@whatworks/payload-rbac 0.1.0

package/dist/utilities/entityLabel.js

@@ -0,0 +1,17 @@
+//#region src/utilities/entityLabel.ts
+/** Humanizes a slug, e.g. `'site-settings'` → `'Site Settings'`. */
+const humanizeSlug = (slug) => {
+	return slug.split(/[-_]+/).filter(Boolean).map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
+};
+/**
+* Resolves a display label for a collection or global at plugin time. Matrix rows
+* cross to the client as serialized props, so only plain-string labels can be used —
+* localized objects and label functions fall back to the humanized slug.
+*/
+const entityLabel = (label, slug) => {
+	return typeof label === "string" && label.trim() !== "" ? label : humanizeSlug(slug);
+};
+
+//#endregion
+export { entityLabel };
+//# sourceMappingURL=entityLabel.js.map

package/dist/utilities/entityLabel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entityLabel.js","names":[],"sources":["../../src/utilities/entityLabel.ts"],"sourcesContent":["/** Humanizes a slug, e.g. `'site-settings'` → `'Site Settings'`. */\nconst humanizeSlug = (slug: string): string => {\n  return slug\n    .split(/[-_]+/)\n    .filter(Boolean)\n    .map((word) => word.charAt(0).toUpperCase() + word.slice(1))\n    .join(' ')\n}\n\n/**\n * Resolves a display label for a collection or global at plugin time. Matrix rows\n * cross to the client as serialized props, so only plain-string labels can be used —\n * localized objects and label functions fall back to the humanized slug.\n */\nexport const entityLabel = (label: unknown, slug: string): string => {\n  return typeof label === 'string' && label.trim() !== '' ? label : humanizeSlug(slug)\n}\n"],"mappings":";;AACA,MAAM,gBAAgB,SAAyB;AAC7C,QAAO,KACJ,MAAM,QAAQ,CACd,OAAO,QAAQ,CACf,KAAK,SAAS,KAAK,OAAO,EAAE,CAAC,aAAa,GAAG,KAAK,MAAM,EAAE,CAAC,CAC3D,KAAK,IAAI;;;;;;;AAQd,MAAa,eAAe,OAAgB,SAAyB;AACnE,QAAO,OAAO,UAAU,YAAY,MAAM,MAAM,KAAK,KAAK,QAAQ,aAAa,KAAK"}

package/dist/utilities/fullAccessHolders.d.ts

@@ -0,0 +1,36 @@
+import { Payload } from "payload";
+
+//#region src/utilities/fullAccessHolders.d.ts
+type RoleHolderQueryArgs = {
+  rolesFieldName: string;
+  /** Every collection carrying the roles field — holders are counted across all of them. */
+  userCollections: string[];
+};
+/** IDs of every role that grants full access (`'*'`). */
+declare const findFullAccessRoleIds: (payload: Payload, rolesCollectionSlug: string) => Promise<(number | string)[]>;
+/** Whether any user across the user collections holds one of the given roles. */
+declare const anyUserHoldsRole: (payload: Payload, roleIds: (number | string)[], {
+  rolesFieldName,
+  userCollections
+}: RoleHolderQueryArgs) => Promise<boolean>;
+type WarnIfAdminRoleUnheldArgs = {
+  adminRoleName: string;
+  rolesCollectionSlug: string;
+} & RoleHolderQueryArgs;
+/**
+ * Init-time check, run after seeding: logs how to recover when no user holds the
+ * admin role. The guards prevent reaching this state through the API; it arises
+ * from what they cannot see — the roles collection wiped at the database level
+ * (re-seeded roles get new IDs, so users' role references dangle) or a renamed
+ * `adminRole` (a fresh role seeded under the new name with no holders). Silent
+ * when there are no users at all: the first-user bootstrap covers that.
+ */
+declare const warnIfAdminRoleUnheld: (payload: Payload, {
+  adminRoleName,
+  rolesCollectionSlug,
+  rolesFieldName,
+  userCollections
+}: WarnIfAdminRoleUnheldArgs) => Promise<void>;
+//#endregion
+export { RoleHolderQueryArgs, WarnIfAdminRoleUnheldArgs, anyUserHoldsRole, findFullAccessRoleIds, warnIfAdminRoleUnheld };
+//# sourceMappingURL=fullAccessHolders.d.ts.map

package/dist/utilities/fullAccessHolders.js

@@ -0,0 +1,68 @@
+import { FULL_ACCESS } from "../permissions.js";
+
+//#region src/utilities/fullAccessHolders.ts
+/** IDs of every role that grants full access (`'*'`). */
+const findFullAccessRoleIds = async (payload, rolesCollectionSlug) => {
+	const { docs } = await payload.find({
+		collection: rolesCollectionSlug,
+		depth: 0,
+		pagination: false
+	});
+	return docs.filter((doc) => {
+		const permissions = doc.permissions;
+		return Array.isArray(permissions) && permissions.includes(FULL_ACCESS);
+	}).map((doc) => doc.id);
+};
+/** Whether any user across the user collections holds one of the given roles. */
+const anyUserHoldsRole = async (payload, roleIds, { rolesFieldName, userCollections }) => {
+	if (roleIds.length === 0) return false;
+	for (const slug of userCollections) {
+		const { totalDocs } = await payload.count({
+			collection: slug,
+			where: { [rolesFieldName]: { in: roleIds } }
+		});
+		if (totalDocs > 0) return true;
+	}
+	return false;
+};
+/**
+* Init-time check, run after seeding: logs how to recover when no user holds the
+* admin role. The guards prevent reaching this state through the API; it arises
+* from what they cannot see — the roles collection wiped at the database level
+* (re-seeded roles get new IDs, so users' role references dangle) or a renamed
+* `adminRole` (a fresh role seeded under the new name with no holders). Silent
+* when there are no users at all: the first-user bootstrap covers that.
+*/
+const warnIfAdminRoleUnheld = async (payload, { adminRoleName, rolesCollectionSlug, rolesFieldName, userCollections }) => {
+	const { docs } = await payload.find({
+		collection: rolesCollectionSlug,
+		depth: 0,
+		limit: 1,
+		where: { name: { equals: adminRoleName } }
+	});
+	const adminRoleId = docs[0]?.id;
+	if (adminRoleId === void 0) return;
+	const holderArgs = {
+		rolesFieldName,
+		userCollections
+	};
+	if (await anyUserHoldsRole(payload, [adminRoleId], holderArgs)) return;
+	let usersExist = false;
+	for (const slug of userCollections) {
+		const { totalDocs } = await payload.count({ collection: slug });
+		if (totalDocs > 0) {
+			usersExist = true;
+			break;
+		}
+	}
+	if (!usersExist) return;
+	if (await anyUserHoldsRole(payload, (await findFullAccessRoleIds(payload, rolesCollectionSlug)).filter((id) => String(id) !== String(adminRoleId)), holderArgs)) {
+		payload.logger.warn(`[payload-rbac] No user holds the "${adminRoleName}" role. A user with full access through another role can assign it in the admin panel.`);
+		return;
+	}
+	payload.logger.warn(`[payload-rbac] No user holds the "${adminRoleName}" role and no user has full access. Any signed-in user may assign "${adminRoleName}" to themselves from their account page — the escalation guard permits this while no administrator exists.`);
+};
+
+//#endregion
+export { anyUserHoldsRole, findFullAccessRoleIds, warnIfAdminRoleUnheld };
+//# sourceMappingURL=fullAccessHolders.js.map

package/dist/utilities/fullAccessHolders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fullAccessHolders.js","names":[],"sources":["../../src/utilities/fullAccessHolders.ts"],"sourcesContent":["import type { Payload } from 'payload'\n\nimport { FULL_ACCESS } from '../permissions.js'\n\nexport type RoleHolderQueryArgs = {\n  rolesFieldName: string\n  /** Every collection carrying the roles field — holders are counted across all of them. */\n  userCollections: string[]\n}\n\n/** IDs of every role that grants full access (`'*'`). */\nexport const findFullAccessRoleIds = async (\n  payload: Payload,\n  rolesCollectionSlug: string,\n): Promise<(number | string)[]> => {\n  const { docs } = await payload.find({\n    collection: rolesCollectionSlug,\n    depth: 0,\n    pagination: false,\n  })\n  return docs\n    .filter((doc) => {\n      const permissions = (doc as { permissions?: unknown }).permissions\n      return Array.isArray(permissions) && permissions.includes(FULL_ACCESS)\n    })\n    .map((doc) => (doc as { id: number | string }).id)\n}\n\n/** Whether any user across the user collections holds one of the given roles. */\nexport const anyUserHoldsRole = async (\n  payload: Payload,\n  roleIds: (number | string)[],\n  { rolesFieldName, userCollections }: RoleHolderQueryArgs,\n): Promise<boolean> => {\n  if (roleIds.length === 0) {\n    return false\n  }\n  for (const slug of userCollections) {\n    const { totalDocs } = await payload.count({\n      collection: slug,\n      where: { [rolesFieldName]: { in: roleIds } },\n    })\n    if (totalDocs > 0) {\n      return true\n    }\n  }\n  return false\n}\n\nexport type WarnIfAdminRoleUnheldArgs = {\n  adminRoleName: string\n  rolesCollectionSlug: string\n} & RoleHolderQueryArgs\n\n/**\n * Init-time check, run after seeding: logs how to recover when no user holds the\n * admin role. The guards prevent reaching this state through the API; it arises\n * from what they cannot see — the roles collection wiped at the database level\n * (re-seeded roles get new IDs, so users' role references dangle) or a renamed\n * `adminRole` (a fresh role seeded under the new name with no holders). Silent\n * when there are no users at all: the first-user bootstrap covers that.\n */\nexport const warnIfAdminRoleUnheld = async (\n  payload: Payload,\n  {\n    adminRoleName,\n    rolesCollectionSlug,\n    rolesFieldName,\n    userCollections,\n  }: WarnIfAdminRoleUnheldArgs,\n): Promise<void> => {\n  const { docs } = await payload.find({\n    collection: rolesCollectionSlug,\n    depth: 0,\n    limit: 1,\n    where: { name: { equals: adminRoleName } },\n  })\n  const adminRoleId = (docs[0] as { id?: number | string } | undefined)?.id\n  if (adminRoleId === undefined) {\n    return\n  }\n\n  const holderArgs = { rolesFieldName, userCollections }\n  if (await anyUserHoldsRole(payload, [adminRoleId], holderArgs)) {\n    return\n  }\n\n  let usersExist = false\n  for (const slug of userCollections) {\n    const { totalDocs } = await payload.count({ collection: slug })\n    if (totalDocs > 0) {\n      usersExist = true\n      break\n    }\n  }\n  if (!usersExist) {\n    return\n  }\n\n  const fullAccessRoleIds = await findFullAccessRoleIds(payload, rolesCollectionSlug)\n  const otherFullAccessRoleIds = fullAccessRoleIds.filter(\n    (id) => String(id) !== String(adminRoleId),\n  )\n  if (await anyUserHoldsRole(payload, otherFullAccessRoleIds, holderArgs)) {\n    payload.logger.warn(\n      `[payload-rbac] No user holds the \"${adminRoleName}\" role. A user with full access through another role can assign it in the admin panel.`,\n    )\n    return\n  }\n  payload.logger.warn(\n    `[payload-rbac] No user holds the \"${adminRoleName}\" role and no user has full access. Any signed-in user may assign \"${adminRoleName}\" to themselves from their account page — the escalation guard permits this while no administrator exists.`,\n  )\n}\n"],"mappings":";;;;AAWA,MAAa,wBAAwB,OACnC,SACA,wBACiC;CACjC,MAAM,EAAE,SAAS,MAAM,QAAQ,KAAK;EAClC,YAAY;EACZ,OAAO;EACP,YAAY;EACb,CAAC;AACF,QAAO,KACJ,QAAQ,QAAQ;EACf,MAAM,cAAe,IAAkC;AACvD,SAAO,MAAM,QAAQ,YAAY,IAAI,YAAY,SAAS,YAAY;GACtE,CACD,KAAK,QAAS,IAAgC,GAAG;;;AAItD,MAAa,mBAAmB,OAC9B,SACA,SACA,EAAE,gBAAgB,sBACG;AACrB,KAAI,QAAQ,WAAW,EACrB,QAAO;AAET,MAAK,MAAM,QAAQ,iBAAiB;EAClC,MAAM,EAAE,cAAc,MAAM,QAAQ,MAAM;GACxC,YAAY;GACZ,OAAO,GAAG,iBAAiB,EAAE,IAAI,SAAS,EAAE;GAC7C,CAAC;AACF,MAAI,YAAY,EACd,QAAO;;AAGX,QAAO;;;;;;;;;;AAgBT,MAAa,wBAAwB,OACnC,SACA,EACE,eACA,qBACA,gBACA,sBAEgB;CAClB,MAAM,EAAE,SAAS,MAAM,QAAQ,KAAK;EAClC,YAAY;EACZ,OAAO;EACP,OAAO;EACP,OAAO,EAAE,MAAM,EAAE,QAAQ,eAAe,EAAE;EAC3C,CAAC;CACF,MAAM,cAAe,KAAK,IAA6C;AACvE,KAAI,gBAAgB,OAClB;CAGF,MAAM,aAAa;EAAE;EAAgB;EAAiB;AACtD,KAAI,MAAM,iBAAiB,SAAS,CAAC,YAAY,EAAE,WAAW,CAC5D;CAGF,IAAI,aAAa;AACjB,MAAK,MAAM,QAAQ,iBAAiB;EAClC,MAAM,EAAE,cAAc,MAAM,QAAQ,MAAM,EAAE,YAAY,MAAM,CAAC;AAC/D,MAAI,YAAY,GAAG;AACjB,gBAAa;AACb;;;AAGJ,KAAI,CAAC,WACH;AAOF,KAAI,MAAM,iBAAiB,UAJD,MAAM,sBAAsB,SAAS,oBAAoB,EAClC,QAC9C,OAAO,OAAO,GAAG,KAAK,OAAO,YAAY,CAC3C,EAC2D,WAAW,EAAE;AACvE,UAAQ,OAAO,KACb,qCAAqC,cAAc,wFACpD;AACD;;AAEF,SAAQ,OAAO,KACb,qCAAqC,cAAc,qEAAqE,cAAc,4GACvI"}

package/dist/utilities/getUserPermissions.d.ts

@@ -0,0 +1,17 @@
+import { PayloadRequest } from "payload";
+
+//#region src/utilities/getUserPermissions.d.ts
+
+/**
+ * Resolves the union of permission strings granted by the requesting user's roles.
+ * Memoized per request; returns an empty set for unauthenticated requests.
+ */
+declare const getUserPermissions: (req: PayloadRequest) => Promise<ReadonlySet<string>>;
+/**
+ * Whether the requesting user holds a permission (or `'*'`), e.g.
+ * `await hasPermission(req, 'posts:update')`.
+ */
+declare const hasPermission: (req: PayloadRequest, permission: string) => Promise<boolean>;
+//#endregion
+export { getUserPermissions, hasPermission };
+//# sourceMappingURL=getUserPermissions.d.ts.map

package/dist/utilities/getUserPermissions.js

@@ -0,0 +1,72 @@
+import { FULL_ACCESS } from "../permissions.js";
+import { getRbacCustomConfig } from "../shared.js";
+
+//#region src/utilities/getUserPermissions.ts
+const emptySet = /* @__PURE__ */ new Set();
+/**
+* Access functions run once per collection and operation when the admin panel
+* computes permissions, so the resolved set is memoized per request. Roles
+* referenced by ID cost at most one indexed find per request.
+*/
+const requestCache = /* @__PURE__ */ new WeakMap();
+const normalizeRoleValue = (entry) => {
+	if (typeof entry === "number" || typeof entry === "string") return { id: entry };
+	if (entry && typeof entry === "object") {
+		const doc = entry;
+		if (Array.isArray(doc.permissions)) return { permissions: doc.permissions.filter((p) => typeof p === "string") };
+		if (typeof doc.id === "number" || typeof doc.id === "string") return { id: doc.id };
+	}
+	return null;
+};
+const resolvePermissions = async (req) => {
+	const custom = getRbacCustomConfig(req.payload.config);
+	if (!custom || !req.user) return emptySet;
+	const value = req.user[custom.rolesFieldName];
+	if (!Array.isArray(value) || value.length === 0) return emptySet;
+	const permissions = /* @__PURE__ */ new Set();
+	const idsToFetch = [];
+	for (const entry of value) {
+		const normalized = normalizeRoleValue(entry);
+		if (!normalized) continue;
+		if ("permissions" in normalized) for (const permission of normalized.permissions) permissions.add(permission);
+		else idsToFetch.push(normalized.id);
+	}
+	if (idsToFetch.length > 0) {
+		const { docs } = await req.payload.find({
+			collection: custom.rolesCollectionSlug,
+			depth: 0,
+			overrideAccess: true,
+			pagination: false,
+			req,
+			where: { id: { in: idsToFetch } }
+		});
+		for (const doc of docs) if (Array.isArray(doc.permissions)) {
+			for (const permission of doc.permissions) if (typeof permission === "string") permissions.add(permission);
+		}
+	}
+	return permissions;
+};
+/**
+* Resolves the union of permission strings granted by the requesting user's roles.
+* Memoized per request; returns an empty set for unauthenticated requests.
+*/
+const getUserPermissions = (req) => {
+	if (!req.user) return Promise.resolve(emptySet);
+	const cached = requestCache.get(req);
+	if (cached) return cached;
+	const resolved = resolvePermissions(req);
+	requestCache.set(req, resolved);
+	return resolved;
+};
+/**
+* Whether the requesting user holds a permission (or `'*'`), e.g.
+* `await hasPermission(req, 'posts:update')`.
+*/
+const hasPermission = async (req, permission) => {
+	const permissions = await getUserPermissions(req);
+	return permissions.has(FULL_ACCESS) || permissions.has(permission);
+};
+
+//#endregion
+export { getUserPermissions, hasPermission };
+//# sourceMappingURL=getUserPermissions.js.map

package/dist/utilities/getUserPermissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getUserPermissions.js","names":["emptySet: ReadonlySet<string>","idsToFetch: (number | string)[]"],"sources":["../../src/utilities/getUserPermissions.ts"],"sourcesContent":["import type { PayloadRequest } from 'payload'\n\nimport { FULL_ACCESS } from '../permissions.js'\nimport { getRbacCustomConfig } from '../shared.js'\n\nconst emptySet: ReadonlySet<string> = new Set()\n\n/**\n * Access functions run once per collection and operation when the admin panel\n * computes permissions, so the resolved set is memoized per request. Roles\n * referenced by ID cost at most one indexed find per request.\n */\nconst requestCache = new WeakMap<PayloadRequest, Promise<ReadonlySet<string>>>()\n\nconst normalizeRoleValue = (\n  entry: unknown,\n): { id: number | string } | { permissions: string[] } | null => {\n  if (typeof entry === 'number' || typeof entry === 'string') {\n    return { id: entry }\n  }\n  if (entry && typeof entry === 'object') {\n    const doc = entry as Record<string, unknown>\n    if (Array.isArray(doc.permissions)) {\n      return { permissions: doc.permissions.filter((p): p is string => typeof p === 'string') }\n    }\n    if (typeof doc.id === 'number' || typeof doc.id === 'string') {\n      return { id: doc.id }\n    }\n  }\n  return null\n}\n\nconst resolvePermissions = async (req: PayloadRequest): Promise<ReadonlySet<string>> => {\n  const custom = getRbacCustomConfig(req.payload.config)\n  if (!custom || !req.user) {\n    return emptySet\n  }\n\n  const value = (req.user as Record<string, unknown>)[custom.rolesFieldName]\n  if (!Array.isArray(value) || value.length === 0) {\n    return emptySet\n  }\n\n  const permissions = new Set<string>()\n  const idsToFetch: (number | string)[] = []\n\n  // `req.user` carries role IDs at the default auth depth 0, or populated role\n  // documents at depth > 0 — use in-document permissions when present.\n  for (const entry of value) {\n    const normalized = normalizeRoleValue(entry)\n    if (!normalized) {\n      continue\n    }\n    if ('permissions' in normalized) {\n      for (const permission of normalized.permissions) {\n        permissions.add(permission)\n      }\n    } else {\n      idsToFetch.push(normalized.id)\n    }\n  }\n\n  if (idsToFetch.length > 0) {\n    // System read: a user's permissions must resolve even when they cannot read\n    // the roles collection themselves.\n    const { docs } = await req.payload.find({\n      collection: custom.rolesCollectionSlug,\n      depth: 0,\n      overrideAccess: true,\n      pagination: false,\n      req,\n      where: { id: { in: idsToFetch } },\n    })\n    for (const doc of docs) {\n      if (Array.isArray(doc.permissions)) {\n        for (const permission of doc.permissions) {\n          if (typeof permission === 'string') {\n            permissions.add(permission)\n          }\n        }\n      }\n    }\n  }\n\n  return permissions\n}\n\n/**\n * Resolves the union of permission strings granted by the requesting user's roles.\n * Memoized per request; returns an empty set for unauthenticated requests.\n */\nexport const getUserPermissions = (req: PayloadRequest): Promise<ReadonlySet<string>> => {\n  if (!req.user) {\n    return Promise.resolve(emptySet)\n  }\n  const cached = requestCache.get(req)\n  if (cached) {\n    return cached\n  }\n  const resolved = resolvePermissions(req)\n  requestCache.set(req, resolved)\n  return resolved\n}\n\n/**\n * Whether the requesting user holds a permission (or `'*'`), e.g.\n * `await hasPermission(req, 'posts:update')`.\n */\nexport const hasPermission = async (req: PayloadRequest, permission: string): Promise<boolean> => {\n  const permissions = await getUserPermissions(req)\n  return permissions.has(FULL_ACCESS) || permissions.has(permission)\n}\n"],"mappings":";;;;AAKA,MAAMA,2BAAgC,IAAI,KAAK;;;;;;AAO/C,MAAM,+BAAe,IAAI,SAAuD;AAEhF,MAAM,sBACJ,UAC+D;AAC/D,KAAI,OAAO,UAAU,YAAY,OAAO,UAAU,SAChD,QAAO,EAAE,IAAI,OAAO;AAEtB,KAAI,SAAS,OAAO,UAAU,UAAU;EACtC,MAAM,MAAM;AACZ,MAAI,MAAM,QAAQ,IAAI,YAAY,CAChC,QAAO,EAAE,aAAa,IAAI,YAAY,QAAQ,MAAmB,OAAO,MAAM,SAAS,EAAE;AAE3F,MAAI,OAAO,IAAI,OAAO,YAAY,OAAO,IAAI,OAAO,SAClD,QAAO,EAAE,IAAI,IAAI,IAAI;;AAGzB,QAAO;;AAGT,MAAM,qBAAqB,OAAO,QAAsD;CACtF,MAAM,SAAS,oBAAoB,IAAI,QAAQ,OAAO;AACtD,KAAI,CAAC,UAAU,CAAC,IAAI,KAClB,QAAO;CAGT,MAAM,QAAS,IAAI,KAAiC,OAAO;AAC3D,KAAI,CAAC,MAAM,QAAQ,MAAM,IAAI,MAAM,WAAW,EAC5C,QAAO;CAGT,MAAM,8BAAc,IAAI,KAAa;CACrC,MAAMC,aAAkC,EAAE;AAI1C,MAAK,MAAM,SAAS,OAAO;EACzB,MAAM,aAAa,mBAAmB,MAAM;AAC5C,MAAI,CAAC,WACH;AAEF,MAAI,iBAAiB,WACnB,MAAK,MAAM,cAAc,WAAW,YAClC,aAAY,IAAI,WAAW;MAG7B,YAAW,KAAK,WAAW,GAAG;;AAIlC,KAAI,WAAW,SAAS,GAAG;EAGzB,MAAM,EAAE,SAAS,MAAM,IAAI,QAAQ,KAAK;GACtC,YAAY,OAAO;GACnB,OAAO;GACP,gBAAgB;GAChB,YAAY;GACZ;GACA,OAAO,EAAE,IAAI,EAAE,IAAI,YAAY,EAAE;GAClC,CAAC;AACF,OAAK,MAAM,OAAO,KAChB,KAAI,MAAM,QAAQ,IAAI,YAAY,EAChC;QAAK,MAAM,cAAc,IAAI,YAC3B,KAAI,OAAO,eAAe,SACxB,aAAY,IAAI,WAAW;;;AAOrC,QAAO;;;;;;AAOT,MAAa,sBAAsB,QAAsD;AACvF,KAAI,CAAC,IAAI,KACP,QAAO,QAAQ,QAAQ,SAAS;CAElC,MAAM,SAAS,aAAa,IAAI,IAAI;AACpC,KAAI,OACF,QAAO;CAET,MAAM,WAAW,mBAAmB,IAAI;AACxC,cAAa,IAAI,KAAK,SAAS;AAC/B,QAAO;;;;;;AAOT,MAAa,gBAAgB,OAAO,KAAqB,eAAyC;CAChG,MAAM,cAAc,MAAM,mBAAmB,IAAI;AACjD,QAAO,YAAY,IAAI,YAAY,IAAI,YAAY,IAAI,WAAW"}

package/package.json

@@ -0,0 +1,88 @@
+{
+  "name": "@whatworks/payload-rbac",
+  "version": "0.1.0",
+  "description": "Role based access control plugin for Payload. Roles live in the database with a per-collection Create/Read/Update/Delete permission matrix, can be predefined in code and seeded on init, and are enforced across all collections and globals.",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "LICENSE.md",
+    "README.md"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/what-works-global/payload-packages",
+    "directory": "packages/rbac"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./client": {
+      "types": "./dist/exports/client.d.ts",
+      "import": "./dist/exports/client.js",
+      "default": "./dist/exports/client.js"
+    }
+  },
+  "peerDependencies": {
+    "@payloadcms/ui": ">=3.27.0 <4",
+    "next": ">=15.0.0 <17",
+    "payload": ">=3.27.0 <4",
+    "react": ">=19.0.0 <20",
+    "react-dom": ">=19.0.0 <20"
+  },
+  "whatworks": {
+    "peerMatrix": {
+      "payload": {
+        "min": "3.27.0"
+      }
+    }
+  },
+  "devDependencies": {
+    "@arethetypeswrong/cli": "0.18.2",
+    "@payloadcms/db-mongodb": "3.84.1",
+    "@payloadcms/eslint-config": "3.28.0",
+    "@payloadcms/next": "3.84.1",
+    "@payloadcms/ui": "3.84.1",
+    "@types/node": "22.19.9",
+    "@types/react": "19.2.9",
+    "@types/react-dom": "19.2.3",
+    "cross-env": "7.0.3",
+    "eslint": "9.23.0",
+    "eslint-config-next": "16.2.6",
+    "next": "16.2.6",
+    "payload": "3.84.1",
+    "publint": "0.3.12",
+    "react": "19.2.1",
+    "react-dom": "19.2.1",
+    "rimraf": "6.0.1",
+    "sharp": "0.34.2",
+    "tsdown": "0.18.0",
+    "typescript": "5.7.3",
+    "vitest": "3.1.2",
+    "@whatworks/dev-fixture": "0.0.0"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "check:exports": "publint && node ../../scripts/check-package-exports.mjs",
+    "clean": "rimraf {dist,*.tsbuildinfo}",
+    "dev": "next dev dev --turbo",
+    "dev:generate-importmap": "pnpm dev:payload generate:importmap",
+    "dev:generate-types": "pnpm dev:payload generate:types",
+    "dev:payload": "cd dev && cross-env PAYLOAD_CONFIG_PATH=./payload.config.ts payload",
+    "generate:importmap": "pnpm dev:generate-importmap",
+    "generate:types": "pnpm dev:generate-types",
+    "lint": "eslint",
+    "lint:fix": "eslint --fix",
+    "test:peer": "vitest run",
+    "typecheck": "tsc --noEmit"
+  }
+}