@webiny/app-admin 0.0.0-mt-2 → 0.0.0-unstable.0156a4c312

package/features/adminUsers/users/updateUser/abstractions/UpdateUserGateway.d.ts

@@ -0,0 +1,33 @@
+export interface IUserRoleRef {
+    id: string;
+    slug: string;
+    name: string;
+}
+export interface IUserTeamRef {
+    id: string;
+    slug: string;
+    name: string;
+}
+export interface IUpdateUserGatewayResult {
+    id: string;
+    email: string;
+    firstName: string;
+    lastName: string;
+    avatar: any;
+    external: boolean;
+    roles: IUserRoleRef[];
+    teams: IUserTeamRef[];
+}
+export interface IUpdateUserGatewayParams {
+    id: string;
+    data: Record<string, any>;
+}
+export interface IUpdateUserGateway {
+    execute(params: IUpdateUserGatewayParams): Promise<IUpdateUserGatewayResult>;
+}
+export declare const UpdateUserGateway: import("@webiny/di").Abstraction<IUpdateUserGateway>;
+export declare namespace UpdateUserGateway {
+    type Interface = IUpdateUserGateway;
+    type Params = IUpdateUserGatewayParams;
+    type Result = IUpdateUserGatewayResult;
+}

package/features/adminUsers/users/updateUser/abstractions/UpdateUserGateway.js

@@ -0,0 +1,5 @@
+import { createAbstraction } from "@webiny/feature/admin";
+const UpdateUserGateway = createAbstraction("UpdateUserGateway");
+export { UpdateUserGateway };
+
+//# sourceMappingURL=UpdateUserGateway.js.map

package/features/adminUsers/users/updateUser/abstractions/UpdateUserGateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/adminUsers/users/updateUser/abstractions/UpdateUserGateway.js","sources":["../../../../../../src/features/adminUsers/users/updateUser/abstractions/UpdateUserGateway.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/admin\";\n\nexport interface IUserRoleRef {\n    id: string;\n    slug: string;\n    name: string;\n}\n\nexport interface IUserTeamRef {\n    id: string;\n    slug: string;\n    name: string;\n}\n\nexport interface IUpdateUserGatewayResult {\n    id: string;\n    email: string;\n    firstName: string;\n    lastName: string;\n    avatar: any;\n    external: boolean;\n    roles: IUserRoleRef[];\n    teams: IUserTeamRef[];\n}\n\nexport interface IUpdateUserGatewayParams {\n    id: string;\n    data: Record<string, any>;\n}\n\nexport interface IUpdateUserGateway {\n    execute(params: IUpdateUserGatewayParams): Promise<IUpdateUserGatewayResult>;\n}\n\nexport const UpdateUserGateway = createAbstraction<IUpdateUserGateway>(\"UpdateUserGateway\");\n\nexport namespace UpdateUserGateway {\n    export type Interface = IUpdateUserGateway;\n    export type Params = IUpdateUserGatewayParams;\n    export type Result = IUpdateUserGatewayResult;\n}\n"],"names":["UpdateUserGateway","createAbstraction"],"mappings":";AAkCO,MAAMA,oBAAoBC,kBAAsC"}

package/features/adminUsers/users/updateUser/abstractions/UpdateUserUseCase.d.ts

@@ -0,0 +1,15 @@
+import type { IUpdateUserGatewayResult } from "./UpdateUserGateway.js";
+export type IUpdateUserUseCaseResult = IUpdateUserGatewayResult;
+export interface IUpdateUserUseCaseParams {
+    id: string;
+    data: Record<string, any>;
+}
+export interface IUpdateUserUseCase {
+    execute(params: IUpdateUserUseCaseParams): Promise<IUpdateUserUseCaseResult>;
+}
+export declare const UpdateUserUseCase: import("@webiny/di").Abstraction<IUpdateUserUseCase>;
+export declare namespace UpdateUserUseCase {
+    type Interface = IUpdateUserUseCase;
+    type Params = IUpdateUserUseCaseParams;
+    type Result = IUpdateUserUseCaseResult;
+}

package/features/adminUsers/users/updateUser/abstractions/UpdateUserUseCase.js

@@ -0,0 +1,5 @@
+import { createAbstraction } from "@webiny/feature/admin";
+const UpdateUserUseCase = createAbstraction("UpdateUserUseCase");
+export { UpdateUserUseCase };
+
+//# sourceMappingURL=UpdateUserUseCase.js.map

package/features/adminUsers/users/updateUser/abstractions/UpdateUserUseCase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/adminUsers/users/updateUser/abstractions/UpdateUserUseCase.js","sources":["../../../../../../src/features/adminUsers/users/updateUser/abstractions/UpdateUserUseCase.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/admin\";\nimport type { IUpdateUserGatewayResult } from \"./UpdateUserGateway.js\";\n\nexport type IUpdateUserUseCaseResult = IUpdateUserGatewayResult;\n\nexport interface IUpdateUserUseCaseParams {\n    id: string;\n    data: Record<string, any>;\n}\n\nexport interface IUpdateUserUseCase {\n    execute(params: IUpdateUserUseCaseParams): Promise<IUpdateUserUseCaseResult>;\n}\n\nexport const UpdateUserUseCase = createAbstraction<IUpdateUserUseCase>(\"UpdateUserUseCase\");\n\nexport namespace UpdateUserUseCase {\n    export type Interface = IUpdateUserUseCase;\n    export type Params = IUpdateUserUseCaseParams;\n    export type Result = IUpdateUserUseCaseResult;\n}\n"],"names":["UpdateUserUseCase","createAbstraction"],"mappings":";AAcO,MAAMA,oBAAoBC,kBAAsC"}

package/features/adminUsers/users/updateUser/abstractions/index.d.ts

@@ -0,0 +1,2 @@
+export { UpdateUserGateway, type IUpdateUserGateway, type IUpdateUserGatewayParams, type IUpdateUserGatewayResult } from "./UpdateUserGateway.js";
+export { UpdateUserUseCase, type IUpdateUserUseCase, type IUpdateUserUseCaseParams, type IUpdateUserUseCaseResult } from "./UpdateUserUseCase.js";

package/features/adminUsers/users/updateUser/abstractions/index.js

@@ -0,0 +1,2 @@
+export { UpdateUserGateway } from "./UpdateUserGateway.js";
+export { UpdateUserUseCase } from "./UpdateUserUseCase.js";

package/features/adminUsers/users/updateUser/feature.d.ts

@@ -0,0 +1,3 @@
+export declare const UpdateUserFeature: import("@webiny/feature/admin").FeatureDefinition<{
+    useCase: import("./abstractions/UpdateUserUseCase.js").IUpdateUserUseCase;
+}, []>;

package/features/adminUsers/users/updateUser/feature.js

@@ -0,0 +1,19 @@
+import { createFeature } from "@webiny/feature/admin";
+import { UpdateUserUseCase } from "./abstractions/index.js";
+import { UpdateUserUseCase as external_UpdateUserUseCase_js_UpdateUserUseCase } from "./UpdateUserUseCase.js";
+import { UpdateUserGateway } from "./UpdateUserGateway.js";
+const UpdateUserFeature = createFeature({
+    name: "AdminUsers/UpdateUser",
+    register (container) {
+        container.register(external_UpdateUserUseCase_js_UpdateUserUseCase);
+        container.register(UpdateUserGateway).inSingletonScope();
+    },
+    resolve (container) {
+        return {
+            useCase: container.resolve(UpdateUserUseCase)
+        };
+    }
+});
+export { UpdateUserFeature };
+
+//# sourceMappingURL=feature.js.map

package/features/adminUsers/users/updateUser/feature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/adminUsers/users/updateUser/feature.js","sources":["../../../../../src/features/adminUsers/users/updateUser/feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/admin\";\nimport { UpdateUserUseCase as UseCaseAbstraction } from \"./abstractions/index.js\";\nimport { UpdateUserUseCase } from \"./UpdateUserUseCase.js\";\nimport { UpdateUserGateway } from \"./UpdateUserGateway.js\";\n\nexport const UpdateUserFeature = createFeature({\n    name: \"AdminUsers/UpdateUser\",\n    register(container) {\n        container.register(UpdateUserUseCase);\n        container.register(UpdateUserGateway).inSingletonScope();\n    },\n    resolve(container) {\n        return {\n            useCase: container.resolve(UseCaseAbstraction)\n        };\n    }\n});\n"],"names":["UpdateUserFeature","createFeature","container","UpdateUserUseCase","UpdateUserGateway","UseCaseAbstraction"],"mappings":";;;;AAKO,MAAMA,oBAAoBC,cAAc;IAC3C,MAAM;IACN,UAASC,SAAS;QACdA,UAAU,QAAQ,CAACC;QACnBD,UAAU,QAAQ,CAACE,mBAAmB,gBAAgB;IAC1D;IACA,SAAQF,SAAS;QACb,OAAO;YACH,SAASA,UAAU,OAAO,CAACG;QAC/B;IACJ;AACJ"}

package/features/adminUsers/users/updateUser/index.d.ts

@@ -0,0 +1,2 @@
+export { UpdateUserUseCase } from "./abstractions/index.js";
+export { UpdateUserFeature } from "./feature.js";

package/features/adminUsers/users/updateUser/index.js

@@ -0,0 +1,2 @@
+export { UpdateUserUseCase } from "./abstractions/index.js";
+export { UpdateUserFeature } from "./feature.js";

package/features/assumePermissions/ApiStreamClientDecorator.d.ts

@@ -0,0 +1,16 @@
+import { ApiStreamClient } from "@webiny/app/features/apiStreamClient/index.js";
+import { AssumePermissionsContext } from "./abstractions.js";
+/**
+ * Carries the previewed role onto streaming requests too, so a streaming route enforces the same
+ * permissions as an equivalent GraphQL call.
+ */
+declare class ApiStreamClientWithAssumedPermissions implements ApiStreamClient.Interface {
+    private context;
+    private decoratee;
+    constructor(context: AssumePermissionsContext.Interface, decoratee: ApiStreamClient.Interface);
+    execute(params: ApiStreamClient.Request): Promise<ApiStreamClient.Response>;
+}
+export declare const ApiStreamClientDecorator: typeof ApiStreamClientWithAssumedPermissions & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/app/features/apiStreamClient/abstractions.js").IApiStreamClient>;
+};
+export {};

package/features/assumePermissions/ApiStreamClientDecorator.js

@@ -0,0 +1,29 @@
+import { ApiStreamClient } from "@webiny/app/features/apiStreamClient/index.js";
+import { AssumePermissionsContext } from "./abstractions.js";
+import { ASSUME_PERMISSIONS_HEADER, assumePermissionsHeaderValue } from "./assumePermissionsHeader.js";
+class ApiStreamClientWithAssumedPermissions {
+    constructor(context, decoratee){
+        this.context = context;
+        this.decoratee = decoratee;
+    }
+    async execute(params) {
+        const headers = {
+            ...params.headers
+        };
+        const assumed = this.context.get();
+        if (assumed && !(ASSUME_PERMISSIONS_HEADER in headers)) headers[ASSUME_PERMISSIONS_HEADER] = assumePermissionsHeaderValue(assumed);
+        return this.decoratee.execute({
+            ...params,
+            headers
+        });
+    }
+}
+const ApiStreamClientDecorator = ApiStreamClient.createDecorator({
+    decorator: ApiStreamClientWithAssumedPermissions,
+    dependencies: [
+        AssumePermissionsContext
+    ]
+});
+export { ApiStreamClientDecorator };
+
+//# sourceMappingURL=ApiStreamClientDecorator.js.map

package/features/assumePermissions/ApiStreamClientDecorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/assumePermissions/ApiStreamClientDecorator.js","sources":["../../../src/features/assumePermissions/ApiStreamClientDecorator.ts"],"sourcesContent":["import { ApiStreamClient } from \"@webiny/app/features/apiStreamClient/index.js\";\nimport { AssumePermissionsContext } from \"./abstractions.js\";\nimport { ASSUME_PERMISSIONS_HEADER } from \"./assumePermissionsHeader.js\";\nimport { assumePermissionsHeaderValue } from \"./assumePermissionsHeader.js\";\n\n/**\n * Carries the previewed role onto streaming requests too, so a streaming route enforces the same\n * permissions as an equivalent GraphQL call.\n */\nclass ApiStreamClientWithAssumedPermissions implements ApiStreamClient.Interface {\n    constructor(\n        private context: AssumePermissionsContext.Interface,\n        private decoratee: ApiStreamClient.Interface\n    ) {}\n\n    async execute(params: ApiStreamClient.Request): Promise<ApiStreamClient.Response> {\n        const headers: ApiStreamClient.Headers = { ...params.headers };\n        const assumed = this.context.get();\n\n        /*\n         * A caller that set the header itself keeps its value. The role list query sends it empty,\n         * so its own lists come back as the signed-in user rather than as the role being previewed.\n         */\n        if (assumed && !(ASSUME_PERMISSIONS_HEADER in headers)) {\n            headers[ASSUME_PERMISSIONS_HEADER] = assumePermissionsHeaderValue(assumed);\n        }\n\n        return this.decoratee.execute({ ...params, headers });\n    }\n}\n\nexport const ApiStreamClientDecorator = ApiStreamClient.createDecorator({\n    decorator: ApiStreamClientWithAssumedPermissions,\n    dependencies: [AssumePermissionsContext]\n});\n"],"names":["ApiStreamClientWithAssumedPermissions","context","decoratee","params","headers","assumed","ASSUME_PERMISSIONS_HEADER","assumePermissionsHeaderValue","ApiStreamClientDecorator","ApiStreamClient","AssumePermissionsContext"],"mappings":";;;AASA,MAAMA;IACF,YACYC,OAA2C,EAC3CC,SAAoC,CAC9C;aAFUD,OAAO,GAAPA;aACAC,SAAS,GAATA;IACT;IAEH,MAAM,QAAQC,MAA+B,EAAqC;QAC9E,MAAMC,UAAmC;YAAE,GAAGD,OAAO,OAAO;QAAC;QAC7D,MAAME,UAAU,IAAI,CAAC,OAAO,CAAC,GAAG;QAMhC,IAAIA,WAAW,CAAEC,CAAAA,6BAA6BF,OAAM,GAChDA,OAAO,CAACE,0BAA0B,GAAGC,6BAA6BF;QAGtE,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAAE,GAAGF,MAAM;YAAEC;QAAQ;IACvD;AACJ;AAEO,MAAMI,2BAA2BC,gBAAgB,eAAe,CAAC;IACpE,WAAWT;IACX,cAAc;QAACU;KAAyB;AAC5C"}

package/features/assumePermissions/AssumePermissionsContext.d.ts

@@ -0,0 +1,17 @@
+import { LocalStorage } from "@webiny/app/features/localStorage";
+import { AssumePermissionsContext as Abstraction } from "./abstractions.js";
+/**
+ * Holds the role or team being previewed, and survives a reload so a refresh mid-preview doesn't
+ * quietly hand the user their real permissions back.
+ */
+declare class AssumePermissionsContextImpl implements Abstraction.Interface {
+    private localStorage;
+    private value;
+    constructor(localStorage: LocalStorage.Interface);
+    get(): Abstraction.Value | null;
+    set(value: Abstraction.Value | null): void;
+}
+export declare const AssumePermissionsContext: typeof AssumePermissionsContextImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("./abstractions.js").IAssumePermissionsContext>;
+};
+export {};

package/features/assumePermissions/AssumePermissionsContext.js

@@ -0,0 +1,32 @@
+import { makeAutoObservable, runInAction } from "mobx";
+import { LocalStorage } from "@webiny/app/features/localStorage";
+import { AssumePermissionsContext } from "./abstractions.js";
+const LOCAL_STORAGE_KEY = "assumedPermissions";
+class AssumePermissionsContextImpl {
+    constructor(localStorage){
+        this.localStorage = localStorage;
+        this.value = this.localStorage.get(LOCAL_STORAGE_KEY) ?? null;
+        makeAutoObservable(this, {}, {
+            autoBind: true
+        });
+    }
+    get() {
+        return this.value;
+    }
+    set(value) {
+        runInAction(()=>{
+            this.value = value;
+        });
+        if (value) return void this.localStorage.set(LOCAL_STORAGE_KEY, value);
+        this.localStorage.remove(LOCAL_STORAGE_KEY);
+    }
+}
+const AssumePermissionsContext_AssumePermissionsContext = AssumePermissionsContext.createImplementation({
+    implementation: AssumePermissionsContextImpl,
+    dependencies: [
+        LocalStorage
+    ]
+});
+export { AssumePermissionsContext_AssumePermissionsContext as AssumePermissionsContext };
+
+//# sourceMappingURL=AssumePermissionsContext.js.map

package/features/assumePermissions/AssumePermissionsContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/assumePermissions/AssumePermissionsContext.js","sources":["../../../src/features/assumePermissions/AssumePermissionsContext.ts"],"sourcesContent":["import { makeAutoObservable } from \"mobx\";\nimport { runInAction } from \"mobx\";\nimport { LocalStorage } from \"@webiny/app/features/localStorage\";\nimport { AssumePermissionsContext as Abstraction } from \"./abstractions.js\";\n\nconst LOCAL_STORAGE_KEY = \"assumedPermissions\";\n\n/**\n * Holds the role or team being previewed, and survives a reload so a refresh mid-preview doesn't\n * quietly hand the user their real permissions back.\n */\nclass AssumePermissionsContextImpl implements Abstraction.Interface {\n    private value: Abstraction.Value | null;\n\n    constructor(private localStorage: LocalStorage.Interface) {\n        this.value = this.localStorage.get<Abstraction.Value>(LOCAL_STORAGE_KEY) ?? null;\n        makeAutoObservable(this, {}, { autoBind: true });\n    }\n\n    get(): Abstraction.Value | null {\n        return this.value;\n    }\n\n    set(value: Abstraction.Value | null): void {\n        runInAction(() => {\n            this.value = value;\n        });\n\n        if (value) {\n            this.localStorage.set(LOCAL_STORAGE_KEY, value);\n            return;\n        }\n\n        this.localStorage.remove(LOCAL_STORAGE_KEY);\n    }\n}\n\nexport const AssumePermissionsContext = Abstraction.createImplementation({\n    implementation: AssumePermissionsContextImpl,\n    dependencies: [LocalStorage]\n});\n"],"names":["LOCAL_STORAGE_KEY","AssumePermissionsContextImpl","localStorage","makeAutoObservable","value","runInAction","AssumePermissionsContext","Abstraction","LocalStorage"],"mappings":";;;AAKA,MAAMA,oBAAoB;AAM1B,MAAMC;IAGF,YAAoBC,YAAoC,CAAE;aAAtCA,YAAY,GAAZA;QAChB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAoBF,sBAAsB;QAC5EG,mBAAmB,IAAI,EAAE,CAAC,GAAG;YAAE,UAAU;QAAK;IAClD;IAEA,MAAgC;QAC5B,OAAO,IAAI,CAAC,KAAK;IACrB;IAEA,IAAIC,KAA+B,EAAQ;QACvCC,YAAY;YACR,IAAI,CAAC,KAAK,GAAGD;QACjB;QAEA,IAAIA,OAAO,YACP,IAAI,CAAC,YAAY,CAAC,GAAG,CAACJ,mBAAmBI;QAI7C,IAAI,CAAC,YAAY,CAAC,MAAM,CAACJ;IAC7B;AACJ;AAEO,MAAMM,oDAA2BC,yBAAAA,oBAAgC,CAAC;IACrE,gBAAgBN;IAChB,cAAc;QAACO;KAAa;AAChC"}

package/features/assumePermissions/AssumePermissionsUseCase.d.ts

@@ -0,0 +1,33 @@
+import { IdentityContext } from "../../features/security/IdentityContext/index.js";
+import { LogInRepository } from "../../features/security/LogIn/abstractions.js";
+import { AssumePermissionsContext } from "./abstractions.js";
+import { AssumePermissionsUseCase as Abstraction } from "./abstractions.js";
+/**
+ * Switches the Admin into (or out of) previewing a role. The permissions themselves come from the
+ * API: once the context holds a role, every request carries the assume-permissions header, so the
+ * login query returns the identity as that role sees it. Nothing about the permission set is
+ * decided on the client.
+ *
+ * This only records the choice and proves it works. The caller reloads the page afterwards, which
+ * is what actually re-renders the Admin as the new role. Swapping the identity in place leaves
+ * half the UI stale, because permission checks like `createHasPermission` read the identity during
+ * render without observing it, and every list already fetched still holds the previous role's
+ * data. The tenant switcher reaches for a full page load for the same reason.
+ *
+ * The login call here is not redundant with the one the reload performs. It is how a role that
+ * grants nothing gets caught BEFORE the reload: the selection is persisted, so reloading into a
+ * failed login would strand the user behind an error screen with no way to clear it.
+ */
+declare class AssumePermissionsUseCaseImpl implements Abstraction.Interface {
+    private assumePermissionsContext;
+    private identityContext;
+    private logInRepository;
+    constructor(assumePermissionsContext: AssumePermissionsContext.Interface, identityContext: IdentityContext.Interface, logInRepository: LogInRepository.Interface);
+    execute(target: Abstraction.Target | null, options?: Abstraction.Options): Promise<void>;
+    private toStored;
+    private verify;
+}
+export declare const AssumePermissionsUseCase: typeof AssumePermissionsUseCaseImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("./abstractions.js").IAssumePermissionsUseCase>;
+};
+export {};

package/features/assumePermissions/AssumePermissionsUseCase.js

@@ -0,0 +1,48 @@
+import { IdentityContext } from "../security/IdentityContext/index.js";
+import { LogInRepository } from "../security/LogIn/abstractions.js";
+import { hasAppPermissions } from "../security/LogIn/hasAppPermissions.js";
+import { AssumePermissionsContext, AssumePermissionsUseCase } from "./abstractions.js";
+class AssumePermissionsUseCaseImpl {
+    constructor(assumePermissionsContext, identityContext, logInRepository){
+        this.assumePermissionsContext = assumePermissionsContext;
+        this.identityContext = identityContext;
+        this.logInRepository = logInRepository;
+    }
+    async execute(target, options = {}) {
+        const previous = this.assumePermissionsContext.get();
+        const value = this.toStored(target, previous, options);
+        this.assumePermissionsContext.set(value);
+        try {
+            await this.verify(value);
+        } catch (error) {
+            this.assumePermissionsContext.set(previous);
+            throw error;
+        }
+    }
+    toStored(target, previous, options) {
+        if (!target) return null;
+        const identity = this.identityContext.getIdentity();
+        const value = {
+            ...target,
+            startedBy: identity.id
+        };
+        const returnTo = previous?.returnTo ?? options.returnTo;
+        if (returnTo) value.returnTo = returnTo;
+        return value;
+    }
+    async verify(value) {
+        const identity = await this.logInRepository.login();
+        if (value && !hasAppPermissions(identity)) throw new Error(`"${value.name}" grants no permissions on this tenant.`);
+    }
+}
+const AssumePermissionsUseCase_AssumePermissionsUseCase = AssumePermissionsUseCase.createImplementation({
+    implementation: AssumePermissionsUseCaseImpl,
+    dependencies: [
+        AssumePermissionsContext,
+        IdentityContext,
+        LogInRepository
+    ]
+});
+export { AssumePermissionsUseCase_AssumePermissionsUseCase as AssumePermissionsUseCase };
+
+//# sourceMappingURL=AssumePermissionsUseCase.js.map

package/features/assumePermissions/AssumePermissionsUseCase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/assumePermissions/AssumePermissionsUseCase.js","sources":["../../../src/features/assumePermissions/AssumePermissionsUseCase.ts"],"sourcesContent":["import { IdentityContext } from \"~/features/security/IdentityContext/index.js\";\nimport { LogInRepository } from \"~/features/security/LogIn/abstractions.js\";\nimport { hasAppPermissions } from \"~/features/security/LogIn/hasAppPermissions.js\";\nimport { AssumePermissionsContext } from \"./abstractions.js\";\nimport { AssumePermissionsUseCase as Abstraction } from \"./abstractions.js\";\n\n/**\n * Switches the Admin into (or out of) previewing a role. The permissions themselves come from the\n * API: once the context holds a role, every request carries the assume-permissions header, so the\n * login query returns the identity as that role sees it. Nothing about the permission set is\n * decided on the client.\n *\n * This only records the choice and proves it works. The caller reloads the page afterwards, which\n * is what actually re-renders the Admin as the new role. Swapping the identity in place leaves\n * half the UI stale, because permission checks like `createHasPermission` read the identity during\n * render without observing it, and every list already fetched still holds the previous role's\n * data. The tenant switcher reaches for a full page load for the same reason.\n *\n * The login call here is not redundant with the one the reload performs. It is how a role that\n * grants nothing gets caught BEFORE the reload: the selection is persisted, so reloading into a\n * failed login would strand the user behind an error screen with no way to clear it.\n */\nclass AssumePermissionsUseCaseImpl implements Abstraction.Interface {\n    constructor(\n        private assumePermissionsContext: AssumePermissionsContext.Interface,\n        private identityContext: IdentityContext.Interface,\n        private logInRepository: LogInRepository.Interface\n    ) {}\n\n    async execute(\n        target: Abstraction.Target | null,\n        options: Abstraction.Options = {}\n    ): Promise<void> {\n        const previous = this.assumePermissionsContext.get();\n        const value = this.toStored(target, previous, options);\n        this.assumePermissionsContext.set(value);\n\n        try {\n            await this.verify(value);\n        } catch (error) {\n            /*\n             * Put the previous selection back. Otherwise the app keeps sending a header it has\n             * already failed on, and because the selection is persisted, a reload won't clear it.\n             */\n            this.assumePermissionsContext.set(previous);\n            throw error;\n        }\n    }\n\n    /*\n     * The identity id is the same whether or not a preview is running (only the permissions\n     * change), so switching straight from one role to another still records the right person.\n     */\n    private toStored(\n        target: Abstraction.Target | null,\n        previous: AssumePermissionsContext.Value | null,\n        options: Abstraction.Options\n    ): AssumePermissionsContext.Value | null {\n        if (!target) {\n            return null;\n        }\n\n        const identity = this.identityContext.getIdentity();\n        const value: AssumePermissionsContext.Value = { ...target, startedBy: identity.id };\n\n        // Switching from one role to the next keeps the place the first preview started from.\n        const returnTo = previous?.returnTo ?? options.returnTo;\n        if (returnTo) {\n            value.returnTo = returnTo;\n        }\n\n        return value;\n    }\n\n    private async verify(value: AssumePermissionsContext.Value | null): Promise<void> {\n        const identity = await this.logInRepository.login();\n\n        if (value && !hasAppPermissions(identity)) {\n            throw new Error(`\"${value.name}\" grants no permissions on this tenant.`);\n        }\n    }\n}\n\nexport const AssumePermissionsUseCase = Abstraction.createImplementation({\n    implementation: AssumePermissionsUseCaseImpl,\n    dependencies: [AssumePermissionsContext, IdentityContext, LogInRepository]\n});\n"],"names":["AssumePermissionsUseCaseImpl","assumePermissionsContext","identityContext","logInRepository","target","options","previous","value","error","identity","returnTo","hasAppPermissions","Error","AssumePermissionsUseCase","Abstraction","AssumePermissionsContext","IdentityContext","LogInRepository"],"mappings":";;;;AAsBA,MAAMA;IACF,YACYC,wBAA4D,EAC5DC,eAA0C,EAC1CC,eAA0C,CACpD;aAHUF,wBAAwB,GAAxBA;aACAC,eAAe,GAAfA;aACAC,eAAe,GAAfA;IACT;IAEH,MAAM,QACFC,MAAiC,EACjCC,UAA+B,CAAC,CAAC,EACpB;QACb,MAAMC,WAAW,IAAI,CAAC,wBAAwB,CAAC,GAAG;QAClD,MAAMC,QAAQ,IAAI,CAAC,QAAQ,CAACH,QAAQE,UAAUD;QAC9C,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAACE;QAElC,IAAI;YACA,MAAM,IAAI,CAAC,MAAM,CAACA;QACtB,EAAE,OAAOC,OAAO;YAKZ,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAACF;YAClC,MAAME;QACV;IACJ;IAMQ,SACJJ,MAAiC,EACjCE,QAA+C,EAC/CD,OAA4B,EACS;QACrC,IAAI,CAACD,QACD,OAAO;QAGX,MAAMK,WAAW,IAAI,CAAC,eAAe,CAAC,WAAW;QACjD,MAAMF,QAAwC;YAAE,GAAGH,MAAM;YAAE,WAAWK,SAAS,EAAE;QAAC;QAGlF,MAAMC,WAAWJ,UAAU,YAAYD,QAAQ,QAAQ;QACvD,IAAIK,UACAH,MAAM,QAAQ,GAAGG;QAGrB,OAAOH;IACX;IAEA,MAAc,OAAOA,KAA4C,EAAiB;QAC9E,MAAME,WAAW,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK;QAEjD,IAAIF,SAAS,CAACI,kBAAkBF,WAC5B,MAAM,IAAIG,MAAM,CAAC,CAAC,EAAEL,MAAM,IAAI,CAAC,uCAAuC,CAAC;IAE/E;AACJ;AAEO,MAAMM,oDAA2BC,yBAAAA,oBAAgC,CAAC;IACrE,gBAAgBd;IAChB,cAAc;QAACe;QAA0BC;QAAiBC;KAAgB;AAC9E"}

package/features/assumePermissions/GraphQLClientDecorator.d.ts

@@ -0,0 +1,16 @@
+import { GraphQLClient } from "@webiny/app/features/graphqlClient/index.js";
+import { AssumePermissionsContext } from "./abstractions.js";
+/**
+ * Tells the API which role to evaluate the request against while a preview is active. Mirrors the
+ * tenancy `GraphQLClientDecorator`.
+ */
+declare class GraphQLClientWithAssumedPermissions implements GraphQLClient.Interface {
+    private context;
+    private decoratee;
+    constructor(context: AssumePermissionsContext.Interface, decoratee: GraphQLClient.Interface);
+    execute<TResult = any, TVariables = any>(params: GraphQLClient.Request<TVariables>): Promise<TResult>;
+}
+export declare const GraphQLClientDecorator: typeof GraphQLClientWithAssumedPermissions & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/app/features/graphqlClient/abstractions.js").IGraphQLClient>;
+};
+export {};

package/features/assumePermissions/GraphQLClientDecorator.js

@@ -0,0 +1,29 @@
+import { GraphQLClient } from "@webiny/app/features/graphqlClient/index.js";
+import { AssumePermissionsContext } from "./abstractions.js";
+import { ASSUME_PERMISSIONS_HEADER, assumePermissionsHeaderValue } from "./assumePermissionsHeader.js";
+class GraphQLClientWithAssumedPermissions {
+    constructor(context, decoratee){
+        this.context = context;
+        this.decoratee = decoratee;
+    }
+    async execute(params) {
+        const headers = {
+            ...params.headers
+        };
+        const assumed = this.context.get();
+        if (assumed && !(ASSUME_PERMISSIONS_HEADER in headers)) headers[ASSUME_PERMISSIONS_HEADER] = assumePermissionsHeaderValue(assumed);
+        return this.decoratee.execute({
+            ...params,
+            headers
+        });
+    }
+}
+const GraphQLClientDecorator = GraphQLClient.createDecorator({
+    decorator: GraphQLClientWithAssumedPermissions,
+    dependencies: [
+        AssumePermissionsContext
+    ]
+});
+export { GraphQLClientDecorator };
+
+//# sourceMappingURL=GraphQLClientDecorator.js.map

package/features/assumePermissions/GraphQLClientDecorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/assumePermissions/GraphQLClientDecorator.js","sources":["../../../src/features/assumePermissions/GraphQLClientDecorator.ts"],"sourcesContent":["import { GraphQLClient } from \"@webiny/app/features/graphqlClient/index.js\";\nimport { AssumePermissionsContext } from \"./abstractions.js\";\nimport { ASSUME_PERMISSIONS_HEADER } from \"./assumePermissionsHeader.js\";\nimport { assumePermissionsHeaderValue } from \"./assumePermissionsHeader.js\";\n\n/**\n * Tells the API which role to evaluate the request against while a preview is active. Mirrors the\n * tenancy `GraphQLClientDecorator`.\n */\nclass GraphQLClientWithAssumedPermissions implements GraphQLClient.Interface {\n    constructor(\n        private context: AssumePermissionsContext.Interface,\n        private decoratee: GraphQLClient.Interface\n    ) {}\n\n    async execute<TResult = any, TVariables = any>(\n        params: GraphQLClient.Request<TVariables>\n    ): Promise<TResult> {\n        const headers: GraphQLClient.Headers = { ...params.headers };\n        const assumed = this.context.get();\n\n        /*\n         * A caller that set the header itself keeps its value. The role list query sends it empty,\n         * so its own lists come back as the signed-in user rather than as the role being previewed.\n         */\n        if (assumed && !(ASSUME_PERMISSIONS_HEADER in headers)) {\n            headers[ASSUME_PERMISSIONS_HEADER] = assumePermissionsHeaderValue(assumed);\n        }\n\n        return this.decoratee.execute({ ...params, headers });\n    }\n}\n\nexport const GraphQLClientDecorator = GraphQLClient.createDecorator({\n    decorator: GraphQLClientWithAssumedPermissions,\n    dependencies: [AssumePermissionsContext]\n});\n"],"names":["GraphQLClientWithAssumedPermissions","context","decoratee","params","headers","assumed","ASSUME_PERMISSIONS_HEADER","assumePermissionsHeaderValue","GraphQLClientDecorator","GraphQLClient","AssumePermissionsContext"],"mappings":";;;AASA,MAAMA;IACF,YACYC,OAA2C,EAC3CC,SAAkC,CAC5C;aAFUD,OAAO,GAAPA;aACAC,SAAS,GAATA;IACT;IAEH,MAAM,QACFC,MAAyC,EACzB;QAChB,MAAMC,UAAiC;YAAE,GAAGD,OAAO,OAAO;QAAC;QAC3D,MAAME,UAAU,IAAI,CAAC,OAAO,CAAC,GAAG;QAMhC,IAAIA,WAAW,CAAEC,CAAAA,6BAA6BF,OAAM,GAChDA,OAAO,CAACE,0BAA0B,GAAGC,6BAA6BF;QAGtE,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAAE,GAAGF,MAAM;YAAEC;QAAQ;IACvD;AACJ;AAEO,MAAMI,yBAAyBC,cAAc,eAAe,CAAC;IAChE,WAAWT;IACX,cAAc;QAACU;KAAyB;AAC5C"}

package/features/assumePermissions/ListAssumableTargetsGateway.d.ts

@@ -0,0 +1,13 @@
+import { MainGraphQLClient } from "@webiny/app/features/mainGraphQLClient/index.js";
+import { ListAssumableTargetsGateway as Abstraction } from "./abstractions.js";
+declare class ListAssumableTargetsGatewayImpl implements Abstraction.Interface {
+    private client;
+    constructor(client: MainGraphQLClient.Interface);
+    execute(params: {
+        includeTeams: boolean;
+    }): Promise<Abstraction.Dto>;
+}
+export declare const ListAssumableTargetsGateway: typeof ListAssumableTargetsGatewayImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("./abstractions.js").IListAssumableTargetsGateway>;
+};
+export {};

package/features/assumePermissions/ListAssumableTargetsGateway.js

@@ -0,0 +1,74 @@
+import { MainGraphQLClient } from "@webiny/app/features/mainGraphQLClient/index.js";
+import { ListAssumableTargetsGateway } from "./abstractions.js";
+import { ASSUME_PERMISSIONS_HEADER } from "./assumePermissionsHeader.js";
+const ROLES_FIELD = `
+    roles: listRoles {
+        data {
+            id
+            name
+        }
+        error {
+            message
+        }
+    }
+`;
+const TEAMS_FIELD = `
+    teams: listTeams {
+        data {
+            id
+            name
+        }
+        error {
+            message
+        }
+    }
+`;
+const LIST_ROLES = `
+    query ListAssumableRoles {
+        security {
+            ${ROLES_FIELD}
+        }
+    }
+`;
+const LIST_ROLES_AND_TEAMS = `
+    query ListAssumableRolesAndTeams {
+        security {
+            ${ROLES_FIELD}
+            ${TEAMS_FIELD}
+        }
+    }
+`;
+function unwrap(response) {
+    if (!response) return [];
+    if (response.error) throw new Error(response.error.message);
+    return response.data ?? [];
+}
+class ListAssumableTargetsGatewayImpl {
+    constructor(client){
+        this.client = client;
+    }
+    async execute(params) {
+        const query = params.includeTeams ? LIST_ROLES_AND_TEAMS : LIST_ROLES;
+        const response = await this.client.execute({
+            query,
+            headers: {
+                [ASSUME_PERMISSIONS_HEADER]: ""
+            }
+        });
+        const roles = unwrap(response.security.roles);
+        const teams = unwrap(response.security.teams);
+        return {
+            roles,
+            teams
+        };
+    }
+}
+const ListAssumableTargetsGateway_ListAssumableTargetsGateway = ListAssumableTargetsGateway.createImplementation({
+    implementation: ListAssumableTargetsGatewayImpl,
+    dependencies: [
+        MainGraphQLClient
+    ]
+});
+export { ListAssumableTargetsGateway_ListAssumableTargetsGateway as ListAssumableTargetsGateway };
+
+//# sourceMappingURL=ListAssumableTargetsGateway.js.map

package/features/assumePermissions/ListAssumableTargetsGateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/assumePermissions/ListAssumableTargetsGateway.js","sources":["../../../src/features/assumePermissions/ListAssumableTargetsGateway.ts"],"sourcesContent":["import { MainGraphQLClient } from \"@webiny/app/features/mainGraphQLClient/index.js\";\nimport { ListAssumableTargetsGateway as Abstraction } from \"./abstractions.js\";\nimport { ASSUME_PERMISSIONS_HEADER } from \"./assumePermissionsHeader.js\";\n\nconst ROLES_FIELD = /* GraphQL */ `\n    roles: listRoles {\n        data {\n            id\n            name\n        }\n        error {\n            message\n        }\n    }\n`;\n\nconst TEAMS_FIELD = /* GraphQL */ `\n    teams: listTeams {\n        data {\n            id\n            name\n        }\n        error {\n            message\n        }\n    }\n`;\n\nconst LIST_ROLES = /* GraphQL */ `\n    query ListAssumableRoles {\n        security {\n            ${ROLES_FIELD}\n        }\n    }\n`;\n\nconst LIST_ROLES_AND_TEAMS = /* GraphQL */ `\n    query ListAssumableRolesAndTeams {\n        security {\n            ${ROLES_FIELD}\n            ${TEAMS_FIELD}\n        }\n    }\n`;\n\ninterface ListResponse<T> {\n    data: T[] | null;\n    error: { message: string } | null;\n}\n\ninterface Response {\n    security: {\n        roles: ListResponse<Abstraction.Dto[\"roles\"][number]>;\n        teams?: ListResponse<Abstraction.Dto[\"teams\"][number]>;\n    };\n}\n\nfunction unwrap<T>(response: ListResponse<T> | undefined): T[] {\n    if (!response) {\n        return [];\n    }\n\n    if (response.error) {\n        throw new Error(response.error.message);\n    }\n\n    return response.data ?? [];\n}\n\nclass ListAssumableTargetsGatewayImpl implements Abstraction.Interface {\n    constructor(private client: MainGraphQLClient.Interface) {}\n\n    async execute(params: { includeTeams: boolean }): Promise<Abstraction.Dto> {\n        const query = params.includeTeams ? LIST_ROLES_AND_TEAMS : LIST_ROLES;\n\n        /*\n         * An explicit, empty assume-permissions header. The client decorator leaves a header the\n         * caller set alone, and the API reads an empty value as \"no preview\", so this one request\n         * runs as the signed-in user even while the rest of the Admin runs as the previewed role.\n         */\n        const response = await this.client.execute<Response>({\n            query,\n            headers: { [ASSUME_PERMISSIONS_HEADER]: \"\" }\n        });\n\n        const roles = unwrap(response.security.roles);\n        const teams = unwrap(response.security.teams);\n\n        return { roles, teams };\n    }\n}\n\nexport const ListAssumableTargetsGateway = Abstraction.createImplementation({\n    implementation: ListAssumableTargetsGatewayImpl,\n    dependencies: [MainGraphQLClient]\n});\n"],"names":["ROLES_FIELD","TEAMS_FIELD","LIST_ROLES","LIST_ROLES_AND_TEAMS","unwrap","response","Error","ListAssumableTargetsGatewayImpl","client","params","query","ASSUME_PERMISSIONS_HEADER","roles","teams","ListAssumableTargetsGateway","Abstraction","MainGraphQLClient"],"mappings":";;;AAIA,MAAMA,cAA4B,CAAC;;;;;;;;;;AAUnC,CAAC;AAED,MAAMC,cAA4B,CAAC;;;;;;;;;;AAUnC,CAAC;AAED,MAAMC,aAA2B,CAAC;;;YAGtB,EAAEF,YAAY;;;AAG1B,CAAC;AAED,MAAMG,uBAAqC,CAAC;;;YAGhC,EAAEH,YAAY;YACd,EAAEC,YAAY;;;AAG1B,CAAC;AAcD,SAASG,OAAUC,QAAqC;IACpD,IAAI,CAACA,UACD,OAAO,EAAE;IAGb,IAAIA,SAAS,KAAK,EACd,MAAM,IAAIC,MAAMD,SAAS,KAAK,CAAC,OAAO;IAG1C,OAAOA,SAAS,IAAI,IAAI,EAAE;AAC9B;AAEA,MAAME;IACF,YAAoBC,MAAmC,CAAE;aAArCA,MAAM,GAANA;IAAsC;IAE1D,MAAM,QAAQC,MAAiC,EAA4B;QACvE,MAAMC,QAAQD,OAAO,YAAY,GAAGN,uBAAuBD;QAO3D,MAAMG,WAAW,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAW;YACjDK;YACA,SAAS;gBAAE,CAACC,0BAA0B,EAAE;YAAG;QAC/C;QAEA,MAAMC,QAAQR,OAAOC,SAAS,QAAQ,CAAC,KAAK;QAC5C,MAAMQ,QAAQT,OAAOC,SAAS,QAAQ,CAAC,KAAK;QAE5C,OAAO;YAAEO;YAAOC;QAAM;IAC1B;AACJ;AAEO,MAAMC,0DAA8BC,4BAAAA,oBAAgC,CAAC;IACxE,gBAAgBR;IAChB,cAAc;QAACS;KAAkB;AACrC"}

package/features/assumePermissions/ListAssumableTargetsUseCase.d.ts

@@ -0,0 +1,16 @@
+import { ListAssumableTargetsGateway } from "./abstractions.js";
+import { ListAssumableTargetsUseCase as Abstraction } from "./abstractions.js";
+declare class ListAssumableTargetsUseCaseImpl implements Abstraction.Interface {
+    private gateway;
+    constructor(gateway: ListAssumableTargetsGateway.Interface);
+    execute(params: {
+        includeTeams: boolean;
+    }): Promise<{
+        roles: import("./abstractions.js").IAssumePermissionsTarget[];
+        teams: import("./abstractions.js").IAssumePermissionsTarget[];
+    }>;
+}
+export declare const ListAssumableTargetsUseCase: typeof ListAssumableTargetsUseCaseImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("./abstractions.js").IListAssumableTargetsUseCase>;
+};
+export {};

package/features/assumePermissions/ListAssumableTargetsUseCase.js

@@ -0,0 +1,38 @@
+import { ListAssumableTargetsGateway, ListAssumableTargetsUseCase } from "./abstractions.js";
+function toRole(role) {
+    return {
+        type: "role",
+        id: role.id,
+        name: role.name
+    };
+}
+function toTeam(team) {
+    return {
+        type: "team",
+        id: team.id,
+        name: team.name
+    };
+}
+class ListAssumableTargetsUseCaseImpl {
+    constructor(gateway){
+        this.gateway = gateway;
+    }
+    async execute(params) {
+        const dto = await this.gateway.execute(params);
+        const roles = dto.roles.map(toRole);
+        const teams = dto.teams.map(toTeam);
+        return {
+            roles,
+            teams
+        };
+    }
+}
+const ListAssumableTargetsUseCase_ListAssumableTargetsUseCase = ListAssumableTargetsUseCase.createImplementation({
+    implementation: ListAssumableTargetsUseCaseImpl,
+    dependencies: [
+        ListAssumableTargetsGateway
+    ]
+});
+export { ListAssumableTargetsUseCase_ListAssumableTargetsUseCase as ListAssumableTargetsUseCase };
+
+//# sourceMappingURL=ListAssumableTargetsUseCase.js.map

package/features/assumePermissions/ListAssumableTargetsUseCase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/assumePermissions/ListAssumableTargetsUseCase.js","sources":["../../../src/features/assumePermissions/ListAssumableTargetsUseCase.ts"],"sourcesContent":["import { ListAssumableTargetsGateway } from \"./abstractions.js\";\nimport { ListAssumableTargetsUseCase as Abstraction } from \"./abstractions.js\";\n\ntype Entry = ListAssumableTargetsGateway.Dto[\"roles\"][number];\n\nfunction toRole(role: Entry): Abstraction.Target {\n    return { type: \"role\", id: role.id, name: role.name };\n}\n\nfunction toTeam(team: Entry): Abstraction.Target {\n    return { type: \"team\", id: team.id, name: team.name };\n}\n\nclass ListAssumableTargetsUseCaseImpl implements Abstraction.Interface {\n    constructor(private gateway: ListAssumableTargetsGateway.Interface) {}\n\n    async execute(params: { includeTeams: boolean }) {\n        const dto = await this.gateway.execute(params);\n\n        const roles = dto.roles.map(toRole);\n        const teams = dto.teams.map(toTeam);\n\n        return { roles, teams };\n    }\n}\n\nexport const ListAssumableTargetsUseCase = Abstraction.createImplementation({\n    implementation: ListAssumableTargetsUseCaseImpl,\n    dependencies: [ListAssumableTargetsGateway]\n});\n"],"names":["toRole","role","toTeam","team","ListAssumableTargetsUseCaseImpl","gateway","params","dto","roles","teams","ListAssumableTargetsUseCase","Abstraction","ListAssumableTargetsGateway"],"mappings":";AAKA,SAASA,OAAOC,IAAW;IACvB,OAAO;QAAE,MAAM;QAAQ,IAAIA,KAAK,EAAE;QAAE,MAAMA,KAAK,IAAI;IAAC;AACxD;AAEA,SAASC,OAAOC,IAAW;IACvB,OAAO;QAAE,MAAM;QAAQ,IAAIA,KAAK,EAAE;QAAE,MAAMA,KAAK,IAAI;IAAC;AACxD;AAEA,MAAMC;IACF,YAAoBC,OAA8C,CAAE;aAAhDA,OAAO,GAAPA;IAAiD;IAErE,MAAM,QAAQC,MAAiC,EAAE;QAC7C,MAAMC,MAAM,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAACD;QAEvC,MAAME,QAAQD,IAAI,KAAK,CAAC,GAAG,CAACP;QAC5B,MAAMS,QAAQF,IAAI,KAAK,CAAC,GAAG,CAACL;QAE5B,OAAO;YAAEM;YAAOC;QAAM;IAC1B;AACJ;AAEO,MAAMC,0DAA8BC,4BAAAA,oBAAgC,CAAC;IACxE,gBAAgBP;IAChB,cAAc;QAACQ;KAA4B;AAC/C"}

package/features/assumePermissions/LogInUseCaseDecorator.d.ts

@@ -0,0 +1,33 @@
+import { LogInUseCase } from "../../features/security/LogIn/abstractions.js";
+import { IdentityContext } from "../../features/security/IdentityContext/index.js";
+import { AssumePermissionsContext } from "./abstractions.js";
+/**
+ * Drops a stored preview that doesn't belong to this login, and logs in again as the user.
+ *
+ * The login request has to carry the preview header, since that request is what returns the
+ * previewed permissions, and it goes out before anyone knows who is signing in. So a preview left
+ * behind is caught here, after the fact, in the two ways it can go wrong:
+ *
+ * - The login fails. A preview that no longer resolves (the role was deleted, or it belongs to
+ *   another tenant) grants nothing, and a login with no permissions throws. Without this the user
+ *   would be stuck on that error screen, because the selection survives a reload.
+ * - It was started by someone else. A session can end without going through log out, so the next
+ *   person on the browser would otherwise inherit whatever the last one was previewing.
+ *
+ * Any login failure drops the preview, not only the one a bad preview causes. The login path throws
+ * plain errors, so there is nothing to tell "no permissions" from a network error by. That errs on
+ * the safe side: a transient failure costs the preview and one retry, and the user is back on
+ * their own permissions. Narrowing it needs a typed error from LogInUseCase.
+ */
+declare class LogInUseCaseDecoratorImpl implements LogInUseCase.Interface {
+    private assumePermissionsContext;
+    private identityContext;
+    private decoratee;
+    constructor(assumePermissionsContext: AssumePermissionsContext.Interface, identityContext: IdentityContext.Interface, decoratee: LogInUseCase.Interface);
+    execute(params: LogInUseCase.Params): Promise<void>;
+    private loginWithoutAssumedPermissions;
+}
+export declare const LogInUseCaseDecorator: typeof LogInUseCaseDecoratorImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("~/features/security/LogIn/abstractions.js").ILogInUseCase>;
+};
+export {};

package/features/assumePermissions/LogInUseCaseDecorator.js

@@ -0,0 +1,36 @@
+import { LogInUseCase } from "../security/LogIn/abstractions.js";
+import { IdentityContext } from "../security/IdentityContext/index.js";
+import { AssumePermissionsContext } from "./abstractions.js";
+class LogInUseCaseDecoratorImpl {
+    constructor(assumePermissionsContext, identityContext, decoratee){
+        this.assumePermissionsContext = assumePermissionsContext;
+        this.identityContext = identityContext;
+        this.decoratee = decoratee;
+    }
+    async execute(params) {
+        const active = this.assumePermissionsContext.get();
+        if (!active) return void await this.decoratee.execute(params);
+        try {
+            await this.decoratee.execute(params);
+        } catch  {
+            await this.loginWithoutAssumedPermissions(params);
+            return;
+        }
+        const identity = this.identityContext.getIdentity();
+        if (identity.id !== active.startedBy) await this.loginWithoutAssumedPermissions(params);
+    }
+    async loginWithoutAssumedPermissions(params) {
+        this.assumePermissionsContext.set(null);
+        await this.decoratee.execute(params);
+    }
+}
+const LogInUseCaseDecorator = LogInUseCase.createDecorator({
+    decorator: LogInUseCaseDecoratorImpl,
+    dependencies: [
+        AssumePermissionsContext,
+        IdentityContext
+    ]
+});
+export { LogInUseCaseDecorator };
+
+//# sourceMappingURL=LogInUseCaseDecorator.js.map