@webiny/app-admin 0.0.0-unstable.b14eaecf38 → 0.0.0-unstable.b6d7105cee

package/permissions/createPermissions.js

@@ -0,0 +1,141 @@
+import { createAbstraction, createFeature } from "@webiny/feature/admin";
+import { IdentityContext } from "../features/security/IdentityContext/abstractions.js";
+function buildEntityMap(schema) {
+    const map = new Map();
+    for (const entity of schema.entities ?? []){
+        const actions = new Set();
+        for (const action of entity.actions ?? [])actions.add(action.name);
+        map.set(entity.id, {
+            permission: entity.permission,
+            actions,
+            hasOwn: entity.scopes.includes("own")
+        });
+    }
+    return map;
+}
+function getEntity(entityMap, entityId) {
+    const entity = entityMap.get(entityId);
+    if (!entity) throw new Error(`Unknown entity "${entityId}" in permission schema.`);
+    return entity;
+}
+function hasFullSchemaAccess(identity, prefix) {
+    const fullAccessName = `${prefix}.*`;
+    const permission = identity.getPermission(fullAccessName);
+    if (!permission) return false;
+    if ("string" == typeof permission.rwd || "string" == typeof permission.pw) return false;
+    return true;
+}
+class SchemaPermissions {
+    constructor(schema, identityContext){
+        this.canAccess = (entityId)=>{
+            if (this.fullAccess) return true;
+            const entity = getEntity(this.entityMap, entityId);
+            return this.identity.getPermissions(entity.permission).length > 0;
+        };
+        this.canRead = (entityId)=>{
+            if (this.fullAccess) return true;
+            const entity = getEntity(this.entityMap, entityId);
+            const permissions = this.identity.getPermissions(entity.permission);
+            if (!permissions.length) return false;
+            return permissions.some((permission)=>{
+                if ("string" != typeof permission.rwd) return true;
+                return permission.rwd.includes("r");
+            });
+        };
+        this.canCreate = (entityId)=>{
+            if (this.fullAccess) return true;
+            const entity = getEntity(this.entityMap, entityId);
+            const permissions = this.identity.getPermissions(entity.permission);
+            if (!permissions.length) return false;
+            return permissions.some((permission)=>{
+                if ("string" != typeof permission.rwd) return true;
+                return permission.rwd.includes("w");
+            });
+        };
+        this.canEdit = (entityId, item)=>{
+            if (this.fullAccess) return true;
+            const entity = getEntity(this.entityMap, entityId);
+            const permissions = this.identity.getPermissions(entity.permission);
+            if (!permissions.length) return false;
+            return permissions.some((permission)=>{
+                if (permission.own) {
+                    if (!item?.createdBy) return true;
+                    return item.createdBy.id === this.identity.id;
+                }
+                if ("string" != typeof permission.rwd) return true;
+                return permission.rwd.includes("w");
+            });
+        };
+        this.canDelete = (entityId, item)=>{
+            if (this.fullAccess) return true;
+            const entity = getEntity(this.entityMap, entityId);
+            const permissions = this.identity.getPermissions(entity.permission);
+            if (!permissions.length) return false;
+            return permissions.some((permission)=>{
+                if (permission.own) return item?.createdBy?.id === this.identity.id;
+                if ("string" != typeof permission.rwd) return true;
+                return permission.rwd.includes("d");
+            });
+        };
+        this.canPublish = (entityId)=>{
+            if (this.fullAccess) return true;
+            const entity = getEntity(this.entityMap, entityId);
+            const permissions = this.identity.getPermissions(entity.permission);
+            if (!permissions.length) return false;
+            return permissions.some((permission)=>permission.pw?.includes("p"));
+        };
+        this.canUnpublish = (entityId)=>{
+            if (this.fullAccess) return true;
+            const entity = getEntity(this.entityMap, entityId);
+            const permissions = this.identity.getPermissions(entity.permission);
+            if (!permissions.length) return false;
+            return permissions.some((permission)=>permission.pw?.includes("u"));
+        };
+        this.canAction = (action, entityId)=>{
+            if (this.fullAccess) return true;
+            const entity = getEntity(this.entityMap, entityId);
+            const permissions = this.identity.getPermissions(entity.permission);
+            if (!permissions.length) return false;
+            return permissions.some((permission)=>true === permission[action]);
+        };
+        this.schema = schema;
+        this.entityMap = buildEntityMap(schema);
+        this.identityContext = identityContext;
+    }
+    get identity() {
+        return this.identityContext.getIdentity();
+    }
+    get fullAccess() {
+        return hasFullSchemaAccess(this.identity, this.schema.prefix);
+    }
+}
+function createPermissionsAbstraction(schema) {
+    return createAbstraction(`${schema.prefix}:Permissions`);
+}
+function createPermissionsFeature(schema, abstraction) {
+    class PermissionsImpl extends SchemaPermissions {
+        constructor(identityContext){
+            super(schema, identityContext);
+        }
+    }
+    const Implementation = abstraction.createImplementation({
+        implementation: PermissionsImpl,
+        dependencies: [
+            IdentityContext
+        ]
+    });
+    return createFeature({
+        name: `${schema.prefix}:Permissions`,
+        register (container) {
+            container.register(Implementation).inSingletonScope();
+        },
+        resolve (container) {
+            return {
+                permissions: container.resolve(abstraction)
+            };
+        }
+    });
+}
+export { createPermissionsAbstraction, createPermissionsFeature };
+
+//# sourceMappingURL=createPermissions.js.map

package/permissions/createPermissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions/createPermissions.js","sources":["../../src/permissions/createPermissions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/admin\";\nimport { createFeature } from \"@webiny/feature/admin\";\nimport { IdentityContext } from \"~/features/security/IdentityContext/abstractions.js\";\nimport type { IIdentityContext } from \"~/features/security/IdentityContext/abstractions.js\";\nimport type { Identity } from \"~/domain/Identity.js\";\nimport type { Abstraction } from \"@webiny/di\";\nimport type { PermissionSchemaConfig, OwnableItem, UsePermissionsResult } from \"./types.js\";\n\ninterface EntityLookup {\n    permission: string;\n    actions: Set<string>;\n    hasOwn: boolean;\n}\n\nfunction buildEntityMap(schema: PermissionSchemaConfig): Map<string, EntityLookup> {\n    const map = new Map<string, EntityLookup>();\n    for (const entity of schema.entities ?? []) {\n        const actions = new Set<string>();\n        for (const action of entity.actions ?? []) {\n            actions.add(action.name);\n        }\n        map.set(entity.id, {\n            permission: entity.permission,\n            actions,\n            hasOwn: entity.scopes.includes(\"own\")\n        });\n    }\n    return map;\n}\n\nfunction getEntity(entityMap: Map<string, EntityLookup>, entityId: string): EntityLookup {\n    const entity = entityMap.get(entityId);\n    if (!entity) {\n        throw new Error(`Unknown entity \"${entityId}\" in permission schema.`);\n    }\n    return entity;\n}\n\n/**\n * Check whether the identity has unrestricted full access for the given schema prefix.\n * Stricter than the legacy check: `{ name: \"wb.*\", rwd: \"r\" }` is NOT full access.\n */\nfunction hasFullSchemaAccess(identity: Identity, prefix: string): boolean {\n    const fullAccessName = `${prefix}.*`;\n    const permission = identity.getPermission(fullAccessName);\n    if (!permission) {\n        return false;\n    }\n    // If any restricting keys are present, this is not full access.\n    if (typeof permission.rwd === \"string\" || typeof permission.pw === \"string\") {\n        return false;\n    }\n    return true;\n}\n\nclass SchemaPermissions<S extends PermissionSchemaConfig> {\n    private readonly schema: S;\n    private readonly entityMap: Map<string, EntityLookup>;\n    private readonly identityContext: IIdentityContext;\n\n    constructor(schema: S, identityContext: IIdentityContext) {\n        this.schema = schema;\n        this.entityMap = buildEntityMap(schema);\n        this.identityContext = identityContext;\n    }\n\n    private get identity(): Identity {\n        return this.identityContext.getIdentity();\n    }\n\n    private get fullAccess(): boolean {\n        return hasFullSchemaAccess(this.identity, this.schema.prefix);\n    }\n\n    canAccess = (entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        return this.identity.getPermissions(entity.permission).length > 0;\n    };\n\n    canRead = (entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"r\");\n        });\n    };\n\n    canCreate = (entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"w\");\n        });\n    };\n\n    canEdit = (entityId: string, item?: OwnableItem): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (permission.own) {\n                if (!item?.createdBy) {\n                    return true;\n                }\n                return item.createdBy.id === this.identity.id;\n            }\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"w\");\n        });\n    };\n\n    canDelete = (entityId: string, item?: OwnableItem): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (permission.own) {\n                return item?.createdBy?.id === this.identity.id;\n            }\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"d\");\n        });\n    };\n\n    canPublish = (entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission.pw?.includes(\"p\");\n        });\n    };\n\n    canUnpublish = (entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission.pw?.includes(\"u\");\n        });\n    };\n\n    canAction = (action: string, entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission[action] === true;\n        });\n    };\n}\n\nexport function createPermissionsAbstraction<const S extends PermissionSchemaConfig>(schema: S) {\n    return createAbstraction<UsePermissionsResult<S>>(`${schema.prefix}:Permissions`);\n}\n\nexport function createPermissionsFeature<const S extends PermissionSchemaConfig>(\n    schema: S,\n    abstraction: Abstraction<UsePermissionsResult<S>>\n) {\n    class PermissionsImpl extends SchemaPermissions<S> {\n        constructor(identityContext: IIdentityContext) {\n            super(schema, identityContext);\n        }\n    }\n\n    const Implementation = abstraction.createImplementation({\n        implementation: PermissionsImpl,\n        dependencies: [IdentityContext]\n    });\n\n    return createFeature({\n        name: `${schema.prefix}:Permissions`,\n        register(container) {\n            container.register(Implementation).inSingletonScope();\n        },\n        resolve(container) {\n            return { permissions: container.resolve(abstraction) };\n        }\n    });\n}\n"],"names":["buildEntityMap","schema","map","Map","entity","actions","Set","action","getEntity","entityMap","entityId","Error","hasFullSchemaAccess","identity","prefix","fullAccessName","permission","SchemaPermissions","identityContext","permissions","item","createPermissionsAbstraction","createAbstraction","createPermissionsFeature","abstraction","PermissionsImpl","Implementation","IdentityContext","createFeature","container"],"mappings":";;AAcA,SAASA,eAAeC,MAA8B;IAClD,MAAMC,MAAM,IAAIC;IAChB,KAAK,MAAMC,UAAUH,OAAO,QAAQ,IAAI,EAAE,CAAE;QACxC,MAAMI,UAAU,IAAIC;QACpB,KAAK,MAAMC,UAAUH,OAAO,OAAO,IAAI,EAAE,CACrCC,QAAQ,GAAG,CAACE,OAAO,IAAI;QAE3BL,IAAI,GAAG,CAACE,OAAO,EAAE,EAAE;YACf,YAAYA,OAAO,UAAU;YAC7BC;YACA,QAAQD,OAAO,MAAM,CAAC,QAAQ,CAAC;QACnC;IACJ;IACA,OAAOF;AACX;AAEA,SAASM,UAAUC,SAAoC,EAAEC,QAAgB;IACrE,MAAMN,SAASK,UAAU,GAAG,CAACC;IAC7B,IAAI,CAACN,QACD,MAAM,IAAIO,MAAM,CAAC,gBAAgB,EAAED,SAAS,uBAAuB,CAAC;IAExE,OAAON;AACX;AAMA,SAASQ,oBAAoBC,QAAkB,EAAEC,MAAc;IAC3D,MAAMC,iBAAiB,GAAGD,OAAO,EAAE,CAAC;IACpC,MAAME,aAAaH,SAAS,aAAa,CAACE;IAC1C,IAAI,CAACC,YACD,OAAO;IAGX,IAAI,AAA0B,YAA1B,OAAOA,WAAW,GAAG,IAAiB,AAAyB,YAAzB,OAAOA,WAAW,EAAE,EAC1D,OAAO;IAEX,OAAO;AACX;AAEA,MAAMC;IAKF,YAAYhB,MAAS,EAAEiB,eAAiC,CAAE;aAc1D,SAAS,GAAG,CAACR;YACT,IAAI,IAAI,CAAC,UAAU,EACf,OAAO;YAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;YACzC,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAACN,OAAO,UAAU,EAAE,MAAM,GAAG;QACpE;aAEA,OAAO,GAAG,CAACM;YACP,IAAI,IAAI,CAAC,UAAU,EACf,OAAO;YAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;YACzC,MAAMS,cAAc,IAAI,CAAC,QAAQ,CAAC,cAAc,CAACf,OAAO,UAAU;YAClE,IAAI,CAACe,YAAY,MAAM,EACnB,OAAO;YAEX,OAAOA,YAAY,IAAI,CAACH,CAAAA;gBACpB,IAAI,AAA0B,YAA1B,OAAOA,WAAW,GAAG,EACrB,OAAO;gBAEX,OAAOA,WAAW,GAAG,CAAC,QAAQ,CAAC;YACnC;QACJ;aAEA,SAAS,GAAG,CAACN;YACT,IAAI,IAAI,CAAC,UAAU,EACf,OAAO;YAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;YACzC,MAAMS,cAAc,IAAI,CAAC,QAAQ,CAAC,cAAc,CAACf,OAAO,UAAU;YAClE,IAAI,CAACe,YAAY,MAAM,EACnB,OAAO;YAEX,OAAOA,YAAY,IAAI,CAACH,CAAAA;gBACpB,IAAI,AAA0B,YAA1B,OAAOA,WAAW,GAAG,EACrB,OAAO;gBAEX,OAAOA,WAAW,GAAG,CAAC,QAAQ,CAAC;YACnC;QACJ;aAEA,OAAO,GAAG,CAACN,UAAkBU;YACzB,IAAI,IAAI,CAAC,UAAU,EACf,OAAO;YAEX,MAAMhB,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;YACzC,MAAMS,cAAc,IAAI,CAAC,QAAQ,CAAC,cAAc,CAACf,OAAO,UAAU;YAClE,IAAI,CAACe,YAAY,MAAM,EACnB,OAAO;YAEX,OAAOA,YAAY,IAAI,CAACH,CAAAA;gBACpB,IAAIA,WAAW,GAAG,EAAE;oBAChB,IAAI,CAACI,MAAM,WACP,OAAO;oBAEX,OAAOA,KAAK,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE;gBACjD;gBACA,IAAI,AAA0B,YAA1B,OAAOJ,WAAW,GAAG,EACrB,OAAO;gBAEX,OAAOA,WAAW,GAAG,CAAC,QAAQ,CAAC;YACnC;QACJ;aAEA,SAAS,GAAG,CAACN,UAAkBU;YAC3B,IAAI,IAAI,CAAC,UAAU,EACf,OAAO;YAEX,MAAMhB,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;YACzC,MAAMS,cAAc,IAAI,CAAC,QAAQ,CAAC,cAAc,CAACf,OAAO,UAAU;YAClE,IAAI,CAACe,YAAY,MAAM,EACnB,OAAO;YAEX,OAAOA,YAAY,IAAI,CAACH,CAAAA;gBACpB,IAAIA,WAAW,GAAG,EACd,OAAOI,MAAM,WAAW,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAEnD,IAAI,AAA0B,YAA1B,OAAOJ,WAAW,GAAG,EACrB,OAAO;gBAEX,OAAOA,WAAW,GAAG,CAAC,QAAQ,CAAC;YACnC;QACJ;aAEA,UAAU,GAAG,CAACN;YACV,IAAI,IAAI,CAAC,UAAU,EACf,OAAO;YAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;YACzC,MAAMS,cAAc,IAAI,CAAC,QAAQ,CAAC,cAAc,CAACf,OAAO,UAAU;YAClE,IAAI,CAACe,YAAY,MAAM,EACnB,OAAO;YAEX,OAAOA,YAAY,IAAI,CAACH,CAAAA,aACbA,WAAW,EAAE,EAAE,SAAS;QAEvC;aAEA,YAAY,GAAG,CAACN;YACZ,IAAI,IAAI,CAAC,UAAU,EACf,OAAO;YAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;YACzC,MAAMS,cAAc,IAAI,CAAC,QAAQ,CAAC,cAAc,CAACf,OAAO,UAAU;YAClE,IAAI,CAACe,YAAY,MAAM,EACnB,OAAO;YAEX,OAAOA,YAAY,IAAI,CAACH,CAAAA,aACbA,WAAW,EAAE,EAAE,SAAS;QAEvC;aAEA,SAAS,GAAG,CAACT,QAAgBG;YACzB,IAAI,IAAI,CAAC,UAAU,EACf,OAAO;YAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;YACzC,MAAMS,cAAc,IAAI,CAAC,QAAQ,CAAC,cAAc,CAACf,OAAO,UAAU;YAClE,IAAI,CAACe,YAAY,MAAM,EACnB,OAAO;YAEX,OAAOA,YAAY,IAAI,CAACH,CAAAA,aACbA,AAAuB,SAAvBA,UAAU,CAACT,OAAO;QAEjC;QA1II,IAAI,CAAC,MAAM,GAAGN;QACd,IAAI,CAAC,SAAS,GAAGD,eAAeC;QAChC,IAAI,CAAC,eAAe,GAAGiB;IAC3B;IAEA,IAAY,WAAqB;QAC7B,OAAO,IAAI,CAAC,eAAe,CAAC,WAAW;IAC3C;IAEA,IAAY,aAAsB;QAC9B,OAAON,oBAAoB,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;IAChE;AAgIJ;AAEO,SAASS,6BAAqEpB,MAAS;IAC1F,OAAOqB,kBAA2C,GAAGrB,OAAO,MAAM,CAAC,YAAY,CAAC;AACpF;AAEO,SAASsB,yBACZtB,MAAS,EACTuB,WAAiD;IAEjD,MAAMC,wBAAwBR;QAC1B,YAAYC,eAAiC,CAAE;YAC3C,KAAK,CAACjB,QAAQiB;QAClB;IACJ;IAEA,MAAMQ,iBAAiBF,YAAY,oBAAoB,CAAC;QACpD,gBAAgBC;QAChB,cAAc;YAACE;SAAgB;IACnC;IAEA,OAAOC,cAAc;QACjB,MAAM,GAAG3B,OAAO,MAAM,CAAC,YAAY,CAAC;QACpC,UAAS4B,SAAS;YACdA,UAAU,QAAQ,CAACH,gBAAgB,gBAAgB;QACvD;QACA,SAAQG,SAAS;YACb,OAAO;gBAAE,aAAaA,UAAU,OAAO,CAACL;YAAa;QACzD;IACJ;AACJ"}

package/permissions/createPermissions.test.d.ts

@@ -0,0 +1 @@
+export {};

package/permissions/createPermissions.test.js

@@ -0,0 +1,209 @@
+import { describe, expect, it } from "vitest";
+import { Container } from "@webiny/di";
+import { createPermissionsAbstraction, createPermissionsFeature } from "./createPermissions.js";
+import { createPermissionSchema } from "./createPermissionSchema.js";
+import { IdentityContext } from "../features/security/IdentityContext/abstractions.js";
+import { IdentityContext as IdentityContext_js_IdentityContext } from "../features/security/IdentityContext/IdentityContext.js";
+import { Identity } from "../domain/Identity.js";
+const TEST_SCHEMA = createPermissionSchema({
+    prefix: "test",
+    fullAccess: true,
+    entities: [
+        {
+            id: "page",
+            title: "Page",
+            permission: "test.page",
+            scopes: [
+                "full",
+                "own"
+            ],
+            actions: [
+                {
+                    name: "rwd"
+                },
+                {
+                    name: "pw"
+                }
+            ]
+        }
+    ]
+});
+const TestPermissions = createPermissionsAbstraction(TEST_SCHEMA);
+const TestPermissionsFeature = createPermissionsFeature(TEST_SCHEMA, TestPermissions);
+function resolve(permissions) {
+    const container = new Container();
+    container.register(IdentityContext_js_IdentityContext).inSingletonScope();
+    TestPermissionsFeature.register(container);
+    const identityContext = container.resolve(IdentityContext);
+    identityContext.setIdentity(Identity.createAuthenticated({
+        id: "test-user",
+        displayName: "Test User",
+        type: "admin",
+        roles: [],
+        teams: [],
+        permissions,
+        profile: {
+            external: false
+        },
+        currentTenant: {
+            id: "root",
+            name: "Root"
+        },
+        defaultTenant: {
+            id: "root",
+            name: "Root"
+        }
+    }));
+    return container.resolve(TestPermissions);
+}
+describe("SchemaPermissions", ()=>{
+    describe("full access", ()=>{
+        it("grants everything with unrestricted wildcard", ()=>{
+            const p = resolve([
+                {
+                    name: "test.*"
+                }
+            ]);
+            expect(p.canAccess("page")).toBe(true);
+            expect(p.canRead("page")).toBe(true);
+            expect(p.canCreate("page")).toBe(true);
+            expect(p.canEdit("page")).toBe(true);
+            expect(p.canDelete("page")).toBe(true);
+            expect(p.canPublish("page")).toBe(true);
+            expect(p.canUnpublish("page")).toBe(true);
+        });
+        it("rejects wildcard with rwd restriction as non-full access", ()=>{
+            const p = resolve([
+                {
+                    name: "test.*",
+                    rwd: "r"
+                }
+            ]);
+            expect(p.canCreate("page")).toBe(false);
+            expect(p.canDelete("page")).toBe(false);
+        });
+    });
+    describe("entity-level access", ()=>{
+        it("grants access when entity permission exists", ()=>{
+            const p = resolve([
+                {
+                    name: "test.page"
+                }
+            ]);
+            expect(p.canAccess("page")).toBe(true);
+        });
+        it("denies access when no permission exists", ()=>{
+            const p = resolve([]);
+            expect(p.canAccess("page")).toBe(false);
+        });
+    });
+    describe("rwd actions", ()=>{
+        it("respects read permission", ()=>{
+            const p = resolve([
+                {
+                    name: "test.page",
+                    rwd: "r"
+                }
+            ]);
+            expect(p.canRead("page")).toBe(true);
+            expect(p.canCreate("page")).toBe(false);
+            expect(p.canDelete("page")).toBe(false);
+        });
+        it("respects write permission", ()=>{
+            const p = resolve([
+                {
+                    name: "test.page",
+                    rwd: "rw"
+                }
+            ]);
+            expect(p.canRead("page")).toBe(true);
+            expect(p.canCreate("page")).toBe(true);
+            expect(p.canEdit("page")).toBe(true);
+            expect(p.canDelete("page")).toBe(false);
+        });
+        it("respects delete permission", ()=>{
+            const p = resolve([
+                {
+                    name: "test.page",
+                    rwd: "d"
+                }
+            ]);
+            expect(p.canDelete("page")).toBe(true);
+            expect(p.canRead("page")).toBe(false);
+        });
+    });
+    describe("publish/unpublish actions", ()=>{
+        it("grants publish when pw includes p", ()=>{
+            const p = resolve([
+                {
+                    name: "test.page",
+                    pw: "p"
+                }
+            ]);
+            expect(p.canPublish("page")).toBe(true);
+            expect(p.canUnpublish("page")).toBe(false);
+        });
+        it("grants both when pw includes pu", ()=>{
+            const p = resolve([
+                {
+                    name: "test.page",
+                    pw: "pu"
+                }
+            ]);
+            expect(p.canPublish("page")).toBe(true);
+            expect(p.canUnpublish("page")).toBe(true);
+        });
+    });
+    describe("own scope", ()=>{
+        it("allows edit when item is owned by the user", ()=>{
+            const p = resolve([
+                {
+                    name: "test.page",
+                    own: true
+                }
+            ]);
+            expect(p.canEdit("page", {
+                createdBy: {
+                    id: "test-user"
+                }
+            })).toBe(true);
+        });
+        it("denies edit when item is owned by someone else", ()=>{
+            const p = resolve([
+                {
+                    name: "test.page",
+                    own: true
+                }
+            ]);
+            expect(p.canEdit("page", {
+                createdBy: {
+                    id: "other-user"
+                }
+            })).toBe(false);
+        });
+        it("allows edit when no item is provided (optimistic)", ()=>{
+            const p = resolve([
+                {
+                    name: "test.page",
+                    own: true
+                }
+            ]);
+            expect(p.canEdit("page")).toBe(true);
+        });
+        it("denies delete when item is owned by someone else", ()=>{
+            const p = resolve([
+                {
+                    name: "test.page",
+                    own: true
+                }
+            ]);
+            expect(p.canDelete("page", {
+                createdBy: {
+                    id: "other-user"
+                }
+            })).toBe(false);
+        });
+    });
+});
+
+//# sourceMappingURL=createPermissions.test.js.map

package/permissions/createPermissions.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions/createPermissions.test.js","sources":["../../src/permissions/createPermissions.test.ts"],"sourcesContent":["import { describe, it, expect } from \"vitest\";\nimport { Container } from \"@webiny/di\";\nimport { createPermissionsAbstraction, createPermissionsFeature } from \"./createPermissions.js\";\nimport { createPermissionSchema } from \"./createPermissionSchema.js\";\nimport { IdentityContext } from \"~/features/security/IdentityContext/abstractions.js\";\nimport { IdentityContext as IdentityContextImpl } from \"~/features/security/IdentityContext/IdentityContext.js\";\nimport { Identity } from \"~/domain/Identity.js\";\n\nconst TEST_SCHEMA = createPermissionSchema({\n    prefix: \"test\",\n    fullAccess: true,\n    entities: [\n        {\n            id: \"page\",\n            title: \"Page\",\n            permission: \"test.page\",\n            scopes: [\"full\", \"own\"],\n            actions: [{ name: \"rwd\" }, { name: \"pw\" }]\n        }\n    ]\n} as const);\n\nconst TestPermissions = createPermissionsAbstraction(TEST_SCHEMA);\nconst TestPermissionsFeature = createPermissionsFeature(TEST_SCHEMA, TestPermissions);\n\nfunction resolve(permissions: Array<{ name: string; [key: string]: any }>) {\n    const container = new Container();\n    container.register(IdentityContextImpl).inSingletonScope();\n    TestPermissionsFeature.register(container);\n\n    const identityContext = container.resolve(IdentityContext);\n    identityContext.setIdentity(\n        Identity.createAuthenticated({\n            id: \"test-user\",\n            displayName: \"Test User\",\n            type: \"admin\",\n            roles: [],\n            teams: [],\n            permissions,\n            profile: { external: false },\n            currentTenant: { id: \"root\", name: \"Root\" },\n            defaultTenant: { id: \"root\", name: \"Root\" }\n        })\n    );\n\n    return container.resolve(TestPermissions);\n}\n\ndescribe(\"SchemaPermissions\", () => {\n    describe(\"full access\", () => {\n        it(\"grants everything with unrestricted wildcard\", () => {\n            const p = resolve([{ name: \"test.*\" }]);\n            expect(p.canAccess(\"page\")).toBe(true);\n            expect(p.canRead(\"page\")).toBe(true);\n            expect(p.canCreate(\"page\")).toBe(true);\n            expect(p.canEdit(\"page\")).toBe(true);\n            expect(p.canDelete(\"page\")).toBe(true);\n            expect(p.canPublish(\"page\")).toBe(true);\n            expect(p.canUnpublish(\"page\")).toBe(true);\n        });\n\n        it(\"rejects wildcard with rwd restriction as non-full access\", () => {\n            const p = resolve([{ name: \"test.*\", rwd: \"r\" }]);\n            expect(p.canCreate(\"page\")).toBe(false);\n            expect(p.canDelete(\"page\")).toBe(false);\n        });\n    });\n\n    describe(\"entity-level access\", () => {\n        it(\"grants access when entity permission exists\", () => {\n            const p = resolve([{ name: \"test.page\" }]);\n            expect(p.canAccess(\"page\")).toBe(true);\n        });\n\n        it(\"denies access when no permission exists\", () => {\n            const p = resolve([]);\n            expect(p.canAccess(\"page\")).toBe(false);\n        });\n    });\n\n    describe(\"rwd actions\", () => {\n        it(\"respects read permission\", () => {\n            const p = resolve([{ name: \"test.page\", rwd: \"r\" }]);\n            expect(p.canRead(\"page\")).toBe(true);\n            expect(p.canCreate(\"page\")).toBe(false);\n            expect(p.canDelete(\"page\")).toBe(false);\n        });\n\n        it(\"respects write permission\", () => {\n            const p = resolve([{ name: \"test.page\", rwd: \"rw\" }]);\n            expect(p.canRead(\"page\")).toBe(true);\n            expect(p.canCreate(\"page\")).toBe(true);\n            expect(p.canEdit(\"page\")).toBe(true);\n            expect(p.canDelete(\"page\")).toBe(false);\n        });\n\n        it(\"respects delete permission\", () => {\n            const p = resolve([{ name: \"test.page\", rwd: \"d\" }]);\n            expect(p.canDelete(\"page\")).toBe(true);\n            expect(p.canRead(\"page\")).toBe(false);\n        });\n    });\n\n    describe(\"publish/unpublish actions\", () => {\n        it(\"grants publish when pw includes p\", () => {\n            const p = resolve([{ name: \"test.page\", pw: \"p\" }]);\n            expect(p.canPublish(\"page\")).toBe(true);\n            expect(p.canUnpublish(\"page\")).toBe(false);\n        });\n\n        it(\"grants both when pw includes pu\", () => {\n            const p = resolve([{ name: \"test.page\", pw: \"pu\" }]);\n            expect(p.canPublish(\"page\")).toBe(true);\n            expect(p.canUnpublish(\"page\")).toBe(true);\n        });\n    });\n\n    describe(\"own scope\", () => {\n        it(\"allows edit when item is owned by the user\", () => {\n            const p = resolve([{ name: \"test.page\", own: true }]);\n            expect(p.canEdit(\"page\", { createdBy: { id: \"test-user\" } })).toBe(true);\n        });\n\n        it(\"denies edit when item is owned by someone else\", () => {\n            const p = resolve([{ name: \"test.page\", own: true }]);\n            expect(p.canEdit(\"page\", { createdBy: { id: \"other-user\" } })).toBe(false);\n        });\n\n        it(\"allows edit when no item is provided (optimistic)\", () => {\n            const p = resolve([{ name: \"test.page\", own: true }]);\n            expect(p.canEdit(\"page\")).toBe(true);\n        });\n\n        it(\"denies delete when item is owned by someone else\", () => {\n            const p = resolve([{ name: \"test.page\", own: true }]);\n            expect(p.canDelete(\"page\", { createdBy: { id: \"other-user\" } })).toBe(false);\n        });\n    });\n});\n"],"names":["TEST_SCHEMA","createPermissionSchema","TestPermissions","createPermissionsAbstraction","TestPermissionsFeature","createPermissionsFeature","resolve","permissions","container","Container","IdentityContextImpl","identityContext","IdentityContext","Identity","describe","it","p","expect"],"mappings":";;;;;;;AAQA,MAAMA,cAAcC,uBAAuB;IACvC,QAAQ;IACR,YAAY;IACZ,UAAU;QACN;YACI,IAAI;YACJ,OAAO;YACP,YAAY;YACZ,QAAQ;gBAAC;gBAAQ;aAAM;YACvB,SAAS;gBAAC;oBAAE,MAAM;gBAAM;gBAAG;oBAAE,MAAM;gBAAK;aAAE;QAC9C;KACH;AACL;AAEA,MAAMC,kBAAkBC,6BAA6BH;AACrD,MAAMI,yBAAyBC,yBAAyBL,aAAaE;AAErE,SAASI,QAAQC,WAAwD;IACrE,MAAMC,YAAY,IAAIC;IACtBD,UAAU,QAAQ,CAACE,oCAAqB,gBAAgB;IACxDN,uBAAuB,QAAQ,CAACI;IAEhC,MAAMG,kBAAkBH,UAAU,OAAO,CAACI;IAC1CD,gBAAgB,WAAW,CACvBE,SAAS,mBAAmB,CAAC;QACzB,IAAI;QACJ,aAAa;QACb,MAAM;QACN,OAAO,EAAE;QACT,OAAO,EAAE;QACTN;QACA,SAAS;YAAE,UAAU;QAAM;QAC3B,eAAe;YAAE,IAAI;YAAQ,MAAM;QAAO;QAC1C,eAAe;YAAE,IAAI;YAAQ,MAAM;QAAO;IAC9C;IAGJ,OAAOC,UAAU,OAAO,CAACN;AAC7B;AAEAY,SAAS,qBAAqB;IAC1BA,SAAS,eAAe;QACpBC,GAAG,gDAAgD;YAC/C,MAAMC,IAAIV,QAAQ;gBAAC;oBAAE,MAAM;gBAAS;aAAE;YACtCW,OAAOD,EAAE,SAAS,CAAC,SAAS,IAAI,CAAC;YACjCC,OAAOD,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC;YAC/BC,OAAOD,EAAE,SAAS,CAAC,SAAS,IAAI,CAAC;YACjCC,OAAOD,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC;YAC/BC,OAAOD,EAAE,SAAS,CAAC,SAAS,IAAI,CAAC;YACjCC,OAAOD,EAAE,UAAU,CAAC,SAAS,IAAI,CAAC;YAClCC,OAAOD,EAAE,YAAY,CAAC,SAAS,IAAI,CAAC;QACxC;QAEAD,GAAG,4DAA4D;YAC3D,MAAMC,IAAIV,QAAQ;gBAAC;oBAAE,MAAM;oBAAU,KAAK;gBAAI;aAAE;YAChDW,OAAOD,EAAE,SAAS,CAAC,SAAS,IAAI,CAAC;YACjCC,OAAOD,EAAE,SAAS,CAAC,SAAS,IAAI,CAAC;QACrC;IACJ;IAEAF,SAAS,uBAAuB;QAC5BC,GAAG,+CAA+C;YAC9C,MAAMC,IAAIV,QAAQ;gBAAC;oBAAE,MAAM;gBAAY;aAAE;YACzCW,OAAOD,EAAE,SAAS,CAAC,SAAS,IAAI,CAAC;QACrC;QAEAD,GAAG,2CAA2C;YAC1C,MAAMC,IAAIV,QAAQ,EAAE;YACpBW,OAAOD,EAAE,SAAS,CAAC,SAAS,IAAI,CAAC;QACrC;IACJ;IAEAF,SAAS,eAAe;QACpBC,GAAG,4BAA4B;YAC3B,MAAMC,IAAIV,QAAQ;gBAAC;oBAAE,MAAM;oBAAa,KAAK;gBAAI;aAAE;YACnDW,OAAOD,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC;YAC/BC,OAAOD,EAAE,SAAS,CAAC,SAAS,IAAI,CAAC;YACjCC,OAAOD,EAAE,SAAS,CAAC,SAAS,IAAI,CAAC;QACrC;QAEAD,GAAG,6BAA6B;YAC5B,MAAMC,IAAIV,QAAQ;gBAAC;oBAAE,MAAM;oBAAa,KAAK;gBAAK;aAAE;YACpDW,OAAOD,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC;YAC/BC,OAAOD,EAAE,SAAS,CAAC,SAAS,IAAI,CAAC;YACjCC,OAAOD,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC;YAC/BC,OAAOD,EAAE,SAAS,CAAC,SAAS,IAAI,CAAC;QACrC;QAEAD,GAAG,8BAA8B;YAC7B,MAAMC,IAAIV,QAAQ;gBAAC;oBAAE,MAAM;oBAAa,KAAK;gBAAI;aAAE;YACnDW,OAAOD,EAAE,SAAS,CAAC,SAAS,IAAI,CAAC;YACjCC,OAAOD,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC;QACnC;IACJ;IAEAF,SAAS,6BAA6B;QAClCC,GAAG,qCAAqC;YACpC,MAAMC,IAAIV,QAAQ;gBAAC;oBAAE,MAAM;oBAAa,IAAI;gBAAI;aAAE;YAClDW,OAAOD,EAAE,UAAU,CAAC,SAAS,IAAI,CAAC;YAClCC,OAAOD,EAAE,YAAY,CAAC,SAAS,IAAI,CAAC;QACxC;QAEAD,GAAG,mCAAmC;YAClC,MAAMC,IAAIV,QAAQ;gBAAC;oBAAE,MAAM;oBAAa,IAAI;gBAAK;aAAE;YACnDW,OAAOD,EAAE,UAAU,CAAC,SAAS,IAAI,CAAC;YAClCC,OAAOD,EAAE,YAAY,CAAC,SAAS,IAAI,CAAC;QACxC;IACJ;IAEAF,SAAS,aAAa;QAClBC,GAAG,8CAA8C;YAC7C,MAAMC,IAAIV,QAAQ;gBAAC;oBAAE,MAAM;oBAAa,KAAK;gBAAK;aAAE;YACpDW,OAAOD,EAAE,OAAO,CAAC,QAAQ;gBAAE,WAAW;oBAAE,IAAI;gBAAY;YAAE,IAAI,IAAI,CAAC;QACvE;QAEAD,GAAG,kDAAkD;YACjD,MAAMC,IAAIV,QAAQ;gBAAC;oBAAE,MAAM;oBAAa,KAAK;gBAAK;aAAE;YACpDW,OAAOD,EAAE,OAAO,CAAC,QAAQ;gBAAE,WAAW;oBAAE,IAAI;gBAAa;YAAE,IAAI,IAAI,CAAC;QACxE;QAEAD,GAAG,qDAAqD;YACpD,MAAMC,IAAIV,QAAQ;gBAAC;oBAAE,MAAM;oBAAa,KAAK;gBAAK;aAAE;YACpDW,OAAOD,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC;QACnC;QAEAD,GAAG,oDAAoD;YACnD,MAAMC,IAAIV,QAAQ;gBAAC;oBAAE,MAAM;oBAAa,KAAK;gBAAK;aAAE;YACpDW,OAAOD,EAAE,SAAS,CAAC,QAAQ;gBAAE,WAAW;oBAAE,IAAI;gBAAa;YAAE,IAAI,IAAI,CAAC;QAC1E;IACJ;AACJ"}

package/permissions/index.d.ts

@@ -0,0 +1,9 @@
+export { createPermissionSchema } from "./createPermissionSchema.js";
+export { createPermissionsAbstraction, createPermissionsFeature } from "./createPermissions.js";
+export { createUsePermissions } from "./usePermissions.js";
+export { usePermissionForm, deserializePermissions, serializePermissions } from "./usePermissionForm.js";
+export { PermissionRenderer } from "./PermissionRenderer.js";
+export type { PermissionRendererProps } from "./PermissionRenderer.js";
+export { usePermissionValue, PermissionValueProvider } from "./PermissionValueContext.js";
+export { createHasPermission } from "./createHasPermission.js";
+export type { Permission, ActionDefinition, EntityDefinition, OwnableItem, PermissionSchemaConfig, PermissionSchema, UsePermissionFormOptions, UsePermissionFormResult, UsePermissionsResult, PermissionRendererConfig, HasPermissionAction, HasPermissionProps } from "./types.js";

package/permissions/index.js

@@ -0,0 +1,7 @@
+export { createPermissionSchema } from "./createPermissionSchema.js";
+export { createPermissionsAbstraction, createPermissionsFeature } from "./createPermissions.js";
+export { createUsePermissions } from "./usePermissions.js";
+export { deserializePermissions, serializePermissions, usePermissionForm } from "./usePermissionForm.js";
+export { PermissionRenderer } from "./PermissionRenderer.js";
+export { PermissionValueProvider, usePermissionValue } from "./PermissionValueContext.js";
+export { createHasPermission } from "./createHasPermission.js";