fail(new WorkflowValidationError(\"Too many user ids.\"));\n        }\n\n        // R287: read again on every request, never cached at registration.\n        let teamsEnabled: boolean;\n        try {\n            teamsEnabled = this.featureFlags.get().isEnabled(TEAMS_FEATURE_FLAG);\n        } catch (error) {\n            return Result.fail(\n                new WorkflowLookupError(error instanceof Error ? error : new Error(String(error)))\n            );\n        }\n\n        // R286: an ids lookup ignores the team filter. An empty filter, or a filter while teams\n        // are off, matches no user, so there is nothing to look up.\n        const teamIds = !ids && input.teamIds ? [...new Set(input.teamIds)] : null;\n        if (teamIds && (!teamsEnabled || teamIds.length === 0)) {\n            return Result.ok({ users: [], missingIds: [] });\n        }\n\n        const listInput: ListUsersInput = {};\n        if (ids) {\n            listInput.where = { id_in: ids };\n        }\n        if (teamIds) {\n            listInput.where = { teams_in: teamIds };\n        }\n\n        // A membership lookup, not an access decision: `ListUsers` needs `adminUsers.user` (D48).\n        let listed: Result<AdminUser[], ListUsersUseCase.Error>;\n        try {\n            listed = await this.identityContext.withoutAuthorization(() => {\n                return this.listUsers.execute(listInput);\n            });\n        } catch (error) {\n            return Result.fail(\n                new WorkflowLookupError(error instanceof Error ? error : new Error(String(error)))\n            );\n        }\n        if (listed.isFail()) {\n            return Result.fail(new WorkflowLookupError(listed.error));\n        }\n\n        if (ids) {\n            const byId = new Map(listed.value.map(user => [user.id, user]));\n            const users: WorkflowListedUser[] = [];\n            const missingIds: string[] = [];\n            for (const id of ids) {\n                const user = byId.get(id);\n                if (user) {\n                    users.push(toListedUser(user, teamsEnabled));\n                } else {\n                    missingIds.push(id);\n                }\n            }\n            return Result.ok({ users, missingIds });\n        }\n\n        // A missing or non-finite limit takes the default; others round down into 1..200 (R92).\n        const requestedLimit =\n            typeof input.limit === \"number\" && Number.isFinite(input.limit)\n                ? Math.floor(input.limit)\n                : DEFAULT_USER_LIST_LIMIT;\n        const limit = Math.min(Math.max(requestedLimit, 1), MAX_USER_LIST_LIMIT);\n\n        const term = input.search?.trim().toLowerCase() ?? \"\";\n        const users = listed.value\n            .filter(user => {\n                if (!term) {\n                    return true;\n                }\n                return (\n                    user.displayName.toLowerCase().includes(term) ||\n                    user.email.toLowerCase().includes(term)\n                );\n            })\n            .sort((a, b) => {\n                return a.displayName.localeCompare(b.displayName) || a.id.localeCompare(b.id);\n            })\n            .slice(0, limit)\n            .map(user => toListedUser(user, teamsEnabled));\n        return Result.ok({ users, missingIds: [] });\n    }\n}\n\nexport const ListWorkflowUsersUseCase = UseCase.createImplementation({\n    implementation: ListWorkflowUsersUseCaseImpl,\n    dependencies: [WorkflowEditorAccess, FeatureFlags, IdentityContext, ListUsersUseCase]\n});\n"],"names":["toListedUser","user","teamsEnabled","teamIds","ListWorkflowUsersUseCaseImpl","editorAccess","featureFlags","identityContext","listUsers","input","access","Result","ids","Set","MAX_USER_LIST_LIMIT","WorkflowValidationError","TEAMS_FEATURE_FLAG","error","WorkflowLookupError","Error","String","listInput","listed","byId","Map","users","missingIds","id","requestedLimit","Number","Math","DEFAULT_USER_LIST_LIMIT","limit","term","a","b","ListWorkflowUsersUseCase","UseCase","WorkflowEditorAccess","FeatureFlags","IdentityContext","ListUsersUseCase"],"mappings":";;;;;;;;AAeA,MAAMA,eAAe,CAACC,MAAiBC;IACnC,MAAMC,UAAUD,eAAe;WAAKD,KAAK,KAAK,IAAI,EAAE;KAAE,GAAG,EAAE;IAC3D,OAAO;QAAE,IAAIA,KAAK,EAAE;QAAE,aAAaA,KAAK,WAAW;QAAEE;IAAQ;AACjE;AAEA,MAAMC;IACF,YACYC,YAA4C,EAC5CC,YAAoC,EACpCC,eAA0C,EAC1CC,SAAqC,CAC/C;aAJUH,YAAY,GAAZA;aACAC,YAAY,GAAZA;aACAC,eAAe,GAAfA;aACAC,SAAS,GAATA;IACT;IAEH,MAAM,QAAQC,QAAuB,CAAC,CAAC,EAAkB;QACrD,MAAMC,SAAS,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAC7C,IAAIA,OAAO,MAAM,IACb,OAAOC,OAAO,IAAI,CAACD,OAAO,KAAK;QAGnC,MAAME,MAAMH,MAAM,GAAG,GAAG;eAAI,IAAII,IAAIJ,MAAM,GAAG;SAAE,GAAG;QAClD,IAAIG,OAAOA,AAAe,MAAfA,IAAI,MAAM,EACjB,OAAOD,OAAO,EAAE,CAAC;YAAE,OAAO,EAAE;YAAE,YAAY,EAAE;QAAC;QAGjD,IAAIC,OAAOA,IAAI,MAAM,GAAGE,qBACpB,OAAOH,OAAO,IAAI,CAAC,IAAII,wBAAwB;QAInD,IAAIb;QACJ,IAAI;YACAA,eAAe,IAAI,CAAC,YAAY,CAAC,GAAG,GAAG,SAAS,CAACc;QACrD,EAAE,OAAOC,OAAO;YACZ,OAAON,OAAO,IAAI,CACd,IAAIO,oBAAoBD,iBAAiBE,QAAQF,QAAQ,IAAIE,MAAMC,OAAOH;QAElF;QAIA,MAAMd,UAAU,CAACS,OAAOH,MAAM,OAAO,GAAG;eAAI,IAAII,IAAIJ,MAAM,OAAO;SAAE,GAAG;QACtE,IAAIN,WAAY,EAACD,gBAAgBC,AAAmB,MAAnBA,QAAQ,MAAM,AAAK,GAChD,OAAOQ,OAAO,EAAE,CAAC;YAAE,OAAO,EAAE;YAAE,YAAY,EAAE;QAAC;QAGjD,MAAMU,YAA4B,CAAC;QACnC,IAAIT,KACAS,UAAU,KAAK,GAAG;YAAE,OAAOT;QAAI;QAEnC,IAAIT,SACAkB,UAAU,KAAK,GAAG;YAAE,UAAUlB;QAAQ;QAI1C,IAAImB;QACJ,IAAI;YACAA,SAAS,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,IAC9C,IAAI,CAAC,SAAS,CAAC,OAAO,CAACD;QAEtC,EAAE,OAAOJ,OAAO;YACZ,OAAON,OAAO,IAAI,CACd,IAAIO,oBAAoBD,iBAAiBE,QAAQF,QAAQ,IAAIE,MAAMC,OAAOH;QAElF;QACA,IAAIK,OAAO,MAAM,IACb,OAAOX,OAAO,IAAI,CAAC,IAAIO,oBAAoBI,OAAO,KAAK;QAG3D,IAAIV,KAAK;YACL,MAAMW,OAAO,IAAIC,IAAIF,OAAO,KAAK,CAAC,GAAG,CAACrB,CAAAA,OAAQ;oBAACA,KAAK,EAAE;oBAAEA;iBAAK;YAC7D,MAAMwB,QAA8B,EAAE;YACtC,MAAMC,aAAuB,EAAE;YAC/B,KAAK,MAAMC,MAAMf,IAAK;gBAClB,MAAMX,OAAOsB,KAAK,GAAG,CAACI;gBACtB,IAAI1B,MACAwB,MAAM,IAAI,CAACzB,aAAaC,MAAMC;qBAE9BwB,WAAW,IAAI,CAACC;YAExB;YACA,OAAOhB,OAAO,EAAE,CAAC;gBAAEc;gBAAOC;YAAW;QACzC;QAGA,MAAME,iBACF,AAAuB,YAAvB,OAAOnB,MAAM,KAAK,IAAiBoB,OAAO,QAAQ,CAACpB,MAAM,KAAK,IACxDqB,KAAK,KAAK,CAACrB,MAAM,KAAK,IACtBsB;QACV,MAAMC,QAAQF,KAAK,GAAG,CAACA,KAAK,GAAG,CAACF,gBAAgB,IAAId;QAEpD,MAAMmB,OAAOxB,MAAM,MAAM,EAAE,OAAO,iBAAiB;QACnD,MAAMgB,QAAQH,OAAO,KAAK,CACrB,MAAM,CAACrB,CAAAA;YACJ,IAAI,CAACgC,MACD,OAAO;YAEX,OACIhC,KAAK,WAAW,CAAC,WAAW,GAAG,QAAQ,CAACgC,SACxChC,KAAK,KAAK,CAAC,WAAW,GAAG,QAAQ,CAACgC;QAE1C,GACC,IAAI,CAAC,CAACC,GAAGC,IACCD,EAAE,WAAW,CAAC,aAAa,CAACC,EAAE,WAAW,KAAKD,EAAE,EAAE,CAAC,aAAa,CAACC,EAAE,EAAE,GAE/E,KAAK,CAAC,GAAGH,OACT,GAAG,CAAC/B,CAAAA,OAAQD,aAAaC,MAAMC;QACpC,OAAOS,OAAO,EAAE,CAAC;YAAEc;YAAO,YAAY,EAAE;QAAC;IAC7C;AACJ;AAEO,MAAMW,oDAA2BC,yBAAAA,oBAA4B,CAAC;IACjE,gBAAgBjC;IAChB,cAAc;QAACkC;QAAsBC;QAAcC;QAAiBC;KAAiB;AACzF"}

package/features/config/ListWorkflowUsers/abstractions.d.ts

@@ -0,0 +1,44 @@
+import { type Result } from "@webiny/feature/api";
+import type { WorkflowUserList } from "../../../domain/config/types.js";
+import type { WorkflowLookupError, WorkflowValidationError } from "../../../domain/workflow/errors.js";
+import type { WorkflowsNotAuthenticatedError, WorkflowsNotAuthorizedError } from "../../../domain/permissions/errors.js";
+export interface ListWorkflowUsersInput {
+    /** Case-insensitive substring of the display name or the email; blank lists everyone. */
+    search?: string | null;
+    /**
+     * Look these users up instead (D117), at most 200 distinct; `search`, `limit` and `teamIds`
+     * are ignored, so a saved target who left the teams still resolves.
+     */
+    ids?: string[] | null;
+    /**
+     * Only users who are in at least one of these teams (R286). Empty matches no user. With
+     * teams off a filter matches no user either. Null or absent is no filter.
+     */
+    teamIds?: string[] | null;
+    /** Rows of a search: 50 by default, 1..200 (R92). */
+    limit?: number | null;
+}
+export interface IListWorkflowUsersUseCaseErrors {
+    notAuthenticated: WorkflowsNotAuthenticatedError;
+    notAuthorized: WorkflowsNotAuthorizedError;
+    validation: WorkflowValidationError;
+    lookup: WorkflowLookupError;
+}
+type UseCaseError = IListWorkflowUsersUseCaseErrors[keyof IListWorkflowUsersUseCaseErrors];
+export interface IListWorkflowUsersUseCase {
+    execute(input?: ListWorkflowUsersInput): Promise<Result<WorkflowUserList, UseCaseError>>;
+}
+/**
+ * The tenant's users for the workflow editor, the settings page and the request dialog (spec 10,
+ * D48, D117, R123): needs `workflows.editor`. Reads users as the system (they need
+ * `adminUsers.user`) and returns only id, display name and team ids (none while teams are off,
+ * R286). The shared `listUsers` GraphQL operation calls this, never api-core directly.
+ */
+export declare const ListWorkflowUsersUseCase: import("@webiny/di").Abstraction<IListWorkflowUsersUseCase>;
+export declare namespace ListWorkflowUsersUseCase {
+    type Interface = IListWorkflowUsersUseCase;
+    type Input = ListWorkflowUsersInput;
+    type Error = UseCaseError;
+    type Return = Promise<Result<WorkflowUserList, UseCaseError>>;
+}
+export {};

package/features/config/ListWorkflowUsers/abstractions.js

@@ -0,0 +1,5 @@
+import { createAbstraction } from "@webiny/feature/api";
+const ListWorkflowUsersUseCase = createAbstraction("ListWorkflowUsersUseCase");
+export { ListWorkflowUsersUseCase };
+
+//# sourceMappingURL=abstractions.js.map

package/features/config/ListWorkflowUsers/abstractions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/config/ListWorkflowUsers/abstractions.js","sources":["../../../../src/features/config/ListWorkflowUsers/abstractions.ts"],"sourcesContent":["import { createAbstraction, type Result } from \"@webiny/feature/api\";\nimport type { WorkflowUserList } from \"~/domain/config/types.js\";\nimport type { WorkflowLookupError, WorkflowValidationError } from \"~/domain/workflow/errors.js\";\nimport type {\n    WorkflowsNotAuthenticatedError,\n    WorkflowsNotAuthorizedError\n} from \"~/domain/permissions/errors.js\";\n\nexport interface ListWorkflowUsersInput {\n    /** Case-insensitive substring of the display name or the email; blank lists everyone. */\n    search?: string | null;\n    /**\n     * Look these users up instead (D117), at most 200 distinct; `search`, `limit` and `teamIds`\n     * are ignored, so a saved target who left the teams still resolves.\n     */\n    ids?: string[] | null;\n    /**\n     * Only users who are in at least one of these teams (R286). Empty matches no user. With\n     * teams off a filter matches no user either. Null or absent is no filter.\n     */\n    teamIds?: string[] | null;\n    /** Rows of a search: 50 by default, 1..200 (R92). */\n    limit?: number | null;\n}\n\nexport interface IListWorkflowUsersUseCaseErrors {\n    notAuthenticated: WorkflowsNotAuthenticatedError;\n    notAuthorized: WorkflowsNotAuthorizedError;\n    validation: WorkflowValidationError;\n    lookup: WorkflowLookupError;\n}\n\ntype UseCaseError = IListWorkflowUsersUseCaseErrors[keyof IListWorkflowUsersUseCaseErrors];\n\nexport interface IListWorkflowUsersUseCase {\n    execute(input?: ListWorkflowUsersInput): Promise<Result<WorkflowUserList, UseCaseError>>;\n}\n\n/**\n * The tenant's users for the workflow editor, the settings page and the request dialog (spec 10,\n * D48, D117, R123): needs `workflows.editor`. Reads users as the system (they need\n * `adminUsers.user`) and returns only id, display name and team ids (none while teams are off,\n * R286). The shared `listUsers` GraphQL operation calls this, never api-core directly.\n */\nexport const ListWorkflowUsersUseCase = createAbstraction<IListWorkflowUsersUseCase>(\n    \"ListWorkflowUsersUseCase\"\n);\n\nexport namespace ListWorkflowUsersUseCase {\n    export type Interface = IListWorkflowUsersUseCase;\n    export type Input = ListWorkflowUsersInput;\n    export type Error = UseCaseError;\n    export type Return = Promise<Result<WorkflowUserList, UseCaseError>>;\n}\n"],"names":["ListWorkflowUsersUseCase","createAbstraction"],"mappings":";AA4CO,MAAMA,2BAA2BC,kBACpC"}

package/features/config/ListWorkflowUsers/feature.d.ts

@@ -0,0 +1,4 @@
+export declare const ListWorkflowUsersFeature: {
+    name: string;
+    register(container: import("@webiny/di").Container): void;
+};

package/features/config/ListWorkflowUsers/feature.js

@@ -0,0 +1,11 @@
+import { createFeature } from "@webiny/feature/api";
+import { ListWorkflowUsersUseCase } from "./ListWorkflowUsersUseCase.js";
+const ListWorkflowUsersFeature = createFeature({
+    name: "Workflows/ListWorkflowUsers",
+    register (container) {
+        container.register(ListWorkflowUsersUseCase);
+    }
+});
+export { ListWorkflowUsersFeature };
+
+//# sourceMappingURL=feature.js.map

package/features/config/ListWorkflowUsers/feature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/config/ListWorkflowUsers/feature.js","sources":["../../../../src/features/config/ListWorkflowUsers/feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { ListWorkflowUsersUseCase } from \"./ListWorkflowUsersUseCase.js\";\n\nexport const ListWorkflowUsersFeature = createFeature({\n    name: \"Workflows/ListWorkflowUsers\",\n    register(container) {\n        container.register(ListWorkflowUsersUseCase);\n    }\n});\n"],"names":["ListWorkflowUsersFeature","createFeature","container","ListWorkflowUsersUseCase"],"mappings":";;AAGO,MAAMA,2BAA2BC,cAAc;IAClD,MAAM;IACN,UAASC,SAAS;QACdA,UAAU,QAAQ,CAACC;IACvB;AACJ"}

package/features/config/ListWorkflowUsers/index.d.ts

@@ -0,0 +1,3 @@
+export { ListWorkflowUsersUseCase } from "./abstractions.js";
+export type { ListWorkflowUsersInput } from "./abstractions.js";
+export type { WorkflowListedUser, WorkflowUserList } from "../../../domain/config/types.js";

package/features/config/ListWorkflowUsers/index.js

@@ -0,0 +1 @@
+export { ListWorkflowUsersUseCase } from "./abstractions.js";

package/features/config/SaveWorkflowSettingsForEditor/SaveWorkflowSettingsForEditorUseCase.d.ts

@@ -0,0 +1,13 @@
+import { WorkflowEditorAccess } from "../../../features/permissions/WorkflowEditorAccess/index.js";
+import { SaveWorkflowSettingsUseCase } from "../../../features/settings/SaveWorkflowSettings/index.js";
+import { SaveWorkflowSettingsForEditorUseCase as UseCase } from "./abstractions.js";
+declare class SaveWorkflowSettingsForEditorUseCaseImpl implements UseCase.Interface {
+    private editorAccess;
+    private saveSettings;
+    constructor(editorAccess: WorkflowEditorAccess.Interface, saveSettings: SaveWorkflowSettingsUseCase.Interface);
+    execute(input: UseCase.Input): UseCase.Return;
+}
+export declare const SaveWorkflowSettingsForEditorUseCase: typeof SaveWorkflowSettingsForEditorUseCaseImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("./abstractions.js").ISaveWorkflowSettingsForEditorUseCase>;
+};
+export {};

package/features/config/SaveWorkflowSettingsForEditor/SaveWorkflowSettingsForEditorUseCase.js

@@ -0,0 +1,25 @@
+import { Result } from "@webiny/feature/api";
+import { WorkflowEditorAccess } from "../../permissions/WorkflowEditorAccess/index.js";
+import { SaveWorkflowSettingsUseCase } from "../../settings/SaveWorkflowSettings/index.js";
+import { SaveWorkflowSettingsForEditorUseCase } from "./abstractions.js";
+class SaveWorkflowSettingsForEditorUseCaseImpl {
+    constructor(editorAccess, saveSettings){
+        this.editorAccess = editorAccess;
+        this.saveSettings = saveSettings;
+    }
+    async execute(input) {
+        const access = await this.editorAccess.check("change the workflow settings");
+        if (access.isFail()) return Result.fail(access.error);
+        return this.saveSettings.execute(input);
+    }
+}
+const SaveWorkflowSettingsForEditorUseCase_SaveWorkflowSettingsForEditorUseCase = SaveWorkflowSettingsForEditorUseCase.createImplementation({
+    implementation: SaveWorkflowSettingsForEditorUseCaseImpl,
+    dependencies: [
+        WorkflowEditorAccess,
+        SaveWorkflowSettingsUseCase
+    ]
+});
+export { SaveWorkflowSettingsForEditorUseCase_SaveWorkflowSettingsForEditorUseCase as SaveWorkflowSettingsForEditorUseCase };
+
+//# sourceMappingURL=SaveWorkflowSettingsForEditorUseCase.js.map

package/features/config/SaveWorkflowSettingsForEditor/SaveWorkflowSettingsForEditorUseCase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/config/SaveWorkflowSettingsForEditor/SaveWorkflowSettingsForEditorUseCase.js","sources":["../../../../src/features/config/SaveWorkflowSettingsForEditor/SaveWorkflowSettingsForEditorUseCase.ts"],"sourcesContent":["import { Result } from \"@webiny/feature/api\";\nimport { WorkflowEditorAccess } from \"~/features/permissions/WorkflowEditorAccess/index.js\";\nimport { SaveWorkflowSettingsUseCase } from \"~/features/settings/SaveWorkflowSettings/index.js\";\nimport { SaveWorkflowSettingsForEditorUseCase as UseCase } from \"./abstractions.js\";\n\nclass SaveWorkflowSettingsForEditorUseCaseImpl implements UseCase.Interface {\n    constructor(\n        private editorAccess: WorkflowEditorAccess.Interface,\n        private saveSettings: SaveWorkflowSettingsUseCase.Interface\n    ) {}\n\n    async execute(input: UseCase.Input): UseCase.Return {\n        const access = await this.editorAccess.check(\"change the workflow settings\");\n        if (access.isFail()) {\n            return Result.fail(access.error);\n        }\n\n        return this.saveSettings.execute(input);\n    }\n}\n\nexport const SaveWorkflowSettingsForEditorUseCase = UseCase.createImplementation({\n    implementation: SaveWorkflowSettingsForEditorUseCaseImpl,\n    dependencies: [WorkflowEditorAccess, SaveWorkflowSettingsUseCase]\n});\n"],"names":["SaveWorkflowSettingsForEditorUseCaseImpl","editorAccess","saveSettings","input","access","Result","SaveWorkflowSettingsForEditorUseCase","UseCase","WorkflowEditorAccess","SaveWorkflowSettingsUseCase"],"mappings":";;;;AAKA,MAAMA;IACF,YACYC,YAA4C,EAC5CC,YAAmD,CAC7D;aAFUD,YAAY,GAAZA;aACAC,YAAY,GAAZA;IACT;IAEH,MAAM,QAAQC,KAAoB,EAAkB;QAChD,MAAMC,SAAS,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAC7C,IAAIA,OAAO,MAAM,IACb,OAAOC,OAAO,IAAI,CAACD,OAAO,KAAK;QAGnC,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAACD;IACrC;AACJ;AAEO,MAAMG,4EAAuCC,qCAAAA,oBAA4B,CAAC;IAC7E,gBAAgBP;IAChB,cAAc;QAACQ;QAAsBC;KAA4B;AACrE"}

package/features/config/SaveWorkflowSettingsForEditor/abstractions.d.ts

@@ -0,0 +1,27 @@
+import { type Result } from "@webiny/feature/api";
+import type { WorkflowSettings } from "../../../domain/settings/types.js";
+import type { WorkflowLookupError } from "../../../domain/workflow/errors.js";
+import type { WorkflowsNotAuthenticatedError, WorkflowsNotAuthorizedError } from "../../../domain/permissions/errors.js";
+import type { SaveWorkflowSettingsUseCase } from "../../../features/settings/SaveWorkflowSettings/index.js";
+export interface ISaveWorkflowSettingsForEditorUseCaseErrors {
+    notAuthenticated: WorkflowsNotAuthenticatedError;
+    notAuthorized: WorkflowsNotAuthorizedError;
+    lookup: WorkflowLookupError;
+    save: SaveWorkflowSettingsUseCase.Error;
+}
+type UseCaseError = ISaveWorkflowSettingsForEditorUseCaseErrors[keyof ISaveWorkflowSettingsForEditorUseCaseErrors];
+export interface ISaveWorkflowSettingsForEditorUseCase {
+    execute(input: WorkflowSettings): Promise<Result<WorkflowSettings, UseCaseError>>;
+}
+/**
+ * Save the whole settings record, last save wins (spec 4.4, D106, D133 point 2, R97): needs
+ * `workflows.editor`. The shared `updateSettings` GraphQL operation calls this.
+ */
+export declare const SaveWorkflowSettingsForEditorUseCase: import("@webiny/di").Abstraction<ISaveWorkflowSettingsForEditorUseCase>;
+export declare namespace SaveWorkflowSettingsForEditorUseCase {
+    type Interface = ISaveWorkflowSettingsForEditorUseCase;
+    type Input = WorkflowSettings;
+    type Error = UseCaseError;
+    type Return = Promise<Result<WorkflowSettings, UseCaseError>>;
+}
+export {};

package/features/config/SaveWorkflowSettingsForEditor/abstractions.js

@@ -0,0 +1,5 @@
+import { createAbstraction } from "@webiny/feature/api";
+const SaveWorkflowSettingsForEditorUseCase = createAbstraction("SaveWorkflowSettingsForEditorUseCase");
+export { SaveWorkflowSettingsForEditorUseCase };
+
+//# sourceMappingURL=abstractions.js.map

package/features/config/SaveWorkflowSettingsForEditor/abstractions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/config/SaveWorkflowSettingsForEditor/abstractions.js","sources":["../../../../src/features/config/SaveWorkflowSettingsForEditor/abstractions.ts"],"sourcesContent":["import { createAbstraction, type Result } from \"@webiny/feature/api\";\nimport type { WorkflowSettings } from \"~/domain/settings/types.js\";\nimport type { WorkflowLookupError } from \"~/domain/workflow/errors.js\";\nimport type {\n    WorkflowsNotAuthenticatedError,\n    WorkflowsNotAuthorizedError\n} from \"~/domain/permissions/errors.js\";\nimport type { SaveWorkflowSettingsUseCase } from \"~/features/settings/SaveWorkflowSettings/index.js\";\n\nexport interface ISaveWorkflowSettingsForEditorUseCaseErrors {\n    notAuthenticated: WorkflowsNotAuthenticatedError;\n    notAuthorized: WorkflowsNotAuthorizedError;\n    lookup: WorkflowLookupError;\n    save: SaveWorkflowSettingsUseCase.Error;\n}\n\ntype UseCaseError =\n    ISaveWorkflowSettingsForEditorUseCaseErrors[keyof ISaveWorkflowSettingsForEditorUseCaseErrors];\n\nexport interface ISaveWorkflowSettingsForEditorUseCase {\n    execute(input: WorkflowSettings): Promise<Result<WorkflowSettings, UseCaseError>>;\n}\n\n/**\n * Save the whole settings record, last save wins (spec 4.4, D106, D133 point 2, R97): needs\n * `workflows.editor`. The shared `updateSettings` GraphQL operation calls this.\n */\nexport const SaveWorkflowSettingsForEditorUseCase =\n    createAbstraction<ISaveWorkflowSettingsForEditorUseCase>(\n        \"SaveWorkflowSettingsForEditorUseCase\"\n    );\n\nexport namespace SaveWorkflowSettingsForEditorUseCase {\n    export type Interface = ISaveWorkflowSettingsForEditorUseCase;\n    export type Input = WorkflowSettings;\n    export type Error = UseCaseError;\n    export type Return = Promise<Result<WorkflowSettings, UseCaseError>>;\n}\n"],"names":["SaveWorkflowSettingsForEditorUseCase","createAbstraction"],"mappings":";AA2BO,MAAMA,uCACTC,kBACI"}

package/features/config/SaveWorkflowSettingsForEditor/feature.d.ts

@@ -0,0 +1,4 @@
+export declare const SaveWorkflowSettingsForEditorFeature: {
+    name: string;
+    register(container: import("@webiny/di").Container): void;
+};

package/features/config/SaveWorkflowSettingsForEditor/feature.js

@@ -0,0 +1,11 @@
+import { createFeature } from "@webiny/feature/api";
+import { SaveWorkflowSettingsForEditorUseCase } from "./SaveWorkflowSettingsForEditorUseCase.js";
+const SaveWorkflowSettingsForEditorFeature = createFeature({
+    name: "Workflows/SaveWorkflowSettingsForEditor",
+    register (container) {
+        container.register(SaveWorkflowSettingsForEditorUseCase);
+    }
+});
+export { SaveWorkflowSettingsForEditorFeature };
+
+//# sourceMappingURL=feature.js.map

package/features/config/SaveWorkflowSettingsForEditor/feature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/config/SaveWorkflowSettingsForEditor/feature.js","sources":["../../../../src/features/config/SaveWorkflowSettingsForEditor/feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { SaveWorkflowSettingsForEditorUseCase } from \"./SaveWorkflowSettingsForEditorUseCase.js\";\n\nexport const SaveWorkflowSettingsForEditorFeature = createFeature({\n    name: \"Workflows/SaveWorkflowSettingsForEditor\",\n    register(container) {\n        container.register(SaveWorkflowSettingsForEditorUseCase);\n    }\n});\n"],"names":["SaveWorkflowSettingsForEditorFeature","createFeature","container","SaveWorkflowSettingsForEditorUseCase"],"mappings":";;AAGO,MAAMA,uCAAuCC,cAAc;IAC9D,MAAM;IACN,UAASC,SAAS;QACdA,UAAU,QAAQ,CAACC;IACvB;AACJ"}

package/features/config/SaveWorkflowSettingsForEditor/index.d.ts

@@ -0,0 +1 @@
+export { SaveWorkflowSettingsForEditorUseCase } from "./abstractions.js";

package/features/config/SaveWorkflowSettingsForEditor/index.js

@@ -0,0 +1 @@
+export { SaveWorkflowSettingsForEditorUseCase } from "./abstractions.js";

package/features/identity/CandidateReadAccess/CandidateReadAccess.d.ts

@@ -0,0 +1,28 @@
+import { IdentityContext } from "@webiny/api-core/features/security/IdentityContext/index.js";
+import { TenantContext } from "@webiny/api-core/features/tenancy/TenantContext/index.js";
+import { CandidateReadAccess as Abstraction } from "./abstractions.js";
+/**
+ * The candidate's identity is built like the platform's own background identities
+ * (`TaskControl`, `ExecuteScheduledActionUseCase`): an `admin` identity with tenant access, whose
+ * roles and teams the authorizers load by id. Differences from a real login, accepted (A20):
+ * - Only users listed as admin users of the current tenant are evaluated: the caller passes the
+ *   user it listed (R68), so nothing is read here. A user without roles in this tenant still gets
+ *   `RolesTeamsAuthorizer`'s parent-tenant fallback, as at login.
+ * - A custom identity provider's `canAccessTenant` rule is not re-run; the stored user record is
+ *   the membership proof.
+ * - Roles and teams are the stored ones, synced from the identity provider at the user's last
+ *   login (`ExternalIdpUserSyncHandler`).
+ * One identity object per tenant and user is kept for the request, so api-core's permission cache
+ * (keyed by identity object and tenant, R69) loads each candidate once.
+ */
+declare class CandidateReadAccessImpl implements Abstraction.Interface {
+    private identityContext;
+    private tenantContext;
+    private readonly identities;
+    constructor(identityContext: IdentityContext.Interface, tenantContext: TenantContext.Interface);
+    canUserRead(user: Abstraction.User, check: () => Promise<boolean>): Promise<boolean>;
+}
+export declare const CandidateReadAccess: typeof CandidateReadAccessImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("./abstractions.js").ICandidateReadAccess>;
+};
+export {};

package/features/identity/CandidateReadAccess/CandidateReadAccess.js

@@ -0,0 +1,40 @@
+import { AuthenticatedIdentity, IdentityContext } from "@webiny/api-core/features/security/IdentityContext/index.js";
+import { TenantContext } from "@webiny/api-core/features/tenancy/TenantContext/index.js";
+import { CandidateReadAccess } from "./abstractions.js";
+class CandidateReadAccessImpl {
+    constructor(identityContext, tenantContext){
+        this.identityContext = identityContext;
+        this.tenantContext = tenantContext;
+        this.identities = new Map();
+    }
+    async canUserRead(user, check) {
+        try {
+            const key = `${this.tenantContext.getTenant().id}:${user.id}`;
+            let identity = this.identities.get(key);
+            if (!identity) {
+                identity = new AuthenticatedIdentity({
+                    id: user.id,
+                    displayName: user.displayName,
+                    type: "admin",
+                    context: {
+                        canAccessTenant: true
+                    }
+                });
+                this.identities.set(key, identity);
+            }
+            return await this.identityContext.withIdentity(identity, ()=>this.identityContext.withAuthorization(check));
+        } catch  {
+            return false;
+        }
+    }
+}
+const CandidateReadAccess_CandidateReadAccess = CandidateReadAccess.createImplementation({
+    implementation: CandidateReadAccessImpl,
+    dependencies: [
+        IdentityContext,
+        TenantContext
+    ]
+});
+export { CandidateReadAccess_CandidateReadAccess as CandidateReadAccess };
+
+//# sourceMappingURL=CandidateReadAccess.js.map

package/features/identity/CandidateReadAccess/CandidateReadAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/identity/CandidateReadAccess/CandidateReadAccess.js","sources":["../../../../src/features/identity/CandidateReadAccess/CandidateReadAccess.ts"],"sourcesContent":["import {\n    AuthenticatedIdentity,\n    IdentityContext,\n    type Identity\n} from \"@webiny/api-core/features/security/IdentityContext/index.js\";\nimport { TenantContext } from \"@webiny/api-core/features/tenancy/TenantContext/index.js\";\nimport { CandidateReadAccess as Abstraction } from \"./abstractions.js\";\n\n/**\n * The candidate's identity is built like the platform's own background identities\n * (`TaskControl`, `ExecuteScheduledActionUseCase`): an `admin` identity with tenant access, whose\n * roles and teams the authorizers load by id. Differences from a real login, accepted (A20):\n * - Only users listed as admin users of the current tenant are evaluated: the caller passes the\n *   user it listed (R68), so nothing is read here. A user without roles in this tenant still gets\n *   `RolesTeamsAuthorizer`'s parent-tenant fallback, as at login.\n * - A custom identity provider's `canAccessTenant` rule is not re-run; the stored user record is\n *   the membership proof.\n * - Roles and teams are the stored ones, synced from the identity provider at the user's last\n *   login (`ExternalIdpUserSyncHandler`).\n * One identity object per tenant and user is kept for the request, so api-core's permission cache\n * (keyed by identity object and tenant, R69) loads each candidate once.\n */\nclass CandidateReadAccessImpl implements Abstraction.Interface {\n    private readonly identities = new Map<string, Identity>();\n\n    public constructor(\n        private identityContext: IdentityContext.Interface,\n        private tenantContext: TenantContext.Interface\n    ) {}\n\n    public async canUserRead(\n        user: Abstraction.User,\n        check: () => Promise<boolean>\n    ): Promise<boolean> {\n        try {\n            const key = `${this.tenantContext.getTenant().id}:${user.id}`;\n            let identity = this.identities.get(key);\n            if (!identity) {\n                identity = new AuthenticatedIdentity({\n                    id: user.id,\n                    displayName: user.displayName,\n                    type: \"admin\",\n                    context: { canAccessTenant: true }\n                });\n                this.identities.set(key, identity);\n            }\n            return await this.identityContext.withIdentity(identity, () => {\n                return this.identityContext.withAuthorization(check);\n            });\n        } catch {\n            return false;\n        }\n    }\n}\n\nexport const CandidateReadAccess = Abstraction.createImplementation({\n    implementation: CandidateReadAccessImpl,\n    dependencies: [IdentityContext, TenantContext]\n});\n"],"names":["CandidateReadAccessImpl","identityContext","tenantContext","Map","user","check","key","identity","AuthenticatedIdentity","CandidateReadAccess","Abstraction","IdentityContext","TenantContext"],"mappings":";;;AAsBA,MAAMA;IAGF,YACYC,eAA0C,EAC1CC,aAAsC,CAChD;aAFUD,eAAe,GAAfA;aACAC,aAAa,GAAbA;aAJK,UAAU,GAAG,IAAIC;IAK/B;IAEH,MAAa,YACTC,IAAsB,EACtBC,KAA6B,EACb;QAChB,IAAI;YACA,MAAMC,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC,EAAEF,KAAK,EAAE,EAAE;YAC7D,IAAIG,WAAW,IAAI,CAAC,UAAU,CAAC,GAAG,CAACD;YACnC,IAAI,CAACC,UAAU;gBACXA,WAAW,IAAIC,sBAAsB;oBACjC,IAAIJ,KAAK,EAAE;oBACX,aAAaA,KAAK,WAAW;oBAC7B,MAAM;oBACN,SAAS;wBAAE,iBAAiB;oBAAK;gBACrC;gBACA,IAAI,CAAC,UAAU,CAAC,GAAG,CAACE,KAAKC;YAC7B;YACA,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAACA,UAAU,IAC9C,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAACF;QAEtD,EAAE,OAAM;YACJ,OAAO;QACX;IACJ;AACJ;AAEO,MAAMI,0CAAsBC,oBAAAA,oBAAgC,CAAC;IAChE,gBAAgBV;IAChB,cAAc;QAACW;QAAiBC;KAAc;AAClD"}

package/features/identity/CandidateReadAccess/abstractions.d.ts

@@ -0,0 +1,25 @@
+/** An admin user of the current tenant, as the caller listed it (`AdminUser` fits). */
+export interface CandidateUser {
+    id: string;
+    displayName: string;
+}
+export interface ICandidateReadAccess {
+    /**
+     * Runs `check` as the admin user `user` of the current tenant, with authorization enabled
+     * (also inside `withoutAuthorization`), and returns its answer; `false` when anything throws
+     * (fail closed). The caller vouches that `user` is an admin user of the current tenant: it
+     * passes a user it listed with `ListUsersUseCase` (R68), so nothing is looked up here. Read CMS
+     * models before calling, as the current identity (A19).
+     */
+    canUserRead(user: CandidateUser, check: () => Promise<boolean>): Promise<boolean>;
+}
+/**
+ * A building block for the target adapters' `ReviewTargetReadAccess.filterReadableUsers` (R48,
+ * R67): one boolean read check for a candidate, nothing else. Not a general "run as" primitive and
+ * not called by the api-workflows use cases (D132).
+ */
+export declare const CandidateReadAccess: import("@webiny/di").Abstraction<ICandidateReadAccess>;
+export declare namespace CandidateReadAccess {
+    type Interface = ICandidateReadAccess;
+    type User = CandidateUser;
+}

package/features/identity/CandidateReadAccess/abstractions.js

@@ -0,0 +1,5 @@
+import { createAbstraction } from "@webiny/feature/api";
+const CandidateReadAccess = createAbstraction("CandidateReadAccess");
+export { CandidateReadAccess };
+
+//# sourceMappingURL=abstractions.js.map

package/features/identity/CandidateReadAccess/abstractions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/identity/CandidateReadAccess/abstractions.js","sources":["../../../../src/features/identity/CandidateReadAccess/abstractions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\n\n/** An admin user of the current tenant, as the caller listed it (`AdminUser` fits). */\nexport interface CandidateUser {\n    id: string;\n    displayName: string;\n}\n\nexport interface ICandidateReadAccess {\n    /**\n     * Runs `check` as the admin user `user` of the current tenant, with authorization enabled\n     * (also inside `withoutAuthorization`), and returns its answer; `false` when anything throws\n     * (fail closed). The caller vouches that `user` is an admin user of the current tenant: it\n     * passes a user it listed with `ListUsersUseCase` (R68), so nothing is looked up here. Read CMS\n     * models before calling, as the current identity (A19).\n     */\n    canUserRead(user: CandidateUser, check: () => Promise<boolean>): Promise<boolean>;\n}\n\n/**\n * A building block for the target adapters' `ReviewTargetReadAccess.filterReadableUsers` (R48,\n * R67): one boolean read check for a candidate, nothing else. Not a general \"run as\" primitive and\n * not called by the api-workflows use cases (D132).\n */\nexport const CandidateReadAccess = createAbstraction<ICandidateReadAccess>(\"CandidateReadAccess\");\n\nexport namespace CandidateReadAccess {\n    export type Interface = ICandidateReadAccess;\n    export type User = CandidateUser;\n}\n"],"names":["CandidateReadAccess","createAbstraction"],"mappings":";AAwBO,MAAMA,sBAAsBC,kBAAwC"}

package/features/identity/CandidateReadAccess/feature.d.ts

@@ -0,0 +1,4 @@
+export declare const CandidateReadAccessFeature: {
+    name: string;
+    register(container: import("@webiny/di").Container): void;
+};

package/features/identity/CandidateReadAccess/feature.js

@@ -0,0 +1,11 @@
+import { createFeature } from "@webiny/feature/api";
+import { CandidateReadAccess } from "./CandidateReadAccess.js";
+const CandidateReadAccessFeature = createFeature({
+    name: "Workflows/CandidateReadAccess",
+    register (container) {
+        container.register(CandidateReadAccess).inSingletonScope();
+    }
+});
+export { CandidateReadAccessFeature };
+
+//# sourceMappingURL=feature.js.map

package/features/identity/CandidateReadAccess/feature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/identity/CandidateReadAccess/feature.js","sources":["../../../../src/features/identity/CandidateReadAccess/feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { CandidateReadAccess } from \"./CandidateReadAccess.js\";\n\nexport const CandidateReadAccessFeature = createFeature({\n    name: \"Workflows/CandidateReadAccess\",\n    register(container) {\n        // One instance per request container, so candidate identities are reused (R69).\n        container.register(CandidateReadAccess).inSingletonScope();\n    }\n});\n"],"names":["CandidateReadAccessFeature","createFeature","container","CandidateReadAccess"],"mappings":";;AAGO,MAAMA,6BAA6BC,cAAc;IACpD,MAAM;IACN,UAASC,SAAS;QAEdA,UAAU,QAAQ,CAACC,qBAAqB,gBAAgB;IAC5D;AACJ"}

package/features/identity/CandidateReadAccess/index.d.ts

@@ -0,0 +1 @@
+export { CandidateReadAccess } from "./abstractions.js";

package/features/identity/CandidateReadAccess/index.js

@@ -0,0 +1 @@
+export { CandidateReadAccess } from "./abstractions.js";

package/features/identity/CurrentReviewViewer/CurrentReviewViewer.d.ts

@@ -0,0 +1,21 @@
+import { IdentityContext } from "@webiny/api-core/features/security/IdentityContext/index.js";
+import { CurrentUserTeams } from "../../../features/identity/CurrentUserTeams/index.js";
+import { WorkflowsPermissions } from "../../../features/permissions/WorkflowsPermissions/index.js";
+import { CurrentReviewViewer as Abstraction } from "./abstractions.js";
+/**
+ * Reads the identity on every call (no cache): its parts are cached by their own owners. Every
+ * non-anonymous identity is a `user` actor; `identityType` keeps its kind (`admin`, `api-key`,
+ * D30, D133). An API key belongs to no team, so `teamIds` is `[]` for it (A16).
+ */
+declare class CurrentReviewViewerImpl implements Abstraction.Interface {
+    private identityContext;
+    private currentUserTeams;
+    private permissions;
+    constructor(identityContext: IdentityContext.Interface, currentUserTeams: CurrentUserTeams.Interface, permissions: WorkflowsPermissions.Interface);
+    getActor(): Abstraction.ActorResult;
+    get(): Abstraction.Return;
+}
+export declare const CurrentReviewViewer: typeof CurrentReviewViewerImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("./abstractions.js").ICurrentReviewViewer>;
+};
+export {};

package/features/identity/CurrentReviewViewer/CurrentReviewViewer.js

@@ -0,0 +1,48 @@
+import { Result } from "@webiny/feature/api";
+import { IdentityContext } from "@webiny/api-core/features/security/IdentityContext/index.js";
+import { CurrentUserTeams } from "../CurrentUserTeams/index.js";
+import { WorkflowsPermissions } from "../../permissions/WorkflowsPermissions/index.js";
+import { WorkflowsNotAuthenticatedError } from "../../../domain/permissions/errors.js";
+import { CurrentReviewViewer } from "./abstractions.js";
+class CurrentReviewViewerImpl {
+    constructor(identityContext, currentUserTeams, permissions){
+        this.identityContext = identityContext;
+        this.currentUserTeams = currentUserTeams;
+        this.permissions = permissions;
+    }
+    getActor() {
+        const identity = this.identityContext.getIdentity();
+        if (identity.isAnonymous()) return Result.fail(new WorkflowsNotAuthenticatedError());
+        return Result.ok({
+            type: "user",
+            id: identity.id,
+            displayName: identity.displayName,
+            identityType: identity.type
+        });
+    }
+    async get() {
+        const actor = this.getActor();
+        if (actor.isFail()) return Result.fail(actor.error);
+        const [teamIds, permissions] = await Promise.all([
+            this.currentUserTeams.getTeamIds(),
+            this.permissions.getPermissionSet()
+        ]);
+        const viewer = {
+            actor: actor.value,
+            teamIds,
+            permissions
+        };
+        return Result.ok(viewer);
+    }
+}
+const CurrentReviewViewer_CurrentReviewViewer = CurrentReviewViewer.createImplementation({
+    implementation: CurrentReviewViewerImpl,
+    dependencies: [
+        IdentityContext,
+        CurrentUserTeams,
+        WorkflowsPermissions
+    ]
+});
+export { CurrentReviewViewer_CurrentReviewViewer as CurrentReviewViewer };
+
+//# sourceMappingURL=CurrentReviewViewer.js.map

package/features/identity/CurrentReviewViewer/CurrentReviewViewer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/identity/CurrentReviewViewer/CurrentReviewViewer.js","sources":["../../../../src/features/identity/CurrentReviewViewer/CurrentReviewViewer.ts"],"sourcesContent":["import { Result } from \"@webiny/feature/api\";\nimport { IdentityContext } from \"@webiny/api-core/features/security/IdentityContext/index.js\";\nimport { CurrentUserTeams } from \"~/features/identity/CurrentUserTeams/index.js\";\nimport { WorkflowsPermissions } from \"~/features/permissions/WorkflowsPermissions/index.js\";\nimport { WorkflowsNotAuthenticatedError } from \"~/domain/permissions/errors.js\";\nimport type { ReviewViewer } from \"~/domain/review/types.js\";\nimport { CurrentReviewViewer as Abstraction } from \"./abstractions.js\";\n\n/**\n * Reads the identity on every call (no cache): its parts are cached by their own owners. Every\n * non-anonymous identity is a `user` actor; `identityType` keeps its kind (`admin`, `api-key`,\n * D30, D133). An API key belongs to no team, so `teamIds` is `[]` for it (A16).\n */\nclass CurrentReviewViewerImpl implements Abstraction.Interface {\n    public constructor(\n        private identityContext: IdentityContext.Interface,\n        private currentUserTeams: CurrentUserTeams.Interface,\n        private permissions: WorkflowsPermissions.Interface\n    ) {}\n\n    public getActor(): Abstraction.ActorResult {\n        const identity = this.identityContext.getIdentity();\n        if (identity.isAnonymous()) {\n            return Result.fail(new WorkflowsNotAuthenticatedError());\n        }\n        return Result.ok({\n            type: \"user\",\n            id: identity.id,\n            displayName: identity.displayName,\n            identityType: identity.type\n        });\n    }\n\n    public async get(): Abstraction.Return {\n        const actor = this.getActor();\n        if (actor.isFail()) {\n            return Result.fail(actor.error);\n        }\n\n        const [teamIds, permissions] = await Promise.all([\n            this.currentUserTeams.getTeamIds(),\n            this.permissions.getPermissionSet()\n        ]);\n        const viewer: ReviewViewer = {\n            actor: actor.value,\n            teamIds,\n            permissions\n        };\n        return Result.ok(viewer);\n    }\n}\n\nexport const CurrentReviewViewer = Abstraction.createImplementation({\n    implementation: CurrentReviewViewerImpl,\n    dependencies: [IdentityContext, CurrentUserTeams, WorkflowsPermissions]\n});\n"],"names":["CurrentReviewViewerImpl","identityContext","currentUserTeams","permissions","identity","Result","WorkflowsNotAuthenticatedError","actor","teamIds","Promise","viewer","CurrentReviewViewer","Abstraction","IdentityContext","CurrentUserTeams","WorkflowsPermissions"],"mappings":";;;;;;AAaA,MAAMA;IACF,YACYC,eAA0C,EAC1CC,gBAA4C,EAC5CC,WAA2C,CACrD;aAHUF,eAAe,GAAfA;aACAC,gBAAgB,GAAhBA;aACAC,WAAW,GAAXA;IACT;IAEI,WAAoC;QACvC,MAAMC,WAAW,IAAI,CAAC,eAAe,CAAC,WAAW;QACjD,IAAIA,SAAS,WAAW,IACpB,OAAOC,OAAO,IAAI,CAAC,IAAIC;QAE3B,OAAOD,OAAO,EAAE,CAAC;YACb,MAAM;YACN,IAAID,SAAS,EAAE;YACf,aAAaA,SAAS,WAAW;YACjC,cAAcA,SAAS,IAAI;QAC/B;IACJ;IAEA,MAAa,MAA0B;QACnC,MAAMG,QAAQ,IAAI,CAAC,QAAQ;QAC3B,IAAIA,MAAM,MAAM,IACZ,OAAOF,OAAO,IAAI,CAACE,MAAM,KAAK;QAGlC,MAAM,CAACC,SAASL,YAAY,GAAG,MAAMM,QAAQ,GAAG,CAAC;YAC7C,IAAI,CAAC,gBAAgB,CAAC,UAAU;YAChC,IAAI,CAAC,WAAW,CAAC,gBAAgB;SACpC;QACD,MAAMC,SAAuB;YACzB,OAAOH,MAAM,KAAK;YAClBC;YACAL;QACJ;QACA,OAAOE,OAAO,EAAE,CAACK;IACrB;AACJ;AAEO,MAAMC,0CAAsBC,oBAAAA,oBAAgC,CAAC;IAChE,gBAAgBZ;IAChB,cAAc;QAACa;QAAiBC;QAAkBC;KAAqB;AAC3E"}