@webiny/app-admin 6.3.0 → 6.4.0-beta.1

package/permissions/createPermissions.js.map

@@ -1 +1 @@
-{"version":3,"names":["createAbstraction","createFeature","IdentityContext","buildEntityMap","schema","map","Map","entity","entities","actions","Set","action","add","name","set","id","permission","hasOwn","scopes","includes","getEntity","entityMap","entityId","get","Error","hasFullSchemaAccess","identity","prefix","fullAccessName","getPermission","rwd","pw","SchemaPermissions","constructor","identityContext","getIdentity","fullAccess","canAccess","getPermissions","length","canRead","permissions","some","canCreate","canEdit","item","own","createdBy","canDelete","canPublish","canUnpublish","canAction","createPermissionsAbstraction","createPermissionsFeature","abstraction","PermissionsImpl","Implementation","createImplementation","implementation","dependencies","register","container","inSingletonScope","resolve"],"sources":["createPermissions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/admin\";\nimport { createFeature } from \"@webiny/feature/admin\";\nimport { IdentityContext } from \"~/features/security/IdentityContext/abstractions.js\";\nimport type { IIdentityContext } from \"~/features/security/IdentityContext/abstractions.js\";\nimport type { Identity } from \"~/domain/Identity.js\";\nimport type { Abstraction } from \"@webiny/di\";\nimport type { PermissionSchemaConfig, OwnableItem, UsePermissionsResult } from \"./types.js\";\n\ninterface EntityLookup {\n    permission: string;\n    actions: Set<string>;\n    hasOwn: boolean;\n}\n\nfunction buildEntityMap(schema: PermissionSchemaConfig): Map<string, EntityLookup> {\n    const map = new Map<string, EntityLookup>();\n    for (const entity of schema.entities ?? []) {\n        const actions = new Set<string>();\n        for (const action of entity.actions ?? []) {\n            actions.add(action.name);\n        }\n        map.set(entity.id, {\n            permission: entity.permission,\n            actions,\n            hasOwn: entity.scopes.includes(\"own\")\n        });\n    }\n    return map;\n}\n\nfunction getEntity(entityMap: Map<string, EntityLookup>, entityId: string): EntityLookup {\n    const entity = entityMap.get(entityId);\n    if (!entity) {\n        throw new Error(`Unknown entity \"${entityId}\" in permission schema.`);\n    }\n    return entity;\n}\n\n/**\n * Check whether the identity has unrestricted full access for the given schema prefix.\n * Stricter than the legacy check: `{ name: \"wb.*\", rwd: \"r\" }` is NOT full access.\n */\nfunction hasFullSchemaAccess(identity: Identity, prefix: string): boolean {\n    const fullAccessName = `${prefix}.*`;\n    const permission = identity.getPermission(fullAccessName);\n    if (!permission) {\n        return false;\n    }\n    // If any restricting keys are present, this is not full access.\n    if (typeof permission.rwd === \"string\" || typeof permission.pw === \"string\") {\n        return false;\n    }\n    return true;\n}\n\nclass SchemaPermissions<S extends PermissionSchemaConfig> {\n    private readonly schema: S;\n    private readonly entityMap: Map<string, EntityLookup>;\n    private readonly identityContext: IIdentityContext;\n\n    constructor(schema: S, identityContext: IIdentityContext) {\n        this.schema = schema;\n        this.entityMap = buildEntityMap(schema);\n        this.identityContext = identityContext;\n    }\n\n    private get identity(): Identity {\n        return this.identityContext.getIdentity();\n    }\n\n    private get fullAccess(): boolean {\n        return hasFullSchemaAccess(this.identity, this.schema.prefix);\n    }\n\n    canAccess = (entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        return this.identity.getPermissions(entity.permission).length > 0;\n    };\n\n    canRead = (entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"r\");\n        });\n    };\n\n    canCreate = (entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"w\");\n        });\n    };\n\n    canEdit = (entityId: string, item?: OwnableItem): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (permission.own) {\n                if (!item?.createdBy) {\n                    return true;\n                }\n                return item.createdBy.id === this.identity.id;\n            }\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"w\");\n        });\n    };\n\n    canDelete = (entityId: string, item?: OwnableItem): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (permission.own) {\n                return item?.createdBy?.id === this.identity.id;\n            }\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"d\");\n        });\n    };\n\n    canPublish = (entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission.pw?.includes(\"p\");\n        });\n    };\n\n    canUnpublish = (entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission.pw?.includes(\"u\");\n        });\n    };\n\n    canAction = (action: string, entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission[action] === true;\n        });\n    };\n}\n\nexport function createPermissionsAbstraction<const S extends PermissionSchemaConfig>(schema: S) {\n    return createAbstraction<UsePermissionsResult<S>>(`${schema.prefix}:Permissions`);\n}\n\nexport function createPermissionsFeature<const S extends PermissionSchemaConfig>(\n    schema: S,\n    abstraction: Abstraction<UsePermissionsResult<S>>\n) {\n    class PermissionsImpl extends SchemaPermissions<S> {\n        constructor(identityContext: IIdentityContext) {\n            super(schema, identityContext);\n        }\n    }\n\n    const Implementation = abstraction.createImplementation({\n        implementation: PermissionsImpl,\n        dependencies: [IdentityContext]\n    });\n\n    return createFeature({\n        name: `${schema.prefix}:Permissions`,\n        register(container) {\n            container.register(Implementation).inSingletonScope();\n        },\n        resolve(container) {\n            return { permissions: container.resolve(abstraction) };\n        }\n    });\n}\n"],"mappings":"AAAA,SAASA,iBAAiB,QAAQ,uBAAuB;AACzD,SAASC,aAAa,QAAQ,uBAAuB;AACrD,SAASC,eAAe;AAYxB,SAASC,cAAcA,CAACC,MAA8B,EAA6B;EAC/E,MAAMC,GAAG,GAAG,IAAIC,GAAG,CAAuB,CAAC;EAC3C,KAAK,MAAMC,MAAM,IAAIH,MAAM,CAACI,QAAQ,IAAI,EAAE,EAAE;IACxC,MAAMC,OAAO,GAAG,IAAIC,GAAG,CAAS,CAAC;IACjC,KAAK,MAAMC,MAAM,IAAIJ,MAAM,CAACE,OAAO,IAAI,EAAE,EAAE;MACvCA,OAAO,CAACG,GAAG,CAACD,MAAM,CAACE,IAAI,CAAC;IAC5B;IACAR,GAAG,CAACS,GAAG,CAACP,MAAM,CAACQ,EAAE,EAAE;MACfC,UAAU,EAAET,MAAM,CAACS,UAAU;MAC7BP,OAAO;MACPQ,MAAM,EAAEV,MAAM,CAACW,MAAM,CAACC,QAAQ,CAAC,KAAK;IACxC,CAAC,CAAC;EACN;EACA,OAAOd,GAAG;AACd;AAEA,SAASe,SAASA,CAACC,SAAoC,EAAEC,QAAgB,EAAgB;EACrF,MAAMf,MAAM,GAAGc,SAAS,CAACE,GAAG,CAACD,QAAQ,CAAC;EACtC,IAAI,CAACf,MAAM,EAAE;IACT,MAAM,IAAIiB,KAAK,CAAC,mBAAmBF,QAAQ,yBAAyB,CAAC;EACzE;EACA,OAAOf,MAAM;AACjB;;AAEA;AACA;AACA;AACA;AACA,SAASkB,mBAAmBA,CAACC,QAAkB,EAAEC,MAAc,EAAW;EACtE,MAAMC,cAAc,GAAG,GAAGD,MAAM,IAAI;EACpC,MAAMX,UAAU,GAAGU,QAAQ,CAACG,aAAa,CAACD,cAAc,CAAC;EACzD,IAAI,CAACZ,UAAU,EAAE;IACb,OAAO,KAAK;EAChB;EACA;EACA,IAAI,OAAOA,UAAU,CAACc,GAAG,KAAK,QAAQ,IAAI,OAAOd,UAAU,CAACe,EAAE,KAAK,QAAQ,EAAE;IACzE,OAAO,KAAK;EAChB;EACA,OAAO,IAAI;AACf;AAEA,MAAMC,iBAAiB,CAAmC;EAKtDC,WAAWA,CAAC7B,MAAS,EAAE8B,eAAiC,EAAE;IACtD,IAAI,CAAC9B,MAAM,GAAGA,MAAM;IACpB,IAAI,CAACiB,SAAS,GAAGlB,cAAc,CAACC,MAAM,CAAC;IACvC,IAAI,CAAC8B,eAAe,GAAGA,eAAe;EAC1C;EAEA,IAAYR,QAAQA,CAAA,EAAa;IAC7B,OAAO,IAAI,CAACQ,eAAe,CAACC,WAAW,CAAC,CAAC;EAC7C;EAEA,IAAYC,UAAUA,CAAA,EAAY;IAC9B,OAAOX,mBAAmB,CAAC,IAAI,CAACC,QAAQ,EAAE,IAAI,CAACtB,MAAM,CAACuB,MAAM,CAAC;EACjE;EAEAU,SAAS,GAAIf,QAAgB,IAAc;IACvC,IAAI,IAAI,CAACc,UAAU,EAAE;MACjB,OAAO,IAAI;IACf;IACA,MAAM7B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,OAAO,IAAI,CAACI,QAAQ,CAACY,cAAc,CAAC/B,MAAM,CAACS,UAAU,CAAC,CAACuB,MAAM,GAAG,CAAC;EACrE,CAAC;EAEDC,OAAO,GAAIlB,QAAgB,IAAc;IACrC,IAAI,IAAI,CAACc,UAAU,EAAE;MACjB,OAAO,IAAI;IACf;IACA,MAAM7B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMmB,WAAW,GAAG,IAAI,CAACf,QAAQ,CAACY,cAAc,CAAC/B,MAAM,CAACS,UAAU,CAAC;IACnE,IAAI,CAACyB,WAAW,CAACF,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAOE,WAAW,CAACC,IAAI,CAAC1B,UAAU,IAAI;MAClC,IAAI,OAAOA,UAAU,CAACc,GAAG,KAAK,QAAQ,EAAE;QACpC,OAAO,IAAI;MACf;MACA,OAAOd,UAAU,CAACc,GAAG,CAACX,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN,CAAC;EAEDwB,SAAS,GAAIrB,QAAgB,IAAc;IACvC,IAAI,IAAI,CAACc,UAAU,EAAE;MACjB,OAAO,IAAI;IACf;IACA,MAAM7B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMmB,WAAW,GAAG,IAAI,CAACf,QAAQ,CAACY,cAAc,CAAC/B,MAAM,CAACS,UAAU,CAAC;IACnE,IAAI,CAACyB,WAAW,CAACF,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAOE,WAAW,CAACC,IAAI,CAAC1B,UAAU,IAAI;MAClC,IAAI,OAAOA,UAAU,CAACc,GAAG,KAAK,QAAQ,EAAE;QACpC,OAAO,IAAI;MACf;MACA,OAAOd,UAAU,CAACc,GAAG,CAACX,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN,CAAC;EAEDyB,OAAO,GAAGA,CAACtB,QAAgB,EAAEuB,IAAkB,KAAc;IACzD,IAAI,IAAI,CAACT,UAAU,EAAE;MACjB,OAAO,IAAI;IACf;IACA,MAAM7B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMmB,WAAW,GAAG,IAAI,CAACf,QAAQ,CAACY,cAAc,CAAC/B,MAAM,CAACS,UAAU,CAAC;IACnE,IAAI,CAACyB,WAAW,CAACF,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAOE,WAAW,CAACC,IAAI,CAAC1B,UAAU,IAAI;MAClC,IAAIA,UAAU,CAAC8B,GAAG,EAAE;QAChB,IAAI,CAACD,IAAI,EAAEE,SAAS,EAAE;UAClB,OAAO,IAAI;QACf;QACA,OAAOF,IAAI,CAACE,SAAS,CAAChC,EAAE,KAAK,IAAI,CAACW,QAAQ,CAACX,EAAE;MACjD;MACA,IAAI,OAAOC,UAAU,CAACc,GAAG,KAAK,QAAQ,EAAE;QACpC,OAAO,IAAI;MACf;MACA,OAAOd,UAAU,CAACc,GAAG,CAACX,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN,CAAC;EAED6B,SAAS,GAAGA,CAAC1B,QAAgB,EAAEuB,IAAkB,KAAc;IAC3D,IAAI,IAAI,CAACT,UAAU,EAAE;MACjB,OAAO,IAAI;IACf;IACA,MAAM7B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMmB,WAAW,GAAG,IAAI,CAACf,QAAQ,CAACY,cAAc,CAAC/B,MAAM,CAACS,UAAU,CAAC;IACnE,IAAI,CAACyB,WAAW,CAACF,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAOE,WAAW,CAACC,IAAI,CAAC1B,UAAU,IAAI;MAClC,IAAIA,UAAU,CAAC8B,GAAG,EAAE;QAChB,OAAOD,IAAI,EAAEE,SAAS,EAAEhC,EAAE,KAAK,IAAI,CAACW,QAAQ,CAACX,EAAE;MACnD;MACA,IAAI,OAAOC,UAAU,CAACc,GAAG,KAAK,QAAQ,EAAE;QACpC,OAAO,IAAI;MACf;MACA,OAAOd,UAAU,CAACc,GAAG,CAACX,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN,CAAC;EAED8B,UAAU,GAAI3B,QAAgB,IAAc;IACxC,IAAI,IAAI,CAACc,UAAU,EAAE;MACjB,OAAO,IAAI;IACf;IACA,MAAM7B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMmB,WAAW,GAAG,IAAI,CAACf,QAAQ,CAACY,cAAc,CAAC/B,MAAM,CAACS,UAAU,CAAC;IACnE,IAAI,CAACyB,WAAW,CAACF,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAOE,WAAW,CAACC,IAAI,CAAC1B,UAAU,IAAI;MAClC,OAAOA,UAAU,CAACe,EAAE,EAAEZ,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN,CAAC;EAED+B,YAAY,GAAI5B,QAAgB,IAAc;IAC1C,IAAI,IAAI,CAACc,UAAU,EAAE;MACjB,OAAO,IAAI;IACf;IACA,MAAM7B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMmB,WAAW,GAAG,IAAI,CAACf,QAAQ,CAACY,cAAc,CAAC/B,MAAM,CAACS,UAAU,CAAC;IACnE,IAAI,CAACyB,WAAW,CAACF,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAOE,WAAW,CAACC,IAAI,CAAC1B,UAAU,IAAI;MAClC,OAAOA,UAAU,CAACe,EAAE,EAAEZ,QAAQ,CAAC,GAAG,CAAC;IACvC,CAAC,CAAC;EACN,CAAC;EAEDgC,SAAS,GAAGA,CAACxC,MAAc,EAAEW,QAAgB,KAAc;IACvD,IAAI,IAAI,CAACc,UAAU,EAAE;MACjB,OAAO,IAAI;IACf;IACA,MAAM7B,MAAM,GAAGa,SAAS,CAAC,IAAI,CAACC,SAAS,EAAEC,QAAQ,CAAC;IAClD,MAAMmB,WAAW,GAAG,IAAI,CAACf,QAAQ,CAACY,cAAc,CAAC/B,MAAM,CAACS,UAAU,CAAC;IACnE,IAAI,CAACyB,WAAW,CAACF,MAAM,EAAE;MACrB,OAAO,KAAK;IAChB;IACA,OAAOE,WAAW,CAACC,IAAI,CAAC1B,UAAU,IAAI;MAClC,OAAOA,UAAU,CAACL,MAAM,CAAC,KAAK,IAAI;IACtC,CAAC,CAAC;EACN,CAAC;AACL;AAEA,OAAO,SAASyC,4BAA4BA,CAAyChD,MAAS,EAAE;EAC5F,OAAOJ,iBAAiB,CAA0B,GAAGI,MAAM,CAACuB,MAAM,cAAc,CAAC;AACrF;AAEA,OAAO,SAAS0B,wBAAwBA,CACpCjD,MAAS,EACTkD,WAAiD,EACnD;EACE,MAAMC,eAAe,SAASvB,iBAAiB,CAAI;IAC/CC,WAAWA,CAACC,eAAiC,EAAE;MAC3C,KAAK,CAAC9B,MAAM,EAAE8B,eAAe,CAAC;IAClC;EACJ;EAEA,MAAMsB,cAAc,GAAGF,WAAW,CAACG,oBAAoB,CAAC;IACpDC,cAAc,EAAEH,eAAe;IAC/BI,YAAY,EAAE,CAACzD,eAAe;EAClC,CAAC,CAAC;EAEF,OAAOD,aAAa,CAAC;IACjBY,IAAI,EAAE,GAAGT,MAAM,CAACuB,MAAM,cAAc;IACpCiC,QAAQA,CAACC,SAAS,EAAE;MAChBA,SAAS,CAACD,QAAQ,CAACJ,cAAc,CAAC,CAACM,gBAAgB,CAAC,CAAC;IACzD,CAAC;IACDC,OAAOA,CAACF,SAAS,EAAE;MACf,OAAO;QAAEpB,WAAW,EAAEoB,SAAS,CAACE,OAAO,CAACT,WAAW;MAAE,CAAC;IAC1D;EACJ,CAAC,CAAC;AACN","ignoreList":[]}
+{"version":3,"file":"permissions/createPermissions.js","sources":["../../src/permissions/createPermissions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/admin\";\nimport { createFeature } from \"@webiny/feature/admin\";\nimport { IdentityContext } from \"~/features/security/IdentityContext/abstractions.js\";\nimport type { IIdentityContext } from \"~/features/security/IdentityContext/abstractions.js\";\nimport type { Identity } from \"~/domain/Identity.js\";\nimport type { Abstraction } from \"@webiny/di\";\nimport type { PermissionSchemaConfig, OwnableItem, UsePermissionsResult } from \"./types.js\";\n\ninterface EntityLookup {\n    permission: string;\n    actions: Set<string>;\n    hasOwn: boolean;\n}\n\nfunction buildEntityMap(schema: PermissionSchemaConfig): Map<string, EntityLookup> {\n    const map = new Map<string, EntityLookup>();\n    for (const entity of schema.entities ?? []) {\n        const actions = new Set<string>();\n        for (const action of entity.actions ?? []) {\n            actions.add(action.name);\n        }\n        map.set(entity.id, {\n            permission: entity.permission,\n            actions,\n            hasOwn: entity.scopes.includes(\"own\")\n        });\n    }\n    return map;\n}\n\nfunction getEntity(entityMap: Map<string, EntityLookup>, entityId: string): EntityLookup {\n    const entity = entityMap.get(entityId);\n    if (!entity) {\n        throw new Error(`Unknown entity \"${entityId}\" in permission schema.`);\n    }\n    return entity;\n}\n\n/**\n * Check whether the identity has unrestricted full access for the given schema prefix.\n * Stricter than the legacy check: `{ name: \"wb.*\", rwd: \"r\" }` is NOT full access.\n */\nfunction hasFullSchemaAccess(identity: Identity, prefix: string): boolean {\n    const fullAccessName = `${prefix}.*`;\n    const permission = identity.getPermission(fullAccessName);\n    if (!permission) {\n        return false;\n    }\n    // If any restricting keys are present, this is not full access.\n    if (typeof permission.rwd === \"string\" || typeof permission.pw === \"string\") {\n        return false;\n    }\n    return true;\n}\n\nclass SchemaPermissions<S extends PermissionSchemaConfig> {\n    private readonly schema: S;\n    private readonly entityMap: Map<string, EntityLookup>;\n    private readonly identityContext: IIdentityContext;\n\n    constructor(schema: S, identityContext: IIdentityContext) {\n        this.schema = schema;\n        this.entityMap = buildEntityMap(schema);\n        this.identityContext = identityContext;\n    }\n\n    private get identity(): Identity {\n        return this.identityContext.getIdentity();\n    }\n\n    private get fullAccess(): boolean {\n        return hasFullSchemaAccess(this.identity, this.schema.prefix);\n    }\n\n    canAccess = (entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        return this.identity.getPermissions(entity.permission).length > 0;\n    };\n\n    canRead = (entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"r\");\n        });\n    };\n\n    canCreate = (entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"w\");\n        });\n    };\n\n    canEdit = (entityId: string, item?: OwnableItem): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (permission.own) {\n                if (!item?.createdBy) {\n                    return true;\n                }\n                return item.createdBy.id === this.identity.id;\n            }\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"w\");\n        });\n    };\n\n    canDelete = (entityId: string, item?: OwnableItem): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            if (permission.own) {\n                return item?.createdBy?.id === this.identity.id;\n            }\n            if (typeof permission.rwd !== \"string\") {\n                return true;\n            }\n            return permission.rwd.includes(\"d\");\n        });\n    };\n\n    canPublish = (entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission.pw?.includes(\"p\");\n        });\n    };\n\n    canUnpublish = (entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission.pw?.includes(\"u\");\n        });\n    };\n\n    canAction = (action: string, entityId: string): boolean => {\n        if (this.fullAccess) {\n            return true;\n        }\n        const entity = getEntity(this.entityMap, entityId);\n        const permissions = this.identity.getPermissions(entity.permission);\n        if (!permissions.length) {\n            return false;\n        }\n        return permissions.some(permission => {\n            return permission[action] === true;\n        });\n    };\n}\n\nexport function createPermissionsAbstraction<const S extends PermissionSchemaConfig>(schema: S) {\n    return createAbstraction<UsePermissionsResult<S>>(`${schema.prefix}:Permissions`);\n}\n\nexport function createPermissionsFeature<const S extends PermissionSchemaConfig>(\n    schema: S,\n    abstraction: Abstraction<UsePermissionsResult<S>>\n) {\n    class PermissionsImpl extends SchemaPermissions<S> {\n        constructor(identityContext: IIdentityContext) {\n            super(schema, identityContext);\n        }\n    }\n\n    const Implementation = abstraction.createImplementation({\n        implementation: PermissionsImpl,\n        dependencies: [IdentityContext]\n    });\n\n    return createFeature({\n        name: `${schema.prefix}:Permissions`,\n        register(container) {\n            container.register(Implementation).inSingletonScope();\n        },\n        resolve(container) {\n            return { permissions: container.resolve(abstraction) };\n        }\n    });\n}\n"],"names":["buildEntityMap","schema","map","Map","entity","actions","Set","action","getEntity","entityMap","entityId","Error","hasFullSchemaAccess","identity","prefix","fullAccessName","permission","SchemaPermissions","identityContext","permissions","item","createPermissionsAbstraction","createAbstraction","createPermissionsFeature","abstraction","PermissionsImpl","Implementation","IdentityContext","createFeature","container"],"mappings":";;AAcA,SAASA,eAAeC,MAA8B;IAClD,MAAMC,MAAM,IAAIC;IAChB,KAAK,MAAMC,UAAUH,OAAO,QAAQ,IAAI,EAAE,CAAE;QACxC,MAAMI,UAAU,IAAIC;QACpB,KAAK,MAAMC,UAAUH,OAAO,OAAO,IAAI,EAAE,CACrCC,QAAQ,GAAG,CAACE,OAAO,IAAI;QAE3BL,IAAI,GAAG,CAACE,OAAO,EAAE,EAAE;YACf,YAAYA,OAAO,UAAU;YAC7BC;YACA,QAAQD,OAAO,MAAM,CAAC,QAAQ,CAAC;QACnC;IACJ;IACA,OAAOF;AACX;AAEA,SAASM,UAAUC,SAAoC,EAAEC,QAAgB;IACrE,MAAMN,SAASK,UAAU,GAAG,CAACC;IAC7B,IAAI,CAACN,QACD,MAAM,IAAIO,MAAM,CAAC,gBAAgB,EAAED,SAAS,uBAAuB,CAAC;IAExE,OAAON;AACX;AAMA,SAASQ,oBAAoBC,QAAkB,EAAEC,MAAc;IAC3D,MAAMC,iBAAiB,GAAGD,OAAO,EAAE,CAAC;IACpC,MAAME,aAAaH,SAAS,aAAa,CAACE;IAC1C,IAAI,CAACC,YACD,OAAO;IAGX,IAAI,AAA0B,YAA1B,OAAOA,WAAW,GAAG,IAAiB,AAAyB,YAAzB,OAAOA,WAAW,EAAE,EAC1D,OAAO;IAEX,OAAO;AACX;AAEA,MAAMC;IAKF,YAAYhB,MAAS,EAAEiB,eAAiC,CAAE;aAc1D,SAAS,GAAG,CAACR;YACT,IAAI,IAAI,CAAC,UAAU,EACf,OAAO;YAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;YACzC,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAACN,OAAO,UAAU,EAAE,MAAM,GAAG;QACpE;aAEA,OAAO,GAAG,CAACM;YACP,IAAI,IAAI,CAAC,UAAU,EACf,OAAO;YAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;YACzC,MAAMS,cAAc,IAAI,CAAC,QAAQ,CAAC,cAAc,CAACf,OAAO,UAAU;YAClE,IAAI,CAACe,YAAY,MAAM,EACnB,OAAO;YAEX,OAAOA,YAAY,IAAI,CAACH,CAAAA;gBACpB,IAAI,AAA0B,YAA1B,OAAOA,WAAW,GAAG,EACrB,OAAO;gBAEX,OAAOA,WAAW,GAAG,CAAC,QAAQ,CAAC;YACnC;QACJ;aAEA,SAAS,GAAG,CAACN;YACT,IAAI,IAAI,CAAC,UAAU,EACf,OAAO;YAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;YACzC,MAAMS,cAAc,IAAI,CAAC,QAAQ,CAAC,cAAc,CAACf,OAAO,UAAU;YAClE,IAAI,CAACe,YAAY,MAAM,EACnB,OAAO;YAEX,OAAOA,YAAY,IAAI,CAACH,CAAAA;gBACpB,IAAI,AAA0B,YAA1B,OAAOA,WAAW,GAAG,EACrB,OAAO;gBAEX,OAAOA,WAAW,GAAG,CAAC,QAAQ,CAAC;YACnC;QACJ;aAEA,OAAO,GAAG,CAACN,UAAkBU;YACzB,IAAI,IAAI,CAAC,UAAU,EACf,OAAO;YAEX,MAAMhB,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;YACzC,MAAMS,cAAc,IAAI,CAAC,QAAQ,CAAC,cAAc,CAACf,OAAO,UAAU;YAClE,IAAI,CAACe,YAAY,MAAM,EACnB,OAAO;YAEX,OAAOA,YAAY,IAAI,CAACH,CAAAA;gBACpB,IAAIA,WAAW,GAAG,EAAE;oBAChB,IAAI,CAACI,MAAM,WACP,OAAO;oBAEX,OAAOA,KAAK,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE;gBACjD;gBACA,IAAI,AAA0B,YAA1B,OAAOJ,WAAW,GAAG,EACrB,OAAO;gBAEX,OAAOA,WAAW,GAAG,CAAC,QAAQ,CAAC;YACnC;QACJ;aAEA,SAAS,GAAG,CAACN,UAAkBU;YAC3B,IAAI,IAAI,CAAC,UAAU,EACf,OAAO;YAEX,MAAMhB,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;YACzC,MAAMS,cAAc,IAAI,CAAC,QAAQ,CAAC,cAAc,CAACf,OAAO,UAAU;YAClE,IAAI,CAACe,YAAY,MAAM,EACnB,OAAO;YAEX,OAAOA,YAAY,IAAI,CAACH,CAAAA;gBACpB,IAAIA,WAAW,GAAG,EACd,OAAOI,MAAM,WAAW,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAEnD,IAAI,AAA0B,YAA1B,OAAOJ,WAAW,GAAG,EACrB,OAAO;gBAEX,OAAOA,WAAW,GAAG,CAAC,QAAQ,CAAC;YACnC;QACJ;aAEA,UAAU,GAAG,CAACN;YACV,IAAI,IAAI,CAAC,UAAU,EACf,OAAO;YAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;YACzC,MAAMS,cAAc,IAAI,CAAC,QAAQ,CAAC,cAAc,CAACf,OAAO,UAAU;YAClE,IAAI,CAACe,YAAY,MAAM,EACnB,OAAO;YAEX,OAAOA,YAAY,IAAI,CAACH,CAAAA,aACbA,WAAW,EAAE,EAAE,SAAS;QAEvC;aAEA,YAAY,GAAG,CAACN;YACZ,IAAI,IAAI,CAAC,UAAU,EACf,OAAO;YAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;YACzC,MAAMS,cAAc,IAAI,CAAC,QAAQ,CAAC,cAAc,CAACf,OAAO,UAAU;YAClE,IAAI,CAACe,YAAY,MAAM,EACnB,OAAO;YAEX,OAAOA,YAAY,IAAI,CAACH,CAAAA,aACbA,WAAW,EAAE,EAAE,SAAS;QAEvC;aAEA,SAAS,GAAG,CAACT,QAAgBG;YACzB,IAAI,IAAI,CAAC,UAAU,EACf,OAAO;YAEX,MAAMN,SAASI,UAAU,IAAI,CAAC,SAAS,EAAEE;YACzC,MAAMS,cAAc,IAAI,CAAC,QAAQ,CAAC,cAAc,CAACf,OAAO,UAAU;YAClE,IAAI,CAACe,YAAY,MAAM,EACnB,OAAO;YAEX,OAAOA,YAAY,IAAI,CAACH,CAAAA,aACbA,AAAuB,SAAvBA,UAAU,CAACT,OAAO;QAEjC;QA1II,IAAI,CAAC,MAAM,GAAGN;QACd,IAAI,CAAC,SAAS,GAAGD,eAAeC;QAChC,IAAI,CAAC,eAAe,GAAGiB;IAC3B;IAEA,IAAY,WAAqB;QAC7B,OAAO,IAAI,CAAC,eAAe,CAAC,WAAW;IAC3C;IAEA,IAAY,aAAsB;QAC9B,OAAON,oBAAoB,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;IAChE;AAgIJ;AAEO,SAASS,6BAAqEpB,MAAS;IAC1F,OAAOqB,kBAA2C,GAAGrB,OAAO,MAAM,CAAC,YAAY,CAAC;AACpF;AAEO,SAASsB,yBACZtB,MAAS,EACTuB,WAAiD;IAEjD,MAAMC,wBAAwBR;QAC1B,YAAYC,eAAiC,CAAE;YAC3C,KAAK,CAACjB,QAAQiB;QAClB;IACJ;IAEA,MAAMQ,iBAAiBF,YAAY,oBAAoB,CAAC;QACpD,gBAAgBC;QAChB,cAAc;YAACE;SAAgB;IACnC;IAEA,OAAOC,cAAc;QACjB,MAAM,GAAG3B,OAAO,MAAM,CAAC,YAAY,CAAC;QACpC,UAAS4B,SAAS;YACdA,UAAU,QAAQ,CAACH,gBAAgB,gBAAgB;QACvD;QACA,SAAQG,SAAS;YACb,OAAO;gBAAE,aAAaA,UAAU,OAAO,CAACL;YAAa;QACzD;IACJ;AACJ"}

package/permissions/createPermissions.test.js

@@ -1,177 +1,209 @@
-import { describe, it, expect } from "vitest";
+import { describe, expect, it } from "vitest";
 import { Container } from "@webiny/di";
 import { createPermissionsAbstraction, createPermissionsFeature } from "./createPermissions.js";
 import { createPermissionSchema } from "./createPermissionSchema.js";
 import { IdentityContext } from "../features/security/IdentityContext/abstractions.js";
-import { IdentityContext as IdentityContextImpl } from "../features/security/IdentityContext/IdentityContext.js";
+import { IdentityContext as IdentityContext_js_IdentityContext } from "../features/security/IdentityContext/IdentityContext.js";
 import { Identity } from "../domain/Identity.js";
 const TEST_SCHEMA = createPermissionSchema({
-  prefix: "test",
-  fullAccess: true,
-  entities: [{
-    id: "page",
-    title: "Page",
-    permission: "test.page",
-    scopes: ["full", "own"],
-    actions: [{
-      name: "rwd"
-    }, {
-      name: "pw"
-    }]
-  }]
+    prefix: "test",
+    fullAccess: true,
+    entities: [
+        {
+            id: "page",
+            title: "Page",
+            permission: "test.page",
+            scopes: [
+                "full",
+                "own"
+            ],
+            actions: [
+                {
+                    name: "rwd"
+                },
+                {
+                    name: "pw"
+                }
+            ]
+        }
+    ]
 });
 const TestPermissions = createPermissionsAbstraction(TEST_SCHEMA);
 const TestPermissionsFeature = createPermissionsFeature(TEST_SCHEMA, TestPermissions);
 function resolve(permissions) {
-  const container = new Container();
-  container.register(IdentityContextImpl).inSingletonScope();
-  TestPermissionsFeature.register(container);
-  const identityContext = container.resolve(IdentityContext);
-  identityContext.setIdentity(Identity.createAuthenticated({
-    id: "test-user",
-    displayName: "Test User",
-    type: "admin",
-    roles: [],
-    teams: [],
-    permissions,
-    profile: {
-      external: false
-    },
-    currentTenant: {
-      id: "root",
-      name: "Root"
-    },
-    defaultTenant: {
-      id: "root",
-      name: "Root"
-    }
-  }));
-  return container.resolve(TestPermissions);
+    const container = new Container();
+    container.register(IdentityContext_js_IdentityContext).inSingletonScope();
+    TestPermissionsFeature.register(container);
+    const identityContext = container.resolve(IdentityContext);
+    identityContext.setIdentity(Identity.createAuthenticated({
+        id: "test-user",
+        displayName: "Test User",
+        type: "admin",
+        roles: [],
+        teams: [],
+        permissions,
+        profile: {
+            external: false
+        },
+        currentTenant: {
+            id: "root",
+            name: "Root"
+        },
+        defaultTenant: {
+            id: "root",
+            name: "Root"
+        }
+    }));
+    return container.resolve(TestPermissions);
 }
-describe("SchemaPermissions", () => {
-  describe("full access", () => {
-    it("grants everything with unrestricted wildcard", () => {
-      const p = resolve([{
-        name: "test.*"
-      }]);
-      expect(p.canAccess("page")).toBe(true);
-      expect(p.canRead("page")).toBe(true);
-      expect(p.canCreate("page")).toBe(true);
-      expect(p.canEdit("page")).toBe(true);
-      expect(p.canDelete("page")).toBe(true);
-      expect(p.canPublish("page")).toBe(true);
-      expect(p.canUnpublish("page")).toBe(true);
-    });
-    it("rejects wildcard with rwd restriction as non-full access", () => {
-      const p = resolve([{
-        name: "test.*",
-        rwd: "r"
-      }]);
-      expect(p.canCreate("page")).toBe(false);
-      expect(p.canDelete("page")).toBe(false);
-    });
-  });
-  describe("entity-level access", () => {
-    it("grants access when entity permission exists", () => {
-      const p = resolve([{
-        name: "test.page"
-      }]);
-      expect(p.canAccess("page")).toBe(true);
-    });
-    it("denies access when no permission exists", () => {
-      const p = resolve([]);
-      expect(p.canAccess("page")).toBe(false);
-    });
-  });
-  describe("rwd actions", () => {
-    it("respects read permission", () => {
-      const p = resolve([{
-        name: "test.page",
-        rwd: "r"
-      }]);
-      expect(p.canRead("page")).toBe(true);
-      expect(p.canCreate("page")).toBe(false);
-      expect(p.canDelete("page")).toBe(false);
-    });
-    it("respects write permission", () => {
-      const p = resolve([{
-        name: "test.page",
-        rwd: "rw"
-      }]);
-      expect(p.canRead("page")).toBe(true);
-      expect(p.canCreate("page")).toBe(true);
-      expect(p.canEdit("page")).toBe(true);
-      expect(p.canDelete("page")).toBe(false);
+describe("SchemaPermissions", ()=>{
+    describe("full access", ()=>{
+        it("grants everything with unrestricted wildcard", ()=>{
+            const p = resolve([
+                {
+                    name: "test.*"
+                }
+            ]);
+            expect(p.canAccess("page")).toBe(true);
+            expect(p.canRead("page")).toBe(true);
+            expect(p.canCreate("page")).toBe(true);
+            expect(p.canEdit("page")).toBe(true);
+            expect(p.canDelete("page")).toBe(true);
+            expect(p.canPublish("page")).toBe(true);
+            expect(p.canUnpublish("page")).toBe(true);
+        });
+        it("rejects wildcard with rwd restriction as non-full access", ()=>{
+            const p = resolve([
+                {
+                    name: "test.*",
+                    rwd: "r"
+                }
+            ]);
+            expect(p.canCreate("page")).toBe(false);
+            expect(p.canDelete("page")).toBe(false);
+        });
     });
-    it("respects delete permission", () => {
-      const p = resolve([{
-        name: "test.page",
-        rwd: "d"
-      }]);
-      expect(p.canDelete("page")).toBe(true);
-      expect(p.canRead("page")).toBe(false);
+    describe("entity-level access", ()=>{
+        it("grants access when entity permission exists", ()=>{
+            const p = resolve([
+                {
+                    name: "test.page"
+                }
+            ]);
+            expect(p.canAccess("page")).toBe(true);
+        });
+        it("denies access when no permission exists", ()=>{
+            const p = resolve([]);
+            expect(p.canAccess("page")).toBe(false);
+        });
     });
-  });
-  describe("publish/unpublish actions", () => {
-    it("grants publish when pw includes p", () => {
-      const p = resolve([{
-        name: "test.page",
-        pw: "p"
-      }]);
-      expect(p.canPublish("page")).toBe(true);
-      expect(p.canUnpublish("page")).toBe(false);
+    describe("rwd actions", ()=>{
+        it("respects read permission", ()=>{
+            const p = resolve([
+                {
+                    name: "test.page",
+                    rwd: "r"
+                }
+            ]);
+            expect(p.canRead("page")).toBe(true);
+            expect(p.canCreate("page")).toBe(false);
+            expect(p.canDelete("page")).toBe(false);
+        });
+        it("respects write permission", ()=>{
+            const p = resolve([
+                {
+                    name: "test.page",
+                    rwd: "rw"
+                }
+            ]);
+            expect(p.canRead("page")).toBe(true);
+            expect(p.canCreate("page")).toBe(true);
+            expect(p.canEdit("page")).toBe(true);
+            expect(p.canDelete("page")).toBe(false);
+        });
+        it("respects delete permission", ()=>{
+            const p = resolve([
+                {
+                    name: "test.page",
+                    rwd: "d"
+                }
+            ]);
+            expect(p.canDelete("page")).toBe(true);
+            expect(p.canRead("page")).toBe(false);
+        });
     });
-    it("grants both when pw includes pu", () => {
-      const p = resolve([{
-        name: "test.page",
-        pw: "pu"
-      }]);
-      expect(p.canPublish("page")).toBe(true);
-      expect(p.canUnpublish("page")).toBe(true);
+    describe("publish/unpublish actions", ()=>{
+        it("grants publish when pw includes p", ()=>{
+            const p = resolve([
+                {
+                    name: "test.page",
+                    pw: "p"
+                }
+            ]);
+            expect(p.canPublish("page")).toBe(true);
+            expect(p.canUnpublish("page")).toBe(false);
+        });
+        it("grants both when pw includes pu", ()=>{
+            const p = resolve([
+                {
+                    name: "test.page",
+                    pw: "pu"
+                }
+            ]);
+            expect(p.canPublish("page")).toBe(true);
+            expect(p.canUnpublish("page")).toBe(true);
+        });
     });
-  });
-  describe("own scope", () => {
-    it("allows edit when item is owned by the user", () => {
-      const p = resolve([{
-        name: "test.page",
-        own: true
-      }]);
-      expect(p.canEdit("page", {
-        createdBy: {
-          id: "test-user"
-        }
-      })).toBe(true);
-    });
-    it("denies edit when item is owned by someone else", () => {
-      const p = resolve([{
-        name: "test.page",
-        own: true
-      }]);
-      expect(p.canEdit("page", {
-        createdBy: {
-          id: "other-user"
-        }
-      })).toBe(false);
-    });
-    it("allows edit when no item is provided (optimistic)", () => {
-      const p = resolve([{
-        name: "test.page",
-        own: true
-      }]);
-      expect(p.canEdit("page")).toBe(true);
-    });
-    it("denies delete when item is owned by someone else", () => {
-      const p = resolve([{
-        name: "test.page",
-        own: true
-      }]);
-      expect(p.canDelete("page", {
-        createdBy: {
-          id: "other-user"
-        }
-      })).toBe(false);
+    describe("own scope", ()=>{
+        it("allows edit when item is owned by the user", ()=>{
+            const p = resolve([
+                {
+                    name: "test.page",
+                    own: true
+                }
+            ]);
+            expect(p.canEdit("page", {
+                createdBy: {
+                    id: "test-user"
+                }
+            })).toBe(true);
+        });
+        it("denies edit when item is owned by someone else", ()=>{
+            const p = resolve([
+                {
+                    name: "test.page",
+                    own: true
+                }
+            ]);
+            expect(p.canEdit("page", {
+                createdBy: {
+                    id: "other-user"
+                }
+            })).toBe(false);
+        });
+        it("allows edit when no item is provided (optimistic)", ()=>{
+            const p = resolve([
+                {
+                    name: "test.page",
+                    own: true
+                }
+            ]);
+            expect(p.canEdit("page")).toBe(true);
+        });
+        it("denies delete when item is owned by someone else", ()=>{
+            const p = resolve([
+                {
+                    name: "test.page",
+                    own: true
+                }
+            ]);
+            expect(p.canDelete("page", {
+                createdBy: {
+                    id: "other-user"
+                }
+            })).toBe(false);
+        });
     });
-  });
 });
 
 //# sourceMappingURL=createPermissions.test.js.map

package/permissions/createPermissions.test.js.map

@@ -1 +1 @@
-{"version":3,"names":["describe","it","expect","Container","createPermissionsAbstraction","createPermissionsFeature","createPermissionSchema","IdentityContext","IdentityContextImpl","Identity","TEST_SCHEMA","prefix","fullAccess","entities","id","title","permission","scopes","actions","name","TestPermissions","TestPermissionsFeature","resolve","permissions","container","register","inSingletonScope","identityContext","setIdentity","createAuthenticated","displayName","type","roles","teams","profile","external","currentTenant","defaultTenant","p","canAccess","toBe","canRead","canCreate","canEdit","canDelete","canPublish","canUnpublish","rwd","pw","own","createdBy"],"sources":["createPermissions.test.ts"],"sourcesContent":["import { describe, it, expect } from \"vitest\";\nimport { Container } from \"@webiny/di\";\nimport { createPermissionsAbstraction, createPermissionsFeature } from \"./createPermissions.js\";\nimport { createPermissionSchema } from \"./createPermissionSchema.js\";\nimport { IdentityContext } from \"~/features/security/IdentityContext/abstractions.js\";\nimport { IdentityContext as IdentityContextImpl } from \"~/features/security/IdentityContext/IdentityContext.js\";\nimport { Identity } from \"~/domain/Identity.js\";\n\nconst TEST_SCHEMA = createPermissionSchema({\n    prefix: \"test\",\n    fullAccess: true,\n    entities: [\n        {\n            id: \"page\",\n            title: \"Page\",\n            permission: \"test.page\",\n            scopes: [\"full\", \"own\"],\n            actions: [{ name: \"rwd\" }, { name: \"pw\" }]\n        }\n    ]\n} as const);\n\nconst TestPermissions = createPermissionsAbstraction(TEST_SCHEMA);\nconst TestPermissionsFeature = createPermissionsFeature(TEST_SCHEMA, TestPermissions);\n\nfunction resolve(permissions: Array<{ name: string; [key: string]: any }>) {\n    const container = new Container();\n    container.register(IdentityContextImpl).inSingletonScope();\n    TestPermissionsFeature.register(container);\n\n    const identityContext = container.resolve(IdentityContext);\n    identityContext.setIdentity(\n        Identity.createAuthenticated({\n            id: \"test-user\",\n            displayName: \"Test User\",\n            type: \"admin\",\n            roles: [],\n            teams: [],\n            permissions,\n            profile: { external: false },\n            currentTenant: { id: \"root\", name: \"Root\" },\n            defaultTenant: { id: \"root\", name: \"Root\" }\n        })\n    );\n\n    return container.resolve(TestPermissions);\n}\n\ndescribe(\"SchemaPermissions\", () => {\n    describe(\"full access\", () => {\n        it(\"grants everything with unrestricted wildcard\", () => {\n            const p = resolve([{ name: \"test.*\" }]);\n            expect(p.canAccess(\"page\")).toBe(true);\n            expect(p.canRead(\"page\")).toBe(true);\n            expect(p.canCreate(\"page\")).toBe(true);\n            expect(p.canEdit(\"page\")).toBe(true);\n            expect(p.canDelete(\"page\")).toBe(true);\n            expect(p.canPublish(\"page\")).toBe(true);\n            expect(p.canUnpublish(\"page\")).toBe(true);\n        });\n\n        it(\"rejects wildcard with rwd restriction as non-full access\", () => {\n            const p = resolve([{ name: \"test.*\", rwd: \"r\" }]);\n            expect(p.canCreate(\"page\")).toBe(false);\n            expect(p.canDelete(\"page\")).toBe(false);\n        });\n    });\n\n    describe(\"entity-level access\", () => {\n        it(\"grants access when entity permission exists\", () => {\n            const p = resolve([{ name: \"test.page\" }]);\n            expect(p.canAccess(\"page\")).toBe(true);\n        });\n\n        it(\"denies access when no permission exists\", () => {\n            const p = resolve([]);\n            expect(p.canAccess(\"page\")).toBe(false);\n        });\n    });\n\n    describe(\"rwd actions\", () => {\n        it(\"respects read permission\", () => {\n            const p = resolve([{ name: \"test.page\", rwd: \"r\" }]);\n            expect(p.canRead(\"page\")).toBe(true);\n            expect(p.canCreate(\"page\")).toBe(false);\n            expect(p.canDelete(\"page\")).toBe(false);\n        });\n\n        it(\"respects write permission\", () => {\n            const p = resolve([{ name: \"test.page\", rwd: \"rw\" }]);\n            expect(p.canRead(\"page\")).toBe(true);\n            expect(p.canCreate(\"page\")).toBe(true);\n            expect(p.canEdit(\"page\")).toBe(true);\n            expect(p.canDelete(\"page\")).toBe(false);\n        });\n\n        it(\"respects delete permission\", () => {\n            const p = resolve([{ name: \"test.page\", rwd: \"d\" }]);\n            expect(p.canDelete(\"page\")).toBe(true);\n            expect(p.canRead(\"page\")).toBe(false);\n        });\n    });\n\n    describe(\"publish/unpublish actions\", () => {\n        it(\"grants publish when pw includes p\", () => {\n            const p = resolve([{ name: \"test.page\", pw: \"p\" }]);\n            expect(p.canPublish(\"page\")).toBe(true);\n            expect(p.canUnpublish(\"page\")).toBe(false);\n        });\n\n        it(\"grants both when pw includes pu\", () => {\n            const p = resolve([{ name: \"test.page\", pw: \"pu\" }]);\n            expect(p.canPublish(\"page\")).toBe(true);\n            expect(p.canUnpublish(\"page\")).toBe(true);\n        });\n    });\n\n    describe(\"own scope\", () => {\n        it(\"allows edit when item is owned by the user\", () => {\n            const p = resolve([{ name: \"test.page\", own: true }]);\n            expect(p.canEdit(\"page\", { createdBy: { id: \"test-user\" } })).toBe(true);\n        });\n\n        it(\"denies edit when item is owned by someone else\", () => {\n            const p = resolve([{ name: \"test.page\", own: true }]);\n            expect(p.canEdit(\"page\", { createdBy: { id: \"other-user\" } })).toBe(false);\n        });\n\n        it(\"allows edit when no item is provided (optimistic)\", () => {\n            const p = resolve([{ name: \"test.page\", own: true }]);\n            expect(p.canEdit(\"page\")).toBe(true);\n        });\n\n        it(\"denies delete when item is owned by someone else\", () => {\n            const p = resolve([{ name: \"test.page\", own: true }]);\n            expect(p.canDelete(\"page\", { createdBy: { id: \"other-user\" } })).toBe(false);\n        });\n    });\n});\n"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,EAAE,EAAEC,MAAM,QAAQ,QAAQ;AAC7C,SAASC,SAAS,QAAQ,YAAY;AACtC,SAASC,4BAA4B,EAAEC,wBAAwB;AAC/D,SAASC,sBAAsB;AAC/B,SAASC,eAAe;AACxB,SAASA,eAAe,IAAIC,mBAAmB;AAC/C,SAASC,QAAQ;AAEjB,MAAMC,WAAW,GAAGJ,sBAAsB,CAAC;EACvCK,MAAM,EAAE,MAAM;EACdC,UAAU,EAAE,IAAI;EAChBC,QAAQ,EAAE,CACN;IACIC,EAAE,EAAE,MAAM;IACVC,KAAK,EAAE,MAAM;IACbC,UAAU,EAAE,WAAW;IACvBC,MAAM,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;IACvBC,OAAO,EAAE,CAAC;MAAEC,IAAI,EAAE;IAAM,CAAC,EAAE;MAAEA,IAAI,EAAE;IAAK,CAAC;EAC7C,CAAC;AAET,CAAU,CAAC;AAEX,MAAMC,eAAe,GAAGhB,4BAA4B,CAACM,WAAW,CAAC;AACjE,MAAMW,sBAAsB,GAAGhB,wBAAwB,CAACK,WAAW,EAAEU,eAAe,CAAC;AAErF,SAASE,OAAOA,CAACC,WAAwD,EAAE;EACvE,MAAMC,SAAS,GAAG,IAAIrB,SAAS,CAAC,CAAC;EACjCqB,SAAS,CAACC,QAAQ,CAACjB,mBAAmB,CAAC,CAACkB,gBAAgB,CAAC,CAAC;EAC1DL,sBAAsB,CAACI,QAAQ,CAACD,SAAS,CAAC;EAE1C,MAAMG,eAAe,GAAGH,SAAS,CAACF,OAAO,CAACf,eAAe,CAAC;EAC1DoB,eAAe,CAACC,WAAW,CACvBnB,QAAQ,CAACoB,mBAAmB,CAAC;IACzBf,EAAE,EAAE,WAAW;IACfgB,WAAW,EAAE,WAAW;IACxBC,IAAI,EAAE,OAAO;IACbC,KAAK,EAAE,EAAE;IACTC,KAAK,EAAE,EAAE;IACTV,WAAW;IACXW,OAAO,EAAE;MAAEC,QAAQ,EAAE;IAAM,CAAC;IAC5BC,aAAa,EAAE;MAAEtB,EAAE,EAAE,MAAM;MAAEK,IAAI,EAAE;IAAO,CAAC;IAC3CkB,aAAa,EAAE;MAAEvB,EAAE,EAAE,MAAM;MAAEK,IAAI,EAAE;IAAO;EAC9C,CAAC,CACL,CAAC;EAED,OAAOK,SAAS,CAACF,OAAO,CAACF,eAAe,CAAC;AAC7C;AAEApB,QAAQ,CAAC,mBAAmB,EAAE,MAAM;EAChCA,QAAQ,CAAC,aAAa,EAAE,MAAM;IAC1BC,EAAE,CAAC,8CAA8C,EAAE,MAAM;MACrD,MAAMqC,CAAC,GAAGhB,OAAO,CAAC,CAAC;QAAEH,IAAI,EAAE;MAAS,CAAC,CAAC,CAAC;MACvCjB,MAAM,CAACoC,CAAC,CAACC,SAAS,CAAC,MAAM,CAAC,CAAC,CAACC,IAAI,CAAC,IAAI,CAAC;MACtCtC,MAAM,CAACoC,CAAC,CAACG,OAAO,CAAC,MAAM,CAAC,CAAC,CAACD,IAAI,CAAC,IAAI,CAAC;MACpCtC,MAAM,CAACoC,CAAC,CAACI,SAAS,CAAC,MAAM,CAAC,CAAC,CAACF,IAAI,CAAC,IAAI,CAAC;MACtCtC,MAAM,CAACoC,CAAC,CAACK,OAAO,CAAC,MAAM,CAAC,CAAC,CAACH,IAAI,CAAC,IAAI,CAAC;MACpCtC,MAAM,CAACoC,CAAC,CAACM,SAAS,CAAC,MAAM,CAAC,CAAC,CAACJ,IAAI,CAAC,IAAI,CAAC;MACtCtC,MAAM,CAACoC,CAAC,CAACO,UAAU,CAAC,MAAM,CAAC,CAAC,CAACL,IAAI,CAAC,IAAI,CAAC;MACvCtC,MAAM,CAACoC,CAAC,CAACQ,YAAY,CAAC,MAAM,CAAC,CAAC,CAACN,IAAI,CAAC,IAAI,CAAC;IAC7C,CAAC,CAAC;IAEFvC,EAAE,CAAC,0DAA0D,EAAE,MAAM;MACjE,MAAMqC,CAAC,GAAGhB,OAAO,CAAC,CAAC;QAAEH,IAAI,EAAE,QAAQ;QAAE4B,GAAG,EAAE;MAAI,CAAC,CAAC,CAAC;MACjD7C,MAAM,CAACoC,CAAC,CAACI,SAAS,CAAC,MAAM,CAAC,CAAC,CAACF,IAAI,CAAC,KAAK,CAAC;MACvCtC,MAAM,CAACoC,CAAC,CAACM,SAAS,CAAC,MAAM,CAAC,CAAC,CAACJ,IAAI,CAAC,KAAK,CAAC;IAC3C,CAAC,CAAC;EACN,CAAC,CAAC;EAEFxC,QAAQ,CAAC,qBAAqB,EAAE,MAAM;IAClCC,EAAE,CAAC,6CAA6C,EAAE,MAAM;MACpD,MAAMqC,CAAC,GAAGhB,OAAO,CAAC,CAAC;QAAEH,IAAI,EAAE;MAAY,CAAC,CAAC,CAAC;MAC1CjB,MAAM,CAACoC,CAAC,CAACC,SAAS,CAAC,MAAM,CAAC,CAAC,CAACC,IAAI,CAAC,IAAI,CAAC;IAC1C,CAAC,CAAC;IAEFvC,EAAE,CAAC,yCAAyC,EAAE,MAAM;MAChD,MAAMqC,CAAC,GAAGhB,OAAO,CAAC,EAAE,CAAC;MACrBpB,MAAM,CAACoC,CAAC,CAACC,SAAS,CAAC,MAAM,CAAC,CAAC,CAACC,IAAI,CAAC,KAAK,CAAC;IAC3C,CAAC,CAAC;EACN,CAAC,CAAC;EAEFxC,QAAQ,CAAC,aAAa,EAAE,MAAM;IAC1BC,EAAE,CAAC,0BAA0B,EAAE,MAAM;MACjC,MAAMqC,CAAC,GAAGhB,OAAO,CAAC,CAAC;QAAEH,IAAI,EAAE,WAAW;QAAE4B,GAAG,EAAE;MAAI,CAAC,CAAC,CAAC;MACpD7C,MAAM,CAACoC,CAAC,CAACG,OAAO,CAAC,MAAM,CAAC,CAAC,CAACD,IAAI,CAAC,IAAI,CAAC;MACpCtC,MAAM,CAACoC,CAAC,CAACI,SAAS,CAAC,MAAM,CAAC,CAAC,CAACF,IAAI,CAAC,KAAK,CAAC;MACvCtC,MAAM,CAACoC,CAAC,CAACM,SAAS,CAAC,MAAM,CAAC,CAAC,CAACJ,IAAI,CAAC,KAAK,CAAC;IAC3C,CAAC,CAAC;IAEFvC,EAAE,CAAC,2BAA2B,EAAE,MAAM;MAClC,MAAMqC,CAAC,GAAGhB,OAAO,CAAC,CAAC;QAAEH,IAAI,EAAE,WAAW;QAAE4B,GAAG,EAAE;MAAK,CAAC,CAAC,CAAC;MACrD7C,MAAM,CAACoC,CAAC,CAACG,OAAO,CAAC,MAAM,CAAC,CAAC,CAACD,IAAI,CAAC,IAAI,CAAC;MACpCtC,MAAM,CAACoC,CAAC,CAACI,SAAS,CAAC,MAAM,CAAC,CAAC,CAACF,IAAI,CAAC,IAAI,CAAC;MACtCtC,MAAM,CAACoC,CAAC,CAACK,OAAO,CAAC,MAAM,CAAC,CAAC,CAACH,IAAI,CAAC,IAAI,CAAC;MACpCtC,MAAM,CAACoC,CAAC,CAACM,SAAS,CAAC,MAAM,CAAC,CAAC,CAACJ,IAAI,CAAC,KAAK,CAAC;IAC3C,CAAC,CAAC;IAEFvC,EAAE,CAAC,4BAA4B,EAAE,MAAM;MACnC,MAAMqC,CAAC,GAAGhB,OAAO,CAAC,CAAC;QAAEH,IAAI,EAAE,WAAW;QAAE4B,GAAG,EAAE;MAAI,CAAC,CAAC,CAAC;MACpD7C,MAAM,CAACoC,CAAC,CAACM,SAAS,CAAC,MAAM,CAAC,CAAC,CAACJ,IAAI,CAAC,IAAI,CAAC;MACtCtC,MAAM,CAACoC,CAAC,CAACG,OAAO,CAAC,MAAM,CAAC,CAAC,CAACD,IAAI,CAAC,KAAK,CAAC;IACzC,CAAC,CAAC;EACN,CAAC,CAAC;EAEFxC,QAAQ,CAAC,2BAA2B,EAAE,MAAM;IACxCC,EAAE,CAAC,mCAAmC,EAAE,MAAM;MAC1C,MAAMqC,CAAC,GAAGhB,OAAO,CAAC,CAAC;QAAEH,IAAI,EAAE,WAAW;QAAE6B,EAAE,EAAE;MAAI,CAAC,CAAC,CAAC;MACnD9C,MAAM,CAACoC,CAAC,CAACO,UAAU,CAAC,MAAM,CAAC,CAAC,CAACL,IAAI,CAAC,IAAI,CAAC;MACvCtC,MAAM,CAACoC,CAAC,CAACQ,YAAY,CAAC,MAAM,CAAC,CAAC,CAACN,IAAI,CAAC,KAAK,CAAC;IAC9C,CAAC,CAAC;IAEFvC,EAAE,CAAC,iCAAiC,EAAE,MAAM;MACxC,MAAMqC,CAAC,GAAGhB,OAAO,CAAC,CAAC;QAAEH,IAAI,EAAE,WAAW;QAAE6B,EAAE,EAAE;MAAK,CAAC,CAAC,CAAC;MACpD9C,MAAM,CAACoC,CAAC,CAACO,UAAU,CAAC,MAAM,CAAC,CAAC,CAACL,IAAI,CAAC,IAAI,CAAC;MACvCtC,MAAM,CAACoC,CAAC,CAACQ,YAAY,CAAC,MAAM,CAAC,CAAC,CAACN,IAAI,CAAC,IAAI,CAAC;IAC7C,CAAC,CAAC;EACN,CAAC,CAAC;EAEFxC,QAAQ,CAAC,WAAW,EAAE,MAAM;IACxBC,EAAE,CAAC,4CAA4C,EAAE,MAAM;MACnD,MAAMqC,CAAC,GAAGhB,OAAO,CAAC,CAAC;QAAEH,IAAI,EAAE,WAAW;QAAE8B,GAAG,EAAE;MAAK,CAAC,CAAC,CAAC;MACrD/C,MAAM,CAACoC,CAAC,CAACK,OAAO,CAAC,MAAM,EAAE;QAAEO,SAAS,EAAE;UAAEpC,EAAE,EAAE;QAAY;MAAE,CAAC,CAAC,CAAC,CAAC0B,IAAI,CAAC,IAAI,CAAC;IAC5E,CAAC,CAAC;IAEFvC,EAAE,CAAC,gDAAgD,EAAE,MAAM;MACvD,MAAMqC,CAAC,GAAGhB,OAAO,CAAC,CAAC;QAAEH,IAAI,EAAE,WAAW;QAAE8B,GAAG,EAAE;MAAK,CAAC,CAAC,CAAC;MACrD/C,MAAM,CAACoC,CAAC,CAACK,OAAO,CAAC,MAAM,EAAE;QAAEO,SAAS,EAAE;UAAEpC,EAAE,EAAE;QAAa;MAAE,CAAC,CAAC,CAAC,CAAC0B,IAAI,CAAC,KAAK,CAAC;IAC9E,CAAC,CAAC;IAEFvC,EAAE,CAAC,mDAAmD,EAAE,MAAM;MAC1D,MAAMqC,CAAC,GAAGhB,OAAO,CAAC,CAAC;QAAEH,IAAI,EAAE,WAAW;QAAE8B,GAAG,EAAE;MAAK,CAAC,CAAC,CAAC;MACrD/C,MAAM,CAACoC,CAAC,CAACK,OAAO,CAAC,MAAM,CAAC,CAAC,CAACH,IAAI,CAAC,IAAI,CAAC;IACxC,CAAC,CAAC;IAEFvC,EAAE,CAAC,kDAAkD,EAAE,MAAM;MACzD,MAAMqC,CAAC,GAAGhB,OAAO,CAAC,CAAC;QAAEH,IAAI,EAAE,WAAW;QAAE8B,GAAG,EAAE;MAAK,CAAC,CAAC,CAAC;MACrD/C,MAAM,CAACoC,CAAC,CAACM,SAAS,CAAC,MAAM,EAAE;QAAEM,SAAS,EAAE;UAAEpC,EAAE,EAAE;QAAa;MAAE,CAAC,CAAC,CAAC,CAAC0B,IAAI,CAAC,KAAK,CAAC;IAChF,CAAC,CAAC;EACN,CAAC,CAAC;AACN,CAAC,CAAC","ignoreList":[]}
+{"version":3,"file":"permissions/createPermissions.test.js","sources":["../../src/permissions/createPermissions.test.ts"],"sourcesContent":["import { describe, it, expect } from \"vitest\";\nimport { Container } from \"@webiny/di\";\nimport { createPermissionsAbstraction, createPermissionsFeature } from \"./createPermissions.js\";\nimport { createPermissionSchema } from \"./createPermissionSchema.js\";\nimport { IdentityContext } from \"~/features/security/IdentityContext/abstractions.js\";\nimport { IdentityContext as IdentityContextImpl } from \"~/features/security/IdentityContext/IdentityContext.js\";\nimport { Identity } from \"~/domain/Identity.js\";\n\nconst TEST_SCHEMA = createPermissionSchema({\n    prefix: \"test\",\n    fullAccess: true,\n    entities: [\n        {\n            id: \"page\",\n            title: \"Page\",\n            permission: \"test.page\",\n            scopes: [\"full\", \"own\"],\n            actions: [{ name: \"rwd\" }, { name: \"pw\" }]\n        }\n    ]\n} as const);\n\nconst TestPermissions = createPermissionsAbstraction(TEST_SCHEMA);\nconst TestPermissionsFeature = createPermissionsFeature(TEST_SCHEMA, TestPermissions);\n\nfunction resolve(permissions: Array<{ name: string; [key: string]: any }>) {\n    const container = new Container();\n    container.register(IdentityContextImpl).inSingletonScope();\n    TestPermissionsFeature.register(container);\n\n    const identityContext = container.resolve(IdentityContext);\n    identityContext.setIdentity(\n        Identity.createAuthenticated({\n            id: \"test-user\",\n            displayName: \"Test User\",\n            type: \"admin\",\n            roles: [],\n            teams: [],\n            permissions,\n            profile: { external: false },\n            currentTenant: { id: \"root\", name: \"Root\" },\n            defaultTenant: { id: \"root\", name: \"Root\" }\n        })\n    );\n\n    return container.resolve(TestPermissions);\n}\n\ndescribe(\"SchemaPermissions\", () => {\n    describe(\"full access\", () => {\n        it(\"grants everything with unrestricted wildcard\", () => {\n            const p = resolve([{ name: \"test.*\" }]);\n            expect(p.canAccess(\"page\")).toBe(true);\n            expect(p.canRead(\"page\")).toBe(true);\n            expect(p.canCreate(\"page\")).toBe(true);\n            expect(p.canEdit(\"page\")).toBe(true);\n            expect(p.canDelete(\"page\")).toBe(true);\n            expect(p.canPublish(\"page\")).toBe(true);\n            expect(p.canUnpublish(\"page\")).toBe(true);\n        });\n\n        it(\"rejects wildcard with rwd restriction as non-full access\", () => {\n            const p = resolve([{ name: \"test.*\", rwd: \"r\" }]);\n            expect(p.canCreate(\"page\")).toBe(false);\n            expect(p.canDelete(\"page\")).toBe(false);\n        });\n    });\n\n    describe(\"entity-level access\", () => {\n        it(\"grants access when entity permission exists\", () => {\n            const p = resolve([{ name: \"test.page\" }]);\n            expect(p.canAccess(\"page\")).toBe(true);\n        });\n\n        it(\"denies access when no permission exists\", () => {\n            const p = resolve([]);\n            expect(p.canAccess(\"page\")).toBe(false);\n        });\n    });\n\n    describe(\"rwd actions\", () => {\n        it(\"respects read permission\", () => {\n            const p = resolve([{ name: \"test.page\", rwd: \"r\" }]);\n            expect(p.canRead(\"page\")).toBe(true);\n            expect(p.canCreate(\"page\")).toBe(false);\n            expect(p.canDelete(\"page\")).toBe(false);\n        });\n\n        it(\"respects write permission\", () => {\n            const p = resolve([{ name: \"test.page\", rwd: \"rw\" }]);\n            expect(p.canRead(\"page\")).toBe(true);\n            expect(p.canCreate(\"page\")).toBe(true);\n            expect(p.canEdit(\"page\")).toBe(true);\n            expect(p.canDelete(\"page\")).toBe(false);\n        });\n\n        it(\"respects delete permission\", () => {\n            const p = resolve([{ name: \"test.page\", rwd: \"d\" }]);\n            expect(p.canDelete(\"page\")).toBe(true);\n            expect(p.canRead(\"page\")).toBe(false);\n        });\n    });\n\n    describe(\"publish/unpublish actions\", () => {\n        it(\"grants publish when pw includes p\", () => {\n            const p = resolve([{ name: \"test.page\", pw: \"p\" }]);\n            expect(p.canPublish(\"page\")).toBe(true);\n            expect(p.canUnpublish(\"page\")).toBe(false);\n        });\n\n        it(\"grants both when pw includes pu\", () => {\n            const p = resolve([{ name: \"test.page\", pw: \"pu\" }]);\n            expect(p.canPublish(\"page\")).toBe(true);\n            expect(p.canUnpublish(\"page\")).toBe(true);\n        });\n    });\n\n    describe(\"own scope\", () => {\n        it(\"allows edit when item is owned by the user\", () => {\n            const p = resolve([{ name: \"test.page\", own: true }]);\n            expect(p.canEdit(\"page\", { createdBy: { id: \"test-user\" } })).toBe(true);\n        });\n\n        it(\"denies edit when item is owned by someone else\", () => {\n            const p = resolve([{ name: \"test.page\", own: true }]);\n            expect(p.canEdit(\"page\", { createdBy: { id: \"other-user\" } })).toBe(false);\n        });\n\n        it(\"allows edit when no item is provided (optimistic)\", () => {\n            const p = resolve([{ name: \"test.page\", own: true }]);\n            expect(p.canEdit(\"page\")).toBe(true);\n        });\n\n        it(\"denies delete when item is owned by someone else\", () => {\n            const p = resolve([{ name: \"test.page\", own: true }]);\n            expect(p.canDelete(\"page\", { createdBy: { id: \"other-user\" } })).toBe(false);\n        });\n    });\n});\n"],"names":["TEST_SCHEMA","createPermissionSchema","TestPermissions","createPermissionsAbstraction","TestPermissionsFeature","createPermissionsFeature","resolve","permissions","container","Container","IdentityContextImpl","identityContext","IdentityContext","Identity","describe","it","p","expect"],"mappings":";;;;;;;AAQA,MAAMA,cAAcC,uBAAuB;IACvC,QAAQ;IACR,YAAY;IACZ,UAAU;QACN;YACI,IAAI;YACJ,OAAO;YACP,YAAY;YACZ,QAAQ;gBAAC;gBAAQ;aAAM;YACvB,SAAS;gBAAC;oBAAE,MAAM;gBAAM;gBAAG;oBAAE,MAAM;gBAAK;aAAE;QAC9C;KACH;AACL;AAEA,MAAMC,kBAAkBC,6BAA6BH;AACrD,MAAMI,yBAAyBC,yBAAyBL,aAAaE;AAErE,SAASI,QAAQC,WAAwD;IACrE,MAAMC,YAAY,IAAIC;IACtBD,UAAU,QAAQ,CAACE,oCAAqB,gBAAgB;IACxDN,uBAAuB,QAAQ,CAACI;IAEhC,MAAMG,kBAAkBH,UAAU,OAAO,CAACI;IAC1CD,gBAAgB,WAAW,CACvBE,SAAS,mBAAmB,CAAC;QACzB,IAAI;QACJ,aAAa;QACb,MAAM;QACN,OAAO,EAAE;QACT,OAAO,EAAE;QACTN;QACA,SAAS;YAAE,UAAU;QAAM;QAC3B,eAAe;YAAE,IAAI;YAAQ,MAAM;QAAO;QAC1C,eAAe;YAAE,IAAI;YAAQ,MAAM;QAAO;IAC9C;IAGJ,OAAOC,UAAU,OAAO,CAACN;AAC7B;AAEAY,SAAS,qBAAqB;IAC1BA,SAAS,eAAe;QACpBC,GAAG,gDAAgD;YAC/C,MAAMC,IAAIV,QAAQ;gBAAC;oBAAE,MAAM;gBAAS;aAAE;YACtCW,OAAOD,EAAE,SAAS,CAAC,SAAS,IAAI,CAAC;YACjCC,OAAOD,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC;YAC/BC,OAAOD,EAAE,SAAS,CAAC,SAAS,IAAI,CAAC;YACjCC,OAAOD,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC;YAC/BC,OAAOD,EAAE,SAAS,CAAC,SAAS,IAAI,CAAC;YACjCC,OAAOD,EAAE,UAAU,CAAC,SAAS,IAAI,CAAC;YAClCC,OAAOD,EAAE,YAAY,CAAC,SAAS,IAAI,CAAC;QACxC;QAEAD,GAAG,4DAA4D;YAC3D,MAAMC,IAAIV,QAAQ;gBAAC;oBAAE,MAAM;oBAAU,KAAK;gBAAI;aAAE;YAChDW,OAAOD,EAAE,SAAS,CAAC,SAAS,IAAI,CAAC;YACjCC,OAAOD,EAAE,SAAS,CAAC,SAAS,IAAI,CAAC;QACrC;IACJ;IAEAF,SAAS,uBAAuB;QAC5BC,GAAG,+CAA+C;YAC9C,MAAMC,IAAIV,QAAQ;gBAAC;oBAAE,MAAM;gBAAY;aAAE;YACzCW,OAAOD,EAAE,SAAS,CAAC,SAAS,IAAI,CAAC;QACrC;QAEAD,GAAG,2CAA2C;YAC1C,MAAMC,IAAIV,QAAQ,EAAE;YACpBW,OAAOD,EAAE,SAAS,CAAC,SAAS,IAAI,CAAC;QACrC;IACJ;IAEAF,SAAS,eAAe;QACpBC,GAAG,4BAA4B;YAC3B,MAAMC,IAAIV,QAAQ;gBAAC;oBAAE,MAAM;oBAAa,KAAK;gBAAI;aAAE;YACnDW,OAAOD,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC;YAC/BC,OAAOD,EAAE,SAAS,CAAC,SAAS,IAAI,CAAC;YACjCC,OAAOD,EAAE,SAAS,CAAC,SAAS,IAAI,CAAC;QACrC;QAEAD,GAAG,6BAA6B;YAC5B,MAAMC,IAAIV,QAAQ;gBAAC;oBAAE,MAAM;oBAAa,KAAK;gBAAK;aAAE;YACpDW,OAAOD,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC;YAC/BC,OAAOD,EAAE,SAAS,CAAC,SAAS,IAAI,CAAC;YACjCC,OAAOD,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC;YAC/BC,OAAOD,EAAE,SAAS,CAAC,SAAS,IAAI,CAAC;QACrC;QAEAD,GAAG,8BAA8B;YAC7B,MAAMC,IAAIV,QAAQ;gBAAC;oBAAE,MAAM;oBAAa,KAAK;gBAAI;aAAE;YACnDW,OAAOD,EAAE,SAAS,CAAC,SAAS,IAAI,CAAC;YACjCC,OAAOD,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC;QACnC;IACJ;IAEAF,SAAS,6BAA6B;QAClCC,GAAG,qCAAqC;YACpC,MAAMC,IAAIV,QAAQ;gBAAC;oBAAE,MAAM;oBAAa,IAAI;gBAAI;aAAE;YAClDW,OAAOD,EAAE,UAAU,CAAC,SAAS,IAAI,CAAC;YAClCC,OAAOD,EAAE,YAAY,CAAC,SAAS,IAAI,CAAC;QACxC;QAEAD,GAAG,mCAAmC;YAClC,MAAMC,IAAIV,QAAQ;gBAAC;oBAAE,MAAM;oBAAa,IAAI;gBAAK;aAAE;YACnDW,OAAOD,EAAE,UAAU,CAAC,SAAS,IAAI,CAAC;YAClCC,OAAOD,EAAE,YAAY,CAAC,SAAS,IAAI,CAAC;QACxC;IACJ;IAEAF,SAAS,aAAa;QAClBC,GAAG,8CAA8C;YAC7C,MAAMC,IAAIV,QAAQ;gBAAC;oBAAE,MAAM;oBAAa,KAAK;gBAAK;aAAE;YACpDW,OAAOD,EAAE,OAAO,CAAC,QAAQ;gBAAE,WAAW;oBAAE,IAAI;gBAAY;YAAE,IAAI,IAAI,CAAC;QACvE;QAEAD,GAAG,kDAAkD;YACjD,MAAMC,IAAIV,QAAQ;gBAAC;oBAAE,MAAM;oBAAa,KAAK;gBAAK;aAAE;YACpDW,OAAOD,EAAE,OAAO,CAAC,QAAQ;gBAAE,WAAW;oBAAE,IAAI;gBAAa;YAAE,IAAI,IAAI,CAAC;QACxE;QAEAD,GAAG,qDAAqD;YACpD,MAAMC,IAAIV,QAAQ;gBAAC;oBAAE,MAAM;oBAAa,KAAK;gBAAK;aAAE;YACpDW,OAAOD,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC;QACnC;QAEAD,GAAG,oDAAoD;YACnD,MAAMC,IAAIV,QAAQ;gBAAC;oBAAE,MAAM;oBAAa,KAAK;gBAAK;aAAE;YACpDW,OAAOD,EAAE,SAAS,CAAC,QAAQ;gBAAE,WAAW;oBAAE,IAAI;gBAAa;YAAE,IAAI,IAAI,CAAC;QAC1E;IACJ;AACJ"}

package/permissions/index.js

@@ -1,9 +1,7 @@
 export { createPermissionSchema } from "./createPermissionSchema.js";
 export { createPermissionsAbstraction, createPermissionsFeature } from "./createPermissions.js";
 export { createUsePermissions } from "./usePermissions.js";
-export { usePermissionForm, deserializePermissions, serializePermissions } from "./usePermissionForm.js";
+export { deserializePermissions, serializePermissions, usePermissionForm } from "./usePermissionForm.js";
 export { PermissionRenderer } from "./PermissionRenderer.js";
-export { usePermissionValue, PermissionValueProvider } from "./PermissionValueContext.js";
+export { PermissionValueProvider, usePermissionValue } from "./PermissionValueContext.js";
 export { createHasPermission } from "./createHasPermission.js";
-
-//# sourceMappingURL=index.js.map

package/permissions/types.js

@@ -1,3 +0,0 @@
-export {};
-
-//# sourceMappingURL=types.js.map