@ahksolution/permissions-sdk 1.0.0

package/dist/types/permission.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.types.js","sourceRoot":"","sources":["../../src/types/permission.types.ts"],"names":[],"mappings":";;;AA4CA;;GAEG;AACU,QAAA,wBAAwB,GAAG,sBAAsB,CAAC"}

package/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "@ahksolution/permissions-sdk",
+  "version": "1.0.0",
+  "description": "gRPC client SDK for AHK Solution Permissions Microservice - provides NestJS guard, decorators, and client for inter-service permission checks",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist",
+    "src/proto"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && npm run copy:proto",
+    "copy:proto": "node -e \"const fs=require('fs');const path=require('path');fs.mkdirSync('dist/proto',{recursive:true});fs.copyFileSync('src/proto/permissions.proto','dist/proto/permissions.proto');\"",
+    "clean": "rimraf dist",
+    "prebuild": "npm run clean",
+    "prepublishOnly": "npm run build",
+    "lint": "eslint \"src/**/*.ts\"",
+    "lint:fix": "eslint \"src/**/*.ts\" --fix"
+  },
+  "keywords": [
+    "permissions",
+    "rbac",
+    "abac",
+    "grpc",
+    "nestjs",
+    "microservice",
+    "authorization"
+  ],
+  "author": "AHK",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/ahksolution/permissions-sdk"
+  },
+  "peerDependencies": {
+    "@nestjs/common": "^11.0.0",
+    "@nestjs/core": "^11.0.0",
+    "@nestjs/microservices": "^11.0.0",
+    "@grpc/grpc-js": "^1.12.0",
+    "@grpc/proto-loader": "^0.7.0",
+    "rxjs": "^7.0.0"
+  },
+  "devDependencies": {
+    "@nestjs/common": "^11.0.1",
+    "@nestjs/core": "^11.0.1",
+    "@nestjs/microservices": "^11.0.1",
+    "@grpc/grpc-js": "^1.12.5",
+    "@grpc/proto-loader": "^0.7.13",
+    "@types/node": "^22.10.7",
+    "rimraf": "^6.1.2",
+    "rxjs": "^7.8.1",
+    "typescript": "^5.7.3"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  }
+}

package/src/proto/permissions.proto

@@ -0,0 +1,150 @@
+syntax = "proto3";
+
+package permissions;
+
+/**
+ * Permissions Service
+ * Provides gRPC endpoints for permission evaluation in a microservice architecture.
+ * Supports RBAC (Role-Based Access Control) and ABAC (Attribute-Based Access Control).
+ */
+service PermissionsService {
+  /**
+   * Check a single permission for a user with optional ABAC context
+   */
+  rpc CheckPermission(CheckPermissionRequest) returns (CheckPermissionResponse);
+
+  /**
+   * Check multiple permissions at once for efficiency
+   */
+  rpc CheckBulkPermissions(CheckBulkPermissionsRequest) returns (CheckBulkPermissionsResponse);
+
+  /**
+   * Get all effective permissions for a user (computed from roles + custom assignments)
+   */
+  rpc GetEffectivePermissions(GetEffectivePermissionsRequest) returns (GetEffectivePermissionsResponse);
+
+  /**
+   * Simple boolean check - does user have this permission?
+   */
+  rpc HasPermission(HasPermissionRequest) returns (HasPermissionResponse);
+
+  /**
+   * Check if user has ALL of the specified permissions
+   */
+  rpc HasAllPermissions(HasMultiplePermissionsRequest) returns (HasPermissionResponse);
+
+  /**
+   * Check if user has ANY of the specified permissions
+   */
+  rpc HasAnyPermission(HasMultiplePermissionsRequest) returns (HasPermissionResponse);
+}
+
+// ============================================================================
+// Request Messages
+// ============================================================================
+
+message CheckPermissionRequest {
+  string user_id = 1;
+  string permission_code = 2;
+  optional ResourceContext resource_context = 3;
+  optional RequestContext request_context = 4;
+}
+
+message CheckBulkPermissionsRequest {
+  string user_id = 1;
+  repeated string permission_codes = 2;
+  optional ResourceContext resource_context = 3;
+  optional RequestContext request_context = 4;
+}
+
+message GetEffectivePermissionsRequest {
+  string user_id = 1;
+}
+
+message HasPermissionRequest {
+  string user_id = 1;
+  string permission_code = 2;
+}
+
+message HasMultiplePermissionsRequest {
+  string user_id = 1;
+  repeated string permission_codes = 2;
+}
+
+// ============================================================================
+// Response Messages
+// ============================================================================
+
+message CheckPermissionResponse {
+  bool allowed = 1;
+  EvaluationSource source = 2;
+  repeated string matched_roles = 3;
+  repeated string matched_policies = 4;
+  string reason = 5;
+  int32 evaluation_time_ms = 6;
+}
+
+message CheckBulkPermissionsResponse {
+  map<string, CheckPermissionResponse> results = 1;
+  int32 total_time_ms = 2;
+}
+
+message GetEffectivePermissionsResponse {
+  repeated string permissions = 1;
+  repeated RoleInfo roles = 2;
+  int32 version = 3;
+  string computed_at = 4;
+}
+
+message HasPermissionResponse {
+  bool has_permission = 1;
+}
+
+// ============================================================================
+// Shared Types
+// ============================================================================
+
+/**
+ * Source of the permission decision
+ */
+enum EvaluationSource {
+  EVALUATION_SOURCE_UNSPECIFIED = 0;
+  EVALUATION_SOURCE_RBAC = 1;
+  EVALUATION_SOURCE_ABAC = 2;
+  EVALUATION_SOURCE_BREAK_GLASS = 3;
+  EVALUATION_SOURCE_DENIED = 4;
+}
+
+/**
+ * Role information
+ */
+message RoleInfo {
+  string id = 1;
+  string code = 2;
+  string name = 3;
+  bool is_system = 4;
+}
+
+/**
+ * Resource context for ABAC evaluation
+ * Contains attributes about the resource being accessed
+ */
+message ResourceContext {
+  optional string id = 1;
+  optional string type = 2;
+  optional string owner_id = 3;
+  optional string department = 4;
+  map<string, string> attributes = 5;
+}
+
+/**
+ * Request context for ABAC evaluation
+ * Contains attributes about the request itself
+ */
+message RequestContext {
+  optional string ip = 1;
+  optional string user_agent = 2;
+  optional string method = 3;
+  optional string path = 4;
+  map<string, string> attributes = 5;
+}