rimecms 0.22.0

package/dist/core/collections/upload/util/path.d.ts

@@ -0,0 +1,65 @@
+import { UPLOAD_PATH } from '../../../constant.js';
+import type { CollectionSlug } from '../../../types/doc.js';
+import type { Route } from '../../../../panel/types.js';
+export type UploadPath = `${typeof UPLOAD_PATH.ROOT_NAME}${string}`;
+/**
+ * Validates that a path string follows the required format:
+ * - Must start with ROOT_NAME
+ * - Only allows alphanumeric characters, hyphens, underscores, spaces, and the separator
+ * - Can only use the defined separator
+ * @example
+ * validatePath("root:folder:subfolder") // valid
+ * validatePath("root:folder with spaces:sub-folder_name") // valid
+ * validatePath("root/folder") // throws Error
+ * validatePath("root:folder$") // throws Error
+ */
+/**
+ * Given an optional path string
+ * this returns:
+ * - the name (last part of the segment)
+ * - the parent path (path without the name)
+ * - the normalized path
+ * @example
+ * getSegments("root:foo:bar") // { name: "bar", parent: "root:foo", path: "root:foo:bar" }
+ * getSegments("root") // { name: "root", parent: null, path: "root" }
+ */
+export declare function getSegments(path?: UploadPath | null): {
+    name: string;
+    path: UploadPath;
+    parent: UploadPath | null;
+};
+/**
+ * Get the parent path for a given path
+ * or return null if path is ROOT_NAME
+ * @example
+ * // returns 'root'
+ * getParentPath('root:foo')
+ */
+export declare function getParentPath(path: UploadPath): string | null;
+/**
+ * Build an array of route based on the path param
+ * for a given collection slug.
+ * This omiting the root path wich is the collection path and do not add the path to the last
+ * @example
+ * buildUploadAria('root:foo')
+ * // return [{ title: 'foo' }]
+ * buildUploadAria('root:foo:bar')
+ * // return [{ title: 'foo', path: '/panel/{slug}?=root:foo' }, { title: 'bar' }]
+ */
+export declare function buildUploadAria({ path, slug }: {
+    path: UploadPath;
+    slug: CollectionSlug;
+}): Partial<Route>[];
+export declare function removePathFromLastAria(aria: Partial<Route>[]): Partial<Route>[];
+/**
+ * Validates that a path string follows the required format:
+ * - Must start with ROOT_NAME
+ * - Only allows alphanumeric characters, hyphens, underscores, spaces, and the separator
+ * - Can only use the defined separator
+ * @example
+ * validatePath("root:folder:subfolder") // valid
+ * validatePath("root:folder with spaces:sub-folder_name") // valid
+ * validatePath("root/folder") // invalid
+ * validatePath("root:folder$") // invalid
+ */
+export declare const validatePath: (value: unknown) => string | true;

package/dist/core/collections/upload/util/path.js

@@ -0,0 +1,138 @@
+import { PARAMS, UPLOAD_PATH } from '../../../constant.js';
+import { RimeError } from '../../../errors/index.js';
+import { panelUrl } from '../../../../panel/util/url.js';
+import { toKebabCase } from '../../../../util/string.js';
+/**
+ * Validates that a path string follows the required format:
+ * - Must start with ROOT_NAME
+ * - Only allows alphanumeric characters, hyphens, underscores, spaces, and the separator
+ * - Can only use the defined separator
+ * @example
+ * validatePath("root:folder:subfolder") // valid
+ * validatePath("root:folder with spaces:sub-folder_name") // valid
+ * validatePath("root/folder") // throws Error
+ * validatePath("root:folder$") // throws Error
+ */
+/**
+ * Given an optional path string
+ * this returns:
+ * - the name (last part of the segment)
+ * - the parent path (path without the name)
+ * - the normalized path
+ * @example
+ * getSegments("root:foo:bar") // { name: "bar", parent: "root:foo", path: "root:foo:bar" }
+ * getSegments("root") // { name: "root", parent: null, path: "root" }
+ */
+export function getSegments(path) {
+    // Use nullish coalescing to handle both undefined and null
+    const safePath = path ?? UPLOAD_PATH.ROOT_NAME;
+    // Validate and normalize the path
+    const isValid = validatePath(safePath);
+    if (typeof isValid === 'string') {
+        throw new RimeError(RimeError.BAD_REQUEST, isValid);
+    }
+    const segments = safePath
+        .split(UPLOAD_PATH.SEPARATOR)
+        .filter((s) => s !== UPLOAD_PATH.SEPARATOR)
+        .filter((s) => !!s);
+    if (segments.length <= 1) {
+        return {
+            name: UPLOAD_PATH.ROOT_NAME,
+            path: UPLOAD_PATH.ROOT_NAME,
+            parent: null
+        };
+    }
+    const name = segments[segments.length - 1];
+    // Only create parent if we have more than one segment
+    const parent = segments.length > 1 ? segments.slice(0, -1).join(UPLOAD_PATH.SEPARATOR) : null;
+    // Reconstruct the normalized path from filtered segments
+    const normalizedPath = segments.join(UPLOAD_PATH.SEPARATOR);
+    return {
+        name,
+        parent: parent,
+        path: normalizedPath
+    };
+}
+/**
+ * Get the parent path for a given path
+ * or return null if path is ROOT_NAME
+ * @example
+ * // returns 'root'
+ * getParentPath('root:foo')
+ */
+export function getParentPath(path) {
+    if (path === UPLOAD_PATH.ROOT_NAME)
+        return null;
+    return path.split(UPLOAD_PATH.SEPARATOR).slice(0, -1).join(UPLOAD_PATH.SEPARATOR);
+}
+/**
+ * Build an array of route based on the path param
+ * for a given collection slug.
+ * This omiting the root path wich is the collection path and do not add the path to the last
+ * @example
+ * buildUploadAria('root:foo')
+ * // return [{ title: 'foo' }]
+ * buildUploadAria('root:foo:bar')
+ * // return [{ title: 'foo', path: '/panel/{slug}?=root:foo' }, { title: 'bar' }]
+ */
+export function buildUploadAria({ path, slug }) {
+    const segments = path.split(':');
+    const result = [];
+    let currentPath = '';
+    for (const segment of segments) {
+        if (!segment)
+            continue;
+        currentPath = currentPath ? `${currentPath}:${segment}` : segment;
+        if (currentPath !== segments[0]) {
+            result.push({
+                title: segment,
+                url: `${panelUrl(toKebabCase(slug))}?${PARAMS.UPLOAD_PATH}=${currentPath}`
+            });
+        }
+    }
+    return result;
+}
+export function removePathFromLastAria(aria) {
+    return aria.map((route, index) => {
+        if (index === aria.length - 1) {
+            return { title: route.title };
+        }
+        return route;
+    });
+}
+/**
+ * Validates that a path string follows the required format:
+ * - Must start with ROOT_NAME
+ * - Only allows alphanumeric characters, hyphens, underscores, spaces, and the separator
+ * - Can only use the defined separator
+ * @example
+ * validatePath("root:folder:subfolder") // valid
+ * validatePath("root:folder with spaces:sub-folder_name") // valid
+ * validatePath("root/folder") // invalid
+ * validatePath("root:folder$") // invalid
+ */
+export const validatePath = (value) => {
+    if (typeof value !== 'string') {
+        return 'path should be a string';
+    }
+    // Check if path starts with ROOT_NAME
+    const STARTS_WITH_ROOT = value === UPLOAD_PATH.ROOT_NAME || value.startsWith(`${UPLOAD_PATH.ROOT_NAME}:`);
+    if (!STARTS_WITH_ROOT) {
+        return `Path must start with "${UPLOAD_PATH.ROOT_NAME}"`;
+    }
+    // Create a mutable copy for normalization
+    let normalizedPath = value;
+    // Remove trailing separator if present
+    while (normalizedPath !== UPLOAD_PATH.ROOT_NAME && normalizedPath.endsWith(UPLOAD_PATH.SEPARATOR)) {
+        normalizedPath = normalizedPath.slice(0, -1);
+    }
+    // Only allow alphanumeric characters, hyphens, underscores, spaces, and the separator
+    // The regex ensures:
+    // 1. Starts with ROOT_NAME
+    // 2. Followed by zero or more segments (each segment starts with separator followed by valid chars)
+    const validPathRegex = new RegExp(`^${UPLOAD_PATH.ROOT_NAME}(${UPLOAD_PATH.SEPARATOR}[a-zA-Z0-9\\-_ ]+)*$`);
+    if (!validPathRegex.test(normalizedPath)) {
+        return 'Path contains invalid characters. Only alphanumeric characters, hyphens, underscores, and spaces are allowed.';
+    }
+    return true;
+};

package/dist/core/collections/versions/operations.d.ts

@@ -0,0 +1,93 @@
+import type { BuiltArea, BuiltCollection } from '../../../types.js';
+/**
+ * Defines the different version operation strategies for document updates.
+ */
+export declare const VERSIONS_OPERATIONS: {
+    readonly UPDATE: "update";
+    readonly UPDATE_PUBLISHED: "update_published";
+    readonly UPDATE_VERSION: "update_version";
+    readonly NEW_VERSION_FROM_LATEST: "new_version_from_latest";
+    readonly NEW_DRAFT_FROM_PUBLISHED: "new_version_from_published";
+};
+export type VersionOperation = (typeof VERSIONS_OPERATIONS)[keyof typeof VERSIONS_OPERATIONS];
+/**
+ * Helper functions to check version operation types
+ * These make the code more readable by replacing verbose array checks with clear function calls
+ */
+export declare const VersionOperations: {
+    /**
+     * Checks if the operation creates a new version (either draft or latest)
+     * @example
+     * if (VersionOperations.isNewVersionCreation(versionOperation)) {
+     *   // Handle new version creation logic
+     * }
+     */
+    isNewVersionCreation: (operation: VersionOperation) => operation is "new_version_from_latest" | "new_version_from_published";
+    /**
+     * Checks if the operation is for updating a specific version
+     * @example
+     * if (VersionOperations.isSpecificVersionUpdate(versionOperation)) {
+     *   // Handle specific version update logic
+     * }
+     */
+    isSpecificVersionUpdate: (operation: VersionOperation) => operation is "update_published" | "update_version";
+    /**
+     * Checks if the operation requires draft status handling
+     * @example
+     * if (VersionOperations.requiresDraftHandling(versionOperation)) {
+     *   // Set draft status
+     * }
+     */
+    requiresDraftHandling: (operation: VersionOperation) => operation is "new_version_from_published";
+    /**
+     * Checks if the operation is for a non-versioned document
+     * @example
+     * if (VersionOperations.isSimpleUpdate(versionOperation)) {
+     *   // Handle simple update logic
+     * }
+     */
+    isSimpleUpdate: (operation: VersionOperation) => operation is "update";
+    /**
+     * Checks if the operation is for updating a published version
+     * @example
+     * if (VersionOperations.isPublishedUpdate(versionOperation)) {
+     *   // Handle published version update logic
+     * }
+     */
+    isPublishedUpdate: (operation: VersionOperation) => operation is "update_published";
+    /**
+     * Checks if the operation requires retrieving draft versions
+     * Used for determining which version to fetch (draft or published)
+     * @example
+     * const document = await findById({
+     *   id,
+     *   draft: VersionOperations.shouldRetrieveDraft(versionOperation)
+     * });
+     */
+    shouldRetrieveDraft: (operation: VersionOperation) => operation is "update_version" | "new_version_from_latest";
+};
+type Args = {
+    draft?: boolean;
+    versionId?: string;
+    config: BuiltArea | BuiltCollection;
+};
+/**
+ * Determines the appropriate version update operation based on configuration and parameters.
+ *
+ * @example
+ * // Determine the operation type for a document update
+ * const versionOperation = defineVersionUpdateOperation({
+ *   draft: true,
+ *   versionId: undefined,
+ *   config: documentConfig
+ * });
+ *
+ * // Use with helper functions for clearer code
+ * if (VersionOperations.isNewVersionCreation(versionOperation)) {
+ *   // Handle new version creation logic
+ * }
+ *
+ * @returns The appropriate version operation based on the context
+ */
+export declare function defineVersionUpdateOperation({ draft, versionId, config }: Args): VersionOperation;
+export {};

package/dist/core/collections/versions/operations.js

@@ -0,0 +1,117 @@
+/**
+ * Defines the different version operation strategies for document updates.
+ */
+export const VERSIONS_OPERATIONS = {
+    UPDATE: 'update',
+    UPDATE_PUBLISHED: 'update_published',
+    UPDATE_VERSION: 'update_version',
+    NEW_VERSION_FROM_LATEST: 'new_version_from_latest',
+    NEW_DRAFT_FROM_PUBLISHED: 'new_version_from_published'
+};
+/**
+ * Helper functions to check version operation types
+ * These make the code more readable by replacing verbose array checks with clear function calls
+ */
+export const VersionOperations = {
+    /**
+     * Checks if the operation creates a new version (either draft or latest)
+     * @example
+     * if (VersionOperations.isNewVersionCreation(versionOperation)) {
+     *   // Handle new version creation logic
+     * }
+     */
+    isNewVersionCreation: (operation) => {
+        return (operation === VERSIONS_OPERATIONS.NEW_DRAFT_FROM_PUBLISHED ||
+            operation === VERSIONS_OPERATIONS.NEW_VERSION_FROM_LATEST);
+    },
+    /**
+     * Checks if the operation is for updating a specific version
+     * @example
+     * if (VersionOperations.isSpecificVersionUpdate(versionOperation)) {
+     *   // Handle specific version update logic
+     * }
+     */
+    isSpecificVersionUpdate: (operation) => {
+        return (operation === VERSIONS_OPERATIONS.UPDATE_VERSION ||
+            operation === VERSIONS_OPERATIONS.UPDATE_PUBLISHED);
+    },
+    /**
+     * Checks if the operation requires draft status handling
+     * @example
+     * if (VersionOperations.requiresDraftHandling(versionOperation)) {
+     *   // Set draft status
+     * }
+     */
+    requiresDraftHandling: (operation) => {
+        return operation === VERSIONS_OPERATIONS.NEW_DRAFT_FROM_PUBLISHED;
+    },
+    /**
+     * Checks if the operation is for a non-versioned document
+     * @example
+     * if (VersionOperations.isSimpleUpdate(versionOperation)) {
+     *   // Handle simple update logic
+     * }
+     */
+    isSimpleUpdate: (operation) => {
+        return operation === VERSIONS_OPERATIONS.UPDATE;
+    },
+    /**
+     * Checks if the operation is for updating a published version
+     * @example
+     * if (VersionOperations.isPublishedUpdate(versionOperation)) {
+     *   // Handle published version update logic
+     * }
+     */
+    isPublishedUpdate: (operation) => {
+        return operation === VERSIONS_OPERATIONS.UPDATE_PUBLISHED;
+    },
+    /**
+     * Checks if the operation requires retrieving draft versions
+     * Used for determining which version to fetch (draft or published)
+     * @example
+     * const document = await findById({
+     *   id,
+     *   draft: VersionOperations.shouldRetrieveDraft(versionOperation)
+     * });
+     */
+    shouldRetrieveDraft: (operation) => {
+        return (operation === VERSIONS_OPERATIONS.UPDATE_VERSION ||
+            operation === VERSIONS_OPERATIONS.NEW_VERSION_FROM_LATEST);
+    }
+};
+/**
+ * Determines the appropriate version update operation based on configuration and parameters.
+ *
+ * @example
+ * // Determine the operation type for a document update
+ * const versionOperation = defineVersionUpdateOperation({
+ *   draft: true,
+ *   versionId: undefined,
+ *   config: documentConfig
+ * });
+ *
+ * // Use with helper functions for clearer code
+ * if (VersionOperations.isNewVersionCreation(versionOperation)) {
+ *   // Handle new version creation logic
+ * }
+ *
+ * @returns The appropriate version operation based on the context
+ */
+export function defineVersionUpdateOperation({ draft, versionId, config }) {
+    // Non-versioned documents always use simple update
+    if (!config.versions) {
+        return VERSIONS_OPERATIONS.UPDATE;
+    }
+    // If a specific version ID is provided, update that version
+    if (versionId) {
+        return VERSIONS_OPERATIONS.UPDATE_VERSION;
+    }
+    // For versioned documents without draft support, create a new version
+    if (!config.versions.draft) {
+        return VERSIONS_OPERATIONS.NEW_VERSION_FROM_LATEST;
+    }
+    // For versioned documents with draft support
+    return draft
+        ? VERSIONS_OPERATIONS.NEW_DRAFT_FROM_PUBLISHED
+        : VERSIONS_OPERATIONS.UPDATE_PUBLISHED;
+}

package/dist/core/config/auth/better-auth-hooks.d.ts

@@ -0,0 +1,4 @@
+import { type AuthMiddleware } from 'better-auth/plugins';
+/****************************************************/
+export declare const betterAuthBeforeHook: AuthMiddleware;
+export declare const betterAuthAfterHook: AuthMiddleware;

package/dist/core/config/auth/better-auth-hooks.js

@@ -0,0 +1,136 @@
+import { dev } from '$app/environment';
+import { getRequestEvent } from '$app/server';
+import { BETTER_AUTH_ROLES } from '../../collections/auth/constant.server.js';
+import { logger } from '../../logger/index.server.js';
+import { trycatch } from '../../../util/function.js';
+import { omit } from '../../../util/object.js';
+import { APIError } from 'better-auth/api';
+import { createAuthMiddleware } from 'better-auth/plugins';
+import { eq } from 'drizzle-orm';
+/****************************************************/
+/* After hooks
+/****************************************************/
+const getUserAttributes = async (ctx) => {
+    const newSession = ctx.context.newSession;
+    if (newSession) {
+        const event = getRequestEvent();
+        const user = await event.locals.rime.adapter.auth.getUserAttributes({
+            authUserId: newSession.user.id,
+            slug: newSession.user.type
+        });
+        if (!user) {
+            logger.error(`cant' find user with authUser id ${newSession.user.id} from ${newSession.user.type} collection`);
+            throw new APIError('BAD_REQUEST');
+        }
+        return ctx.json({
+            user: {
+                email: user.email,
+                name: user.name,
+                id: user.id
+            }
+        });
+    }
+};
+/**
+ * The creation of users handle from here is made for these two scenarios :
+ * - public sign-up with better-auth
+ * - create the first user via api/init
+ */
+const handleUserCreation = async (ctx) => {
+    const newSession = ctx.context.newSession;
+    if (!newSession)
+        return;
+    const event = getRequestEvent();
+    const data = ctx.body;
+    /**
+     * Handle first user creation,
+     * - set its role to admin
+     * - set isSuperAdmin to true
+     */
+    if (event.locals.isInit && dev) {
+        const { authUsers } = event.locals.rime.adapter.tables;
+        await event.locals.rime.adapter.db
+            .update(authUsers)
+            .set({
+            role: BETTER_AUTH_ROLES.ADMIN
+        })
+            .where(eq(authUsers.id, newSession.user.id));
+        // Create a placeholder user to authorize staff creation
+        event.locals.user = {
+            id: '1',
+            name: 'system',
+            email: 'admin@system.com',
+            roles: ['admin'],
+            isSuperAdmin: true
+        };
+        data.isSuperAdmin = true;
+    }
+    /**
+     * Set isAutoSignIn flag to true to auto-populate the user document
+     * after creation on event.locals.user, this tell the operation that
+     * the creation is initiate by a better-auth sign-up
+     */
+    event.locals.isAutoSignIn = true;
+    /**
+     * Create the collection document
+     */
+    const [error] = await trycatch(() => event.locals.rime
+        .collection(ctx.body.type)
+        .system(event.locals.isInit)
+        .create({
+        data: {
+            ...omit(['password', 'type'], ctx.body),
+            // explicit set roles to null if not from the init process,
+            // it will be set to the default role value
+            // better safe than wrong, this prevent the role prop to be set from
+            // outside the panel
+            roles: event.locals.isInit ? ['admin'] : null,
+            authUserId: newSession.user.id
+        }
+    }));
+    // If error clean up session/account/user created
+    // Would be great to do it with the admin plugin,
+    if (error) {
+        console.log(error);
+        logger.error(error.message);
+        ctx.context.newSession = null;
+        const { user } = newSession;
+        const event = getRequestEvent();
+        const { rime } = event.locals;
+        const sessionTable = rime.adapter.tables.authSessions;
+        const authAccountsTable = rime.adapter.tables.authAccounts;
+        const authUsersTable = rime.adapter.tables.authUsers;
+        await rime.adapter.db.delete(sessionTable).where(eq(sessionTable.userId, user.id));
+        await rime.adapter.db.delete(authAccountsTable).where(eq(authAccountsTable.userId, user.id));
+        await rime.adapter.db.delete(authUsersTable).where(eq(authUsersTable.id, user.id));
+        throw new APIError('BAD_REQUEST');
+    }
+};
+/****************************************************/
+/* Before Hooks
+/****************************************************/
+const preventPublicStaffSignUp = (ctx) => {
+    // Prevent public staff sign-up
+    const event = getRequestEvent();
+    if (ctx.body.type === 'staff' && !event.locals.user?.isStaff && !event.locals.isInit) {
+        throw new APIError('UNAUTHORIZED');
+    }
+};
+/****************************************************/
+/* exports
+/****************************************************/
+export const betterAuthBeforeHook = createAuthMiddleware(async (ctx) => {
+    if (ctx.path.startsWith('/sign-up')) {
+        preventPublicStaffSignUp(ctx);
+    }
+});
+export const betterAuthAfterHook = createAuthMiddleware(async (ctx) => {
+    // Handle sign-in
+    if (ctx.path.startsWith('/sign-in')) {
+        return await getUserAttributes(ctx);
+    }
+    // Handle sign-up
+    if (ctx.path.startsWith('/sign-up')) {
+        return await handleUserCreation(ctx);
+    }
+});

package/dist/core/config/auth/better-auth-permissions.d.ts

@@ -0,0 +1,73 @@
+export declare const accessControl: {
+    newRole<K extends "user" | "session">(statements: import("better-auth/plugins/access").Subset<K, {
+        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+        readonly session: readonly ["list", "revoke", "delete"];
+    }>): {
+        authorize<K_1 extends K>(request: K_1 extends infer T extends K_2 ? { [key in T]?: import("better-auth/plugins/access").Subset<K, {
+            readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+            readonly session: readonly ["list", "revoke", "delete"];
+        }>[key] | {
+            actions: import("better-auth/plugins/access").Subset<K, {
+                readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+                readonly session: readonly ["list", "revoke", "delete"];
+            }>[key];
+            connector: "OR" | "AND";
+        } | undefined; } : never, connector?: "OR" | "AND"): import("better-auth/plugins/access").AuthorizeResponse;
+        statements: import("better-auth/plugins/access").Subset<K, {
+            readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+            readonly session: readonly ["list", "revoke", "delete"];
+        }>;
+    };
+    statements: {
+        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+        readonly session: readonly ["list", "revoke", "delete"];
+    };
+};
+export declare const admin: {
+    authorize<K_1 extends "user" | "session">(request: K_1 extends infer T extends K ? { [key in T]?: import("better-auth/plugins/access").Subset<"user" | "session", {
+        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+        readonly session: readonly ["list", "revoke", "delete"];
+    }>[key] | {
+        actions: import("better-auth/plugins/access").Subset<"user" | "session", {
+            readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+            readonly session: readonly ["list", "revoke", "delete"];
+        }>[key];
+        connector: "OR" | "AND";
+    } | undefined; } : never, connector?: "OR" | "AND"): import("better-auth/plugins/access").AuthorizeResponse;
+    statements: import("better-auth/plugins/access").Subset<"user" | "session", {
+        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+        readonly session: readonly ["list", "revoke", "delete"];
+    }>;
+};
+export declare const staff: {
+    authorize<K_1 extends "user">(request: K_1 extends infer T extends K ? { [key in T]?: import("better-auth/plugins/access").Subset<"user", {
+        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+        readonly session: readonly ["list", "revoke", "delete"];
+    }>[key] | {
+        actions: import("better-auth/plugins/access").Subset<"user", {
+            readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+            readonly session: readonly ["list", "revoke", "delete"];
+        }>[key];
+        connector: "OR" | "AND";
+    } | undefined; } : never, connector?: "OR" | "AND"): import("better-auth/plugins/access").AuthorizeResponse;
+    statements: import("better-auth/plugins/access").Subset<"user", {
+        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+        readonly session: readonly ["list", "revoke", "delete"];
+    }>;
+};
+export declare const user: {
+    authorize<K_1 extends "user" | "session">(request: K_1 extends infer T extends K ? { [key in T]?: import("better-auth/plugins/access").Subset<"user" | "session", {
+        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+        readonly session: readonly ["list", "revoke", "delete"];
+    }>[key] | {
+        actions: import("better-auth/plugins/access").Subset<"user" | "session", {
+            readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+            readonly session: readonly ["list", "revoke", "delete"];
+        }>[key];
+        connector: "OR" | "AND";
+    } | undefined; } : never, connector?: "OR" | "AND"): import("better-auth/plugins/access").AuthorizeResponse;
+    statements: import("better-auth/plugins/access").Subset<"user" | "session", {
+        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+        readonly session: readonly ["list", "revoke", "delete"];
+    }>;
+};

package/dist/core/config/auth/better-auth-permissions.js

@@ -0,0 +1,8 @@
+import { defaultStatements, adminAc, userAc } from 'better-auth/plugins/admin/access';
+import { createAccessControl } from 'better-auth/plugins/access';
+export const accessControl = createAccessControl(defaultStatements);
+export const admin = accessControl.newRole(adminAc.statements);
+export const staff = accessControl.newRole({
+    user: ['create', 'list', 'delete']
+});
+export const user = accessControl.newRole(userAc.statements);