@webiny/app-admin 0.0.0-unstable.e6f0dc8ca7 → 0.0.0-unstable.eb81deee7e

package/permissions/createHasPermission.js.map

@@ -1 +1 @@
-{"version":3,"names":["React","useContainer","BUILT_IN_ACTIONS","read","create","edit","delete","publish","unpublish","createHasPermission","abstraction","HasPermission","children","props","container","permissions","resolve","action","someActions","allActions","entities","entity","any","all","requireAll","checkAction","entityId","singleAction","canAccess","method","canAction","check","every","act","some","allowed","createElement","Fragment"],"sources":["createHasPermission.tsx"],"sourcesContent":["import React from \"react\";\nimport type { Abstraction } from \"@webiny/di\";\nimport type { HasPermissionProps, PermissionSchemaConfig, UsePermissionsResult } from \"./types.js\";\nimport { useContainer } from \"@webiny/app\";\n\nconst BUILT_IN_ACTIONS: Record<string, string> = {\n    read: \"canRead\",\n    create: \"canCreate\",\n    edit: \"canEdit\",\n    delete: \"canDelete\",\n    publish: \"canPublish\",\n    unpublish: \"canUnpublish\"\n};\n\nexport function createHasPermission<const S extends PermissionSchemaConfig>(\n    abstraction: Abstraction<UsePermissionsResult<S>>\n): React.FC<HasPermissionProps<S>> {\n    return function HasPermission({ children, ...props }) {\n        const container = useContainer();\n        const permissions = container.resolve(abstraction);\n\n        const action = props.action as string | undefined;\n        const someActions = props.someActions as string[] | undefined;\n        const allActions = props.allActions as string[] | undefined;\n        const entities: string[] = props.entity ? [props.entity] : (props.any ?? props.all ?? []);\n        const requireAll = !!props.all;\n\n        const checkAction = (entityId: string, singleAction: string | undefined): boolean => {\n            if (!singleAction) {\n                return permissions.canAccess(entityId);\n            }\n            const method = BUILT_IN_ACTIONS[singleAction] as keyof typeof permissions;\n            if (method && typeof permissions[method] === \"function\") {\n                return (permissions[method] as (entityId: string) => boolean)(entityId);\n            }\n            return (permissions.canAction as (action: string, entityId: string) => boolean)(\n                singleAction,\n                entityId\n            );\n        };\n\n        const check = (entityId: string): boolean => {\n            if (allActions) {\n                return allActions.every(act => checkAction(entityId, act));\n            }\n            if (someActions) {\n                return someActions.some(act => checkAction(entityId, act));\n            }\n            return checkAction(entityId, action);\n        };\n\n        const allowed = requireAll ? entities.every(check) : entities.some(check);\n\n        return allowed ? <>{children}</> : null;\n    };\n}\n"],"mappings":"AAAA,OAAOA,KAAK,MAAM,OAAO;AAGzB,SAASC,YAAY,QAAQ,aAAa;AAE1C,MAAMC,gBAAwC,GAAG;EAC7CC,IAAI,EAAE,SAAS;EACfC,MAAM,EAAE,WAAW;EACnBC,IAAI,EAAE,SAAS;EACfC,MAAM,EAAE,WAAW;EACnBC,OAAO,EAAE,YAAY;EACrBC,SAAS,EAAE;AACf,CAAC;AAED,OAAO,SAASC,mBAAmBA,CAC/BC,WAAiD,EAClB;EAC/B,OAAO,SAASC,aAAaA,CAAC;IAAEC,QAAQ;IAAE,GAAGC;EAAM,CAAC,EAAE;IAClD,MAAMC,SAAS,GAAGb,YAAY,CAAC,CAAC;IAChC,MAAMc,WAAW,GAAGD,SAAS,CAACE,OAAO,CAACN,WAAW,CAAC;IAElD,MAAMO,MAAM,GAAGJ,KAAK,CAACI,MAA4B;IACjD,MAAMC,WAAW,GAAGL,KAAK,CAACK,WAAmC;IAC7D,MAAMC,UAAU,GAAGN,KAAK,CAACM,UAAkC;IAC3D,MAAMC,QAAkB,GAAGP,KAAK,CAACQ,MAAM,GAAG,CAACR,KAAK,CAACQ,MAAM,CAAC,GAAIR,KAAK,CAACS,GAAG,IAAIT,KAAK,CAACU,GAAG,IAAI,EAAG;IACzF,MAAMC,UAAU,GAAG,CAAC,CAACX,KAAK,CAACU,GAAG;IAE9B,MAAME,WAAW,GAAGA,CAACC,QAAgB,EAAEC,YAAgC,KAAc;MACjF,IAAI,CAACA,YAAY,EAAE;QACf,OAAOZ,WAAW,CAACa,SAAS,CAACF,QAAQ,CAAC;MAC1C;MACA,MAAMG,MAAM,GAAG3B,gBAAgB,CAACyB,YAAY,CAA6B;MACzE,IAAIE,MAAM,IAAI,OAAOd,WAAW,CAACc,MAAM,CAAC,KAAK,UAAU,EAAE;QACrD,OAAQd,WAAW,CAACc,MAAM,CAAC,CAAmCH,QAAQ,CAAC;MAC3E;MACA,OAAQX,WAAW,CAACe,SAAS,CACzBH,YAAY,EACZD,QACJ,CAAC;IACL,CAAC;IAED,MAAMK,KAAK,GAAIL,QAAgB,IAAc;MACzC,IAAIP,UAAU,EAAE;QACZ,OAAOA,UAAU,CAACa,KAAK,CAACC,GAAG,IAAIR,WAAW,CAACC,QAAQ,EAAEO,GAAG,CAAC,CAAC;MAC9D;MACA,IAAIf,WAAW,EAAE;QACb,OAAOA,WAAW,CAACgB,IAAI,CAACD,GAAG,IAAIR,WAAW,CAACC,QAAQ,EAAEO,GAAG,CAAC,CAAC;MAC9D;MACA,OAAOR,WAAW,CAACC,QAAQ,EAAET,MAAM,CAAC;IACxC,CAAC;IAED,MAAMkB,OAAO,GAAGX,UAAU,GAAGJ,QAAQ,CAACY,KAAK,CAACD,KAAK,CAAC,GAAGX,QAAQ,CAACc,IAAI,CAACH,KAAK,CAAC;IAEzE,OAAOI,OAAO,gBAAGnC,KAAA,CAAAoC,aAAA,CAAApC,KAAA,CAAAqC,QAAA,QAAGzB,QAAW,CAAC,GAAG,IAAI;EAC3C,CAAC;AACL","ignoreList":[]}
+{"version":3,"file":"permissions/createHasPermission.js","sources":["../../src/permissions/createHasPermission.tsx"],"sourcesContent":["import React from \"react\";\nimport type { Abstraction } from \"@webiny/di\";\nimport type { HasPermissionProps, PermissionSchemaConfig, UsePermissionsResult } from \"./types.js\";\nimport { useContainer } from \"@webiny/app\";\n\nconst BUILT_IN_ACTIONS: Record<string, string> = {\n    read: \"canRead\",\n    create: \"canCreate\",\n    edit: \"canEdit\",\n    delete: \"canDelete\",\n    publish: \"canPublish\",\n    unpublish: \"canUnpublish\"\n};\n\nexport function createHasPermission<const S extends PermissionSchemaConfig>(\n    abstraction: Abstraction<UsePermissionsResult<S>>\n): React.FC<HasPermissionProps<S>> {\n    return function HasPermission({ children, ...props }) {\n        const container = useContainer();\n        const permissions = container.resolve(abstraction);\n\n        const action = props.action as string | undefined;\n        const someActions = props.someActions as string[] | undefined;\n        const allActions = props.allActions as string[] | undefined;\n        const entities: string[] = props.entity ? [props.entity] : (props.any ?? props.all ?? []);\n        const requireAll = !!props.all;\n\n        const checkAction = (entityId: string, singleAction: string | undefined): boolean => {\n            if (!singleAction) {\n                return permissions.canAccess(entityId);\n            }\n            const method = BUILT_IN_ACTIONS[singleAction] as keyof typeof permissions;\n            if (method && typeof permissions[method] === \"function\") {\n                return (permissions[method] as (entityId: string) => boolean)(entityId);\n            }\n            return (permissions.canAction as (action: string, entityId: string) => boolean)(\n                singleAction,\n                entityId\n            );\n        };\n\n        const check = (entityId: string): boolean => {\n            if (allActions) {\n                return allActions.every(act => checkAction(entityId, act));\n            }\n            if (someActions) {\n                return someActions.some(act => checkAction(entityId, act));\n            }\n            return checkAction(entityId, action);\n        };\n\n        const allowed = requireAll ? entities.every(check) : entities.some(check);\n\n        return allowed ? <>{children}</> : null;\n    };\n}\n"],"names":["BUILT_IN_ACTIONS","createHasPermission","abstraction","children","props","container","useContainer","permissions","action","someActions","allActions","entities","requireAll","checkAction","entityId","singleAction","method","check","act","allowed"],"mappings":";;AAKA,MAAMA,mBAA2C;IAC7C,MAAM;IACN,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,SAAS;IACT,WAAW;AACf;AAEO,SAASC,oBACZC,WAAiD;IAEjD,OAAO,SAAuB,EAAEC,QAAQ,EAAE,GAAGC,OAAO;QAChD,MAAMC,YAAYC;QAClB,MAAMC,cAAcF,UAAU,OAAO,CAACH;QAEtC,MAAMM,SAASJ,MAAM,MAAM;QAC3B,MAAMK,cAAcL,MAAM,WAAW;QACrC,MAAMM,aAAaN,MAAM,UAAU;QACnC,MAAMO,WAAqBP,MAAM,MAAM,GAAG;YAACA,MAAM,MAAM;SAAC,GAAIA,MAAM,GAAG,IAAIA,MAAM,GAAG,IAAI,EAAE;QACxF,MAAMQ,aAAa,CAAC,CAACR,MAAM,GAAG;QAE9B,MAAMS,cAAc,CAACC,UAAkBC;YACnC,IAAI,CAACA,cACD,OAAOR,YAAY,SAAS,CAACO;YAEjC,MAAME,SAAShB,gBAAgB,CAACe,aAAa;YAC7C,IAAIC,UAAU,AAA+B,cAA/B,OAAOT,WAAW,CAACS,OAAO,EACpC,OAAQT,WAAW,CAACS,OAAO,CAAmCF;YAElE,OAAQP,YAAY,SAAS,CACzBQ,cACAD;QAER;QAEA,MAAMG,QAAQ,CAACH;YACX,IAAIJ,YACA,OAAOA,WAAW,KAAK,CAACQ,CAAAA,MAAOL,YAAYC,UAAUI;YAEzD,IAAIT,aACA,OAAOA,YAAY,IAAI,CAACS,CAAAA,MAAOL,YAAYC,UAAUI;YAEzD,OAAOL,YAAYC,UAAUN;QACjC;QAEA,MAAMW,UAAUP,aAAaD,SAAS,KAAK,CAACM,SAASN,SAAS,IAAI,CAACM;QAEnE,OAAOE,UAAU,WAAVA,GAAU,0CAAGhB,YAAe;IACvC;AACJ"}

package/permissions/createPermissionSchema.js

@@ -1,8 +1,9 @@
-export function createPermissionSchema(config) {
-  return {
-    ...config,
-    entities: config.entities ?? []
-  };
+function createPermissionSchema(config) {
+    return {
+        ...config,
+        entities: config.entities ?? []
+    };
 }
+export { createPermissionSchema };
 
 //# sourceMappingURL=createPermissionSchema.js.map

package/permissions/createPermissionSchema.js.map

@@ -1 +1 @@
-{"version":3,"names":["createPermissionSchema","config","entities"],"sources":["createPermissionSchema.ts"],"sourcesContent":["import type { PermissionSchemaConfig } from \"./types.js\";\n\nexport function createPermissionSchema<const T extends PermissionSchemaConfig>(config: T): T {\n    return {\n        ...config,\n        entities: config.entities ?? []\n    };\n}\n"],"mappings":"AAEA,OAAO,SAASA,sBAAsBA,CAAyCC,MAAS,EAAK;EACzF,OAAO;IACH,GAAGA,MAAM;IACTC,QAAQ,EAAED,MAAM,CAACC,QAAQ,IAAI;EACjC,CAAC;AACL","ignoreList":[]}
+{"version":3,"file":"permissions/createPermissionSchema.js","sources":["../../src/permissions/createPermissionSchema.ts"],"sourcesContent":["import type { PermissionSchemaConfig } from \"./types.js\";\n\nexport function createPermissionSchema<const T extends PermissionSchemaConfig>(config: T): T {\n    return {\n        ...config,\n        entities: config.entities ?? []\n    };\n}\n"],"names":["createPermissionSchema","config"],"mappings":"AAEO,SAASA,uBAA+DC,MAAS;IACpF,OAAO;QACH,GAAGA,MAAM;QACT,UAAUA,OAAO,QAAQ,IAAI,EAAE;IACnC;AACJ"}

package/permissions/createPermissions.js

@@ -1,201 +1,141 @@
-import { createAbstraction } from "@webiny/feature/admin";
-import { createFeature } from "@webiny/feature/admin";
+import { createAbstraction, createFeature } from "@webiny/feature/admin";
 import { IdentityContext } from "../features/security/IdentityContext/abstractions.js";
 function buildEntityMap(schema) {
-  const map = new Map();
-  for (const entity of schema.entities ?? []) {
-    const actions = new Set();
-    for (const action of entity.actions ?? []) {
-      actions.add(action.name);
-    }
-    map.set(entity.id, {
-      permission: entity.permission,
-      actions,
-      hasOwn: entity.scopes.includes("own")
-    });
-  }
-  return map;
+    const map = new Map();
+    for (const entity of schema.entities ?? []){
+        const actions = new Set();
+        for (const action of entity.actions ?? [])actions.add(action.name);
+        map.set(entity.id, {
+            permission: entity.permission,
+            actions,
+            hasOwn: entity.scopes.includes("own")
+        });
+    }
+    return map;
 }
 function getEntity(entityMap, entityId) {
-  const entity = entityMap.get(entityId);
-  if (!entity) {
-    throw new Error(`Unknown entity "${entityId}" in permission schema.`);
-  }
-  return entity;
+    const entity = entityMap.get(entityId);
+    if (!entity) throw new Error(`Unknown entity "${entityId}" in permission schema.`);
+    return entity;
 }
-
-/**
- * Check whether the identity has unrestricted full access for the given schema prefix.
- * Stricter than the legacy check: `{ name: "wb.*", rwd: "r" }` is NOT full access.
- */
 function hasFullSchemaAccess(identity, prefix) {
-  const fullAccessName = `${prefix}.*`;
-  const permission = identity.getPermission(fullAccessName);
-  if (!permission) {
-    return false;
-  }
-  // If any restricting keys are present, this is not full access.
-  if (typeof permission.rwd === "string" || typeof permission.pw === "string") {
-    return false;
-  }
-  return true;
+    const fullAccessName = `${prefix}.*`;
+    const permission = identity.getPermission(fullAccessName);
+    if (!permission) return false;
+    if ("string" == typeof permission.rwd || "string" == typeof permission.pw) return false;
+    return true;
 }
 class SchemaPermissions {
-  constructor(schema, identityContext) {
-    this.schema = schema;
-    this.entityMap = buildEntityMap(schema);
-    this.identityContext = identityContext;
-  }
-  get identity() {
-    return this.identityContext.getIdentity();
-  }
-  get fullAccess() {
-    return hasFullSchemaAccess(this.identity, this.schema.prefix);
-  }
-  canAccess = entityId => {
-    if (this.fullAccess) {
-      return true;
-    }
-    const entity = getEntity(this.entityMap, entityId);
-    return this.identity.getPermissions(entity.permission).length > 0;
-  };
-  canRead = entityId => {
-    if (this.fullAccess) {
-      return true;
-    }
-    const entity = getEntity(this.entityMap, entityId);
-    const permissions = this.identity.getPermissions(entity.permission);
-    if (!permissions.length) {
-      return false;
-    }
-    return permissions.some(permission => {
-      if (typeof permission.rwd !== "string") {
-        return true;
-      }
-      return permission.rwd.includes("r");
-    });
-  };
-  canCreate = entityId => {
-    if (this.fullAccess) {
-      return true;
+    constructor(schema, identityContext){
+        this.canAccess = (entityId)=>{
+            if (this.fullAccess) return true;
+            const entity = getEntity(this.entityMap, entityId);
+            return this.identity.getPermissions(entity.permission).length > 0;
+        };
+        this.canRead = (entityId)=>{
+            if (this.fullAccess) return true;
+            const entity = getEntity(this.entityMap, entityId);
+            const permissions = this.identity.getPermissions(entity.permission);
+            if (!permissions.length) return false;
+            return permissions.some((permission)=>{
+                if ("string" != typeof permission.rwd) return true;
+                return permission.rwd.includes("r");
+            });
+        };
+        this.canCreate = (entityId)=>{
+            if (this.fullAccess) return true;
+            const entity = getEntity(this.entityMap, entityId);
+            const permissions = this.identity.getPermissions(entity.permission);
+            if (!permissions.length) return false;
+            return permissions.some((permission)=>{
+                if ("string" != typeof permission.rwd) return true;
+                return permission.rwd.includes("w");
+            });
+        };
+        this.canEdit = (entityId, item)=>{
+            if (this.fullAccess) return true;
+            const entity = getEntity(this.entityMap, entityId);
+            const permissions = this.identity.getPermissions(entity.permission);
+            if (!permissions.length) return false;
+            return permissions.some((permission)=>{
+                if (permission.own) {
+                    if (!item?.createdBy) return true;
+                    return item.createdBy.id === this.identity.id;
+                }
+                if ("string" != typeof permission.rwd) return true;
+                return permission.rwd.includes("w");
+            });
+        };
+        this.canDelete = (entityId, item)=>{
+            if (this.fullAccess) return true;
+            const entity = getEntity(this.entityMap, entityId);
+            const permissions = this.identity.getPermissions(entity.permission);
+            if (!permissions.length) return false;
+            return permissions.some((permission)=>{
+                if (permission.own) return item?.createdBy?.id === this.identity.id;
+                if ("string" != typeof permission.rwd) return true;
+                return permission.rwd.includes("d");
+            });
+        };
+        this.canPublish = (entityId)=>{
+            if (this.fullAccess) return true;
+            const entity = getEntity(this.entityMap, entityId);
+            const permissions = this.identity.getPermissions(entity.permission);
+            if (!permissions.length) return false;
+            return permissions.some((permission)=>permission.pw?.includes("p"));
+        };
+        this.canUnpublish = (entityId)=>{
+            if (this.fullAccess) return true;
+            const entity = getEntity(this.entityMap, entityId);
+            const permissions = this.identity.getPermissions(entity.permission);
+            if (!permissions.length) return false;
+            return permissions.some((permission)=>permission.pw?.includes("u"));
+        };
+        this.canAction = (action, entityId)=>{
+            if (this.fullAccess) return true;
+            const entity = getEntity(this.entityMap, entityId);
+            const permissions = this.identity.getPermissions(entity.permission);
+            if (!permissions.length) return false;
+            return permissions.some((permission)=>true === permission[action]);
+        };
+        this.schema = schema;
+        this.entityMap = buildEntityMap(schema);
+        this.identityContext = identityContext;
+    }
+    get identity() {
+        return this.identityContext.getIdentity();
+    }
+    get fullAccess() {
+        return hasFullSchemaAccess(this.identity, this.schema.prefix);
     }
-    const entity = getEntity(this.entityMap, entityId);
-    const permissions = this.identity.getPermissions(entity.permission);
-    if (!permissions.length) {
-      return false;
-    }
-    return permissions.some(permission => {
-      if (typeof permission.rwd !== "string") {
-        return true;
-      }
-      return permission.rwd.includes("w");
-    });
-  };
-  canEdit = (entityId, item) => {
-    if (this.fullAccess) {
-      return true;
-    }
-    const entity = getEntity(this.entityMap, entityId);
-    const permissions = this.identity.getPermissions(entity.permission);
-    if (!permissions.length) {
-      return false;
-    }
-    return permissions.some(permission => {
-      if (permission.own) {
-        if (!item?.createdBy) {
-          return true;
+}
+function createPermissionsAbstraction(schema) {
+    return createAbstraction(`${schema.prefix}:Permissions`);
+}
+function createPermissionsFeature(schema, abstraction) {
+    class PermissionsImpl extends SchemaPermissions {
+        constructor(identityContext){
+            super(schema, identityContext);
         }
-        return item.createdBy.id === this.identity.id;
-      }
-      if (typeof permission.rwd !== "string") {
-        return true;
-      }
-      return permission.rwd.includes("w");
-    });
-  };
-  canDelete = (entityId, item) => {
-    if (this.fullAccess) {
-      return true;
     }
-    const entity = getEntity(this.entityMap, entityId);
-    const permissions = this.identity.getPermissions(entity.permission);
-    if (!permissions.length) {
-      return false;
-    }
-    return permissions.some(permission => {
-      if (permission.own) {
-        return item?.createdBy?.id === this.identity.id;
-      }
-      if (typeof permission.rwd !== "string") {
-        return true;
-      }
-      return permission.rwd.includes("d");
-    });
-  };
-  canPublish = entityId => {
-    if (this.fullAccess) {
-      return true;
-    }
-    const entity = getEntity(this.entityMap, entityId);
-    const permissions = this.identity.getPermissions(entity.permission);
-    if (!permissions.length) {
-      return false;
-    }
-    return permissions.some(permission => {
-      return permission.pw?.includes("p");
-    });
-  };
-  canUnpublish = entityId => {
-    if (this.fullAccess) {
-      return true;
-    }
-    const entity = getEntity(this.entityMap, entityId);
-    const permissions = this.identity.getPermissions(entity.permission);
-    if (!permissions.length) {
-      return false;
-    }
-    return permissions.some(permission => {
-      return permission.pw?.includes("u");
+    const Implementation = abstraction.createImplementation({
+        implementation: PermissionsImpl,
+        dependencies: [
+            IdentityContext
+        ]
     });
-  };
-  canAction = (action, entityId) => {
-    if (this.fullAccess) {
-      return true;
-    }
-    const entity = getEntity(this.entityMap, entityId);
-    const permissions = this.identity.getPermissions(entity.permission);
-    if (!permissions.length) {
-      return false;
-    }
-    return permissions.some(permission => {
-      return permission[action] === true;
+    return createFeature({
+        name: `${schema.prefix}:Permissions`,
+        register (container) {
+            container.register(Implementation).inSingletonScope();
+        },
+        resolve (container) {
+            return {
+                permissions: container.resolve(abstraction)
+            };
+        }
     });
-  };
-}
-export function createPermissionsAbstraction(schema) {
-  return createAbstraction(`${schema.prefix}:Permissions`);
-}
-export function createPermissionsFeature(schema, abstraction) {
-  class PermissionsImpl extends SchemaPermissions {
-    constructor(identityContext) {
-      super(schema, identityContext);
-    }
-  }
-  const Implementation = abstraction.createImplementation({
-    implementation: PermissionsImpl,
-    dependencies: [IdentityContext]
-  });
-  return createFeature({
-    name: `${schema.prefix}:Permissions`,
-    register(container) {
-      container.register(Implementation).inSingletonScope();
-    },
-    resolve(container) {
-      return {
-        permissions: container.resolve(abstraction)
-      };
-    }
-  });
 }
+export { createPermissionsAbstraction, createPermissionsFeature };
 
 //# sourceMappingURL=createPermissions.js.map

package/permissions/createPermissions.js.map

@@ -1 +1 @@
-{"version":3,"names":["createAbstraction","createFeature","IdentityContext","buildEntityMap","schema","map","Map","entity","entities","actions","Set","action","add","name","set","id","permission","hasOwn","scopes","includes","getEntity","entityMap","entityId","get","Error","hasFullSchemaAccess","identity","prefix","fullAccessName","getPermission","rwd","pw","SchemaPermissions","constructor","identityContext","getIdentity","fullAccess","canAccess","getPermissions","length","canRead","permissions","some","canCreate","canEdit","item","own","createdBy","canDelete","canPublish","canUnpublish","canAction","createPermissionsAbstraction","createPermissionsFeature","abstraction","PermissionsImpl","Implementation","createImplementation","implementation","dependencies","register","container","inSingletonScope","resolve"],"sources":["createPermissions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/admin\";\nimport { createFeature } from \"@webiny/feature/admin\";\nimport { IdentityContext } from \"~/features/security/IdentityContext/abstractions.js\";\nimport type { IIdentityContext } from \"~/features/security/IdentityContext/abstractions.js\";\nimport type { Identity } from \"~/domain/Identity.js\";\nimport type { Abstraction } from \"@webiny/di\";\nimport type { PermissionSchemaConfig, OwnableItem, UsePermissionsResult } from \"./types.js\";\n\ninterface EntityLookup {\n    permission: string;\n    actions: Set<string>;\n    hasOwn: boolean;\n}\n\nfunction buildEntityMap(schema: PermissionSchemaConfig): Map<string, EntityLookup> {\n    const map = new Map<string, EntityLookup>();\n    for (const entity of schema.entities ?? []) {\n        const actions = new Set<string>();\n        for (const action of entity.actions ?? []) {\n            actions.add(action.name);\n        }\n        map.set(entity.id, {\n            permission: entity.permission,\n            actions,\n            hasOwn: entity.scopes.includes(\"own\")\n        });\n    }\n    return map;\n}\n\nfunction getEntity(entityMap: Map<string, EntityLookup>, entityId: string): EntityLookup {\n    const entity = entityMap.get(entityId);\n    if (!entity) {\n        throw new Error(`Unknown entity \"${entityId}\" in permission schema.`);\n    }\n    return entity;\n}\n\n/**\n * Check whether the identity has unrestricted full access for the given schema prefix.\n * Stricter than the legacy check: `{ name: \"wb.*\", rwd: \"r\" }` is NOT full access.\n */\nfunction hasFullSchemaAccess(identity: Identity, prefix: string): boolean {\n    const fullAccessName = `${prefix}.*`;\n    const permission = identity.getPermission(fullAccessName);\n    if (!permission) {\n        return false;\n    }\n    // If any restricting keys are present, this is not full access.\n    if (typeof permission.rwd === \"string\" || typeof permission.pw === \"string\") {\n        return false;\n    }\n    return true;\n}\n\nclass SchemaPermissions<S extends PermissionSchemaConfig> {\n    private readonly schema: S;\n    private readonly entityMap: Map<string, EntityLookup>;\n    private readonly identityContext: IIdentityContext;\n\n    constructor(schema: S, identityContext: IIdentityContext) {\n        this.schema = schema;\n        this.entityMap = buildEntityMap(schema);\n        this.identityContext = identityContext;\n    }\n\n    private get identity(): Identity {\n        return this.identityContext.getIdentity();\n    }\n\n    private get fullAccess(): boolean {\n        return hasFullSchemaAccess(this.identity, this.schema.prefix);\n    }\n\n    canAccess = (entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        return this.identity.getPermissions(entity.permission).length > 0;\n    };\n\n    canRead = (entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"r\");\n        });\n    };\n\n    canCreate = (entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"w\");\n        });\n    };\n\n    canEdit = (entityId: string, item?: OwnableItem): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (permission.own) {\n                if (!item?.createdBy) {\n                    return true;\n                }\n                return item.createdBy.id === this.identity.id;\n            }\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"w\");\n        });\n    };\n\n    canDelete = (entityId: string, item?: OwnableItem): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (permission.own) {\n                return item?.createdBy?.id === this.identity.id;\n            }\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"d\");\n        });\n    };\n\n    canPublish = (entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission.pw?.includes(\"p\");\n        });\n    };\n\n    canUnpublish = (entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission.pw?.includes(\"u\");\n        });\n    };\n\n    canAction = (action: string, entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission[action] === true;\n        });\n    };\n}\n\nexport function createPermissionsAbstraction<const S extends PermissionSchemaConfig>(schema: S) {\n    return createAbstraction<UsePermissionsResult<S>>(`${schema.prefix}:Permissions`);\n}\n\nexport function createPermissionsFeature<const S extends PermissionSchemaConfig>(\n    schema: S,\n    abstraction: Abstraction<UsePermissionsResult<S>>\n) {\n    class PermissionsImpl extends SchemaPermissions<S> {\n        constructor(identityContext: IIdentityContext) {\n            super(schema, identityContext);\n        }\n    }\n\n    const Implementation = abstraction.createImplementation({\n        implementation: PermissionsImpl,\n        dependencies: [IdentityContext]\n    });\n\n    return createFeature({\n        name: `${schema.prefix}:Permissions`,\n        register(container) {\n            container.register(Implementation).inSingletonScope();\n        },\n        resolve(container) {\n            return { permissions: container.resolve(abstraction) };\n        }\n    });\n}\n"],"mappings":"AAAA,SAASA,iBAAiB,QAAQ,uBAAuB;AACzD,SAASC,aAAa,QAAQ,uBAAuB;AACrD,SAASC,eAAe;AAYxB,SAASC,cAAcA,CAACC,MAA8B,EAA6B;EAC/E,MAAMC,GAAG,GAAG,IAAIC,GAAG,CAAuB,CAAC;EAC3C,KAAK,MAAMC,MAAM,IAAIH,MAAM,CAACI,QAAQ,IAAI,EAAE,EAAE;IACxC,MAAMC,OAAO,GAAG,IAAIC,GAAG,CAAS,CAAC;IACjC,KAAK,MAAMC,MAAM,IAAIJ,MAAM,CAACE,OAAO,IAAI,EAAE,EAAE;MACvCA,OAAO,CAACG,GAAG,CAACD,MAAM,CAACE,IAAI,CAAC;IAC5B;IACAR,GAAG,CAACS,GAAG,CAACP,MAAM,CAACQ,EAAE,EAAE;MACfC,UAAU,EAAET,MAAM,CAACS,UAAU;MAC7BP,OAAO;MACPQ,MAAM,EAAEV,MAAM,CAACW,MAAM,CAACC,QAAQ,CAAC,KAAK;IACxC,CAAC,CAAC;EACN;EACA,OAAOd,GAAG;AACd;AAEA,SAASe,SAASA,CAACC,SAAoC,EAAEC,QAAgB,EAAgB;EACrF,MAAMf,MAAM,GAAGc,SAAS,CAACE,GAAG,CAACD,QAAQ,CAAC;EACtC,IAAI,CAACf,MAAM,EAAE;IACT,MAAM,IAAIiB,KAAK,CAAC,mBAAmBF,QAAQ,yBAAyB,CAAC;EACzE;EACA,OAAOf,MAAM;AACjB;;AAEA;AACA;AACA;AACA;AACA,SAASkB,mBAAmBA,CAACC,QAAkB,EAAEC,MAAc,EAAW;EACtE,MAAMC,cAAc,GAAG,GAAGD,MAAM,IAAI;EACpC,MAAMX,UAAU,GAAGU,QAAQ,CAACG,aAAa,CAACD,cAAc,CAAC;EACzD,IAAI,CAACZ,UAAU,EAAE;IACb,OAAO,KAAK;EAChB;EACA;EACA,IAAI,OAAOA,UAAU,CAACc,GAAG,KAAK,QAAQ,IAAI,OAAOd,UAAU,CAACe,EAAE,KAAK,QAAQ,EAAE;IACzE,OAAO,KAAK;EAChB;EACA,OAAO,IAAI;AACf;AAEA,MAAMC,iBAAiB,CAAmC;EAKtDC,WAAWA,CAAC7B,MAAS,EAAE8B,eAAiC,EAAE;IACtD,IAAI,CAAC9B,MAAM,GAAGA,MAAM;IACpB,IAAI,CAACiB,SAAS,GAAGlB,cAAc,CAACC,MAAM,CAAC;IACvC,IAAI,CAAC8B,eAAe,GAAGA,eAAe;EAC1C;EAEA,IAAYR,QAAQA,CAAA,EAAa;IAC7B,OAAO,IAAI,CAACQ,eAAe,CAACC,WAAW,CAAC,CAAC;EAC7C;EAEA,IAAYC,UAAUA,CAAA,EAAY;IAC9B,OAAOX,mBAAmB,CAAC,IAAI,CAACC,QAAQ,EAAE,IAAI,CAACtB,MAAM,CAACuB,MAAM,CAAC;EACjE;EAEAU,SAAS,GAAIf,QAAgB,IAAc;IACvC,IAAI,IAAI,CAACc,UAAU,EAAE;MACjB,OAAO,IAAI;IACf;IACA,MAAM7B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,OAAO,IAAI,CAACI,QAAQ,CAACY,cAAc,CAAC/B,MAAM,CAACS,UAAU,CAAC,CAACuB,MAAM,GAAG,CAAC;EACrE,CAAC;EAEDC,OAAO,GAAIlB,QAAgB,IAAc;IACrC,IAAI,IAAI,CAACc,UAAU,EAAE;MACjB,OAAO,IAAI;IACf;IACA,MAAM7B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMmB,WAAW,GAAG,IAAI,CAACf,QAAQ,CAACY,cAAc,CAAC/B,MAAM,CAACS,UAAU,CAAC;IACnE,IAAI,CAACyB,WAAW,CAACF,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAOE,WAAW,CAACC,IAAI,CAAC1B,UAAU,IAAI;MAClC,IAAI,OAAOA,UAAU,CAACc,GAAG,KAAK,QAAQ,EAAE;QACpC,OAAO,IAAI;MACf;MACA,OAAOd,UAAU,CAACc,GAAG,CAACX,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN,CAAC;EAEDwB,SAAS,GAAIrB,QAAgB,IAAc;IACvC,IAAI,IAAI,CAACc,UAAU,EAAE;MACjB,OAAO,IAAI;IACf;IACA,MAAM7B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMmB,WAAW,GAAG,IAAI,CAACf,QAAQ,CAACY,cAAc,CAAC/B,MAAM,CAACS,UAAU,CAAC;IACnE,IAAI,CAACyB,WAAW,CAACF,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAOE,WAAW,CAACC,IAAI,CAAC1B,UAAU,IAAI;MAClC,IAAI,OAAOA,UAAU,CAACc,GAAG,KAAK,QAAQ,EAAE;QACpC,OAAO,IAAI;MACf;MACA,OAAOd,UAAU,CAACc,GAAG,CAACX,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN,CAAC;EAEDyB,OAAO,GAAGA,CAACtB,QAAgB,EAAEuB,IAAkB,KAAc;IACzD,IAAI,IAAI,CAACT,UAAU,EAAE;MACjB,OAAO,IAAI;IACf;IACA,MAAM7B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMmB,WAAW,GAAG,IAAI,CAACf,QAAQ,CAACY,cAAc,CAAC/B,MAAM,CAACS,UAAU,CAAC;IACnE,IAAI,CAACyB,WAAW,CAACF,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAOE,WAAW,CAACC,IAAI,CAAC1B,UAAU,IAAI;MAClC,IAAIA,UAAU,CAAC8B,GAAG,EAAE;QAChB,IAAI,CAACD,IAAI,EAAEE,SAAS,EAAE;UAClB,OAAO,IAAI;QACf;QACA,OAAOF,IAAI,CAACE,SAAS,CAAChC,EAAE,KAAK,IAAI,CAACW,QAAQ,CAACX,EAAE;MACjD;MACA,IAAI,OAAOC,UAAU,CAACc,GAAG,KAAK,QAAQ,EAAE;QACpC,OAAO,IAAI;MACf;MACA,OAAOd,UAAU,CAACc,GAAG,CAACX,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN,CAAC;EAED6B,SAAS,GAAGA,CAAC1B,QAAgB,EAAEuB,IAAkB,KAAc;IAC3D,IAAI,IAAI,CAACT,UAAU,EAAE;MACjB,OAAO,IAAI;IACf;IACA,MAAM7B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMmB,WAAW,GAAG,IAAI,CAACf,QAAQ,CAACY,cAAc,CAAC/B,MAAM,CAACS,UAAU,CAAC;IACnE,IAAI,CAACyB,WAAW,CAACF,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAOE,WAAW,CAACC,IAAI,CAAC1B,UAAU,IAAI;MAClC,IAAIA,UAAU,CAAC8B,GAAG,EAAE;QAChB,OAAOD,IAAI,EAAEE,SAAS,EAAEhC,EAAE,KAAK,IAAI,CAACW,QAAQ,CAACX,EAAE;MACnD;MACA,IAAI,OAAOC,UAAU,CAACc,GAAG,KAAK,QAAQ,EAAE;QACpC,OAAO,IAAI;MACf;MACA,OAAOd,UAAU,CAACc,GAAG,CAACX,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN,CAAC;EAED8B,UAAU,GAAI3B,QAAgB,IAAc;IACxC,IAAI,IAAI,CAACc,UAAU,EAAE;MACjB,OAAO,IAAI;IACf;IACA,MAAM7B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMmB,WAAW,GAAG,IAAI,CAACf,QAAQ,CAACY,cAAc,CAAC/B,MAAM,CAACS,UAAU,CAAC;IACnE,IAAI,CAACyB,WAAW,CAACF,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAOE,WAAW,CAACC,IAAI,CAAC1B,UAAU,IAAI;MAClC,OAAOA,UAAU,CAACe,EAAE,EAAEZ,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN,CAAC;EAED+B,YAAY,GAAI5B,QAAgB,IAAc;IAC1C,IAAI,IAAI,CAACc,UAAU,EAAE;MACjB,OAAO,IAAI;IACf;IACA,MAAM7B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMmB,WAAW,GAAG,IAAI,CAACf,QAAQ,CAACY,cAAc,CAAC/B,MAAM,CAACS,UAAU,CAAC;IACnE,IAAI,CAACyB,WAAW,CAACF,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAOE,WAAW,CAACC,IAAI,CAAC1B,UAAU,IAAI;MAClC,OAAOA,UAAU,CAACe,EAAE,EAAEZ,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN,CAAC;EAEDgC,SAAS,GAAGA,CAACxC,MAAc,EAAEW,QAAgB,KAAc;IACvD,IAAI,IAAI,CAACc,UAAU,EAAE;MACjB,OAAO,IAAI;IACf;IACA,MAAM7B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMmB,WAAW,GAAG,IAAI,CAACf,QAAQ,CAACY,cAAc,CAAC/B,MAAM,CAACS,UAAU,CAAC;IACnE,IAAI,CAACyB,WAAW,CAACF,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAOE,WAAW,CAACC,IAAI,CAAC1B,UAAU,IAAI;MAClC,OAAOA,UAAU,CAACL,MAAM,CAAC,KAAK,IAAI;IACtC,CAAC,CAAC;EACN,CAAC;AACL;AAEA,OAAO,SAASyC,4BAA4BA,CAAyChD,MAAS,EAAE;EAC5F,OAAOJ,iBAAiB,CAA0B,GAAGI,MAAM,CAACuB,MAAM,cAAc,CAAC;AACrF;AAEA,OAAO,SAAS0B,wBAAwBA,CACpCjD,MAAS,EACTkD,WAAiD,EACnD;EACE,MAAMC,eAAe,SAASvB,iBAAiB,CAAI;IAC/CC,WAAWA,CAACC,eAAiC,EAAE;MAC3C,KAAK,CAAC9B,MAAM,EAAE8B,eAAe,CAAC;IAClC;EACJ;EAEA,MAAMsB,cAAc,GAAGF,WAAW,CAACG,oBAAoB,CAAC;IACpDC,cAAc,EAAEH,eAAe;IAC/BI,YAAY,EAAE,CAACzD,eAAe;EAClC,CAAC,CAAC;EAEF,OAAOD,aAAa,CAAC;IACjBY,IAAI,EAAE,GAAGT,MAAM,CAACuB,MAAM,cAAc;IACpCiC,QAAQA,CAACC,SAAS,EAAE;MAChBA,SAAS,CAACD,QAAQ,CAACJ,cAAc,CAAC,CAACM,gBAAgB,CAAC,CAAC;IACzD,CAAC;IACDC,OAAOA,CAACF,SAAS,EAAE;MACf,OAAO;QAAEpB,WAAW,EAAEoB,SAAS,CAACE,OAAO,CAACT,WAAW;MAAE,CAAC;IAC1D;EACJ,CAAC,CAAC;AACN","ignoreList":[]}
+{"version":3,"file":"permissions/createPermissions.js","sources":["../../src/permissions/createPermissions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/admin\";\nimport { createFeature } from \"@webiny/feature/admin\";\nimport { IdentityContext } from \"~/features/security/IdentityContext/abstractions.js\";\nimport type { IIdentityContext } from \"~/features/security/IdentityContext/abstractions.js\";\nimport type { Identity } from \"~/domain/Identity.js\";\nimport type { Abstraction } from \"@webiny/di\";\nimport type { PermissionSchemaConfig, OwnableItem, UsePermissionsResult } from \"./types.js\";\n\ninterface EntityLookup {\n    permission: string;\n    actions: Set<string>;\n    hasOwn: boolean;\n}\n\nfunction buildEntityMap(schema: PermissionSchemaConfig): Map<string, EntityLookup> {\n    const map = new Map<string, EntityLookup>();\n    for (const entity of schema.entities ?? []) {\n        const actions = new Set<string>();\n        for (const action of entity.actions ?? []) {\n            actions.add(action.name);\n        }\n        map.set(entity.id, {\n            permission: entity.permission,\n            actions,\n            hasOwn: entity.scopes.includes(\"own\")\n        });\n    }\n    return map;\n}\n\nfunction getEntity(entityMap: Map<string, EntityLookup>, entityId: string): EntityLookup {\n    const entity = entityMap.get(entityId);\n    if (!entity) {\n        throw new Error(`Unknown entity \"${entityId}\" in permission schema.`);\n    }\n    return entity;\n}\n\n/**\n * Check whether the identity has unrestricted full access for the given schema prefix.\n * Stricter than the legacy check: `{ name: \"wb.*\", rwd: \"r\" }` is NOT full access.\n */\nfunction hasFullSchemaAccess(identity: Identity, prefix: string): boolean {\n    const fullAccessName = `${prefix}.*`;\n    const permission = identity.getPermission(fullAccessName);\n    if (!permission) {\n        return false;\n    }\n    // If any restricting keys are present, this is not full access.\n    if (typeof permission.rwd === \"string\" || typeof permission.pw === \"string\") {\n        return false;\n    }\n    return true;\n}\n\nclass SchemaPermissions<S extends PermissionSchemaConfig> {\n    private readonly schema: S;\n    private readonly entityMap: Map<string, EntityLookup>;\n    private readonly identityContext: IIdentityContext;\n\n    constructor(schema: S, identityContext: IIdentityContext) {\n        this.schema = schema;\n        this.entityMap = buildEntityMap(schema);\n        this.identityContext = identityContext;\n    }\n\n    private get identity(): Identity {\n        return this.identityContext.getIdentity();\n    }\n\n    private get fullAccess(): boolean {\n        return hasFullSchemaAccess(this.identity, this.schema.prefix);\n    }\n\n    canAccess = (entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        return this.identity.getPermissions(entity.permission).length > 0;\n    };\n\n    canRead = (entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"r\");\n        });\n    };\n\n    canCreate = (entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"w\");\n        });\n    };\n\n    canEdit = (entityId: string, item?: OwnableItem): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (permission.own) {\n                if (!item?.createdBy) {\n                    return true;\n                }\n                return item.createdBy.id === this.identity.id;\n            }\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"w\");\n        });\n    };\n\n    canDelete = (entityId: string, item?: OwnableItem): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (permission.own) {\n                return item?.createdBy?.id === this.identity.id;\n            }\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"d\");\n        });\n    };\n\n    canPublish = (entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission.pw?.includes(\"p\");\n        });\n    };\n\n    canUnpublish = (entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission.pw?.includes(\"u\");\n        });\n    };\n\n    canAction = (action: string, entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission[action] === true;\n        });\n    };\n}\n\nexport function createPermissionsAbstraction<const S extends PermissionSchemaConfig>(schema: S) {\n    return createAbstraction<UsePermissionsResult<S>>(`${schema.prefix}:Permissions`);\n}\n\nexport function createPermissionsFeature<const S extends PermissionSchemaConfig>(\n    schema: S,\n    abstraction: Abstraction<UsePermissionsResult<S>>\n) {\n    // eslint-disable-next-line webiny/require-implements-on-create-implementation -- UsePermissionsResult<S> is a conditional type, not a statically-known object type (TS2422); conformance is enforced by the Abstraction<UsePermissionsResult<S>> generic.\n    class PermissionsImpl extends SchemaPermissions<S> {\n        constructor(identityContext: IIdentityContext) {\n            super(schema, identityContext);\n        }\n    }\n\n    const Implementation = abstraction.createImplementation({\n        implementation: PermissionsImpl,\n        dependencies: [IdentityContext]\n    });\n\n    return createFeature({\n        name: `${schema.prefix}:Permissions`,\n        register(container) {\n            container.register(Implementation).inSingletonScope();\n        },\n        resolve(container) {\n            return { permissions: container.resolve(abstraction) };\n        }\n    });\n}\n"],"names":["buildEntityMap","schema","map","Map","entity","actions","Set","action","getEntity","entityMap","entityId","Error","hasFullSchemaAccess","identity","prefix","fullAccessName","permission","SchemaPermissions","identityContext","permissions","item","createPermissionsAbstraction","createAbstraction","createPermissionsFeature","abstraction","PermissionsImpl","Implementation","IdentityContext","createFeature","container"],"mappings":";;AAcA,SAASA,eAAeC,MAA8B;IAClD,MAAMC,MAAM,IAAIC;IAChB,KAAK,MAAMC,UAAUH,OAAO,QAAQ,IAAI,EAAE,CAAE;QACxC,MAAMI,UAAU,IAAIC;QACpB,KAAK,MAAMC,UAAUH,OAAO,OAAO,IAAI,EAAE,CACrCC,QAAQ,GAAG,CAACE,OAAO,IAAI;QAE3BL,IAAI,GAAG,CAACE,OAAO,EAAE,EAAE;YACf,YAAYA,OAAO,UAAU;YAC7BC;YACA,QAAQD,OAAO,MAAM,CAAC,QAAQ,CAAC;QACnC;IACJ;IACA,OAAOF;AACX;AAEA,SAASM,UAAUC,SAAoC,EAAEC,QAAgB;IACrE,MAAMN,SAASK,UAAU,GAAG,CAACC;IAC7B,IAAI,CAACN,QACD,MAAM,IAAIO,MAAM,CAAC,gBAAgB,EAAED,SAAS,uBAAuB,CAAC;IAExE,OAAON;AACX;AAMA,SAASQ,oBAAoBC,QAAkB,EAAEC,MAAc;IAC3D,MAAMC,iBAAiB,GAAGD,OAAO,EAAE,CAAC;IACpC,MAAME,aAAaH,SAAS,aAAa,CAACE;IAC1C,IAAI,CAACC,YACD,OAAO;IAGX,IAAI,AAA0B,YAA1B,OAAOA,WAAW,GAAG,IAAiB,AAAyB,YAAzB,OAAOA,WAAW,EAAE,EAC1D,OAAO;IAEX,OAAO;AACX;AAEA,MAAMC;IAKF,YAAYhB,MAAS,EAAEiB,eAAiC,CAAE;aAc1D,SAAS,GAAG,CAACR;YACT,IAAI,IAAI,CAAC,UAAU,EACf,OAAO;YAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;YACzC,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAACN,OAAO,UAAU,EAAE,MAAM,GAAG;QACpE;aAEA,OAAO,GAAG,CAACM;YACP,IAAI,IAAI,CAAC,UAAU,EACf,OAAO;YAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;YACzC,MAAMS,cAAc,IAAI,CAAC,QAAQ,CAAC,cAAc,CAACf,OAAO,UAAU;YAClE,IAAI,CAACe,YAAY,MAAM,EACnB,OAAO;YAEX,OAAOA,YAAY,IAAI,CAACH,CAAAA;gBACpB,IAAI,AAA0B,YAA1B,OAAOA,WAAW,GAAG,EACrB,OAAO;gBAEX,OAAOA,WAAW,GAAG,CAAC,QAAQ,CAAC;YACnC;QACJ;aAEA,SAAS,GAAG,CAACN;YACT,IAAI,IAAI,CAAC,UAAU,EACf,OAAO;YAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;YACzC,MAAMS,cAAc,IAAI,CAAC,QAAQ,CAAC,cAAc,CAACf,OAAO,UAAU;YAClE,IAAI,CAACe,YAAY,MAAM,EACnB,OAAO;YAEX,OAAOA,YAAY,IAAI,CAACH,CAAAA;gBACpB,IAAI,AAA0B,YAA1B,OAAOA,WAAW,GAAG,EACrB,OAAO;gBAEX,OAAOA,WAAW,GAAG,CAAC,QAAQ,CAAC;YACnC;QACJ;aAEA,OAAO,GAAG,CAACN,UAAkBU;YACzB,IAAI,IAAI,CAAC,UAAU,EACf,OAAO;YAEX,MAAMhB,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;YACzC,MAAMS,cAAc,IAAI,CAAC,QAAQ,CAAC,cAAc,CAACf,OAAO,UAAU;YAClE,IAAI,CAACe,YAAY,MAAM,EACnB,OAAO;YAEX,OAAOA,YAAY,IAAI,CAACH,CAAAA;gBACpB,IAAIA,WAAW,GAAG,EAAE;oBAChB,IAAI,CAACI,MAAM,WACP,OAAO;oBAEX,OAAOA,KAAK,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE;gBACjD;gBACA,IAAI,AAA0B,YAA1B,OAAOJ,WAAW,GAAG,EACrB,OAAO;gBAEX,OAAOA,WAAW,GAAG,CAAC,QAAQ,CAAC;YACnC;QACJ;aAEA,SAAS,GAAG,CAACN,UAAkBU;YAC3B,IAAI,IAAI,CAAC,UAAU,EACf,OAAO;YAEX,MAAMhB,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;YACzC,MAAMS,cAAc,IAAI,CAAC,QAAQ,CAAC,cAAc,CAACf,OAAO,UAAU;YAClE,IAAI,CAACe,YAAY,MAAM,EACnB,OAAO;YAEX,OAAOA,YAAY,IAAI,CAACH,CAAAA;gBACpB,IAAIA,WAAW,GAAG,EACd,OAAOI,MAAM,WAAW,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAEnD,IAAI,AAA0B,YAA1B,OAAOJ,WAAW,GAAG,EACrB,OAAO;gBAEX,OAAOA,WAAW,GAAG,CAAC,QAAQ,CAAC;YACnC;QACJ;aAEA,UAAU,GAAG,CAACN;YACV,IAAI,IAAI,CAAC,UAAU,EACf,OAAO;YAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;YACzC,MAAMS,cAAc,IAAI,CAAC,QAAQ,CAAC,cAAc,CAACf,OAAO,UAAU;YAClE,IAAI,CAACe,YAAY,MAAM,EACnB,OAAO;YAEX,OAAOA,YAAY,IAAI,CAACH,CAAAA,aACbA,WAAW,EAAE,EAAE,SAAS;QAEvC;aAEA,YAAY,GAAG,CAACN;YACZ,IAAI,IAAI,CAAC,UAAU,EACf,OAAO;YAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;YACzC,MAAMS,cAAc,IAAI,CAAC,QAAQ,CAAC,cAAc,CAACf,OAAO,UAAU;YAClE,IAAI,CAACe,YAAY,MAAM,EACnB,OAAO;YAEX,OAAOA,YAAY,IAAI,CAACH,CAAAA,aACbA,WAAW,EAAE,EAAE,SAAS;QAEvC;aAEA,SAAS,GAAG,CAACT,QAAgBG;YACzB,IAAI,IAAI,CAAC,UAAU,EACf,OAAO;YAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;YACzC,MAAMS,cAAc,IAAI,CAAC,QAAQ,CAAC,cAAc,CAACf,OAAO,UAAU;YAClE,IAAI,CAACe,YAAY,MAAM,EACnB,OAAO;YAEX,OAAOA,YAAY,IAAI,CAACH,CAAAA,aACbA,AAAuB,SAAvBA,UAAU,CAACT,OAAO;QAEjC;QA1II,IAAI,CAAC,MAAM,GAAGN;QACd,IAAI,CAAC,SAAS,GAAGD,eAAeC;QAChC,IAAI,CAAC,eAAe,GAAGiB;IAC3B;IAEA,IAAY,WAAqB;QAC7B,OAAO,IAAI,CAAC,eAAe,CAAC,WAAW;IAC3C;IAEA,IAAY,aAAsB;QAC9B,OAAON,oBAAoB,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;IAChE;AAgIJ;AAEO,SAASS,6BAAqEpB,MAAS;IAC1F,OAAOqB,kBAA2C,GAAGrB,OAAO,MAAM,CAAC,YAAY,CAAC;AACpF;AAEO,SAASsB,yBACZtB,MAAS,EACTuB,WAAiD;IAGjD,MAAMC,wBAAwBR;QAC1B,YAAYC,eAAiC,CAAE;YAC3C,KAAK,CAACjB,QAAQiB;QAClB;IACJ;IAEA,MAAMQ,iBAAiBF,YAAY,oBAAoB,CAAC;QACpD,gBAAgBC;QAChB,cAAc;YAACE;SAAgB;IACnC;IAEA,OAAOC,cAAc;QACjB,MAAM,GAAG3B,OAAO,MAAM,CAAC,YAAY,CAAC;QACpC,UAAS4B,SAAS;YACdA,UAAU,QAAQ,CAACH,gBAAgB,gBAAgB;QACvD;QACA,SAAQG,SAAS;YACb,OAAO;gBAAE,aAAaA,UAAU,OAAO,CAACL;YAAa;QACzD;IACJ;AACJ"}