@albirex/platformatic-logto 1.6.4 → 1.7.1

package/lib/index.cjs

@@ -34,6 +34,7 @@ __export(index_exports, {
   deletePermissionsVersion: () => deletePermissionsVersion,
   fastifyLogto: () => import_fastify_logto2.fastifyLogto,
   findRuleForRequestUser: () => findRuleForRequestUser,
+  findScopeForRequestUser: () => findScopeForRequestUser,
   getRequestFromContext: () => getRequestFromContext,
   getRoles: () => getRoles,
   incrementPermissionsVersion: () => incrementPermissionsVersion,
@@ -133,9 +134,37 @@ function getRoles(request, roleKey, anonymousRole, isRolePath = false) {
   }
   return output;
 }
+function getScopes(request, scopesKey, anonymousRole, isScopePath = false) {
+  let output = [];
+  const user = request.user;
+  if (!user) {
+    output.push(anonymousRole);
+    return output;
+  }
+  let scopesRaw;
+  if (isScopePath) {
+    const roleKeys = scopesKey.split(".");
+    scopesRaw = user;
+    for (const key of roleKeys) {
+      scopesRaw = scopesRaw[key];
+    }
+  } else {
+    scopesRaw = user[scopesKey];
+  }
+  if (typeof scopesRaw === "string") {
+    output = scopesRaw.split(" ");
+  } else if (Array.isArray(scopesRaw)) {
+    output = scopesRaw;
+  }
+  if (output.length === 0) {
+    output.push(anonymousRole);
+  }
+  return output;
+}
 
 // src/index.ts
 var PLT_ADMIN_ROLE = "platformatic-admin";
+var PLT_ADMIN_SCOPES = "*";
 var platformaticLogto = (0, import_fastify_plugin.default)(async (app, opts) => {
   app.decorate("platformaticLogTo", {
     opts
@@ -150,107 +179,19 @@ var platformaticLogto = (0, import_fastify_plugin.default)(async (app, opts) =>
     });
     app.log.info("Redis client registered for permissions version check");
   }
-  app.register(import_fastify_logto.default, {
-    endpoint: opts.logtoBaseUrl || "https://auth.example.com",
-    appId: opts.logtoAppId || "your-app-id",
-    appSecret: opts.logtoAppSecret || "your-app-secret"
-  });
+  if (opts.roleBasedAuth) {
+    app.register(import_fastify_logto.default, {
+      endpoint: opts.roleBasedAuth.logtoBaseUrl || "https://auth.example.com",
+      appId: opts.roleBasedAuth.logtoAppId || "your-app-id",
+      appSecret: opts.roleBasedAuth.logtoAppSecret || "your-app-secret"
+    });
+  }
   await app.register(fastifyUser, opts.jwtPlugin);
+  const roleKey = opts.roleBasedAuth?.rolePath || opts.roleBasedAuth?.roleKey || "X-PLATFORMATIC-ROLE";
+  const scopesKey = opts.scopeBasedAuth.scopesPath || opts.scopeBasedAuth.scopesKey || "X-PLATFORMATIC-SCOPES";
   const adminSecret = opts.adminSecret;
-  const roleKey = opts.rolePath || opts.roleKey || "X-PLATFORMATIC-ROLE";
-  const userKey = opts.userPath || opts.userKey || "X-PLATFORMATIC-USER-ID";
-  const isRolePath = !!opts.rolePath;
+  const isRolePath = !!opts.roleBasedAuth?.rolePath;
   const anonymousRole = opts.anonymousRole || "anonymous";
-  async function composeLogToRules() {
-    const rolesResp = await app.logto.callAPI("/api/roles?type=User", "GET");
-    if (!rolesResp.ok) {
-      throw rolesResp;
-    }
-    const roles = await rolesResp.json();
-    const rules = [{
-      role: anonymousRole,
-      entities: Object.keys(app.platformatic.entities),
-      find: opts.allowAnonymous,
-      save: opts.allowAnonymous,
-      delete: opts.allowAnonymous
-    }];
-    for (const role of roles) {
-      const scopesResp = await app.logto.callAPI(`/api/roles/${role.id}/scopes`, "GET");
-      if (!scopesResp.ok) {
-        throw scopesResp;
-      }
-      const scopes = await scopesResp.json();
-      for (const scope of scopes) {
-        const roleName = role.name;
-        let [scopeAction, entity] = scope.name.split(":");
-        if (!app.platformatic.entities[entity]) {
-          app.log.debug(`Unknown entity '${entity}' in authorization rule`);
-          continue;
-        }
-        switch (scopeAction) {
-          case "create":
-            scopeAction = "save";
-            break;
-          case "read":
-            scopeAction = "find";
-            break;
-          case "update":
-            scopeAction = "updateMany";
-            break;
-        }
-        const checkExists = rules.find((r) => r.role === roleName && r.entity === entity);
-        if (checkExists) {
-          if (opts.checks) {
-            checkExists[scopeAction] = {
-              checks: {
-                userId: userKey
-              }
-            };
-          } else {
-            checkExists[scopeAction] = true;
-          }
-        } else {
-          const newRule = {
-            role: roleName,
-            entity
-          };
-          if (opts.checks) {
-            newRule[scopeAction] = {
-              checks: {
-                userId: userKey
-              }
-            };
-          } else {
-            newRule[scopeAction] = true;
-          }
-          if (opts.defaults) {
-            newRule.defaults = {
-              userId: userKey
-            };
-          }
-          rules.push(newRule);
-        }
-      }
-    }
-    const logRules = rules.reduce((prev, curr) => {
-      (prev[curr["role"]] ??= []).push(curr);
-      return prev;
-    }, {});
-    for (const key in logRules) {
-      app.log.info(`Rules set for role ${key}`);
-      for (const element of logRules[key]) {
-        const { entity, entities, role, ...other } = element;
-        app.log.info(`	${entity ?? entities.join(",")}: ${JSON.stringify(other)}`);
-      }
-    }
-    const missingEntities = Object.keys(app.platformatic.entities).filter((e) => !rules.map((r) => r.entity).includes(e));
-    if (missingEntities.length) {
-      app.log.warn(`Missing rules for entities: ${missingEntities.join(", ")}`);
-    }
-    app.log.debug("LogTo calculated rules");
-    app.log.debug(rules);
-    return rules;
-  }
   app.decorateRequest("setupDBAuthorizationUser", setupUser);
   async function setupUser() {
     await this.extractUser();
@@ -280,13 +221,112 @@ var platformaticLogto = (0, import_fastify_plugin.default)(async (app, opts) =>
       await checkPermissionsVersion(app, opts, this.user);
     }
     if (forceAdminRole) {
-      this.user = {
-        // ...request.user,
-        [roleKey]: this.headers["x-platformatic-role"] ? [this.headers["x-platformatic-role"]] : [PLT_ADMIN_ROLE]
-      };
+      if (opts.roleBasedAuth) {
+        this.user = {
+          // ...request.user,
+          [roleKey]: this.headers["x-platformatic-role"] ? [this.headers["x-platformatic-role"]] : [PLT_ADMIN_ROLE]
+        };
+      }
+      if (opts.scopeBasedAuth) {
+        this.user = {
+          // ...request.user,
+          [scopesKey]: this.headers["x-platformatic-scopes"] ? [this.headers["x-platformatic-scopes"]] : [PLT_ADMIN_SCOPES]
+        };
+      }
     }
   }
-  app.addHook("onReady", async function() {
+  async function roleBasedAuth() {
+    const userKey = opts.roleBasedAuth.userKey || opts.roleBasedAuth.userPath || "X-PLATFORMATIC-USER-ID";
+    async function composeLogToRules() {
+      const rolesResp = await app.logto.callAPI("/api/roles?type=User", "GET");
+      if (!rolesResp.ok) {
+        throw rolesResp;
+      }
+      const roles = await rolesResp.json();
+      const rules = [{
+        role: anonymousRole,
+        entities: Object.keys(app.platformatic.entities),
+        find: opts.allowAnonymous,
+        save: opts.allowAnonymous,
+        delete: opts.allowAnonymous
+      }];
+      for (const role of roles) {
+        const scopesResp = await app.logto.callAPI(`/api/roles/${role.id}/scopes`, "GET");
+        if (!scopesResp.ok) {
+          throw scopesResp;
+        }
+        const scopes = await scopesResp.json();
+        for (const scope of scopes) {
+          const roleName = role.name;
+          let [scopeAction, entity] = scope.name.split(":");
+          if (!app.platformatic.entities[entity]) {
+            app.log.debug(`Unknown entity '${entity}' in authorization rule`);
+            continue;
+          }
+          switch (scopeAction) {
+            case "create":
+              scopeAction = "save";
+              break;
+            case "read":
+              scopeAction = "find";
+              break;
+            case "update":
+              scopeAction = "updateMany";
+              break;
+          }
+          const checkExists = rules.find((r) => r.role === roleName && r.entity === entity);
+          if (checkExists) {
+            if (opts.checks) {
+              checkExists[scopeAction] = {
+                checks: {
+                  userId: userKey
+                }
+              };
+            } else {
+              checkExists[scopeAction] = true;
+            }
+          } else {
+            const newRule = {
+              role: roleName,
+              entity
+            };
+            if (opts.checks) {
+              newRule[scopeAction] = {
+                checks: {
+                  userId: userKey
+                }
+              };
+            } else {
+              newRule[scopeAction] = true;
+            }
+            if (opts.defaults) {
+              newRule.defaults = {
+                userId: userKey
+              };
+            }
+            rules.push(newRule);
+          }
+        }
+      }
+      const logRules = rules.reduce((prev, curr) => {
+        (prev[curr["role"]] ??= []).push(curr);
+        return prev;
+      }, {});
+      for (const key in logRules) {
+        app.log.info(`Rules set for role ${key}`);
+        for (const element of logRules[key]) {
+          const { entity, entities, role, ...other } = element;
+          app.log.info(`	${entity ?? entities.join(",")}: ${JSON.stringify(other)}`);
+        }
+      }
+      const missingEntities = Object.keys(app.platformatic.entities).filter((e) => !rules.map((r) => r.entity).includes(e));
+      if (missingEntities.length) {
+        app.log.warn(`Missing rules for entities: ${missingEntities.join(", ")}`);
+      }
+      app.log.debug("LogTo calculated rules");
+      app.log.debug(rules);
+      return rules;
+    }
     const logToRules = await composeLogToRules();
     app.platformaticLogTo.rules = logToRules;
     const entityRules = {};
@@ -426,6 +466,63 @@ var platformaticLogto = (0, import_fastify_plugin.default)(async (app, opts) =>
         }
       });
     }
+  }
+  async function scopeBasedAuth() {
+    for (const entityKey of Object.keys(app.platformatic.entities)) {
+      let useOriginal = function(ctx) {
+        return !ctx;
+      };
+      let userPropToFillForPublish;
+      const topicsWithoutChecks = false;
+      if (userPropToFillForPublish && topicsWithoutChecks) {
+        throw new Error(`Subscription for entity "${entityKey}" have conflictling rules across roles`);
+      }
+      app.platformatic.addEntityHooks(entityKey, {
+        async find(originalFind, { where, ctx, fields, ...restOpts } = {}) {
+          if (useOriginal(ctx)) {
+            return originalFind({ ...restOpts, where, ctx, fields });
+          }
+          await findScopeForRequestUser(ctx, entityKey, "find", scopesKey, anonymousRole, isRolePath);
+          return originalFind({ ...restOpts, where, ctx, fields });
+        },
+        async save(originalSave, { input, ctx, fields, ...restOpts }) {
+          if (useOriginal(ctx)) {
+            return originalSave({ ctx, input, fields, ...restOpts });
+          }
+          await findScopeForRequestUser(ctx, entityKey, "save", scopesKey, anonymousRole, isRolePath);
+          return originalSave({ input, ctx, fields, ...restOpts });
+        },
+        async insert(originalInsert, { inputs, ctx, fields, ...restOpts }) {
+          if (useOriginal(ctx)) {
+            return originalInsert({ inputs, ctx, fields, ...restOpts });
+          }
+          await findScopeForRequestUser(ctx, entityKey, "insert", scopesKey, anonymousRole, isRolePath);
+          return originalInsert({ inputs, ctx, fields, ...restOpts });
+        },
+        async delete(originalDelete, { where, ctx, fields, ...restOpts }) {
+          if (useOriginal(ctx)) {
+            return originalDelete({ where, ctx, fields, ...restOpts });
+          }
+          await findScopeForRequestUser(ctx, entityKey, "delete", scopesKey, anonymousRole, isRolePath);
+          return originalDelete({ where, ctx, fields, ...restOpts });
+        },
+        async updateMany(originalUpdateMany, { where, ctx, fields, ...restOpts }) {
+          if (useOriginal(ctx)) {
+            return originalUpdateMany({ ...restOpts, where, ctx, fields });
+          }
+          await findScopeForRequestUser(ctx, entityKey, "updateMany", scopesKey, anonymousRole, isRolePath);
+          return originalUpdateMany({ ...restOpts, where, ctx, fields });
+        }
+      });
+    }
+  }
+  app.addHook("onReady", async function() {
+    if (opts.roleBasedAuth) {
+      await roleBasedAuth();
+    }
+    if (opts.scopeBasedAuth) {
+      await scopeBasedAuth();
+    }
   });
 }, { name: "@albirex/platformatic-logto" });
 async function fromRuleToWhere(ctx, rule, where, user) {
@@ -470,6 +567,26 @@ async function findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRole
   ctx.reply.request.log.trace({ roles, rule }, "found rule");
   return rule;
 }
+async function findScopeForRequestUser(ctx, entityKey, action, scopesKey, anonymousRole, isScopePath = false) {
+  const request = getRequestFromContext(ctx);
+  await request.setupDBAuthorizationUser();
+  const scopes = getScopes(request, scopesKey, anonymousRole, isScopePath);
+  const scope = scopes.find((s) => {
+    if (s === PLT_ADMIN_SCOPES) {
+      return true;
+    }
+    if (action !== "find") {
+      return s === `${action}:${entityKey}`;
+    } else {
+      return s === `${action}:${entityKey}` || s === `read:${entityKey}`;
+    }
+  });
+  if (!scope) {
+    ctx.reply.request.log.warn("no scope found");
+    throw new Unauthorized();
+  }
+  ctx.reply.request.log.trace({ scopes, scope }, "found scope");
+}
 function checkFieldsFromRule(rule, fields) {
   if (!rule) {
     throw new Unauthorized();
@@ -564,6 +681,7 @@ var index_default = platformaticLogto;
   deletePermissionsVersion,
   fastifyLogto,
   findRuleForRequestUser,
+  findScopeForRequestUser,
   getRequestFromContext,
   getRoles,
   incrementPermissionsVersion,

package/lib/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/utils/find-rule.ts","../src/utils/errors.ts","../src/utils/permissions-version.ts","../src/utils/utils.ts"],"sourcesContent":["import fp from 'fastify-plugin'\nimport * as fastifyUser from 'fastify-user'\n\nimport findRule from './utils/find-rule.js'\nimport { Unauthorized, UnauthorizedField, MissingNotNullableError, PermissionsOutdated } from './utils/errors.js'\nimport fastifyLogto from '@albirex/fastify-logto';\nimport fastifyRedis from '@fastify/redis';\nimport { FastifyInstance, FastifyPluginAsync } from 'fastify'\nimport type { FastifyUserPluginOptions } from 'fastify-user';\nimport type { Entity, PlatformaticContext } from '@platformatic/sql-mapper'\n\nexport { fastifyLogto } from '@albirex/fastify-logto';\nexport { incrementPermissionsVersion, deletePermissionsVersion } from './utils/permissions-version.js';\n\nimport { getRequestFromContext, getRoles } from './utils/utils.js'\nexport { getRequestFromContext, getRoles } from './utils/utils.js'\n\nconst PLT_ADMIN_ROLE = 'platformatic-admin'\n\nexport type PlatformaticRule = {\n    role: string;\n    entity?: string;\n    entities?: string[];\n    defaults?: Record<string, string>;\n    checks?: boolean;\n    find?: boolean;\n    save?: boolean;\n    delete?: boolean;\n    [action: string]: unknown;\n};\n\nexport type RedisConfig = {\n    host?: string;\n    port?: number;\n    password?: string;\n    username?: string;\n    db?: number;\n};\n\nexport type PlatformaticLogtoAuthOptions = {\n    logtoBaseUrl?: string;\n    logtoAppId?: string;\n    logtoAppSecret?: string;\n    adminSecret?: string;\n    rolePath?: string;\n    roleKey?: string;\n    userPath?: string;\n    userKey?: string;\n    anonymousRole?: string;\n    allowAnonymous?: boolean;\n    checks?: boolean;\n    defaults?: boolean;\n    jwtPlugin: FastifyUserPluginOptions;\n    redis?: RedisConfig;\n    enableTokenVersionCheck?: boolean;\n    sessionVersionKey?: string;\n};\n\nexport const platformaticLogto: FastifyPluginAsync<PlatformaticLogtoAuthOptions> = fp(async (app: FastifyInstance, opts: PlatformaticLogtoAuthOptions) => {\n    app.decorate('platformaticLogTo', {\n        opts\n    })\n\n    // Register Redis if configured\n    if (opts.redis) {\n        await app.register(fastifyRedis, {\n            host: opts.redis.host || '127.0.0.1',\n            port: opts.redis.port || 6379,\n            password: opts.redis.password,\n            username: opts.redis.username,\n            db: opts.redis.db || 0,\n        });\n        app.log.info('Redis client registered for permissions version check');\n    }\n\n    app.register(fastifyLogto, {\n        endpoint: opts.logtoBaseUrl || 'https://auth.example.com',\n        appId: opts.logtoAppId || 'your-app-id',\n        appSecret: opts.logtoAppSecret || 'your-app-secret',\n    });\n\n    await app.register(fastifyUser as unknown as FastifyPluginAsync, opts.jwtPlugin);\n\n    const adminSecret = opts.adminSecret\n    const roleKey = opts.rolePath || opts.roleKey || 'X-PLATFORMATIC-ROLE'\n    const userKey = opts.userPath || opts.userKey || 'X-PLATFORMATIC-USER-ID'\n    const isRolePath = !!opts.rolePath // if `true` the role is intepreted as path like `user.role`\n    const anonymousRole = opts.anonymousRole || 'anonymous'\n\n    async function composeLogToRules() {\n        const rolesResp = await app.logto.callAPI('/api/roles?type=User', 'GET');\n\n        if (!rolesResp.ok) {\n            throw rolesResp;\n        }\n\n        const roles = await rolesResp.json();\n        const rules: PlatformaticRule[] = [{\n            role: anonymousRole,\n            entities: Object.keys(app.platformatic.entities),\n            find: opts.allowAnonymous,\n            save: opts.allowAnonymous,\n            delete: opts.allowAnonymous,\n        }];\n\n        for (const role of roles) {\n            const scopesResp = await app.logto.callAPI(`/api/roles/${role.id}/scopes`, 'GET');\n\n            if (!scopesResp.ok) {\n                throw scopesResp;\n            }\n\n            const scopes = await scopesResp.json();\n\n            for (const scope of scopes) {\n                const roleName = role.name;\n                // eslint-disable-next-line prefer-const\n                let [scopeAction, entity] = scope.name.split(':');\n\n                if (!app.platformatic.entities[entity]) {\n                    app.log.debug(`Unknown entity '${entity}' in authorization rule`)\n                    continue;\n                }\n\n                switch (scopeAction) {\n                    case 'create':\n                        scopeAction = 'save'\n                        break;\n                    case 'read':\n                        scopeAction = 'find'\n                        break;\n                    case 'update':\n                        scopeAction = 'updateMany'\n                        break;\n                }\n\n                const checkExists = rules.find(r => r.role === roleName && r.entity === entity);\n                if (checkExists) {\n                    if (opts.checks) {\n                        checkExists[scopeAction] = {\n                            checks: {\n                                userId: userKey\n                            }\n                        };\n                    } else {\n                        checkExists[scopeAction] = true;\n                    }\n                } else {\n                    const newRule: PlatformaticRule = {\n                        role: roleName,\n                        entity,\n                    };\n\n                    if (opts.checks) {\n                        newRule[scopeAction] = {\n                            checks: {\n                                userId: userKey\n                            }\n                        };\n                    } else {\n                        newRule[scopeAction] = true;\n                    }\n\n                    if (opts.defaults) {\n                        newRule.defaults = {\n                            userId: userKey\n                        };\n                    }\n\n                    rules.push(newRule);\n                }\n            }\n        }\n\n        const logRules = rules.reduce((prev, curr) => {\n            (prev[curr['role']] ??= []).push(curr);\n            return prev;\n        }, {})\n\n        for (const key in logRules) {\n            app.log.info(`Rules set for role ${key}`);\n\n            for (const element of logRules[key]) {\n                // eslint-disable-next-line @typescript-eslint/no-unused-vars\n                const { entity, entities, role, ...other } = element;\n                app.log.info(`\\t${entity ?? entities.join(',')}: ${JSON.stringify(other)}`);\n            }\n        }\n\n        const missingEntities = Object.keys(app.platformatic.entities).filter((e) => !rules.map((r) => r.entity).includes(e));\n\n        if (missingEntities.length) {\n            app.log.warn(`Missing rules for entities: ${missingEntities.join(', ')}`);\n        }\n\n        app.log.debug('LogTo calculated rules');\n        app.log.debug(rules);\n        return rules;\n    }\n\n    app.decorateRequest('setupDBAuthorizationUser', setupUser)\n\n    async function setupUser() {\n        // if (!adminSecret) {\n        await this.extractUser()\n        // }\n\n        let forceAdminRole = false\n        if (adminSecret && this.headers['x-platformatic-admin-secret'] === adminSecret) {\n            if (opts.jwtPlugin.jwt) {\n                forceAdminRole = true\n            } else {\n                this.log.info('admin secret is valid')\n                this.user = new Proxy(this.headers, {\n                    get: (target, key) => {\n                        let value;\n                        if (!target[key.toString()]) {\n                            const newKey = key.toString().toLowerCase()\n                            value = target[newKey]\n                        } else {\n                            value = target[key.toString()]\n                        }\n\n                        if (!value && key.toString().toLowerCase() === roleKey.toLowerCase()) {\n                            value = PLT_ADMIN_ROLE\n                        }\n                        return value\n                    },\n                })\n            }\n        } else {\n            await checkPermissionsVersion(app, opts, this.user)\n        }\n\n        if (forceAdminRole) {\n            // We replace just the role in `request.user`, all the rest is untouched\n            this.user = {\n                // ...request.user,\n                [roleKey]: this.headers['x-platformatic-role'] ? [this.headers['x-platformatic-role']] : [PLT_ADMIN_ROLE]\n            }\n        }\n    }\n\n    app.addHook('onReady', async function () {\n        const logToRules = await composeLogToRules();\n\n        app.platformaticLogTo.rules = logToRules;\n\n        // TODO validate that there is at most a rule for a given role\n        const entityRules = {};\n        for (let i = 0; i < logToRules.length; i++) {\n            const rule = logToRules[i]\n\n            let ruleEntities = null\n            if (rule.entity) {\n                ruleEntities = [rule.entity]\n            } else if (rule.entities) {\n                ruleEntities = [...rule.entities]\n            } else {\n                throw new Error(`Missing entity in authorization rule ${i}`)\n            }\n\n            for (const ruleEntity of ruleEntities) {\n                const newRule = { ...rule, entity: ruleEntity, entities: undefined }\n                if (!app.platformatic.entities[newRule.entity]) {\n                    throw new Error(`Unknown entity '${ruleEntity}' in authorization rule ${i}`)\n                }\n\n                if (!entityRules[ruleEntity]) {\n                    entityRules[ruleEntity] = []\n                }\n                entityRules[ruleEntity].push(newRule)\n            }\n        }\n\n        for (const entityKey of Object.keys(app.platformatic.entities)) {\n            const rules = entityRules[entityKey] || []\n            const type = app.platformatic.entities[entityKey]\n\n            // We have subscriptions!\n            let userPropToFillForPublish\n            const topicsWithoutChecks = false\n\n            // mqtt\n            // if (app.platformatic.mq) {\n            //     for (const rule of rules) {\n            //         const checks = rule.find?.checks\n            //         if (typeof checks !== 'object') {\n            //             topicsWithoutChecks = !!rule.find\n            //             continue\n            //         }\n            //         const keys = Object.keys(checks)\n            //         if (keys.length !== 1) {\n            //             throw new Error(`Subscription requires that the role \"${rule.role}\" has only one check in the find rule for entity \"${rule.entity}\"`)\n            //         }\n            //         const key = keys[0]\n\n            //         const val = typeof checks[key] === 'object' ? checks[key].eq : checks[key]\n            //         if (userPropToFillForPublish && userPropToFillForPublish.val !== val) {\n            //             throw new Error('Unable to configure subscriptions and authorization due to multiple check clauses in find')\n            //         }\n            //         userPropToFillForPublish = { key, val }\n            //     }\n            // }\n\n            if (userPropToFillForPublish && topicsWithoutChecks) {\n                throw new Error(`Subscription for entity \"${entityKey}\" have conflictling rules across roles`)\n            }\n\n            // MUST set this after doing the security checks on the subscriptions\n            if (adminSecret) {\n                rules.push({\n                    role: PLT_ADMIN_ROLE,\n                    find: true,\n                    save: true,\n                    delete: true,\n                    updateMany: true\n                })\n            }\n\n            // If we have `fields` in save rules, we need to check if all the not-nullable\n            // fields are specified\n            checkSaveMandatoryFieldsInRules(type, rules)\n\n            function useOriginal(ctx: PlatformaticContext) {\n                return !ctx\n            }\n\n            app.platformatic.addEntityHooks(entityKey, {\n                async find(originalFind, { where, ctx, fields, ...restOpts } = {}) {\n                    if (useOriginal(ctx)) {\n                        return originalFind({ ...restOpts, where, ctx, fields })\n                    }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n                    checkFieldsFromRule(rule.find, fields || Object.keys(app.platformatic.entities[entityKey].fields))\n                    where = await fromRuleToWhere(ctx, rule.find, where, request.user)\n\n                    return originalFind({ ...restOpts, where, ctx, fields })\n                },\n                async save(originalSave, { input, ctx, fields, ...restOpts }) {\n                    if (useOriginal(ctx)) {\n                        return originalSave({ ctx, input, fields, ...restOpts })\n                    }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n\n                    if (!rule.save) {\n                        throw new Unauthorized()\n                    }\n                    checkFieldsFromRule(rule.save, fields)\n                    checkInputFromRuleFields(rule.save, input)\n\n                    if (rule.defaults) {\n                        for (const key of Object.keys(rule.defaults)) {\n                            const defaults = rule.defaults[key]\n                            if (typeof defaults === 'function') {\n                                input[key] = await defaults({ user: request.user, ctx, input })\n                            } else {\n                                input[key] = request.user[defaults]\n                            }\n                        }\n                    }\n\n                    const hasAllPrimaryKeys = input[type.primaryKey] !== undefined;\n                    const whereConditions = {}\n                    whereConditions[type.primaryKey] = { eq: input[type.primaryKey] }\n\n                    if (hasAllPrimaryKeys) {\n                        const where = await fromRuleToWhere(ctx, rule.save, whereConditions, request.user)\n\n                        const found = await type.find({\n                            where,\n                            ctx,\n                            fields,\n                        })\n\n                        if (found.length === 0) {\n                            throw new Unauthorized()\n                        }\n\n                        return originalSave({ input, ctx, fields, ...restOpts })\n                    }\n\n                    return originalSave({ input, ctx, fields, ...restOpts })\n                },\n\n                async insert(originalInsert, { inputs, ctx, fields, ...restOpts }) {\n                    if (useOriginal(ctx)) {\n                        return originalInsert({ inputs, ctx, fields, ...restOpts })\n                    }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n\n                    if (!rule.save) {\n                        throw new Unauthorized()\n                    }\n\n                    checkFieldsFromRule(rule.save, fields)\n                    checkInputFromRuleFields(rule.save, inputs)\n\n                    /* istanbul ignore else */\n                    if (rule.defaults) {\n                        for (const input of inputs) {\n                            for (const key of Object.keys(rule.defaults)) {\n                                const defaults = rule.defaults[key]\n                                if (typeof defaults === 'function') {\n                                    input[key] = await defaults({ user: request.user, ctx, input })\n                                } else {\n                                    input[key] = request.user[defaults]\n                                }\n                            }\n                        }\n                    }\n\n                    return originalInsert({ inputs, ctx, fields, ...restOpts })\n                },\n\n                async delete(originalDelete, { where, ctx, fields, ...restOpts }) {\n                    if (useOriginal(ctx)) {\n                        return originalDelete({ where, ctx, fields, ...restOpts })\n                    }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n\n                    where = await fromRuleToWhere(ctx, rule.delete, where, request.user)\n\n                    return originalDelete({ where, ctx, fields, ...restOpts })\n                },\n\n                async updateMany(originalUpdateMany, { where, ctx, fields, ...restOpts }) {\n                    if (useOriginal(ctx)) {\n                        return originalUpdateMany({ ...restOpts, where, ctx, fields })\n                    }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n\n                    where = await fromRuleToWhere(ctx, rule.updateMany, where, request.user)\n\n                    return originalUpdateMany({ ...restOpts, where, ctx, fields })\n                },\n            })\n        }\n    })\n}, { name: '@albirex/platformatic-logto' });\n\nasync function fromRuleToWhere(ctx: PlatformaticContext, rule, where, user) {\n    if (!rule) {\n        throw new Unauthorized()\n    }\n    const request = getRequestFromContext(ctx)\n    /* istanbul ignore next */\n    where = where || {}\n\n    if (typeof rule === 'object') {\n        const { checks } = rule\n\n        /* istanbul ignore else */\n        if (checks) {\n            for (const key of Object.keys(checks)) {\n                const clauses = checks[key]\n                if (typeof clauses === 'string') {\n                    // case: \"userId\": \"X-PLATFORMATIC-USER-ID\"\n                    where[key] = {\n                        eq: request.user[clauses],\n                    }\n                } else {\n                    // case:\n                    // userId: {\n                    //   eq: 'X-PLATFORMATIC-USER-ID'\n                    // }\n                    for (const clauseKey of Object.keys(clauses)) {\n                        const clause = clauses[clauseKey]\n                        where[key] = {\n                            [clauseKey]: request.user[clause],\n                        }\n                    }\n                }\n            }\n        }\n    } else if (typeof rule === 'function') {\n        where = await rule({ user, ctx, where })\n    }\n    return where\n}\n\nexport async function findRuleForRequestUser(ctx: PlatformaticContext, rules: PlatformaticRule[], roleKey: string, anonymousRole: string, isRolePath = false) {\n    const request = getRequestFromContext(ctx)\n    await request.setupDBAuthorizationUser()\n    const roles = getRoles(request, roleKey, anonymousRole, isRolePath)\n    const rule = findRule(rules, roles)\n    if (!rule) {\n        ctx.reply.request.log.warn({ roles, rules }, 'no rule for roles')\n        throw new Unauthorized()\n    }\n    ctx.reply.request.log.trace({ roles, rule }, 'found rule')\n    return rule\n}\n\nexport function checkFieldsFromRule(rule, fields) {\n    if (!rule) {\n        throw new Unauthorized()\n    }\n    const { fields: fieldsFromRule } = rule\n    /* istanbul ignore else */\n    if (fieldsFromRule) {\n        for (const field of fields) {\n            if (!fieldsFromRule.includes(field)) {\n                throw new UnauthorizedField(field)\n            }\n        }\n    }\n}\n\nconst validateInputs = (inputs, fieldsFromRule) => {\n    for (const input of inputs) {\n        const inputFields = Object.keys(input)\n        for (const inputField of inputFields) {\n            if (!fieldsFromRule.includes(inputField)) {\n                throw new UnauthorizedField(inputField)\n            }\n        }\n    }\n}\n\nfunction checkInputFromRuleFields(rule, inputs) {\n    const { fields: fieldsFromRule } = rule\n    /* istanbul ignore else */\n    if (fieldsFromRule) {\n        if (!Array.isArray(inputs)) {\n            // save\n            validateInputs([inputs], fieldsFromRule)\n        } else {\n            // insert\n            validateInputs(inputs, fieldsFromRule)\n        }\n    }\n}\n\nfunction checkSaveMandatoryFieldsInRules(type: Entity, rules) {\n    // List of not nullable, not PKs field to validate save/insert when allowed fields are specified on the rule\n    const mandatoryFields =\n        Object.values(type.fields)\n            .filter(k => (!k.isNullable && !k.primaryKey))\n            .map(({ camelcase }) => (camelcase))\n\n    for (const rule of rules) {\n        const { entity, save } = rule\n        if (save && save.fields) {\n            const fields = save.fields\n            for (const mField of mandatoryFields) {\n                if (!fields.includes(mField)) {\n                    throw new MissingNotNullableError(mField, entity)\n                }\n            }\n        }\n    }\n}\n\n/**\n * Check the permissions version\n * @throws PermissionsOutdated if versions don't match\n */\nasync function checkPermissionsVersion(app: FastifyInstance, opts: PlatformaticLogtoAuthOptions, user = null) {\n\n    if (!opts.enableTokenVersionCheck || !opts.redis || !app.redis || !user) {\n            return;\n    }\n\n    const sessionVersionKey = opts.sessionVersionKey || 'version'\n    const tokenVersion = user?.[sessionVersionKey];\n    const userId = user?.sub;\n\n    try {\n        const redisKey = `permissions:version:${userId}`;\n        const currentVersionStr = await app.redis.get(redisKey);\n        const currentVersion = parseInt(currentVersionStr, 10);\n\n        if (currentVersionStr === null) {\n            await app.redis.set(redisKey, tokenVersion.toString());\n            app.log.debug({ userId, version: tokenVersion }, 'Initialized permissions version in Redis');\n            if (tokenVersion > 1) {\n                app.log.warn({\n                    userId,\n                    tokenVersion,\n                    currentVersion\n                }, 'Permissions version mismatch detected');\n                throw new PermissionsOutdated();            \n            }\n            return;\n        }\n\n        // Compare versions\n        if (currentVersion !== tokenVersion) {\n            app.log.warn({\n                userId,\n                tokenVersion,\n                currentVersion\n            }, 'Permissions version mismatch detected');\n            throw new PermissionsOutdated();\n        }\n\n        app.log.trace({ userId, version: tokenVersion }, 'Token version check passed');\n    } catch (error) {\n        if (error.name === 'FastifyError' && error.code === 'PLT_DB_AUTH_VERSION_OUTDATED') {\n            throw error;\n        }\n        app.log.error({ err: error, userId }, 'Error checking token version');\n    }\n}\n\nexport default platformaticLogto;\n\ndeclare module 'fastify' {\n    interface FastifyInstance {\n        platformaticLogTo: {\n            opts: PlatformaticLogtoAuthOptions,\n            rules?: PlatformaticRule[]\n        }\n    }\n}","'use strict'\n\nimport { PlatformaticRule } from '../index.js'\n\nfunction findRule(rules: PlatformaticRule[], roles: string[]) {\n  let found = null\n  for (const rule of rules) {\n    for (const role of roles) {\n      if (rule.role === role) {\n        found = rule\n        break\n      }\n    }\n    if (found) {\n      break\n    }\n  }\n  return found\n}\n\nexport default findRule\n","'use strict'\n\nimport createError from '@fastify/error'\n\nconst ERROR_PREFIX = 'PLT_DB_AUTH'\n\nexport const Unauthorized = createError(`${ERROR_PREFIX}_UNAUTHORIZED`, 'operation not allowed', 401)\nexport const UnauthorizedField = createError(`${ERROR_PREFIX}_FIELD_UNAUTHORIZED`, 'field not allowed: %s', 401)\nexport const MissingNotNullableError = createError(`${ERROR_PREFIX}_NOT_NULLABLE_MISSING`, 'missing not nullable field: \"%s\" in save rule for entity \"%s\"')\nexport const PermissionsOutdated = createError(`${ERROR_PREFIX}_VERSION_OUTDATED`, 'Verision has been updated. Please logout and login again.', 403)\n","'use strict'\n\nimport type { FastifyInstance } from 'fastify'\n\n/**\n * Increment the permissions version\n * @param app - Fastify instance with Redis client and Logto\n * @param userId - User ID\n * @returns New version number\n */\nexport async function incrementPermissionsVersion(app: FastifyInstance, userId: string): Promise<number> {\n    if (!app.logto) {\n        throw new Error('Logto client not available')\n    }\n\n    const userResp = await app.logto.callAPI(`/api/users/${userId}`, 'GET')\n    const userData = await userResp.json()\n    const existingCustomData = userData.customData || {}\n    const currentVersion = existingCustomData.sessionVersion || 0\n    const newVersion = currentVersion + 1\n\n    await app.logto.callAPI(`/api/users/${userId}`, 'PATCH', JSON.stringify({ customData: { ...existingCustomData, sessionVersion: newVersion } }))\n\n    if (app.redis) {\n        const redisKey = `permissions:version:${userId}`\n        await app.redis.set(redisKey, newVersion.toString())\n    }\n\n    return newVersion\n}\n\n/**\n * Delete the permissions version for a user\n * @param app - Fastify instance with Redis client\n * @param userId - User ID\n */\nexport async function deletePermissionsVersion(app: FastifyInstance, userId: string): Promise<void> {\n    if (!app.redis) {\n        throw new Error('Redis client not available')\n    }\n\n    const redisKey = `permissions:version:${userId}`\n    await app.redis.del(redisKey)\n}\n\n","'use strict'\n\nexport function getRequestFromContext (ctx) {\n  if (ctx && !ctx.reply) {\n    throw new Error('Missing reply in context. You should call this function with { ctx: { reply }}')\n  }\n  return ctx.reply.request\n}\n\nexport function getRoles (request, roleKey, anonymousRole, isRolePath = false) {\n  let output = []\n  const user = request.user\n  if (!user) {\n    output.push(anonymousRole)\n    return output\n  }\n\n  let rolesRaw\n  if (isRolePath) {\n    const roleKeys = roleKey.split('.')\n    rolesRaw = user\n    for (const key of roleKeys) {\n      rolesRaw = rolesRaw[key]\n    }\n  } else {\n    rolesRaw = user[roleKey]\n  }\n\n  if (typeof rolesRaw === 'string') {\n    output = rolesRaw.split(',')\n  } else if (Array.isArray(rolesRaw)) {\n    output = rolesRaw\n  }\n  if (output.length === 0) {\n    output.push(anonymousRole)\n  }\n\n  return output\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4BAAe;AACf,kBAA6B;;;ACG7B,SAAS,SAAS,OAA2B,OAAiB;AAC5D,MAAI,QAAQ;AACZ,aAAW,QAAQ,OAAO;AACxB,eAAW,QAAQ,OAAO;AACxB,UAAI,KAAK,SAAS,MAAM;AACtB,gBAAQ;AACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO;AACT;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,IAAO,oBAAQ;;;AClBf,mBAAwB;AAExB,IAAM,eAAe;AAEd,IAAM,mBAAe,aAAAA,SAAY,GAAG,YAAY,iBAAiB,yBAAyB,GAAG;AAC7F,IAAM,wBAAoB,aAAAA,SAAY,GAAG,YAAY,uBAAuB,yBAAyB,GAAG;AACxG,IAAM,8BAA0B,aAAAA,SAAY,GAAG,YAAY,yBAAyB,+DAA+D;AACnJ,IAAM,0BAAsB,aAAAA,SAAY,GAAG,YAAY,qBAAqB,6DAA6D,GAAG;;;AFJnJ,2BAAyB;AACzB,mBAAyB;AAKzB,IAAAC,wBAA6B;;;AGD7B,eAAsB,4BAA4B,KAAsB,QAAiC;AACrG,MAAI,CAAC,IAAI,OAAO;AACZ,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAChD;AAEA,QAAM,WAAW,MAAM,IAAI,MAAM,QAAQ,cAAc,MAAM,IAAI,KAAK;AACtE,QAAM,WAAW,MAAM,SAAS,KAAK;AACrC,QAAM,qBAAqB,SAAS,cAAc,CAAC;AACnD,QAAM,iBAAiB,mBAAmB,kBAAkB;AAC5D,QAAM,aAAa,iBAAiB;AAEpC,QAAM,IAAI,MAAM,QAAQ,cAAc,MAAM,IAAI,SAAS,KAAK,UAAU,EAAE,YAAY,EAAE,GAAG,oBAAoB,gBAAgB,WAAW,EAAE,CAAC,CAAC;AAE9I,MAAI,IAAI,OAAO;AACX,UAAM,WAAW,uBAAuB,MAAM;AAC9C,UAAM,IAAI,MAAM,IAAI,UAAU,WAAW,SAAS,CAAC;AAAA,EACvD;AAEA,SAAO;AACX;AAOA,eAAsB,yBAAyB,KAAsB,QAA+B;AAChG,MAAI,CAAC,IAAI,OAAO;AACZ,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAChD;AAEA,QAAM,WAAW,uBAAuB,MAAM;AAC9C,QAAM,IAAI,MAAM,IAAI,QAAQ;AAChC;;;ACzCO,SAAS,sBAAuB,KAAK;AAC1C,MAAI,OAAO,CAAC,IAAI,OAAO;AACrB,UAAM,IAAI,MAAM,gFAAgF;AAAA,EAClG;AACA,SAAO,IAAI,MAAM;AACnB;AAEO,SAAS,SAAU,SAAS,SAAS,eAAe,aAAa,OAAO;AAC7E,MAAI,SAAS,CAAC;AACd,QAAM,OAAO,QAAQ;AACrB,MAAI,CAAC,MAAM;AACT,WAAO,KAAK,aAAa;AACzB,WAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI,YAAY;AACd,UAAM,WAAW,QAAQ,MAAM,GAAG;AAClC,eAAW;AACX,eAAW,OAAO,UAAU;AAC1B,iBAAW,SAAS,GAAG;AAAA,IACzB;AAAA,EACF,OAAO;AACL,eAAW,KAAK,OAAO;AAAA,EACzB;AAEA,MAAI,OAAO,aAAa,UAAU;AAChC,aAAS,SAAS,MAAM,GAAG;AAAA,EAC7B,WAAW,MAAM,QAAQ,QAAQ,GAAG;AAClC,aAAS;AAAA,EACX;AACA,MAAI,OAAO,WAAW,GAAG;AACvB,WAAO,KAAK,aAAa;AAAA,EAC3B;AAEA,SAAO;AACT;;;AJrBA,IAAM,iBAAiB;AAyChB,IAAM,wBAAsE,sBAAAC,SAAG,OAAO,KAAsB,SAAuC;AACtJ,MAAI,SAAS,qBAAqB;AAAA,IAC9B;AAAA,EACJ,CAAC;AAGD,MAAI,KAAK,OAAO;AACZ,UAAM,IAAI,SAAS,aAAAC,SAAc;AAAA,MAC7B,MAAM,KAAK,MAAM,QAAQ;AAAA,MACzB,MAAM,KAAK,MAAM,QAAQ;AAAA,MACzB,UAAU,KAAK,MAAM;AAAA,MACrB,UAAU,KAAK,MAAM;AAAA,MACrB,IAAI,KAAK,MAAM,MAAM;AAAA,IACzB,CAAC;AACD,QAAI,IAAI,KAAK,uDAAuD;AAAA,EACxE;AAEA,MAAI,SAAS,qBAAAC,SAAc;AAAA,IACvB,UAAU,KAAK,gBAAgB;AAAA,IAC/B,OAAO,KAAK,cAAc;AAAA,IAC1B,WAAW,KAAK,kBAAkB;AAAA,EACtC,CAAC;AAED,QAAM,IAAI,SAAS,aAA8C,KAAK,SAAS;AAE/E,QAAM,cAAc,KAAK;AACzB,QAAM,UAAU,KAAK,YAAY,KAAK,WAAW;AACjD,QAAM,UAAU,KAAK,YAAY,KAAK,WAAW;AACjD,QAAM,aAAa,CAAC,CAAC,KAAK;AAC1B,QAAM,gBAAgB,KAAK,iBAAiB;AAE5C,iBAAe,oBAAoB;AAC/B,UAAM,YAAY,MAAM,IAAI,MAAM,QAAQ,wBAAwB,KAAK;AAEvE,QAAI,CAAC,UAAU,IAAI;AACf,YAAM;AAAA,IACV;AAEA,UAAM,QAAQ,MAAM,UAAU,KAAK;AACnC,UAAM,QAA4B,CAAC;AAAA,MAC/B,MAAM;AAAA,MACN,UAAU,OAAO,KAAK,IAAI,aAAa,QAAQ;AAAA,MAC/C,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,QAAQ,KAAK;AAAA,IACjB,CAAC;AAED,eAAW,QAAQ,OAAO;AACtB,YAAM,aAAa,MAAM,IAAI,MAAM,QAAQ,cAAc,KAAK,EAAE,WAAW,KAAK;AAEhF,UAAI,CAAC,WAAW,IAAI;AAChB,cAAM;AAAA,MACV;AAEA,YAAM,SAAS,MAAM,WAAW,KAAK;AAErC,iBAAW,SAAS,QAAQ;AACxB,cAAM,WAAW,KAAK;AAEtB,YAAI,CAAC,aAAa,MAAM,IAAI,MAAM,KAAK,MAAM,GAAG;AAEhD,YAAI,CAAC,IAAI,aAAa,SAAS,MAAM,GAAG;AACpC,cAAI,IAAI,MAAM,mBAAmB,MAAM,yBAAyB;AAChE;AAAA,QACJ;AAEA,gBAAQ,aAAa;AAAA,UACjB,KAAK;AACD,0BAAc;AACd;AAAA,UACJ,KAAK;AACD,0BAAc;AACd;AAAA,UACJ,KAAK;AACD,0BAAc;AACd;AAAA,QACR;AAEA,cAAM,cAAc,MAAM,KAAK,OAAK,EAAE,SAAS,YAAY,EAAE,WAAW,MAAM;AAC9E,YAAI,aAAa;AACb,cAAI,KAAK,QAAQ;AACb,wBAAY,WAAW,IAAI;AAAA,cACvB,QAAQ;AAAA,gBACJ,QAAQ;AAAA,cACZ;AAAA,YACJ;AAAA,UACJ,OAAO;AACH,wBAAY,WAAW,IAAI;AAAA,UAC/B;AAAA,QACJ,OAAO;AACH,gBAAM,UAA4B;AAAA,YAC9B,MAAM;AAAA,YACN;AAAA,UACJ;AAEA,cAAI,KAAK,QAAQ;AACb,oBAAQ,WAAW,IAAI;AAAA,cACnB,QAAQ;AAAA,gBACJ,QAAQ;AAAA,cACZ;AAAA,YACJ;AAAA,UACJ,OAAO;AACH,oBAAQ,WAAW,IAAI;AAAA,UAC3B;AAEA,cAAI,KAAK,UAAU;AACf,oBAAQ,WAAW;AAAA,cACf,QAAQ;AAAA,YACZ;AAAA,UACJ;AAEA,gBAAM,KAAK,OAAO;AAAA,QACtB;AAAA,MACJ;AAAA,IACJ;AAEA,UAAM,WAAW,MAAM,OAAO,CAAC,MAAM,SAAS;AAC1C,OAAC,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI;AACrC,aAAO;AAAA,IACX,GAAG,CAAC,CAAC;AAEL,eAAW,OAAO,UAAU;AACxB,UAAI,IAAI,KAAK,sBAAsB,GAAG,EAAE;AAExC,iBAAW,WAAW,SAAS,GAAG,GAAG;AAEjC,cAAM,EAAE,QAAQ,UAAU,MAAM,GAAG,MAAM,IAAI;AAC7C,YAAI,IAAI,KAAK,IAAK,UAAU,SAAS,KAAK,GAAG,CAAC,KAAK,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,MAC9E;AAAA,IACJ;AAEA,UAAM,kBAAkB,OAAO,KAAK,IAAI,aAAa,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAEpH,QAAI,gBAAgB,QAAQ;AACxB,UAAI,IAAI,KAAK,+BAA+B,gBAAgB,KAAK,IAAI,CAAC,EAAE;AAAA,IAC5E;AAEA,QAAI,IAAI,MAAM,wBAAwB;AACtC,QAAI,IAAI,MAAM,KAAK;AACnB,WAAO;AAAA,EACX;AAEA,MAAI,gBAAgB,4BAA4B,SAAS;AAEzD,iBAAe,YAAY;AAEvB,UAAM,KAAK,YAAY;AAGvB,QAAI,iBAAiB;AACrB,QAAI,eAAe,KAAK,QAAQ,6BAA6B,MAAM,aAAa;AAC5E,UAAI,KAAK,UAAU,KAAK;AACpB,yBAAiB;AAAA,MACrB,OAAO;AACH,aAAK,IAAI,KAAK,uBAAuB;AACrC,aAAK,OAAO,IAAI,MAAM,KAAK,SAAS;AAAA,UAChC,KAAK,CAAC,QAAQ,QAAQ;AAClB,gBAAI;AACJ,gBAAI,CAAC,OAAO,IAAI,SAAS,CAAC,GAAG;AACzB,oBAAM,SAAS,IAAI,SAAS,EAAE,YAAY;AAC1C,sBAAQ,OAAO,MAAM;AAAA,YACzB,OAAO;AACH,sBAAQ,OAAO,IAAI,SAAS,CAAC;AAAA,YACjC;AAEA,gBAAI,CAAC,SAAS,IAAI,SAAS,EAAE,YAAY,MAAM,QAAQ,YAAY,GAAG;AAClE,sBAAQ;AAAA,YACZ;AACA,mBAAO;AAAA,UACX;AAAA,QACJ,CAAC;AAAA,MACL;AAAA,IACJ,OAAO;AACH,YAAM,wBAAwB,KAAK,MAAM,KAAK,IAAI;AAAA,IACtD;AAEA,QAAI,gBAAgB;AAEhB,WAAK,OAAO;AAAA;AAAA,QAER,CAAC,OAAO,GAAG,KAAK,QAAQ,qBAAqB,IAAI,CAAC,KAAK,QAAQ,qBAAqB,CAAC,IAAI,CAAC,cAAc;AAAA,MAC5G;AAAA,IACJ;AAAA,EACJ;AAEA,MAAI,QAAQ,WAAW,iBAAkB;AACrC,UAAM,aAAa,MAAM,kBAAkB;AAE3C,QAAI,kBAAkB,QAAQ;AAG9B,UAAM,cAAc,CAAC;AACrB,aAAS,IAAI,GAAG,IAAI,WAAW,QAAQ,KAAK;AACxC,YAAM,OAAO,WAAW,CAAC;AAEzB,UAAI,eAAe;AACnB,UAAI,KAAK,QAAQ;AACb,uBAAe,CAAC,KAAK,MAAM;AAAA,MAC/B,WAAW,KAAK,UAAU;AACtB,uBAAe,CAAC,GAAG,KAAK,QAAQ;AAAA,MACpC,OAAO;AACH,cAAM,IAAI,MAAM,wCAAwC,CAAC,EAAE;AAAA,MAC/D;AAEA,iBAAW,cAAc,cAAc;AACnC,cAAM,UAAU,EAAE,GAAG,MAAM,QAAQ,YAAY,UAAU,OAAU;AACnE,YAAI,CAAC,IAAI,aAAa,SAAS,QAAQ,MAAM,GAAG;AAC5C,gBAAM,IAAI,MAAM,mBAAmB,UAAU,2BAA2B,CAAC,EAAE;AAAA,QAC/E;AAEA,YAAI,CAAC,YAAY,UAAU,GAAG;AAC1B,sBAAY,UAAU,IAAI,CAAC;AAAA,QAC/B;AACA,oBAAY,UAAU,EAAE,KAAK,OAAO;AAAA,MACxC;AAAA,IACJ;AAEA,eAAW,aAAa,OAAO,KAAK,IAAI,aAAa,QAAQ,GAAG;AAiD5D,UAAS,cAAT,SAAqB,KAA0B;AAC3C,eAAO,CAAC;AAAA,MACZ;AAlDA,YAAM,QAAQ,YAAY,SAAS,KAAK,CAAC;AACzC,YAAM,OAAO,IAAI,aAAa,SAAS,SAAS;AAGhD,UAAI;AACJ,YAAM,sBAAsB;AAwB5B,UAAI,4BAA4B,qBAAqB;AACjD,cAAM,IAAI,MAAM,4BAA4B,SAAS,wCAAwC;AAAA,MACjG;AAGA,UAAI,aAAa;AACb,cAAM,KAAK;AAAA,UACP,MAAM;AAAA,UACN,MAAM;AAAA,UACN,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,YAAY;AAAA,QAChB,CAAC;AAAA,MACL;AAIA,sCAAgC,MAAM,KAAK;AAM3C,UAAI,aAAa,eAAe,WAAW;AAAA,QACvC,MAAM,KAAK,cAAc,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,IAAI,CAAC,GAAG;AAC/D,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,aAAa,EAAE,GAAG,UAAU,OAAO,KAAK,OAAO,CAAC;AAAA,UAC3D;AACA,gBAAM,UAAU,sBAAsB,GAAG;AACzC,gBAAM,OAAO,MAAM,uBAAuB,KAAK,OAAO,SAAS,eAAe,UAAU;AACxF,8BAAoB,KAAK,MAAM,UAAU,OAAO,KAAK,IAAI,aAAa,SAAS,SAAS,EAAE,MAAM,CAAC;AACjG,kBAAQ,MAAM,gBAAgB,KAAK,KAAK,MAAM,OAAO,QAAQ,IAAI;AAEjE,iBAAO,aAAa,EAAE,GAAG,UAAU,OAAO,KAAK,OAAO,CAAC;AAAA,QAC3D;AAAA,QACA,MAAM,KAAK,cAAc,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,GAAG;AAC1D,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,aAAa,EAAE,KAAK,OAAO,QAAQ,GAAG,SAAS,CAAC;AAAA,UAC3D;AACA,gBAAM,UAAU,sBAAsB,GAAG;AACzC,gBAAM,OAAO,MAAM,uBAAuB,KAAK,OAAO,SAAS,eAAe,UAAU;AAExF,cAAI,CAAC,KAAK,MAAM;AACZ,kBAAM,IAAI,aAAa;AAAA,UAC3B;AACA,8BAAoB,KAAK,MAAM,MAAM;AACrC,mCAAyB,KAAK,MAAM,KAAK;AAEzC,cAAI,KAAK,UAAU;AACf,uBAAW,OAAO,OAAO,KAAK,KAAK,QAAQ,GAAG;AAC1C,oBAAM,WAAW,KAAK,SAAS,GAAG;AAClC,kBAAI,OAAO,aAAa,YAAY;AAChC,sBAAM,GAAG,IAAI,MAAM,SAAS,EAAE,MAAM,QAAQ,MAAM,KAAK,MAAM,CAAC;AAAA,cAClE,OAAO;AACH,sBAAM,GAAG,IAAI,QAAQ,KAAK,QAAQ;AAAA,cACtC;AAAA,YACJ;AAAA,UACJ;AAEA,gBAAM,oBAAoB,MAAM,KAAK,UAAU,MAAM;AACrD,gBAAM,kBAAkB,CAAC;AACzB,0BAAgB,KAAK,UAAU,IAAI,EAAE,IAAI,MAAM,KAAK,UAAU,EAAE;AAEhE,cAAI,mBAAmB;AACnB,kBAAM,QAAQ,MAAM,gBAAgB,KAAK,KAAK,MAAM,iBAAiB,QAAQ,IAAI;AAEjF,kBAAM,QAAQ,MAAM,KAAK,KAAK;AAAA,cAC1B;AAAA,cACA;AAAA,cACA;AAAA,YACJ,CAAC;AAED,gBAAI,MAAM,WAAW,GAAG;AACpB,oBAAM,IAAI,aAAa;AAAA,YAC3B;AAEA,mBAAO,aAAa,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,UAC3D;AAEA,iBAAO,aAAa,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,QAC3D;AAAA,QAEA,MAAM,OAAO,gBAAgB,EAAE,QAAQ,KAAK,QAAQ,GAAG,SAAS,GAAG;AAC/D,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,eAAe,EAAE,QAAQ,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,UAC9D;AACA,gBAAM,UAAU,sBAAsB,GAAG;AACzC,gBAAM,OAAO,MAAM,uBAAuB,KAAK,OAAO,SAAS,eAAe,UAAU;AAExF,cAAI,CAAC,KAAK,MAAM;AACZ,kBAAM,IAAI,aAAa;AAAA,UAC3B;AAEA,8BAAoB,KAAK,MAAM,MAAM;AACrC,mCAAyB,KAAK,MAAM,MAAM;AAG1C,cAAI,KAAK,UAAU;AACf,uBAAW,SAAS,QAAQ;AACxB,yBAAW,OAAO,OAAO,KAAK,KAAK,QAAQ,GAAG;AAC1C,sBAAM,WAAW,KAAK,SAAS,GAAG;AAClC,oBAAI,OAAO,aAAa,YAAY;AAChC,wBAAM,GAAG,IAAI,MAAM,SAAS,EAAE,MAAM,QAAQ,MAAM,KAAK,MAAM,CAAC;AAAA,gBAClE,OAAO;AACH,wBAAM,GAAG,IAAI,QAAQ,KAAK,QAAQ;AAAA,gBACtC;AAAA,cACJ;AAAA,YACJ;AAAA,UACJ;AAEA,iBAAO,eAAe,EAAE,QAAQ,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,QAC9D;AAAA,QAEA,MAAM,OAAO,gBAAgB,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,GAAG;AAC9D,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,eAAe,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,UAC7D;AACA,gBAAM,UAAU,sBAAsB,GAAG;AACzC,gBAAM,OAAO,MAAM,uBAAuB,KAAK,OAAO,SAAS,eAAe,UAAU;AAExF,kBAAQ,MAAM,gBAAgB,KAAK,KAAK,QAAQ,OAAO,QAAQ,IAAI;AAEnE,iBAAO,eAAe,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,QAC7D;AAAA,QAEA,MAAM,WAAW,oBAAoB,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,GAAG;AACtE,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,mBAAmB,EAAE,GAAG,UAAU,OAAO,KAAK,OAAO,CAAC;AAAA,UACjE;AACA,gBAAM,UAAU,sBAAsB,GAAG;AACzC,gBAAM,OAAO,MAAM,uBAAuB,KAAK,OAAO,SAAS,eAAe,UAAU;AAExF,kBAAQ,MAAM,gBAAgB,KAAK,KAAK,YAAY,OAAO,QAAQ,IAAI;AAEvE,iBAAO,mBAAmB,EAAE,GAAG,UAAU,OAAO,KAAK,OAAO,CAAC;AAAA,QACjE;AAAA,MACJ,CAAC;AAAA,IACL;AAAA,EACJ,CAAC;AACL,GAAG,EAAE,MAAM,8BAA8B,CAAC;AAE1C,eAAe,gBAAgB,KAA0B,MAAM,OAAO,MAAM;AACxE,MAAI,CAAC,MAAM;AACP,UAAM,IAAI,aAAa;AAAA,EAC3B;AACA,QAAM,UAAU,sBAAsB,GAAG;AAEzC,UAAQ,SAAS,CAAC;AAElB,MAAI,OAAO,SAAS,UAAU;AAC1B,UAAM,EAAE,OAAO,IAAI;AAGnB,QAAI,QAAQ;AACR,iBAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACnC,cAAM,UAAU,OAAO,GAAG;AAC1B,YAAI,OAAO,YAAY,UAAU;AAE7B,gBAAM,GAAG,IAAI;AAAA,YACT,IAAI,QAAQ,KAAK,OAAO;AAAA,UAC5B;AAAA,QACJ,OAAO;AAKH,qBAAW,aAAa,OAAO,KAAK,OAAO,GAAG;AAC1C,kBAAM,SAAS,QAAQ,SAAS;AAChC,kBAAM,GAAG,IAAI;AAAA,cACT,CAAC,SAAS,GAAG,QAAQ,KAAK,MAAM;AAAA,YACpC;AAAA,UACJ;AAAA,QACJ;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ,WAAW,OAAO,SAAS,YAAY;AACnC,YAAQ,MAAM,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;AAAA,EAC3C;AACA,SAAO;AACX;AAEA,eAAsB,uBAAuB,KAA0B,OAA2B,SAAiB,eAAuB,aAAa,OAAO;AAC1J,QAAM,UAAU,sBAAsB,GAAG;AACzC,QAAM,QAAQ,yBAAyB;AACvC,QAAM,QAAQ,SAAS,SAAS,SAAS,eAAe,UAAU;AAClE,QAAM,OAAO,kBAAS,OAAO,KAAK;AAClC,MAAI,CAAC,MAAM;AACP,QAAI,MAAM,QAAQ,IAAI,KAAK,EAAE,OAAO,MAAM,GAAG,mBAAmB;AAChE,UAAM,IAAI,aAAa;AAAA,EAC3B;AACA,MAAI,MAAM,QAAQ,IAAI,MAAM,EAAE,OAAO,KAAK,GAAG,YAAY;AACzD,SAAO;AACX;AAEO,SAAS,oBAAoB,MAAM,QAAQ;AAC9C,MAAI,CAAC,MAAM;AACP,UAAM,IAAI,aAAa;AAAA,EAC3B;AACA,QAAM,EAAE,QAAQ,eAAe,IAAI;AAEnC,MAAI,gBAAgB;AAChB,eAAW,SAAS,QAAQ;AACxB,UAAI,CAAC,eAAe,SAAS,KAAK,GAAG;AACjC,cAAM,IAAI,kBAAkB,KAAK;AAAA,MACrC;AAAA,IACJ;AAAA,EACJ;AACJ;AAEA,IAAM,iBAAiB,CAAC,QAAQ,mBAAmB;AAC/C,aAAW,SAAS,QAAQ;AACxB,UAAM,cAAc,OAAO,KAAK,KAAK;AACrC,eAAW,cAAc,aAAa;AAClC,UAAI,CAAC,eAAe,SAAS,UAAU,GAAG;AACtC,cAAM,IAAI,kBAAkB,UAAU;AAAA,MAC1C;AAAA,IACJ;AAAA,EACJ;AACJ;AAEA,SAAS,yBAAyB,MAAM,QAAQ;AAC5C,QAAM,EAAE,QAAQ,eAAe,IAAI;AAEnC,MAAI,gBAAgB;AAChB,QAAI,CAAC,MAAM,QAAQ,MAAM,GAAG;AAExB,qBAAe,CAAC,MAAM,GAAG,cAAc;AAAA,IAC3C,OAAO;AAEH,qBAAe,QAAQ,cAAc;AAAA,IACzC;AAAA,EACJ;AACJ;AAEA,SAAS,gCAAgC,MAAc,OAAO;AAE1D,QAAM,kBACF,OAAO,OAAO,KAAK,MAAM,EACpB,OAAO,OAAM,CAAC,EAAE,cAAc,CAAC,EAAE,UAAW,EAC5C,IAAI,CAAC,EAAE,UAAU,MAAO,SAAU;AAE3C,aAAW,QAAQ,OAAO;AACtB,UAAM,EAAE,QAAQ,KAAK,IAAI;AACzB,QAAI,QAAQ,KAAK,QAAQ;AACrB,YAAM,SAAS,KAAK;AACpB,iBAAW,UAAU,iBAAiB;AAClC,YAAI,CAAC,OAAO,SAAS,MAAM,GAAG;AAC1B,gBAAM,IAAI,wBAAwB,QAAQ,MAAM;AAAA,QACpD;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ;AACJ;AAMA,eAAe,wBAAwB,KAAsB,MAAoC,OAAO,MAAM;AAE1G,MAAI,CAAC,KAAK,2BAA2B,CAAC,KAAK,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM;AACjE;AAAA,EACR;AAEA,QAAM,oBAAoB,KAAK,qBAAqB;AACpD,QAAM,eAAe,OAAO,iBAAiB;AAC7C,QAAM,SAAS,MAAM;AAErB,MAAI;AACA,UAAM,WAAW,uBAAuB,MAAM;AAC9C,UAAM,oBAAoB,MAAM,IAAI,MAAM,IAAI,QAAQ;AACtD,UAAM,iBAAiB,SAAS,mBAAmB,EAAE;AAErD,QAAI,sBAAsB,MAAM;AAC5B,YAAM,IAAI,MAAM,IAAI,UAAU,aAAa,SAAS,CAAC;AACrD,UAAI,IAAI,MAAM,EAAE,QAAQ,SAAS,aAAa,GAAG,0CAA0C;AAC3F,UAAI,eAAe,GAAG;AAClB,YAAI,IAAI,KAAK;AAAA,UACT;AAAA,UACA;AAAA,UACA;AAAA,QACJ,GAAG,uCAAuC;AAC1C,cAAM,IAAI,oBAAoB;AAAA,MAClC;AACA;AAAA,IACJ;AAGA,QAAI,mBAAmB,cAAc;AACjC,UAAI,IAAI,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,MACJ,GAAG,uCAAuC;AAC1C,YAAM,IAAI,oBAAoB;AAAA,IAClC;AAEA,QAAI,IAAI,MAAM,EAAE,QAAQ,SAAS,aAAa,GAAG,4BAA4B;AAAA,EACjF,SAAS,OAAO;AACZ,QAAI,MAAM,SAAS,kBAAkB,MAAM,SAAS,gCAAgC;AAChF,YAAM;AAAA,IACV;AACA,QAAI,IAAI,MAAM,EAAE,KAAK,OAAO,OAAO,GAAG,8BAA8B;AAAA,EACxE;AACJ;AAEA,IAAO,gBAAQ;","names":["createError","import_fastify_logto","fp","fastifyRedis","fastifyLogto"]}
+{"version":3,"sources":["../src/index.ts","../src/utils/find-rule.ts","../src/utils/errors.ts","../src/utils/permissions-version.ts","../src/utils/utils.ts"],"sourcesContent":["import fp from 'fastify-plugin'\nimport * as fastifyUser from 'fastify-user'\n\nimport findRule from './utils/find-rule.js'\nimport { Unauthorized, UnauthorizedField, MissingNotNullableError, PermissionsOutdated } from './utils/errors.js'\nimport fastifyLogto from '@albirex/fastify-logto';\nimport fastifyRedis from '@fastify/redis';\nimport { FastifyInstance, FastifyPluginAsync } from 'fastify'\nimport type { FastifyUserPluginOptions } from 'fastify-user';\nimport type { Entity, PlatformaticContext } from '@platformatic/sql-mapper'\n\nexport { fastifyLogto } from '@albirex/fastify-logto';\nexport { incrementPermissionsVersion, deletePermissionsVersion } from './utils/permissions-version.js';\n\nimport { getRequestFromContext, getRoles, getScopes } from './utils/utils.js'\nexport { getRequestFromContext, getRoles } from './utils/utils.js'\n\nconst PLT_ADMIN_ROLE = 'platformatic-admin'\nconst PLT_ADMIN_SCOPES = '*'\n\nexport type EntityActions = 'find' | 'save' | 'insert' | 'updateMany' | 'delete';\n\nexport type PlatformaticRule = {\n    role: string;\n    entity?: string;\n    entities?: string[];\n    defaults?: Record<string, string>;\n    checks?: boolean;\n    find?: boolean;\n    save?: boolean;\n    delete?: boolean;\n    [action: string]: unknown;\n};\n\nexport type RedisConfig = {\n    host?: string;\n    port?: number;\n    password?: string;\n    username?: string;\n    db?: number;\n};\n\nexport type PlatformaticLogToRoleBasedAuthOptions = {\n    logtoBaseUrl?: string;\n    logtoAppId?: string;\n    logtoAppSecret?: string;\n    rolePath?: string;\n    roleKey?: string;\n    userPath?: string;\n    userKey?: string;\n}\n\nexport type PlatformaticLogToScopeBasedAuthOptions = {\n    scopesPath?: string;\n    scopesKey?: string;\n}\n\nexport type PlatformaticLogtoAuthOptions = {\n    adminSecret?: string;\n    roleBasedAuth?: PlatformaticLogToRoleBasedAuthOptions,\n    scopeBasedAuth?: PlatformaticLogToScopeBasedAuthOptions,\n    checks?: boolean;\n    defaults?: boolean;\n    anonymousRole?: string;\n    allowAnonymous?: boolean;\n    jwtPlugin: FastifyUserPluginOptions;\n    redis?: RedisConfig;\n    enableTokenVersionCheck?: boolean;\n    sessionVersionKey?: string;\n};\n\nexport const platformaticLogto: FastifyPluginAsync<PlatformaticLogtoAuthOptions> = fp(async (app: FastifyInstance, opts: PlatformaticLogtoAuthOptions) => {\n    app.decorate('platformaticLogTo', {\n        opts\n    })\n\n    // Register Redis if configured\n    if (opts.redis) {\n        await app.register(fastifyRedis, {\n            host: opts.redis.host || '127.0.0.1',\n            port: opts.redis.port || 6379,\n            password: opts.redis.password,\n            username: opts.redis.username,\n            db: opts.redis.db || 0,\n        });\n        app.log.info('Redis client registered for permissions version check');\n    }\n\n    if (opts.roleBasedAuth) {\n        app.register(fastifyLogto, {\n            endpoint: opts.roleBasedAuth.logtoBaseUrl || 'https://auth.example.com',\n            appId: opts.roleBasedAuth.logtoAppId || 'your-app-id',\n            appSecret: opts.roleBasedAuth.logtoAppSecret || 'your-app-secret',\n        });\n    }\n\n    await app.register(fastifyUser as unknown as FastifyPluginAsync, opts.jwtPlugin);\n\n    const roleKey = opts.roleBasedAuth?.rolePath || opts.roleBasedAuth?.roleKey || 'X-PLATFORMATIC-ROLE';\n    const scopesKey = opts.scopeBasedAuth.scopesPath || opts.scopeBasedAuth.scopesKey || 'X-PLATFORMATIC-SCOPES'\n    const adminSecret = opts.adminSecret\n    const isRolePath = !!opts.roleBasedAuth?.rolePath // if `true` the role is intepreted as path like `user.role`\n    const anonymousRole = opts.anonymousRole || 'anonymous'\n\n    app.decorateRequest('setupDBAuthorizationUser', setupUser)\n\n    async function setupUser() {\n        // if (!adminSecret) {\n        await this.extractUser()\n        // }\n\n        let forceAdminRole = false\n        if (adminSecret && this.headers['x-platformatic-admin-secret'] === adminSecret) {\n            if (opts.jwtPlugin.jwt) {\n                forceAdminRole = true\n            } else {\n                this.log.info('admin secret is valid')\n                this.user = new Proxy(this.headers, {\n                    get: (target, key) => {\n                        let value;\n                        if (!target[key.toString()]) {\n                            const newKey = key.toString().toLowerCase()\n                            value = target[newKey]\n                        } else {\n                            value = target[key.toString()]\n                        }\n\n                        if (!value && key.toString().toLowerCase() === roleKey.toLowerCase()) {\n                            value = PLT_ADMIN_ROLE\n                        }\n                        return value\n                    },\n                })\n            }\n        } else {\n            await checkPermissionsVersion(app, opts, this.user)\n        }\n\n        if (forceAdminRole) {\n            // We replace just the role in `request.user`, all the rest is untouched\n            if (opts.roleBasedAuth) {\n                this.user = {\n                    // ...request.user,\n                    [roleKey]: this.headers['x-platformatic-role'] ? [this.headers['x-platformatic-role']] : [PLT_ADMIN_ROLE]\n                }\n            }\n\n            if (opts.scopeBasedAuth) {\n                this.user = {\n                    // ...request.user,\n                    [scopesKey]: this.headers['x-platformatic-scopes'] ? [this.headers['x-platformatic-scopes']] : [PLT_ADMIN_SCOPES]\n                }\n            }\n        }\n    }\n\n    async function roleBasedAuth() {\n        const userKey = opts.roleBasedAuth.userKey || opts.roleBasedAuth.userPath || 'X-PLATFORMATIC-USER-ID';\n\n        async function composeLogToRules() {\n            const rolesResp = await app.logto.callAPI('/api/roles?type=User', 'GET');\n\n            if (!rolesResp.ok) {\n                throw rolesResp;\n            }\n\n            const roles = await rolesResp.json();\n            const rules: PlatformaticRule[] = [{\n                role: anonymousRole,\n                entities: Object.keys(app.platformatic.entities),\n                find: opts.allowAnonymous,\n                save: opts.allowAnonymous,\n                delete: opts.allowAnonymous,\n            }];\n\n            for (const role of roles) {\n                const scopesResp = await app.logto.callAPI(`/api/roles/${role.id}/scopes`, 'GET');\n\n                if (!scopesResp.ok) {\n                    throw scopesResp;\n                }\n\n                const scopes = await scopesResp.json();\n\n                for (const scope of scopes) {\n                    const roleName = role.name;\n                    // eslint-disable-next-line prefer-const\n                    let [scopeAction, entity] = scope.name.split(':');\n\n                    if (!app.platformatic.entities[entity]) {\n                        app.log.debug(`Unknown entity '${entity}' in authorization rule`)\n                        continue;\n                    }\n\n                    switch (scopeAction) {\n                        case 'create':\n                            scopeAction = 'save'\n                            break;\n                        case 'read':\n                            scopeAction = 'find'\n                            break;\n                        case 'update':\n                            scopeAction = 'updateMany'\n                            break;\n                    }\n\n                    const checkExists = rules.find(r => r.role === roleName && r.entity === entity);\n                    if (checkExists) {\n                        if (opts.checks) {\n                            checkExists[scopeAction] = {\n                                checks: {\n                                    userId: userKey\n                                }\n                            };\n                        } else {\n                            checkExists[scopeAction] = true;\n                        }\n                    } else {\n                        const newRule: PlatformaticRule = {\n                            role: roleName,\n                            entity,\n                        };\n\n                        if (opts.checks) {\n                            newRule[scopeAction] = {\n                                checks: {\n                                    userId: userKey\n                                }\n                            };\n                        } else {\n                            newRule[scopeAction] = true;\n                        }\n\n                        if (opts.defaults) {\n                            newRule.defaults = {\n                                userId: userKey\n                            };\n                        }\n\n                        rules.push(newRule);\n                    }\n                }\n            }\n\n            const logRules = rules.reduce((prev, curr) => {\n                (prev[curr['role']] ??= []).push(curr);\n                return prev;\n            }, {})\n\n            for (const key in logRules) {\n                app.log.info(`Rules set for role ${key}`);\n\n                for (const element of logRules[key]) {\n                    // eslint-disable-next-line @typescript-eslint/no-unused-vars\n                    const { entity, entities, role, ...other } = element;\n                    app.log.info(`\\t${entity ?? entities.join(',')}: ${JSON.stringify(other)}`);\n                }\n            }\n\n            const missingEntities = Object.keys(app.platformatic.entities).filter((e) => !rules.map((r) => r.entity).includes(e));\n\n            if (missingEntities.length) {\n                app.log.warn(`Missing rules for entities: ${missingEntities.join(', ')}`);\n            }\n\n            app.log.debug('LogTo calculated rules');\n            app.log.debug(rules);\n            return rules;\n        }\n\n        const logToRules = await composeLogToRules();\n\n        app.platformaticLogTo.rules = logToRules;\n\n        // TODO validate that there is at most a rule for a given role\n        const entityRules = {};\n        for (let i = 0; i < logToRules.length; i++) {\n            const rule = logToRules[i]\n\n            let ruleEntities = null\n            if (rule.entity) {\n                ruleEntities = [rule.entity]\n            } else if (rule.entities) {\n                ruleEntities = [...rule.entities]\n            } else {\n                throw new Error(`Missing entity in authorization rule ${i}`)\n            }\n\n            for (const ruleEntity of ruleEntities) {\n                const newRule = { ...rule, entity: ruleEntity, entities: undefined }\n                if (!app.platformatic.entities[newRule.entity]) {\n                    throw new Error(`Unknown entity '${ruleEntity}' in authorization rule ${i}`)\n                }\n\n                if (!entityRules[ruleEntity]) {\n                    entityRules[ruleEntity] = []\n                }\n                entityRules[ruleEntity].push(newRule)\n            }\n        }\n\n        for (const entityKey of Object.keys(app.platformatic.entities)) {\n            const rules = entityRules[entityKey] || []\n            const type = app.platformatic.entities[entityKey]\n\n            // We have subscriptions!\n            let userPropToFillForPublish\n            const topicsWithoutChecks = false\n\n            if (userPropToFillForPublish && topicsWithoutChecks) {\n                throw new Error(`Subscription for entity \"${entityKey}\" have conflictling rules across roles`)\n            }\n\n            // MUST set this after doing the security checks on the subscriptions\n            if (adminSecret) {\n                rules.push({\n                    role: PLT_ADMIN_ROLE,\n                    find: true,\n                    save: true,\n                    delete: true,\n                    updateMany: true\n                })\n            }\n\n            // If we have `fields` in save rules, we need to check if all the not-nullable\n            // fields are specified\n            checkSaveMandatoryFieldsInRules(type, rules)\n\n            function useOriginal(ctx: PlatformaticContext) {\n                return !ctx\n            }\n\n            app.platformatic.addEntityHooks(entityKey, {\n                async find(originalFind, { where, ctx, fields, ...restOpts } = {}) {\n                    if (useOriginal(ctx)) {\n                        return originalFind({ ...restOpts, where, ctx, fields })\n                    }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n                    checkFieldsFromRule(rule.find, fields || Object.keys(app.platformatic.entities[entityKey].fields))\n                    where = await fromRuleToWhere(ctx, rule.find, where, request.user)\n\n                    return originalFind({ ...restOpts, where, ctx, fields })\n                },\n                async save(originalSave, { input, ctx, fields, ...restOpts }) {\n                    if (useOriginal(ctx)) {\n                        return originalSave({ ctx, input, fields, ...restOpts })\n                    }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n\n                    if (!rule.save) {\n                        throw new Unauthorized()\n                    }\n                    checkFieldsFromRule(rule.save, fields)\n                    checkInputFromRuleFields(rule.save, input)\n\n                    if (rule.defaults) {\n                        for (const key of Object.keys(rule.defaults)) {\n                            const defaults = rule.defaults[key]\n                            if (typeof defaults === 'function') {\n                                input[key] = await defaults({ user: request.user, ctx, input })\n                            } else {\n                                input[key] = request.user[defaults]\n                            }\n                        }\n                    }\n\n                    const hasAllPrimaryKeys = input[type.primaryKey] !== undefined;\n                    const whereConditions = {}\n                    whereConditions[type.primaryKey] = { eq: input[type.primaryKey] }\n\n                    if (hasAllPrimaryKeys) {\n                        const where = await fromRuleToWhere(ctx, rule.save, whereConditions, request.user)\n\n                        const found = await type.find({\n                            where,\n                            ctx,\n                            fields,\n                        })\n\n                        if (found.length === 0) {\n                            throw new Unauthorized()\n                        }\n\n                        return originalSave({ input, ctx, fields, ...restOpts })\n                    }\n\n                    return originalSave({ input, ctx, fields, ...restOpts })\n                },\n\n                async insert(originalInsert, { inputs, ctx, fields, ...restOpts }) {\n                    if (useOriginal(ctx)) {\n                        return originalInsert({ inputs, ctx, fields, ...restOpts })\n                    }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n\n                    if (!rule.save) {\n                        throw new Unauthorized()\n                    }\n\n                    checkFieldsFromRule(rule.save, fields)\n                    checkInputFromRuleFields(rule.save, inputs)\n\n                    /* istanbul ignore else */\n                    if (rule.defaults) {\n                        for (const input of inputs) {\n                            for (const key of Object.keys(rule.defaults)) {\n                                const defaults = rule.defaults[key]\n                                if (typeof defaults === 'function') {\n                                    input[key] = await defaults({ user: request.user, ctx, input })\n                                } else {\n                                    input[key] = request.user[defaults]\n                                }\n                            }\n                        }\n                    }\n\n                    return originalInsert({ inputs, ctx, fields, ...restOpts })\n                },\n\n                async delete(originalDelete, { where, ctx, fields, ...restOpts }) {\n                    if (useOriginal(ctx)) {\n                        return originalDelete({ where, ctx, fields, ...restOpts })\n                    }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n\n                    where = await fromRuleToWhere(ctx, rule.delete, where, request.user)\n\n                    return originalDelete({ where, ctx, fields, ...restOpts })\n                },\n\n                async updateMany(originalUpdateMany, { where, ctx, fields, ...restOpts }) {\n                    if (useOriginal(ctx)) {\n                        return originalUpdateMany({ ...restOpts, where, ctx, fields })\n                    }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n\n                    where = await fromRuleToWhere(ctx, rule.updateMany, where, request.user)\n\n                    return originalUpdateMany({ ...restOpts, where, ctx, fields })\n                },\n            })\n        }\n    }\n\n    async function scopeBasedAuth() {\n        for (const entityKey of Object.keys(app.platformatic.entities)) {\n            // const type = app.platformatic.entities[entityKey]\n\n            // We have subscriptions!\n            let userPropToFillForPublish\n            const topicsWithoutChecks = false\n\n            if (userPropToFillForPublish && topicsWithoutChecks) {\n                throw new Error(`Subscription for entity \"${entityKey}\" have conflictling rules across roles`)\n            }\n\n            function useOriginal(ctx: PlatformaticContext) {\n                return !ctx\n            }\n\n            app.platformatic.addEntityHooks(entityKey, {\n                async find(originalFind, { where, ctx, fields, ...restOpts } = {}) {\n                    if (useOriginal(ctx)) {\n                        return originalFind({ ...restOpts, where, ctx, fields })\n                    }\n                    await findScopeForRequestUser(ctx, entityKey, 'find', scopesKey, anonymousRole, isRolePath)\n\n                    // checkFieldsFromRule(scope.find, fields || Object.keys(app.platformatic.entities[entityKey].fields))\n                    // where = await fromRuleToWhere(ctx, scope.find, where, request.user)\n\n                    return originalFind({ ...restOpts, where, ctx, fields })\n                },\n                async save(originalSave, { input, ctx, fields, ...restOpts }) {\n                    if (useOriginal(ctx)) {\n                        return originalSave({ ctx, input, fields, ...restOpts })\n                    }\n                    await findScopeForRequestUser(ctx, entityKey, 'save', scopesKey, anonymousRole, isRolePath)\n\n                    // checkFieldsFromRule(rule.save, fields)\n                    // checkInputFromRuleFields(rule.save, input)\n\n                    // if (rule.defaults) {\n                    //     for (const key of Object.keys(rule.defaults)) {\n                    //         const defaults = rule.defaults[key]\n                    //         if (typeof defaults === 'function') {\n                    //             input[key] = await defaults({ user: request.user, ctx, input })\n                    //         } else {\n                    //             input[key] = request.user[defaults]\n                    //         }\n                    //     }\n                    // }\n\n                    // const hasAllPrimaryKeys = input[type.primaryKey] !== undefined;\n                    // const whereConditions = {}\n                    // whereConditions[type.primaryKey] = { eq: input[type.primaryKey] }\n\n                    // if (hasAllPrimaryKeys) {\n                    //     const where = await fromRuleToWhere(ctx, rule.save, whereConditions, request.user)\n\n                    //     const found = await type.find({\n                    //         where,\n                    //         ctx,\n                    //         fields,\n                    //     })\n\n                    //     if (found.length === 0) {\n                    //         throw new Unauthorized()\n                    //     }\n\n                    //     return originalSave({ input, ctx, fields, ...restOpts })\n                    // }\n\n                    return originalSave({ input, ctx, fields, ...restOpts })\n                },\n\n                async insert(originalInsert, { inputs, ctx, fields, ...restOpts }) {\n                    if (useOriginal(ctx)) {\n                        return originalInsert({ inputs, ctx, fields, ...restOpts })\n                    }\n                    await findScopeForRequestUser(ctx, entityKey, 'insert', scopesKey, anonymousRole, isRolePath)\n\n                    // checkFieldsFromRule(rule.save, fields)\n                    // checkInputFromRuleFields(rule.save, inputs)\n\n                    /* istanbul ignore else */\n                    // if (rule.defaults) {\n                    //     for (const input of inputs) {\n                    //         for (const key of Object.keys(rule.defaults)) {\n                    //             const defaults = rule.defaults[key]\n                    //             if (typeof defaults === 'function') {\n                    //                 input[key] = await defaults({ user: request.user, ctx, input })\n                    //             } else {\n                    //                 input[key] = request.user[defaults]\n                    //             }\n                    //         }\n                    //     }\n                    // }\n\n                    return originalInsert({ inputs, ctx, fields, ...restOpts })\n                },\n\n                async delete(originalDelete, { where, ctx, fields, ...restOpts }) {\n                    if (useOriginal(ctx)) {\n                        return originalDelete({ where, ctx, fields, ...restOpts })\n                    }\n                    await findScopeForRequestUser(ctx, entityKey, 'delete', scopesKey, anonymousRole, isRolePath)\n\n                    // where = await fromRuleToWhere(ctx, rule.delete, where, request.user)\n\n                    return originalDelete({ where, ctx, fields, ...restOpts })\n                },\n\n                async updateMany(originalUpdateMany, { where, ctx, fields, ...restOpts }) {\n                    if (useOriginal(ctx)) {\n                        return originalUpdateMany({ ...restOpts, where, ctx, fields })\n                    }\n                    await findScopeForRequestUser(ctx, entityKey, 'updateMany', scopesKey, anonymousRole, isRolePath)\n\n                    // where = await fromRuleToWhere(ctx, rule.updateMany, where, request.user)\n\n                    return originalUpdateMany({ ...restOpts, where, ctx, fields })\n                },\n            })\n        }\n    }\n\n    app.addHook('onReady', async function () {\n        if (opts.roleBasedAuth) {\n            await roleBasedAuth();\n        }\n\n        if (opts.scopeBasedAuth) {\n            await scopeBasedAuth();\n        }\n    })\n}, { name: '@albirex/platformatic-logto' });\n\nasync function fromRuleToWhere(ctx: PlatformaticContext, rule, where, user) {\n    if (!rule) {\n        throw new Unauthorized()\n    }\n    const request = getRequestFromContext(ctx)\n    /* istanbul ignore next */\n    where = where || {}\n\n    if (typeof rule === 'object') {\n        const { checks } = rule\n\n        /* istanbul ignore else */\n        if (checks) {\n            for (const key of Object.keys(checks)) {\n                const clauses = checks[key]\n                if (typeof clauses === 'string') {\n                    // case: \"userId\": \"X-PLATFORMATIC-USER-ID\"\n                    where[key] = {\n                        eq: request.user[clauses],\n                    }\n                } else {\n                    // case:\n                    // userId: {\n                    //   eq: 'X-PLATFORMATIC-USER-ID'\n                    // }\n                    for (const clauseKey of Object.keys(clauses)) {\n                        const clause = clauses[clauseKey]\n                        where[key] = {\n                            [clauseKey]: request.user[clause],\n                        }\n                    }\n                }\n            }\n        }\n    } else if (typeof rule === 'function') {\n        where = await rule({ user, ctx, where })\n    }\n    return where\n}\n\nexport async function findRuleForRequestUser(ctx: PlatformaticContext, rules: PlatformaticRule[], roleKey: string, anonymousRole: string, isRolePath = false) {\n    const request = getRequestFromContext(ctx)\n    await request.setupDBAuthorizationUser()\n    const roles = getRoles(request, roleKey, anonymousRole, isRolePath)\n    const rule = findRule(rules, roles)\n    if (!rule) {\n        ctx.reply.request.log.warn({ roles, rules }, 'no rule for roles')\n        throw new Unauthorized()\n    }\n    ctx.reply.request.log.trace({ roles, rule }, 'found rule')\n    return rule\n}\n\nexport async function findScopeForRequestUser(ctx: PlatformaticContext, entityKey: string, action: EntityActions, scopesKey: string, anonymousRole: string, isScopePath = false) {\n    const request = getRequestFromContext(ctx)\n    await request.setupDBAuthorizationUser()\n    const scopes = getScopes(request, scopesKey, anonymousRole, isScopePath)\n    const scope = scopes.find(s => {\n        if (s === PLT_ADMIN_SCOPES) {\n            return true;\n        }\n\n        if (action !== 'find') {\n            return s === `${action}:${entityKey}`\n        }\n        else {\n            return s === `${action}:${entityKey}` || s === `read:${entityKey}`\n        }\n    });\n\n    if (!scope) {\n        ctx.reply.request.log.warn('no scope found')\n        throw new Unauthorized()\n    }\n    ctx.reply.request.log.trace({ scopes, scope }, 'found scope')\n}\n\nexport function checkFieldsFromRule(rule, fields) {\n    if (!rule) {\n        throw new Unauthorized()\n    }\n    const { fields: fieldsFromRule } = rule\n    /* istanbul ignore else */\n    if (fieldsFromRule) {\n        for (const field of fields) {\n            if (!fieldsFromRule.includes(field)) {\n                throw new UnauthorizedField(field)\n            }\n        }\n    }\n}\n\nconst validateInputs = (inputs, fieldsFromRule) => {\n    for (const input of inputs) {\n        const inputFields = Object.keys(input)\n        for (const inputField of inputFields) {\n            if (!fieldsFromRule.includes(inputField)) {\n                throw new UnauthorizedField(inputField)\n            }\n        }\n    }\n}\n\nfunction checkInputFromRuleFields(rule, inputs) {\n    const { fields: fieldsFromRule } = rule\n    /* istanbul ignore else */\n    if (fieldsFromRule) {\n        if (!Array.isArray(inputs)) {\n            // save\n            validateInputs([inputs], fieldsFromRule)\n        } else {\n            // insert\n            validateInputs(inputs, fieldsFromRule)\n        }\n    }\n}\n\nfunction checkSaveMandatoryFieldsInRules(type: Entity, rules) {\n    // List of not nullable, not PKs field to validate save/insert when allowed fields are specified on the rule\n    const mandatoryFields =\n        Object.values(type.fields)\n            .filter(k => (!k.isNullable && !k.primaryKey))\n            .map(({ camelcase }) => (camelcase))\n\n    for (const rule of rules) {\n        const { entity, save } = rule\n        if (save && save.fields) {\n            const fields = save.fields\n            for (const mField of mandatoryFields) {\n                if (!fields.includes(mField)) {\n                    throw new MissingNotNullableError(mField, entity)\n                }\n            }\n        }\n    }\n}\n\n/**\n * Check the permissions version\n * @throws PermissionsOutdated if versions don't match\n */\nasync function checkPermissionsVersion(app: FastifyInstance, opts: PlatformaticLogtoAuthOptions, user = null) {\n\n    if (!opts.enableTokenVersionCheck || !opts.redis || !app.redis || !user) {\n        return;\n    }\n\n    const sessionVersionKey = opts.sessionVersionKey || 'version'\n    const tokenVersion = user?.[sessionVersionKey];\n    const userId = user?.sub;\n\n    try {\n        const redisKey = `permissions:version:${userId}`;\n        const currentVersionStr = await app.redis.get(redisKey);\n        const currentVersion = parseInt(currentVersionStr, 10);\n\n        if (currentVersionStr === null) {\n            await app.redis.set(redisKey, tokenVersion.toString());\n            app.log.debug({ userId, version: tokenVersion }, 'Initialized permissions version in Redis');\n            if (tokenVersion > 1) {\n                app.log.warn({\n                    userId,\n                    tokenVersion,\n                    currentVersion\n                }, 'Permissions version mismatch detected');\n                throw new PermissionsOutdated();\n            }\n            return;\n        }\n\n        // Compare versions\n        if (currentVersion !== tokenVersion) {\n            app.log.warn({\n                userId,\n                tokenVersion,\n                currentVersion\n            }, 'Permissions version mismatch detected');\n            throw new PermissionsOutdated();\n        }\n\n        app.log.trace({ userId, version: tokenVersion }, 'Token version check passed');\n    } catch (error) {\n        if (error.name === 'FastifyError' && error.code === 'PLT_DB_AUTH_VERSION_OUTDATED') {\n            throw error;\n        }\n        app.log.error({ err: error, userId }, 'Error checking token version');\n    }\n}\n\nexport default platformaticLogto;\n\ndeclare module 'fastify' {\n    interface FastifyInstance {\n        platformaticLogTo: {\n            opts: PlatformaticLogtoAuthOptions,\n            rules?: PlatformaticRule[]\n        }\n    }\n}","'use strict'\n\nimport { PlatformaticRule } from '../index.js'\n\nfunction findRule(rules: PlatformaticRule[], roles: string[]) {\n  let found = null\n  for (const rule of rules) {\n    for (const role of roles) {\n      if (rule.role === role) {\n        found = rule\n        break\n      }\n    }\n    if (found) {\n      break\n    }\n  }\n  return found\n}\n\nexport default findRule\n","'use strict'\n\nimport createError from '@fastify/error'\n\nconst ERROR_PREFIX = 'PLT_DB_AUTH'\n\nexport const Unauthorized = createError(`${ERROR_PREFIX}_UNAUTHORIZED`, 'operation not allowed', 401)\nexport const UnauthorizedField = createError(`${ERROR_PREFIX}_FIELD_UNAUTHORIZED`, 'field not allowed: %s', 401)\nexport const MissingNotNullableError = createError(`${ERROR_PREFIX}_NOT_NULLABLE_MISSING`, 'missing not nullable field: \"%s\" in save rule for entity \"%s\"')\nexport const PermissionsOutdated = createError(`${ERROR_PREFIX}_VERSION_OUTDATED`, 'Verision has been updated. Please logout and login again.', 403)\n","'use strict'\n\nimport type { FastifyInstance } from 'fastify'\n\n/**\n * Increment the permissions version\n * @param app - Fastify instance with Redis client and Logto\n * @param userId - User ID\n * @returns New version number\n */\nexport async function incrementPermissionsVersion(app: FastifyInstance, userId: string): Promise<number> {\n    if (!app.logto) {\n        throw new Error('Logto client not available')\n    }\n\n    const userResp = await app.logto.callAPI(`/api/users/${userId}`, 'GET')\n    const userData = await userResp.json()\n    const existingCustomData = userData.customData || {}\n    const currentVersion = existingCustomData.sessionVersion || 0\n    const newVersion = currentVersion + 1\n\n    await app.logto.callAPI(`/api/users/${userId}`, 'PATCH', JSON.stringify({ customData: { ...existingCustomData, sessionVersion: newVersion } }))\n\n    if (app.redis) {\n        const redisKey = `permissions:version:${userId}`\n        await app.redis.set(redisKey, newVersion.toString())\n    }\n\n    return newVersion\n}\n\n/**\n * Delete the permissions version for a user\n * @param app - Fastify instance with Redis client\n * @param userId - User ID\n */\nexport async function deletePermissionsVersion(app: FastifyInstance, userId: string): Promise<void> {\n    if (!app.redis) {\n        throw new Error('Redis client not available')\n    }\n\n    const redisKey = `permissions:version:${userId}`\n    await app.redis.del(redisKey)\n}\n\n","'use strict'\n\nexport function getRequestFromContext (ctx) {\n  if (ctx && !ctx.reply) {\n    throw new Error('Missing reply in context. You should call this function with { ctx: { reply }}')\n  }\n  return ctx.reply.request\n}\n\nexport function getRoles (request, roleKey, anonymousRole, isRolePath = false) {\n  let output = []\n  const user = request.user\n  if (!user) {\n    output.push(anonymousRole)\n    return output\n  }\n\n  let rolesRaw\n  if (isRolePath) {\n    const roleKeys = roleKey.split('.')\n    rolesRaw = user\n    for (const key of roleKeys) {\n      rolesRaw = rolesRaw[key]\n    }\n  } else {\n    rolesRaw = user[roleKey]\n  }\n\n  if (typeof rolesRaw === 'string') {\n    output = rolesRaw.split(',')\n  } else if (Array.isArray(rolesRaw)) {\n    output = rolesRaw\n  }\n  if (output.length === 0) {\n    output.push(anonymousRole)\n  }\n\n  return output\n}\n\nexport function getScopes(request, scopesKey, anonymousRole, isScopePath = false) {\n  let output = []\n  const user = request.user\n  if (!user) {\n    output.push(anonymousRole)\n    return output\n  }\n\n  let scopesRaw\n  if (isScopePath) {\n    const roleKeys = scopesKey.split('.')\n    scopesRaw = user\n    for (const key of roleKeys) {\n      scopesRaw = scopesRaw[key]\n    }\n  } else {\n    scopesRaw = user[scopesKey]\n  }\n\n  if (typeof scopesRaw === 'string') {\n    output = scopesRaw.split(' ')\n  } else if (Array.isArray(scopesRaw)) {\n    output = scopesRaw\n  }\n  if (output.length === 0) {\n    output.push(anonymousRole)\n  }\n\n  return output\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,4BAAe;AACf,kBAA6B;;;ACG7B,SAAS,SAAS,OAA2B,OAAiB;AAC5D,MAAI,QAAQ;AACZ,aAAW,QAAQ,OAAO;AACxB,eAAW,QAAQ,OAAO;AACxB,UAAI,KAAK,SAAS,MAAM;AACtB,gBAAQ;AACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO;AACT;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,IAAO,oBAAQ;;;AClBf,mBAAwB;AAExB,IAAM,eAAe;AAEd,IAAM,mBAAe,aAAAA,SAAY,GAAG,YAAY,iBAAiB,yBAAyB,GAAG;AAC7F,IAAM,wBAAoB,aAAAA,SAAY,GAAG,YAAY,uBAAuB,yBAAyB,GAAG;AACxG,IAAM,8BAA0B,aAAAA,SAAY,GAAG,YAAY,yBAAyB,+DAA+D;AACnJ,IAAM,0BAAsB,aAAAA,SAAY,GAAG,YAAY,qBAAqB,6DAA6D,GAAG;;;AFJnJ,2BAAyB;AACzB,mBAAyB;AAKzB,IAAAC,wBAA6B;;;AGD7B,eAAsB,4BAA4B,KAAsB,QAAiC;AACrG,MAAI,CAAC,IAAI,OAAO;AACZ,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAChD;AAEA,QAAM,WAAW,MAAM,IAAI,MAAM,QAAQ,cAAc,MAAM,IAAI,KAAK;AACtE,QAAM,WAAW,MAAM,SAAS,KAAK;AACrC,QAAM,qBAAqB,SAAS,cAAc,CAAC;AACnD,QAAM,iBAAiB,mBAAmB,kBAAkB;AAC5D,QAAM,aAAa,iBAAiB;AAEpC,QAAM,IAAI,MAAM,QAAQ,cAAc,MAAM,IAAI,SAAS,KAAK,UAAU,EAAE,YAAY,EAAE,GAAG,oBAAoB,gBAAgB,WAAW,EAAE,CAAC,CAAC;AAE9I,MAAI,IAAI,OAAO;AACX,UAAM,WAAW,uBAAuB,MAAM;AAC9C,UAAM,IAAI,MAAM,IAAI,UAAU,WAAW,SAAS,CAAC;AAAA,EACvD;AAEA,SAAO;AACX;AAOA,eAAsB,yBAAyB,KAAsB,QAA+B;AAChG,MAAI,CAAC,IAAI,OAAO;AACZ,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAChD;AAEA,QAAM,WAAW,uBAAuB,MAAM;AAC9C,QAAM,IAAI,MAAM,IAAI,QAAQ;AAChC;;;ACzCO,SAAS,sBAAuB,KAAK;AAC1C,MAAI,OAAO,CAAC,IAAI,OAAO;AACrB,UAAM,IAAI,MAAM,gFAAgF;AAAA,EAClG;AACA,SAAO,IAAI,MAAM;AACnB;AAEO,SAAS,SAAU,SAAS,SAAS,eAAe,aAAa,OAAO;AAC7E,MAAI,SAAS,CAAC;AACd,QAAM,OAAO,QAAQ;AACrB,MAAI,CAAC,MAAM;AACT,WAAO,KAAK,aAAa;AACzB,WAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI,YAAY;AACd,UAAM,WAAW,QAAQ,MAAM,GAAG;AAClC,eAAW;AACX,eAAW,OAAO,UAAU;AAC1B,iBAAW,SAAS,GAAG;AAAA,IACzB;AAAA,EACF,OAAO;AACL,eAAW,KAAK,OAAO;AAAA,EACzB;AAEA,MAAI,OAAO,aAAa,UAAU;AAChC,aAAS,SAAS,MAAM,GAAG;AAAA,EAC7B,WAAW,MAAM,QAAQ,QAAQ,GAAG;AAClC,aAAS;AAAA,EACX;AACA,MAAI,OAAO,WAAW,GAAG;AACvB,WAAO,KAAK,aAAa;AAAA,EAC3B;AAEA,SAAO;AACT;AAEO,SAAS,UAAU,SAAS,WAAW,eAAe,cAAc,OAAO;AAChF,MAAI,SAAS,CAAC;AACd,QAAM,OAAO,QAAQ;AACrB,MAAI,CAAC,MAAM;AACT,WAAO,KAAK,aAAa;AACzB,WAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI,aAAa;AACf,UAAM,WAAW,UAAU,MAAM,GAAG;AACpC,gBAAY;AACZ,eAAW,OAAO,UAAU;AAC1B,kBAAY,UAAU,GAAG;AAAA,IAC3B;AAAA,EACF,OAAO;AACL,gBAAY,KAAK,SAAS;AAAA,EAC5B;AAEA,MAAI,OAAO,cAAc,UAAU;AACjC,aAAS,UAAU,MAAM,GAAG;AAAA,EAC9B,WAAW,MAAM,QAAQ,SAAS,GAAG;AACnC,aAAS;AAAA,EACX;AACA,MAAI,OAAO,WAAW,GAAG;AACvB,WAAO,KAAK,aAAa;AAAA,EAC3B;AAEA,SAAO;AACT;;;AJpDA,IAAM,iBAAiB;AACvB,IAAM,mBAAmB;AAqDlB,IAAM,wBAAsE,sBAAAC,SAAG,OAAO,KAAsB,SAAuC;AACtJ,MAAI,SAAS,qBAAqB;AAAA,IAC9B;AAAA,EACJ,CAAC;AAGD,MAAI,KAAK,OAAO;AACZ,UAAM,IAAI,SAAS,aAAAC,SAAc;AAAA,MAC7B,MAAM,KAAK,MAAM,QAAQ;AAAA,MACzB,MAAM,KAAK,MAAM,QAAQ;AAAA,MACzB,UAAU,KAAK,MAAM;AAAA,MACrB,UAAU,KAAK,MAAM;AAAA,MACrB,IAAI,KAAK,MAAM,MAAM;AAAA,IACzB,CAAC;AACD,QAAI,IAAI,KAAK,uDAAuD;AAAA,EACxE;AAEA,MAAI,KAAK,eAAe;AACpB,QAAI,SAAS,qBAAAC,SAAc;AAAA,MACvB,UAAU,KAAK,cAAc,gBAAgB;AAAA,MAC7C,OAAO,KAAK,cAAc,cAAc;AAAA,MACxC,WAAW,KAAK,cAAc,kBAAkB;AAAA,IACpD,CAAC;AAAA,EACL;AAEA,QAAM,IAAI,SAAS,aAA8C,KAAK,SAAS;AAE/E,QAAM,UAAU,KAAK,eAAe,YAAY,KAAK,eAAe,WAAW;AAC/E,QAAM,YAAY,KAAK,eAAe,cAAc,KAAK,eAAe,aAAa;AACrF,QAAM,cAAc,KAAK;AACzB,QAAM,aAAa,CAAC,CAAC,KAAK,eAAe;AACzC,QAAM,gBAAgB,KAAK,iBAAiB;AAE5C,MAAI,gBAAgB,4BAA4B,SAAS;AAEzD,iBAAe,YAAY;AAEvB,UAAM,KAAK,YAAY;AAGvB,QAAI,iBAAiB;AACrB,QAAI,eAAe,KAAK,QAAQ,6BAA6B,MAAM,aAAa;AAC5E,UAAI,KAAK,UAAU,KAAK;AACpB,yBAAiB;AAAA,MACrB,OAAO;AACH,aAAK,IAAI,KAAK,uBAAuB;AACrC,aAAK,OAAO,IAAI,MAAM,KAAK,SAAS;AAAA,UAChC,KAAK,CAAC,QAAQ,QAAQ;AAClB,gBAAI;AACJ,gBAAI,CAAC,OAAO,IAAI,SAAS,CAAC,GAAG;AACzB,oBAAM,SAAS,IAAI,SAAS,EAAE,YAAY;AAC1C,sBAAQ,OAAO,MAAM;AAAA,YACzB,OAAO;AACH,sBAAQ,OAAO,IAAI,SAAS,CAAC;AAAA,YACjC;AAEA,gBAAI,CAAC,SAAS,IAAI,SAAS,EAAE,YAAY,MAAM,QAAQ,YAAY,GAAG;AAClE,sBAAQ;AAAA,YACZ;AACA,mBAAO;AAAA,UACX;AAAA,QACJ,CAAC;AAAA,MACL;AAAA,IACJ,OAAO;AACH,YAAM,wBAAwB,KAAK,MAAM,KAAK,IAAI;AAAA,IACtD;AAEA,QAAI,gBAAgB;AAEhB,UAAI,KAAK,eAAe;AACpB,aAAK,OAAO;AAAA;AAAA,UAER,CAAC,OAAO,GAAG,KAAK,QAAQ,qBAAqB,IAAI,CAAC,KAAK,QAAQ,qBAAqB,CAAC,IAAI,CAAC,cAAc;AAAA,QAC5G;AAAA,MACJ;AAEA,UAAI,KAAK,gBAAgB;AACrB,aAAK,OAAO;AAAA;AAAA,UAER,CAAC,SAAS,GAAG,KAAK,QAAQ,uBAAuB,IAAI,CAAC,KAAK,QAAQ,uBAAuB,CAAC,IAAI,CAAC,gBAAgB;AAAA,QACpH;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ;AAEA,iBAAe,gBAAgB;AAC3B,UAAM,UAAU,KAAK,cAAc,WAAW,KAAK,cAAc,YAAY;AAE7E,mBAAe,oBAAoB;AAC/B,YAAM,YAAY,MAAM,IAAI,MAAM,QAAQ,wBAAwB,KAAK;AAEvE,UAAI,CAAC,UAAU,IAAI;AACf,cAAM;AAAA,MACV;AAEA,YAAM,QAAQ,MAAM,UAAU,KAAK;AACnC,YAAM,QAA4B,CAAC;AAAA,QAC/B,MAAM;AAAA,QACN,UAAU,OAAO,KAAK,IAAI,aAAa,QAAQ;AAAA,QAC/C,MAAM,KAAK;AAAA,QACX,MAAM,KAAK;AAAA,QACX,QAAQ,KAAK;AAAA,MACjB,CAAC;AAED,iBAAW,QAAQ,OAAO;AACtB,cAAM,aAAa,MAAM,IAAI,MAAM,QAAQ,cAAc,KAAK,EAAE,WAAW,KAAK;AAEhF,YAAI,CAAC,WAAW,IAAI;AAChB,gBAAM;AAAA,QACV;AAEA,cAAM,SAAS,MAAM,WAAW,KAAK;AAErC,mBAAW,SAAS,QAAQ;AACxB,gBAAM,WAAW,KAAK;AAEtB,cAAI,CAAC,aAAa,MAAM,IAAI,MAAM,KAAK,MAAM,GAAG;AAEhD,cAAI,CAAC,IAAI,aAAa,SAAS,MAAM,GAAG;AACpC,gBAAI,IAAI,MAAM,mBAAmB,MAAM,yBAAyB;AAChE;AAAA,UACJ;AAEA,kBAAQ,aAAa;AAAA,YACjB,KAAK;AACD,4BAAc;AACd;AAAA,YACJ,KAAK;AACD,4BAAc;AACd;AAAA,YACJ,KAAK;AACD,4BAAc;AACd;AAAA,UACR;AAEA,gBAAM,cAAc,MAAM,KAAK,OAAK,EAAE,SAAS,YAAY,EAAE,WAAW,MAAM;AAC9E,cAAI,aAAa;AACb,gBAAI,KAAK,QAAQ;AACb,0BAAY,WAAW,IAAI;AAAA,gBACvB,QAAQ;AAAA,kBACJ,QAAQ;AAAA,gBACZ;AAAA,cACJ;AAAA,YACJ,OAAO;AACH,0BAAY,WAAW,IAAI;AAAA,YAC/B;AAAA,UACJ,OAAO;AACH,kBAAM,UAA4B;AAAA,cAC9B,MAAM;AAAA,cACN;AAAA,YACJ;AAEA,gBAAI,KAAK,QAAQ;AACb,sBAAQ,WAAW,IAAI;AAAA,gBACnB,QAAQ;AAAA,kBACJ,QAAQ;AAAA,gBACZ;AAAA,cACJ;AAAA,YACJ,OAAO;AACH,sBAAQ,WAAW,IAAI;AAAA,YAC3B;AAEA,gBAAI,KAAK,UAAU;AACf,sBAAQ,WAAW;AAAA,gBACf,QAAQ;AAAA,cACZ;AAAA,YACJ;AAEA,kBAAM,KAAK,OAAO;AAAA,UACtB;AAAA,QACJ;AAAA,MACJ;AAEA,YAAM,WAAW,MAAM,OAAO,CAAC,MAAM,SAAS;AAC1C,SAAC,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI;AACrC,eAAO;AAAA,MACX,GAAG,CAAC,CAAC;AAEL,iBAAW,OAAO,UAAU;AACxB,YAAI,IAAI,KAAK,sBAAsB,GAAG,EAAE;AAExC,mBAAW,WAAW,SAAS,GAAG,GAAG;AAEjC,gBAAM,EAAE,QAAQ,UAAU,MAAM,GAAG,MAAM,IAAI;AAC7C,cAAI,IAAI,KAAK,IAAK,UAAU,SAAS,KAAK,GAAG,CAAC,KAAK,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,QAC9E;AAAA,MACJ;AAEA,YAAM,kBAAkB,OAAO,KAAK,IAAI,aAAa,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAEpH,UAAI,gBAAgB,QAAQ;AACxB,YAAI,IAAI,KAAK,+BAA+B,gBAAgB,KAAK,IAAI,CAAC,EAAE;AAAA,MAC5E;AAEA,UAAI,IAAI,MAAM,wBAAwB;AACtC,UAAI,IAAI,MAAM,KAAK;AACnB,aAAO;AAAA,IACX;AAEA,UAAM,aAAa,MAAM,kBAAkB;AAE3C,QAAI,kBAAkB,QAAQ;AAG9B,UAAM,cAAc,CAAC;AACrB,aAAS,IAAI,GAAG,IAAI,WAAW,QAAQ,KAAK;AACxC,YAAM,OAAO,WAAW,CAAC;AAEzB,UAAI,eAAe;AACnB,UAAI,KAAK,QAAQ;AACb,uBAAe,CAAC,KAAK,MAAM;AAAA,MAC/B,WAAW,KAAK,UAAU;AACtB,uBAAe,CAAC,GAAG,KAAK,QAAQ;AAAA,MACpC,OAAO;AACH,cAAM,IAAI,MAAM,wCAAwC,CAAC,EAAE;AAAA,MAC/D;AAEA,iBAAW,cAAc,cAAc;AACnC,cAAM,UAAU,EAAE,GAAG,MAAM,QAAQ,YAAY,UAAU,OAAU;AACnE,YAAI,CAAC,IAAI,aAAa,SAAS,QAAQ,MAAM,GAAG;AAC5C,gBAAM,IAAI,MAAM,mBAAmB,UAAU,2BAA2B,CAAC,EAAE;AAAA,QAC/E;AAEA,YAAI,CAAC,YAAY,UAAU,GAAG;AAC1B,sBAAY,UAAU,IAAI,CAAC;AAAA,QAC/B;AACA,oBAAY,UAAU,EAAE,KAAK,OAAO;AAAA,MACxC;AAAA,IACJ;AAEA,eAAW,aAAa,OAAO,KAAK,IAAI,aAAa,QAAQ,GAAG;AA2B5D,UAAS,cAAT,SAAqB,KAA0B;AAC3C,eAAO,CAAC;AAAA,MACZ;AA5BA,YAAM,QAAQ,YAAY,SAAS,KAAK,CAAC;AACzC,YAAM,OAAO,IAAI,aAAa,SAAS,SAAS;AAGhD,UAAI;AACJ,YAAM,sBAAsB;AAE5B,UAAI,4BAA4B,qBAAqB;AACjD,cAAM,IAAI,MAAM,4BAA4B,SAAS,wCAAwC;AAAA,MACjG;AAGA,UAAI,aAAa;AACb,cAAM,KAAK;AAAA,UACP,MAAM;AAAA,UACN,MAAM;AAAA,UACN,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,YAAY;AAAA,QAChB,CAAC;AAAA,MACL;AAIA,sCAAgC,MAAM,KAAK;AAM3C,UAAI,aAAa,eAAe,WAAW;AAAA,QACvC,MAAM,KAAK,cAAc,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,IAAI,CAAC,GAAG;AAC/D,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,aAAa,EAAE,GAAG,UAAU,OAAO,KAAK,OAAO,CAAC;AAAA,UAC3D;AACA,gBAAM,UAAU,sBAAsB,GAAG;AACzC,gBAAM,OAAO,MAAM,uBAAuB,KAAK,OAAO,SAAS,eAAe,UAAU;AACxF,8BAAoB,KAAK,MAAM,UAAU,OAAO,KAAK,IAAI,aAAa,SAAS,SAAS,EAAE,MAAM,CAAC;AACjG,kBAAQ,MAAM,gBAAgB,KAAK,KAAK,MAAM,OAAO,QAAQ,IAAI;AAEjE,iBAAO,aAAa,EAAE,GAAG,UAAU,OAAO,KAAK,OAAO,CAAC;AAAA,QAC3D;AAAA,QACA,MAAM,KAAK,cAAc,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,GAAG;AAC1D,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,aAAa,EAAE,KAAK,OAAO,QAAQ,GAAG,SAAS,CAAC;AAAA,UAC3D;AACA,gBAAM,UAAU,sBAAsB,GAAG;AACzC,gBAAM,OAAO,MAAM,uBAAuB,KAAK,OAAO,SAAS,eAAe,UAAU;AAExF,cAAI,CAAC,KAAK,MAAM;AACZ,kBAAM,IAAI,aAAa;AAAA,UAC3B;AACA,8BAAoB,KAAK,MAAM,MAAM;AACrC,mCAAyB,KAAK,MAAM,KAAK;AAEzC,cAAI,KAAK,UAAU;AACf,uBAAW,OAAO,OAAO,KAAK,KAAK,QAAQ,GAAG;AAC1C,oBAAM,WAAW,KAAK,SAAS,GAAG;AAClC,kBAAI,OAAO,aAAa,YAAY;AAChC,sBAAM,GAAG,IAAI,MAAM,SAAS,EAAE,MAAM,QAAQ,MAAM,KAAK,MAAM,CAAC;AAAA,cAClE,OAAO;AACH,sBAAM,GAAG,IAAI,QAAQ,KAAK,QAAQ;AAAA,cACtC;AAAA,YACJ;AAAA,UACJ;AAEA,gBAAM,oBAAoB,MAAM,KAAK,UAAU,MAAM;AACrD,gBAAM,kBAAkB,CAAC;AACzB,0BAAgB,KAAK,UAAU,IAAI,EAAE,IAAI,MAAM,KAAK,UAAU,EAAE;AAEhE,cAAI,mBAAmB;AACnB,kBAAM,QAAQ,MAAM,gBAAgB,KAAK,KAAK,MAAM,iBAAiB,QAAQ,IAAI;AAEjF,kBAAM,QAAQ,MAAM,KAAK,KAAK;AAAA,cAC1B;AAAA,cACA;AAAA,cACA;AAAA,YACJ,CAAC;AAED,gBAAI,MAAM,WAAW,GAAG;AACpB,oBAAM,IAAI,aAAa;AAAA,YAC3B;AAEA,mBAAO,aAAa,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,UAC3D;AAEA,iBAAO,aAAa,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,QAC3D;AAAA,QAEA,MAAM,OAAO,gBAAgB,EAAE,QAAQ,KAAK,QAAQ,GAAG,SAAS,GAAG;AAC/D,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,eAAe,EAAE,QAAQ,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,UAC9D;AACA,gBAAM,UAAU,sBAAsB,GAAG;AACzC,gBAAM,OAAO,MAAM,uBAAuB,KAAK,OAAO,SAAS,eAAe,UAAU;AAExF,cAAI,CAAC,KAAK,MAAM;AACZ,kBAAM,IAAI,aAAa;AAAA,UAC3B;AAEA,8BAAoB,KAAK,MAAM,MAAM;AACrC,mCAAyB,KAAK,MAAM,MAAM;AAG1C,cAAI,KAAK,UAAU;AACf,uBAAW,SAAS,QAAQ;AACxB,yBAAW,OAAO,OAAO,KAAK,KAAK,QAAQ,GAAG;AAC1C,sBAAM,WAAW,KAAK,SAAS,GAAG;AAClC,oBAAI,OAAO,aAAa,YAAY;AAChC,wBAAM,GAAG,IAAI,MAAM,SAAS,EAAE,MAAM,QAAQ,MAAM,KAAK,MAAM,CAAC;AAAA,gBAClE,OAAO;AACH,wBAAM,GAAG,IAAI,QAAQ,KAAK,QAAQ;AAAA,gBACtC;AAAA,cACJ;AAAA,YACJ;AAAA,UACJ;AAEA,iBAAO,eAAe,EAAE,QAAQ,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,QAC9D;AAAA,QAEA,MAAM,OAAO,gBAAgB,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,GAAG;AAC9D,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,eAAe,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,UAC7D;AACA,gBAAM,UAAU,sBAAsB,GAAG;AACzC,gBAAM,OAAO,MAAM,uBAAuB,KAAK,OAAO,SAAS,eAAe,UAAU;AAExF,kBAAQ,MAAM,gBAAgB,KAAK,KAAK,QAAQ,OAAO,QAAQ,IAAI;AAEnE,iBAAO,eAAe,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,QAC7D;AAAA,QAEA,MAAM,WAAW,oBAAoB,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,GAAG;AACtE,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,mBAAmB,EAAE,GAAG,UAAU,OAAO,KAAK,OAAO,CAAC;AAAA,UACjE;AACA,gBAAM,UAAU,sBAAsB,GAAG;AACzC,gBAAM,OAAO,MAAM,uBAAuB,KAAK,OAAO,SAAS,eAAe,UAAU;AAExF,kBAAQ,MAAM,gBAAgB,KAAK,KAAK,YAAY,OAAO,QAAQ,IAAI;AAEvE,iBAAO,mBAAmB,EAAE,GAAG,UAAU,OAAO,KAAK,OAAO,CAAC;AAAA,QACjE;AAAA,MACJ,CAAC;AAAA,IACL;AAAA,EACJ;AAEA,iBAAe,iBAAiB;AAC5B,eAAW,aAAa,OAAO,KAAK,IAAI,aAAa,QAAQ,GAAG;AAW5D,UAAS,cAAT,SAAqB,KAA0B;AAC3C,eAAO,CAAC;AAAA,MACZ;AATA,UAAI;AACJ,YAAM,sBAAsB;AAE5B,UAAI,4BAA4B,qBAAqB;AACjD,cAAM,IAAI,MAAM,4BAA4B,SAAS,wCAAwC;AAAA,MACjG;AAMA,UAAI,aAAa,eAAe,WAAW;AAAA,QACvC,MAAM,KAAK,cAAc,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,IAAI,CAAC,GAAG;AAC/D,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,aAAa,EAAE,GAAG,UAAU,OAAO,KAAK,OAAO,CAAC;AAAA,UAC3D;AACA,gBAAM,wBAAwB,KAAK,WAAW,QAAQ,WAAW,eAAe,UAAU;AAK1F,iBAAO,aAAa,EAAE,GAAG,UAAU,OAAO,KAAK,OAAO,CAAC;AAAA,QAC3D;AAAA,QACA,MAAM,KAAK,cAAc,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,GAAG;AAC1D,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,aAAa,EAAE,KAAK,OAAO,QAAQ,GAAG,SAAS,CAAC;AAAA,UAC3D;AACA,gBAAM,wBAAwB,KAAK,WAAW,QAAQ,WAAW,eAAe,UAAU;AAoC1F,iBAAO,aAAa,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,QAC3D;AAAA,QAEA,MAAM,OAAO,gBAAgB,EAAE,QAAQ,KAAK,QAAQ,GAAG,SAAS,GAAG;AAC/D,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,eAAe,EAAE,QAAQ,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,UAC9D;AACA,gBAAM,wBAAwB,KAAK,WAAW,UAAU,WAAW,eAAe,UAAU;AAmB5F,iBAAO,eAAe,EAAE,QAAQ,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,QAC9D;AAAA,QAEA,MAAM,OAAO,gBAAgB,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,GAAG;AAC9D,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,eAAe,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,UAC7D;AACA,gBAAM,wBAAwB,KAAK,WAAW,UAAU,WAAW,eAAe,UAAU;AAI5F,iBAAO,eAAe,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,QAC7D;AAAA,QAEA,MAAM,WAAW,oBAAoB,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,GAAG;AACtE,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,mBAAmB,EAAE,GAAG,UAAU,OAAO,KAAK,OAAO,CAAC;AAAA,UACjE;AACA,gBAAM,wBAAwB,KAAK,WAAW,cAAc,WAAW,eAAe,UAAU;AAIhG,iBAAO,mBAAmB,EAAE,GAAG,UAAU,OAAO,KAAK,OAAO,CAAC;AAAA,QACjE;AAAA,MACJ,CAAC;AAAA,IACL;AAAA,EACJ;AAEA,MAAI,QAAQ,WAAW,iBAAkB;AACrC,QAAI,KAAK,eAAe;AACpB,YAAM,cAAc;AAAA,IACxB;AAEA,QAAI,KAAK,gBAAgB;AACrB,YAAM,eAAe;AAAA,IACzB;AAAA,EACJ,CAAC;AACL,GAAG,EAAE,MAAM,8BAA8B,CAAC;AAE1C,eAAe,gBAAgB,KAA0B,MAAM,OAAO,MAAM;AACxE,MAAI,CAAC,MAAM;AACP,UAAM,IAAI,aAAa;AAAA,EAC3B;AACA,QAAM,UAAU,sBAAsB,GAAG;AAEzC,UAAQ,SAAS,CAAC;AAElB,MAAI,OAAO,SAAS,UAAU;AAC1B,UAAM,EAAE,OAAO,IAAI;AAGnB,QAAI,QAAQ;AACR,iBAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACnC,cAAM,UAAU,OAAO,GAAG;AAC1B,YAAI,OAAO,YAAY,UAAU;AAE7B,gBAAM,GAAG,IAAI;AAAA,YACT,IAAI,QAAQ,KAAK,OAAO;AAAA,UAC5B;AAAA,QACJ,OAAO;AAKH,qBAAW,aAAa,OAAO,KAAK,OAAO,GAAG;AAC1C,kBAAM,SAAS,QAAQ,SAAS;AAChC,kBAAM,GAAG,IAAI;AAAA,cACT,CAAC,SAAS,GAAG,QAAQ,KAAK,MAAM;AAAA,YACpC;AAAA,UACJ;AAAA,QACJ;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ,WAAW,OAAO,SAAS,YAAY;AACnC,YAAQ,MAAM,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;AAAA,EAC3C;AACA,SAAO;AACX;AAEA,eAAsB,uBAAuB,KAA0B,OAA2B,SAAiB,eAAuB,aAAa,OAAO;AAC1J,QAAM,UAAU,sBAAsB,GAAG;AACzC,QAAM,QAAQ,yBAAyB;AACvC,QAAM,QAAQ,SAAS,SAAS,SAAS,eAAe,UAAU;AAClE,QAAM,OAAO,kBAAS,OAAO,KAAK;AAClC,MAAI,CAAC,MAAM;AACP,QAAI,MAAM,QAAQ,IAAI,KAAK,EAAE,OAAO,MAAM,GAAG,mBAAmB;AAChE,UAAM,IAAI,aAAa;AAAA,EAC3B;AACA,MAAI,MAAM,QAAQ,IAAI,MAAM,EAAE,OAAO,KAAK,GAAG,YAAY;AACzD,SAAO;AACX;AAEA,eAAsB,wBAAwB,KAA0B,WAAmB,QAAuB,WAAmB,eAAuB,cAAc,OAAO;AAC7K,QAAM,UAAU,sBAAsB,GAAG;AACzC,QAAM,QAAQ,yBAAyB;AACvC,QAAM,SAAS,UAAU,SAAS,WAAW,eAAe,WAAW;AACvE,QAAM,QAAQ,OAAO,KAAK,OAAK;AAC3B,QAAI,MAAM,kBAAkB;AACxB,aAAO;AAAA,IACX;AAEA,QAAI,WAAW,QAAQ;AACnB,aAAO,MAAM,GAAG,MAAM,IAAI,SAAS;AAAA,IACvC,OACK;AACD,aAAO,MAAM,GAAG,MAAM,IAAI,SAAS,MAAM,MAAM,QAAQ,SAAS;AAAA,IACpE;AAAA,EACJ,CAAC;AAED,MAAI,CAAC,OAAO;AACR,QAAI,MAAM,QAAQ,IAAI,KAAK,gBAAgB;AAC3C,UAAM,IAAI,aAAa;AAAA,EAC3B;AACA,MAAI,MAAM,QAAQ,IAAI,MAAM,EAAE,QAAQ,MAAM,GAAG,aAAa;AAChE;AAEO,SAAS,oBAAoB,MAAM,QAAQ;AAC9C,MAAI,CAAC,MAAM;AACP,UAAM,IAAI,aAAa;AAAA,EAC3B;AACA,QAAM,EAAE,QAAQ,eAAe,IAAI;AAEnC,MAAI,gBAAgB;AAChB,eAAW,SAAS,QAAQ;AACxB,UAAI,CAAC,eAAe,SAAS,KAAK,GAAG;AACjC,cAAM,IAAI,kBAAkB,KAAK;AAAA,MACrC;AAAA,IACJ;AAAA,EACJ;AACJ;AAEA,IAAM,iBAAiB,CAAC,QAAQ,mBAAmB;AAC/C,aAAW,SAAS,QAAQ;AACxB,UAAM,cAAc,OAAO,KAAK,KAAK;AACrC,eAAW,cAAc,aAAa;AAClC,UAAI,CAAC,eAAe,SAAS,UAAU,GAAG;AACtC,cAAM,IAAI,kBAAkB,UAAU;AAAA,MAC1C;AAAA,IACJ;AAAA,EACJ;AACJ;AAEA,SAAS,yBAAyB,MAAM,QAAQ;AAC5C,QAAM,EAAE,QAAQ,eAAe,IAAI;AAEnC,MAAI,gBAAgB;AAChB,QAAI,CAAC,MAAM,QAAQ,MAAM,GAAG;AAExB,qBAAe,CAAC,MAAM,GAAG,cAAc;AAAA,IAC3C,OAAO;AAEH,qBAAe,QAAQ,cAAc;AAAA,IACzC;AAAA,EACJ;AACJ;AAEA,SAAS,gCAAgC,MAAc,OAAO;AAE1D,QAAM,kBACF,OAAO,OAAO,KAAK,MAAM,EACpB,OAAO,OAAM,CAAC,EAAE,cAAc,CAAC,EAAE,UAAW,EAC5C,IAAI,CAAC,EAAE,UAAU,MAAO,SAAU;AAE3C,aAAW,QAAQ,OAAO;AACtB,UAAM,EAAE,QAAQ,KAAK,IAAI;AACzB,QAAI,QAAQ,KAAK,QAAQ;AACrB,YAAM,SAAS,KAAK;AACpB,iBAAW,UAAU,iBAAiB;AAClC,YAAI,CAAC,OAAO,SAAS,MAAM,GAAG;AAC1B,gBAAM,IAAI,wBAAwB,QAAQ,MAAM;AAAA,QACpD;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ;AACJ;AAMA,eAAe,wBAAwB,KAAsB,MAAoC,OAAO,MAAM;AAE1G,MAAI,CAAC,KAAK,2BAA2B,CAAC,KAAK,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM;AACrE;AAAA,EACJ;AAEA,QAAM,oBAAoB,KAAK,qBAAqB;AACpD,QAAM,eAAe,OAAO,iBAAiB;AAC7C,QAAM,SAAS,MAAM;AAErB,MAAI;AACA,UAAM,WAAW,uBAAuB,MAAM;AAC9C,UAAM,oBAAoB,MAAM,IAAI,MAAM,IAAI,QAAQ;AACtD,UAAM,iBAAiB,SAAS,mBAAmB,EAAE;AAErD,QAAI,sBAAsB,MAAM;AAC5B,YAAM,IAAI,MAAM,IAAI,UAAU,aAAa,SAAS,CAAC;AACrD,UAAI,IAAI,MAAM,EAAE,QAAQ,SAAS,aAAa,GAAG,0CAA0C;AAC3F,UAAI,eAAe,GAAG;AAClB,YAAI,IAAI,KAAK;AAAA,UACT;AAAA,UACA;AAAA,UACA;AAAA,QACJ,GAAG,uCAAuC;AAC1C,cAAM,IAAI,oBAAoB;AAAA,MAClC;AACA;AAAA,IACJ;AAGA,QAAI,mBAAmB,cAAc;AACjC,UAAI,IAAI,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,MACJ,GAAG,uCAAuC;AAC1C,YAAM,IAAI,oBAAoB;AAAA,IAClC;AAEA,QAAI,IAAI,MAAM,EAAE,QAAQ,SAAS,aAAa,GAAG,4BAA4B;AAAA,EACjF,SAAS,OAAO;AACZ,QAAI,MAAM,SAAS,kBAAkB,MAAM,SAAS,gCAAgC;AAChF,YAAM;AAAA,IACV;AACA,QAAI,IAAI,MAAM,EAAE,KAAK,OAAO,OAAO,GAAG,8BAA8B;AAAA,EACxE;AACJ;AAEA,IAAO,gBAAQ;","names":["createError","import_fastify_logto","fp","fastifyRedis","fastifyLogto"]}

package/lib/index.d.cts

@@ -20,6 +20,7 @@ declare function deletePermissionsVersion(app: FastifyInstance, userId: string):
 declare function getRequestFromContext(ctx: any): any;
 declare function getRoles(request: any, roleKey: any, anonymousRole: any, isRolePath?: boolean): any[];
 
+type EntityActions = 'find' | 'save' | 'insert' | 'updateMany' | 'delete';
 type PlatformaticRule = {
     role: string;
     entity?: string;
@@ -38,19 +39,27 @@ type RedisConfig = {
     username?: string;
     db?: number;
 };
-type PlatformaticLogtoAuthOptions = {
+type PlatformaticLogToRoleBasedAuthOptions = {
     logtoBaseUrl?: string;
     logtoAppId?: string;
     logtoAppSecret?: string;
-    adminSecret?: string;
     rolePath?: string;
     roleKey?: string;
     userPath?: string;
     userKey?: string;
-    anonymousRole?: string;
-    allowAnonymous?: boolean;
+};
+type PlatformaticLogToScopeBasedAuthOptions = {
+    scopesPath?: string;
+    scopesKey?: string;
+};
+type PlatformaticLogtoAuthOptions = {
+    adminSecret?: string;
+    roleBasedAuth?: PlatformaticLogToRoleBasedAuthOptions;
+    scopeBasedAuth?: PlatformaticLogToScopeBasedAuthOptions;
     checks?: boolean;
     defaults?: boolean;
+    anonymousRole?: string;
+    allowAnonymous?: boolean;
     jwtPlugin: FastifyUserPluginOptions;
     redis?: RedisConfig;
     enableTokenVersionCheck?: boolean;
@@ -58,6 +67,7 @@ type PlatformaticLogtoAuthOptions = {
 };
 declare const platformaticLogto: FastifyPluginAsync<PlatformaticLogtoAuthOptions>;
 declare function findRuleForRequestUser(ctx: PlatformaticContext, rules: PlatformaticRule[], roleKey: string, anonymousRole: string, isRolePath?: boolean): Promise<any>;
+declare function findScopeForRequestUser(ctx: PlatformaticContext, entityKey: string, action: EntityActions, scopesKey: string, anonymousRole: string, isScopePath?: boolean): Promise<void>;
 declare function checkFieldsFromRule(rule: any, fields: any): void;
 
 declare module 'fastify' {
@@ -69,4 +79,4 @@ declare module 'fastify' {
     }
 }
 
-export { type PlatformaticLogtoAuthOptions, type PlatformaticRule, type RedisConfig, checkFieldsFromRule, platformaticLogto as default, deletePermissionsVersion, findRuleForRequestUser, getRequestFromContext, getRoles, incrementPermissionsVersion, platformaticLogto };
+export { type EntityActions, type PlatformaticLogToRoleBasedAuthOptions, type PlatformaticLogToScopeBasedAuthOptions, type PlatformaticLogtoAuthOptions, type PlatformaticRule, type RedisConfig, checkFieldsFromRule, platformaticLogto as default, deletePermissionsVersion, findRuleForRequestUser, findScopeForRequestUser, getRequestFromContext, getRoles, incrementPermissionsVersion, platformaticLogto };

package/lib/index.d.ts

@@ -20,6 +20,7 @@ declare function deletePermissionsVersion(app: FastifyInstance, userId: string):
 declare function getRequestFromContext(ctx: any): any;
 declare function getRoles(request: any, roleKey: any, anonymousRole: any, isRolePath?: boolean): any[];
 
+type EntityActions = 'find' | 'save' | 'insert' | 'updateMany' | 'delete';
 type PlatformaticRule = {
     role: string;
     entity?: string;
@@ -38,19 +39,27 @@ type RedisConfig = {
     username?: string;
     db?: number;
 };
-type PlatformaticLogtoAuthOptions = {
+type PlatformaticLogToRoleBasedAuthOptions = {
     logtoBaseUrl?: string;
     logtoAppId?: string;
     logtoAppSecret?: string;
-    adminSecret?: string;
     rolePath?: string;
     roleKey?: string;
     userPath?: string;
     userKey?: string;
-    anonymousRole?: string;
-    allowAnonymous?: boolean;
+};
+type PlatformaticLogToScopeBasedAuthOptions = {
+    scopesPath?: string;
+    scopesKey?: string;
+};
+type PlatformaticLogtoAuthOptions = {
+    adminSecret?: string;
+    roleBasedAuth?: PlatformaticLogToRoleBasedAuthOptions;
+    scopeBasedAuth?: PlatformaticLogToScopeBasedAuthOptions;
     checks?: boolean;
     defaults?: boolean;
+    anonymousRole?: string;
+    allowAnonymous?: boolean;
     jwtPlugin: FastifyUserPluginOptions;
     redis?: RedisConfig;
     enableTokenVersionCheck?: boolean;
@@ -58,6 +67,7 @@ type PlatformaticLogtoAuthOptions = {
 };
 declare const platformaticLogto: FastifyPluginAsync<PlatformaticLogtoAuthOptions>;
 declare function findRuleForRequestUser(ctx: PlatformaticContext, rules: PlatformaticRule[], roleKey: string, anonymousRole: string, isRolePath?: boolean): Promise<any>;
+declare function findScopeForRequestUser(ctx: PlatformaticContext, entityKey: string, action: EntityActions, scopesKey: string, anonymousRole: string, isScopePath?: boolean): Promise<void>;
 declare function checkFieldsFromRule(rule: any, fields: any): void;
 
 declare module 'fastify' {
@@ -69,4 +79,4 @@ declare module 'fastify' {
     }
 }
 
-export { type PlatformaticLogtoAuthOptions, type PlatformaticRule, type RedisConfig, checkFieldsFromRule, platformaticLogto as default, deletePermissionsVersion, findRuleForRequestUser, getRequestFromContext, getRoles, incrementPermissionsVersion, platformaticLogto };
+export { type EntityActions, type PlatformaticLogToRoleBasedAuthOptions, type PlatformaticLogToScopeBasedAuthOptions, type PlatformaticLogtoAuthOptions, type PlatformaticRule, type RedisConfig, checkFieldsFromRule, platformaticLogto as default, deletePermissionsVersion, findRuleForRequestUser, findScopeForRequestUser, getRequestFromContext, getRoles, incrementPermissionsVersion, platformaticLogto };

package/lib/index.js

@@ -92,9 +92,37 @@ function getRoles(request, roleKey, anonymousRole, isRolePath = false) {
   }
   return output;
 }
+function getScopes(request, scopesKey, anonymousRole, isScopePath = false) {
+  let output = [];
+  const user = request.user;
+  if (!user) {
+    output.push(anonymousRole);
+    return output;
+  }
+  let scopesRaw;
+  if (isScopePath) {
+    const roleKeys = scopesKey.split(".");
+    scopesRaw = user;
+    for (const key of roleKeys) {
+      scopesRaw = scopesRaw[key];
+    }
+  } else {
+    scopesRaw = user[scopesKey];
+  }
+  if (typeof scopesRaw === "string") {
+    output = scopesRaw.split(" ");
+  } else if (Array.isArray(scopesRaw)) {
+    output = scopesRaw;
+  }
+  if (output.length === 0) {
+    output.push(anonymousRole);
+  }
+  return output;
+}
 
 // src/index.ts
 var PLT_ADMIN_ROLE = "platformatic-admin";
+var PLT_ADMIN_SCOPES = "*";
 var platformaticLogto = fp(async (app, opts) => {
   app.decorate("platformaticLogTo", {
     opts
@@ -109,107 +137,19 @@ var platformaticLogto = fp(async (app, opts) => {
     });
     app.log.info("Redis client registered for permissions version check");
   }
-  app.register(fastifyLogto, {
-    endpoint: opts.logtoBaseUrl || "https://auth.example.com",
-    appId: opts.logtoAppId || "your-app-id",
-    appSecret: opts.logtoAppSecret || "your-app-secret"
-  });
+  if (opts.roleBasedAuth) {
+    app.register(fastifyLogto, {
+      endpoint: opts.roleBasedAuth.logtoBaseUrl || "https://auth.example.com",
+      appId: opts.roleBasedAuth.logtoAppId || "your-app-id",
+      appSecret: opts.roleBasedAuth.logtoAppSecret || "your-app-secret"
+    });
+  }
   await app.register(fastifyUser, opts.jwtPlugin);
+  const roleKey = opts.roleBasedAuth?.rolePath || opts.roleBasedAuth?.roleKey || "X-PLATFORMATIC-ROLE";
+  const scopesKey = opts.scopeBasedAuth.scopesPath || opts.scopeBasedAuth.scopesKey || "X-PLATFORMATIC-SCOPES";
   const adminSecret = opts.adminSecret;
-  const roleKey = opts.rolePath || opts.roleKey || "X-PLATFORMATIC-ROLE";
-  const userKey = opts.userPath || opts.userKey || "X-PLATFORMATIC-USER-ID";
-  const isRolePath = !!opts.rolePath;
+  const isRolePath = !!opts.roleBasedAuth?.rolePath;
   const anonymousRole = opts.anonymousRole || "anonymous";
-  async function composeLogToRules() {
-    const rolesResp = await app.logto.callAPI("/api/roles?type=User", "GET");
-    if (!rolesResp.ok) {
-      throw rolesResp;
-    }
-    const roles = await rolesResp.json();
-    const rules = [{
-      role: anonymousRole,
-      entities: Object.keys(app.platformatic.entities),
-      find: opts.allowAnonymous,
-      save: opts.allowAnonymous,
-      delete: opts.allowAnonymous
-    }];
-    for (const role of roles) {
-      const scopesResp = await app.logto.callAPI(`/api/roles/${role.id}/scopes`, "GET");
-      if (!scopesResp.ok) {
-        throw scopesResp;
-      }
-      const scopes = await scopesResp.json();
-      for (const scope of scopes) {
-        const roleName = role.name;
-        let [scopeAction, entity] = scope.name.split(":");
-        if (!app.platformatic.entities[entity]) {
-          app.log.debug(`Unknown entity '${entity}' in authorization rule`);
-          continue;
-        }
-        switch (scopeAction) {
-          case "create":
-            scopeAction = "save";
-            break;
-          case "read":
-            scopeAction = "find";
-            break;
-          case "update":
-            scopeAction = "updateMany";
-            break;
-        }
-        const checkExists = rules.find((r) => r.role === roleName && r.entity === entity);
-        if (checkExists) {
-          if (opts.checks) {
-            checkExists[scopeAction] = {
-              checks: {
-                userId: userKey
-              }
-            };
-          } else {
-            checkExists[scopeAction] = true;
-          }
-        } else {
-          const newRule = {
-            role: roleName,
-            entity
-          };
-          if (opts.checks) {
-            newRule[scopeAction] = {
-              checks: {
-                userId: userKey
-              }
-            };
-          } else {
-            newRule[scopeAction] = true;
-          }
-          if (opts.defaults) {
-            newRule.defaults = {
-              userId: userKey
-            };
-          }
-          rules.push(newRule);
-        }
-      }
-    }
-    const logRules = rules.reduce((prev, curr) => {
-      (prev[curr["role"]] ??= []).push(curr);
-      return prev;
-    }, {});
-    for (const key in logRules) {
-      app.log.info(`Rules set for role ${key}`);
-      for (const element of logRules[key]) {
-        const { entity, entities, role, ...other } = element;
-        app.log.info(`	${entity ?? entities.join(",")}: ${JSON.stringify(other)}`);
-      }
-    }
-    const missingEntities = Object.keys(app.platformatic.entities).filter((e) => !rules.map((r) => r.entity).includes(e));
-    if (missingEntities.length) {
-      app.log.warn(`Missing rules for entities: ${missingEntities.join(", ")}`);
-    }
-    app.log.debug("LogTo calculated rules");
-    app.log.debug(rules);
-    return rules;
-  }
   app.decorateRequest("setupDBAuthorizationUser", setupUser);
   async function setupUser() {
     await this.extractUser();
@@ -239,13 +179,112 @@ var platformaticLogto = fp(async (app, opts) => {
       await checkPermissionsVersion(app, opts, this.user);
     }
     if (forceAdminRole) {
-      this.user = {
-        // ...request.user,
-        [roleKey]: this.headers["x-platformatic-role"] ? [this.headers["x-platformatic-role"]] : [PLT_ADMIN_ROLE]
-      };
+      if (opts.roleBasedAuth) {
+        this.user = {
+          // ...request.user,
+          [roleKey]: this.headers["x-platformatic-role"] ? [this.headers["x-platformatic-role"]] : [PLT_ADMIN_ROLE]
+        };
+      }
+      if (opts.scopeBasedAuth) {
+        this.user = {
+          // ...request.user,
+          [scopesKey]: this.headers["x-platformatic-scopes"] ? [this.headers["x-platformatic-scopes"]] : [PLT_ADMIN_SCOPES]
+        };
+      }
     }
   }
-  app.addHook("onReady", async function() {
+  async function roleBasedAuth() {
+    const userKey = opts.roleBasedAuth.userKey || opts.roleBasedAuth.userPath || "X-PLATFORMATIC-USER-ID";
+    async function composeLogToRules() {
+      const rolesResp = await app.logto.callAPI("/api/roles?type=User", "GET");
+      if (!rolesResp.ok) {
+        throw rolesResp;
+      }
+      const roles = await rolesResp.json();
+      const rules = [{
+        role: anonymousRole,
+        entities: Object.keys(app.platformatic.entities),
+        find: opts.allowAnonymous,
+        save: opts.allowAnonymous,
+        delete: opts.allowAnonymous
+      }];
+      for (const role of roles) {
+        const scopesResp = await app.logto.callAPI(`/api/roles/${role.id}/scopes`, "GET");
+        if (!scopesResp.ok) {
+          throw scopesResp;
+        }
+        const scopes = await scopesResp.json();
+        for (const scope of scopes) {
+          const roleName = role.name;
+          let [scopeAction, entity] = scope.name.split(":");
+          if (!app.platformatic.entities[entity]) {
+            app.log.debug(`Unknown entity '${entity}' in authorization rule`);
+            continue;
+          }
+          switch (scopeAction) {
+            case "create":
+              scopeAction = "save";
+              break;
+            case "read":
+              scopeAction = "find";
+              break;
+            case "update":
+              scopeAction = "updateMany";
+              break;
+          }
+          const checkExists = rules.find((r) => r.role === roleName && r.entity === entity);
+          if (checkExists) {
+            if (opts.checks) {
+              checkExists[scopeAction] = {
+                checks: {
+                  userId: userKey
+                }
+              };
+            } else {
+              checkExists[scopeAction] = true;
+            }
+          } else {
+            const newRule = {
+              role: roleName,
+              entity
+            };
+            if (opts.checks) {
+              newRule[scopeAction] = {
+                checks: {
+                  userId: userKey
+                }
+              };
+            } else {
+              newRule[scopeAction] = true;
+            }
+            if (opts.defaults) {
+              newRule.defaults = {
+                userId: userKey
+              };
+            }
+            rules.push(newRule);
+          }
+        }
+      }
+      const logRules = rules.reduce((prev, curr) => {
+        (prev[curr["role"]] ??= []).push(curr);
+        return prev;
+      }, {});
+      for (const key in logRules) {
+        app.log.info(`Rules set for role ${key}`);
+        for (const element of logRules[key]) {
+          const { entity, entities, role, ...other } = element;
+          app.log.info(`	${entity ?? entities.join(",")}: ${JSON.stringify(other)}`);
+        }
+      }
+      const missingEntities = Object.keys(app.platformatic.entities).filter((e) => !rules.map((r) => r.entity).includes(e));
+      if (missingEntities.length) {
+        app.log.warn(`Missing rules for entities: ${missingEntities.join(", ")}`);
+      }
+      app.log.debug("LogTo calculated rules");
+      app.log.debug(rules);
+      return rules;
+    }
     const logToRules = await composeLogToRules();
     app.platformaticLogTo.rules = logToRules;
     const entityRules = {};
@@ -385,6 +424,63 @@ var platformaticLogto = fp(async (app, opts) => {
         }
       });
     }
+  }
+  async function scopeBasedAuth() {
+    for (const entityKey of Object.keys(app.platformatic.entities)) {
+      let useOriginal = function(ctx) {
+        return !ctx;
+      };
+      let userPropToFillForPublish;
+      const topicsWithoutChecks = false;
+      if (userPropToFillForPublish && topicsWithoutChecks) {
+        throw new Error(`Subscription for entity "${entityKey}" have conflictling rules across roles`);
+      }
+      app.platformatic.addEntityHooks(entityKey, {
+        async find(originalFind, { where, ctx, fields, ...restOpts } = {}) {
+          if (useOriginal(ctx)) {
+            return originalFind({ ...restOpts, where, ctx, fields });
+          }
+          await findScopeForRequestUser(ctx, entityKey, "find", scopesKey, anonymousRole, isRolePath);
+          return originalFind({ ...restOpts, where, ctx, fields });
+        },
+        async save(originalSave, { input, ctx, fields, ...restOpts }) {
+          if (useOriginal(ctx)) {
+            return originalSave({ ctx, input, fields, ...restOpts });
+          }
+          await findScopeForRequestUser(ctx, entityKey, "save", scopesKey, anonymousRole, isRolePath);
+          return originalSave({ input, ctx, fields, ...restOpts });
+        },
+        async insert(originalInsert, { inputs, ctx, fields, ...restOpts }) {
+          if (useOriginal(ctx)) {
+            return originalInsert({ inputs, ctx, fields, ...restOpts });
+          }
+          await findScopeForRequestUser(ctx, entityKey, "insert", scopesKey, anonymousRole, isRolePath);
+          return originalInsert({ inputs, ctx, fields, ...restOpts });
+        },
+        async delete(originalDelete, { where, ctx, fields, ...restOpts }) {
+          if (useOriginal(ctx)) {
+            return originalDelete({ where, ctx, fields, ...restOpts });
+          }
+          await findScopeForRequestUser(ctx, entityKey, "delete", scopesKey, anonymousRole, isRolePath);
+          return originalDelete({ where, ctx, fields, ...restOpts });
+        },
+        async updateMany(originalUpdateMany, { where, ctx, fields, ...restOpts }) {
+          if (useOriginal(ctx)) {
+            return originalUpdateMany({ ...restOpts, where, ctx, fields });
+          }
+          await findScopeForRequestUser(ctx, entityKey, "updateMany", scopesKey, anonymousRole, isRolePath);
+          return originalUpdateMany({ ...restOpts, where, ctx, fields });
+        }
+      });
+    }
+  }
+  app.addHook("onReady", async function() {
+    if (opts.roleBasedAuth) {
+      await roleBasedAuth();
+    }
+    if (opts.scopeBasedAuth) {
+      await scopeBasedAuth();
+    }
   });
 }, { name: "@albirex/platformatic-logto" });
 async function fromRuleToWhere(ctx, rule, where, user) {
@@ -429,6 +525,26 @@ async function findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRole
   ctx.reply.request.log.trace({ roles, rule }, "found rule");
   return rule;
 }
+async function findScopeForRequestUser(ctx, entityKey, action, scopesKey, anonymousRole, isScopePath = false) {
+  const request = getRequestFromContext(ctx);
+  await request.setupDBAuthorizationUser();
+  const scopes = getScopes(request, scopesKey, anonymousRole, isScopePath);
+  const scope = scopes.find((s) => {
+    if (s === PLT_ADMIN_SCOPES) {
+      return true;
+    }
+    if (action !== "find") {
+      return s === `${action}:${entityKey}`;
+    } else {
+      return s === `${action}:${entityKey}` || s === `read:${entityKey}`;
+    }
+  });
+  if (!scope) {
+    ctx.reply.request.log.warn("no scope found");
+    throw new Unauthorized();
+  }
+  ctx.reply.request.log.trace({ scopes, scope }, "found scope");
+}
 function checkFieldsFromRule(rule, fields) {
   if (!rule) {
     throw new Unauthorized();
@@ -523,6 +639,7 @@ export {
   deletePermissionsVersion,
   fastifyLogto2 as fastifyLogto,
   findRuleForRequestUser,
+  findScopeForRequestUser,
   getRequestFromContext,
   getRoles,
   incrementPermissionsVersion,

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/utils/find-rule.ts","../src/utils/errors.ts","../src/utils/permissions-version.ts","../src/utils/utils.ts"],"sourcesContent":["import fp from 'fastify-plugin'\nimport * as fastifyUser from 'fastify-user'\n\nimport findRule from './utils/find-rule.js'\nimport { Unauthorized, UnauthorizedField, MissingNotNullableError, PermissionsOutdated } from './utils/errors.js'\nimport fastifyLogto from '@albirex/fastify-logto';\nimport fastifyRedis from '@fastify/redis';\nimport { FastifyInstance, FastifyPluginAsync } from 'fastify'\nimport type { FastifyUserPluginOptions } from 'fastify-user';\nimport type { Entity, PlatformaticContext } from '@platformatic/sql-mapper'\n\nexport { fastifyLogto } from '@albirex/fastify-logto';\nexport { incrementPermissionsVersion, deletePermissionsVersion } from './utils/permissions-version.js';\n\nimport { getRequestFromContext, getRoles } from './utils/utils.js'\nexport { getRequestFromContext, getRoles } from './utils/utils.js'\n\nconst PLT_ADMIN_ROLE = 'platformatic-admin'\n\nexport type PlatformaticRule = {\n    role: string;\n    entity?: string;\n    entities?: string[];\n    defaults?: Record<string, string>;\n    checks?: boolean;\n    find?: boolean;\n    save?: boolean;\n    delete?: boolean;\n    [action: string]: unknown;\n};\n\nexport type RedisConfig = {\n    host?: string;\n    port?: number;\n    password?: string;\n    username?: string;\n    db?: number;\n};\n\nexport type PlatformaticLogtoAuthOptions = {\n    logtoBaseUrl?: string;\n    logtoAppId?: string;\n    logtoAppSecret?: string;\n    adminSecret?: string;\n    rolePath?: string;\n    roleKey?: string;\n    userPath?: string;\n    userKey?: string;\n    anonymousRole?: string;\n    allowAnonymous?: boolean;\n    checks?: boolean;\n    defaults?: boolean;\n    jwtPlugin: FastifyUserPluginOptions;\n    redis?: RedisConfig;\n    enableTokenVersionCheck?: boolean;\n    sessionVersionKey?: string;\n};\n\nexport const platformaticLogto: FastifyPluginAsync<PlatformaticLogtoAuthOptions> = fp(async (app: FastifyInstance, opts: PlatformaticLogtoAuthOptions) => {\n    app.decorate('platformaticLogTo', {\n        opts\n    })\n\n    // Register Redis if configured\n    if (opts.redis) {\n        await app.register(fastifyRedis, {\n            host: opts.redis.host || '127.0.0.1',\n            port: opts.redis.port || 6379,\n            password: opts.redis.password,\n            username: opts.redis.username,\n            db: opts.redis.db || 0,\n        });\n        app.log.info('Redis client registered for permissions version check');\n    }\n\n    app.register(fastifyLogto, {\n        endpoint: opts.logtoBaseUrl || 'https://auth.example.com',\n        appId: opts.logtoAppId || 'your-app-id',\n        appSecret: opts.logtoAppSecret || 'your-app-secret',\n    });\n\n    await app.register(fastifyUser as unknown as FastifyPluginAsync, opts.jwtPlugin);\n\n    const adminSecret = opts.adminSecret\n    const roleKey = opts.rolePath || opts.roleKey || 'X-PLATFORMATIC-ROLE'\n    const userKey = opts.userPath || opts.userKey || 'X-PLATFORMATIC-USER-ID'\n    const isRolePath = !!opts.rolePath // if `true` the role is intepreted as path like `user.role`\n    const anonymousRole = opts.anonymousRole || 'anonymous'\n\n    async function composeLogToRules() {\n        const rolesResp = await app.logto.callAPI('/api/roles?type=User', 'GET');\n\n        if (!rolesResp.ok) {\n            throw rolesResp;\n        }\n\n        const roles = await rolesResp.json();\n        const rules: PlatformaticRule[] = [{\n            role: anonymousRole,\n            entities: Object.keys(app.platformatic.entities),\n            find: opts.allowAnonymous,\n            save: opts.allowAnonymous,\n            delete: opts.allowAnonymous,\n        }];\n\n        for (const role of roles) {\n            const scopesResp = await app.logto.callAPI(`/api/roles/${role.id}/scopes`, 'GET');\n\n            if (!scopesResp.ok) {\n                throw scopesResp;\n            }\n\n            const scopes = await scopesResp.json();\n\n            for (const scope of scopes) {\n                const roleName = role.name;\n                // eslint-disable-next-line prefer-const\n                let [scopeAction, entity] = scope.name.split(':');\n\n                if (!app.platformatic.entities[entity]) {\n                    app.log.debug(`Unknown entity '${entity}' in authorization rule`)\n                    continue;\n                }\n\n                switch (scopeAction) {\n                    case 'create':\n                        scopeAction = 'save'\n                        break;\n                    case 'read':\n                        scopeAction = 'find'\n                        break;\n                    case 'update':\n                        scopeAction = 'updateMany'\n                        break;\n                }\n\n                const checkExists = rules.find(r => r.role === roleName && r.entity === entity);\n                if (checkExists) {\n                    if (opts.checks) {\n                        checkExists[scopeAction] = {\n                            checks: {\n                                userId: userKey\n                            }\n                        };\n                    } else {\n                        checkExists[scopeAction] = true;\n                    }\n                } else {\n                    const newRule: PlatformaticRule = {\n                        role: roleName,\n                        entity,\n                    };\n\n                    if (opts.checks) {\n                        newRule[scopeAction] = {\n                            checks: {\n                                userId: userKey\n                            }\n                        };\n                    } else {\n                        newRule[scopeAction] = true;\n                    }\n\n                    if (opts.defaults) {\n                        newRule.defaults = {\n                            userId: userKey\n                        };\n                    }\n\n                    rules.push(newRule);\n                }\n            }\n        }\n\n        const logRules = rules.reduce((prev, curr) => {\n            (prev[curr['role']] ??= []).push(curr);\n            return prev;\n        }, {})\n\n        for (const key in logRules) {\n            app.log.info(`Rules set for role ${key}`);\n\n            for (const element of logRules[key]) {\n                // eslint-disable-next-line @typescript-eslint/no-unused-vars\n                const { entity, entities, role, ...other } = element;\n                app.log.info(`\\t${entity ?? entities.join(',')}: ${JSON.stringify(other)}`);\n            }\n        }\n\n        const missingEntities = Object.keys(app.platformatic.entities).filter((e) => !rules.map((r) => r.entity).includes(e));\n\n        if (missingEntities.length) {\n            app.log.warn(`Missing rules for entities: ${missingEntities.join(', ')}`);\n        }\n\n        app.log.debug('LogTo calculated rules');\n        app.log.debug(rules);\n        return rules;\n    }\n\n    app.decorateRequest('setupDBAuthorizationUser', setupUser)\n\n    async function setupUser() {\n        // if (!adminSecret) {\n        await this.extractUser()\n        // }\n\n        let forceAdminRole = false\n        if (adminSecret && this.headers['x-platformatic-admin-secret'] === adminSecret) {\n            if (opts.jwtPlugin.jwt) {\n                forceAdminRole = true\n            } else {\n                this.log.info('admin secret is valid')\n                this.user = new Proxy(this.headers, {\n                    get: (target, key) => {\n                        let value;\n                        if (!target[key.toString()]) {\n                            const newKey = key.toString().toLowerCase()\n                            value = target[newKey]\n                        } else {\n                            value = target[key.toString()]\n                        }\n\n                        if (!value && key.toString().toLowerCase() === roleKey.toLowerCase()) {\n                            value = PLT_ADMIN_ROLE\n                        }\n                        return value\n                    },\n                })\n            }\n        } else {\n            await checkPermissionsVersion(app, opts, this.user)\n        }\n\n        if (forceAdminRole) {\n            // We replace just the role in `request.user`, all the rest is untouched\n            this.user = {\n                // ...request.user,\n                [roleKey]: this.headers['x-platformatic-role'] ? [this.headers['x-platformatic-role']] : [PLT_ADMIN_ROLE]\n            }\n        }\n    }\n\n    app.addHook('onReady', async function () {\n        const logToRules = await composeLogToRules();\n\n        app.platformaticLogTo.rules = logToRules;\n\n        // TODO validate that there is at most a rule for a given role\n        const entityRules = {};\n        for (let i = 0; i < logToRules.length; i++) {\n            const rule = logToRules[i]\n\n            let ruleEntities = null\n            if (rule.entity) {\n                ruleEntities = [rule.entity]\n            } else if (rule.entities) {\n                ruleEntities = [...rule.entities]\n            } else {\n                throw new Error(`Missing entity in authorization rule ${i}`)\n            }\n\n            for (const ruleEntity of ruleEntities) {\n                const newRule = { ...rule, entity: ruleEntity, entities: undefined }\n                if (!app.platformatic.entities[newRule.entity]) {\n                    throw new Error(`Unknown entity '${ruleEntity}' in authorization rule ${i}`)\n                }\n\n                if (!entityRules[ruleEntity]) {\n                    entityRules[ruleEntity] = []\n                }\n                entityRules[ruleEntity].push(newRule)\n            }\n        }\n\n        for (const entityKey of Object.keys(app.platformatic.entities)) {\n            const rules = entityRules[entityKey] || []\n            const type = app.platformatic.entities[entityKey]\n\n            // We have subscriptions!\n            let userPropToFillForPublish\n            const topicsWithoutChecks = false\n\n            // mqtt\n            // if (app.platformatic.mq) {\n            //     for (const rule of rules) {\n            //         const checks = rule.find?.checks\n            //         if (typeof checks !== 'object') {\n            //             topicsWithoutChecks = !!rule.find\n            //             continue\n            //         }\n            //         const keys = Object.keys(checks)\n            //         if (keys.length !== 1) {\n            //             throw new Error(`Subscription requires that the role \"${rule.role}\" has only one check in the find rule for entity \"${rule.entity}\"`)\n            //         }\n            //         const key = keys[0]\n\n            //         const val = typeof checks[key] === 'object' ? checks[key].eq : checks[key]\n            //         if (userPropToFillForPublish && userPropToFillForPublish.val !== val) {\n            //             throw new Error('Unable to configure subscriptions and authorization due to multiple check clauses in find')\n            //         }\n            //         userPropToFillForPublish = { key, val }\n            //     }\n            // }\n\n            if (userPropToFillForPublish && topicsWithoutChecks) {\n                throw new Error(`Subscription for entity \"${entityKey}\" have conflictling rules across roles`)\n            }\n\n            // MUST set this after doing the security checks on the subscriptions\n            if (adminSecret) {\n                rules.push({\n                    role: PLT_ADMIN_ROLE,\n                    find: true,\n                    save: true,\n                    delete: true,\n                    updateMany: true\n                })\n            }\n\n            // If we have `fields` in save rules, we need to check if all the not-nullable\n            // fields are specified\n            checkSaveMandatoryFieldsInRules(type, rules)\n\n            function useOriginal(ctx: PlatformaticContext) {\n                return !ctx\n            }\n\n            app.platformatic.addEntityHooks(entityKey, {\n                async find(originalFind, { where, ctx, fields, ...restOpts } = {}) {\n                    if (useOriginal(ctx)) {\n                        return originalFind({ ...restOpts, where, ctx, fields })\n                    }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n                    checkFieldsFromRule(rule.find, fields || Object.keys(app.platformatic.entities[entityKey].fields))\n                    where = await fromRuleToWhere(ctx, rule.find, where, request.user)\n\n                    return originalFind({ ...restOpts, where, ctx, fields })\n                },\n                async save(originalSave, { input, ctx, fields, ...restOpts }) {\n                    if (useOriginal(ctx)) {\n                        return originalSave({ ctx, input, fields, ...restOpts })\n                    }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n\n                    if (!rule.save) {\n                        throw new Unauthorized()\n                    }\n                    checkFieldsFromRule(rule.save, fields)\n                    checkInputFromRuleFields(rule.save, input)\n\n                    if (rule.defaults) {\n                        for (const key of Object.keys(rule.defaults)) {\n                            const defaults = rule.defaults[key]\n                            if (typeof defaults === 'function') {\n                                input[key] = await defaults({ user: request.user, ctx, input })\n                            } else {\n                                input[key] = request.user[defaults]\n                            }\n                        }\n                    }\n\n                    const hasAllPrimaryKeys = input[type.primaryKey] !== undefined;\n                    const whereConditions = {}\n                    whereConditions[type.primaryKey] = { eq: input[type.primaryKey] }\n\n                    if (hasAllPrimaryKeys) {\n                        const where = await fromRuleToWhere(ctx, rule.save, whereConditions, request.user)\n\n                        const found = await type.find({\n                            where,\n                            ctx,\n                            fields,\n                        })\n\n                        if (found.length === 0) {\n                            throw new Unauthorized()\n                        }\n\n                        return originalSave({ input, ctx, fields, ...restOpts })\n                    }\n\n                    return originalSave({ input, ctx, fields, ...restOpts })\n                },\n\n                async insert(originalInsert, { inputs, ctx, fields, ...restOpts }) {\n                    if (useOriginal(ctx)) {\n                        return originalInsert({ inputs, ctx, fields, ...restOpts })\n                    }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n\n                    if (!rule.save) {\n                        throw new Unauthorized()\n                    }\n\n                    checkFieldsFromRule(rule.save, fields)\n                    checkInputFromRuleFields(rule.save, inputs)\n\n                    /* istanbul ignore else */\n                    if (rule.defaults) {\n                        for (const input of inputs) {\n                            for (const key of Object.keys(rule.defaults)) {\n                                const defaults = rule.defaults[key]\n                                if (typeof defaults === 'function') {\n                                    input[key] = await defaults({ user: request.user, ctx, input })\n                                } else {\n                                    input[key] = request.user[defaults]\n                                }\n                            }\n                        }\n                    }\n\n                    return originalInsert({ inputs, ctx, fields, ...restOpts })\n                },\n\n                async delete(originalDelete, { where, ctx, fields, ...restOpts }) {\n                    if (useOriginal(ctx)) {\n                        return originalDelete({ where, ctx, fields, ...restOpts })\n                    }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n\n                    where = await fromRuleToWhere(ctx, rule.delete, where, request.user)\n\n                    return originalDelete({ where, ctx, fields, ...restOpts })\n                },\n\n                async updateMany(originalUpdateMany, { where, ctx, fields, ...restOpts }) {\n                    if (useOriginal(ctx)) {\n                        return originalUpdateMany({ ...restOpts, where, ctx, fields })\n                    }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n\n                    where = await fromRuleToWhere(ctx, rule.updateMany, where, request.user)\n\n                    return originalUpdateMany({ ...restOpts, where, ctx, fields })\n                },\n            })\n        }\n    })\n}, { name: '@albirex/platformatic-logto' });\n\nasync function fromRuleToWhere(ctx: PlatformaticContext, rule, where, user) {\n    if (!rule) {\n        throw new Unauthorized()\n    }\n    const request = getRequestFromContext(ctx)\n    /* istanbul ignore next */\n    where = where || {}\n\n    if (typeof rule === 'object') {\n        const { checks } = rule\n\n        /* istanbul ignore else */\n        if (checks) {\n            for (const key of Object.keys(checks)) {\n                const clauses = checks[key]\n                if (typeof clauses === 'string') {\n                    // case: \"userId\": \"X-PLATFORMATIC-USER-ID\"\n                    where[key] = {\n                        eq: request.user[clauses],\n                    }\n                } else {\n                    // case:\n                    // userId: {\n                    //   eq: 'X-PLATFORMATIC-USER-ID'\n                    // }\n                    for (const clauseKey of Object.keys(clauses)) {\n                        const clause = clauses[clauseKey]\n                        where[key] = {\n                            [clauseKey]: request.user[clause],\n                        }\n                    }\n                }\n            }\n        }\n    } else if (typeof rule === 'function') {\n        where = await rule({ user, ctx, where })\n    }\n    return where\n}\n\nexport async function findRuleForRequestUser(ctx: PlatformaticContext, rules: PlatformaticRule[], roleKey: string, anonymousRole: string, isRolePath = false) {\n    const request = getRequestFromContext(ctx)\n    await request.setupDBAuthorizationUser()\n    const roles = getRoles(request, roleKey, anonymousRole, isRolePath)\n    const rule = findRule(rules, roles)\n    if (!rule) {\n        ctx.reply.request.log.warn({ roles, rules }, 'no rule for roles')\n        throw new Unauthorized()\n    }\n    ctx.reply.request.log.trace({ roles, rule }, 'found rule')\n    return rule\n}\n\nexport function checkFieldsFromRule(rule, fields) {\n    if (!rule) {\n        throw new Unauthorized()\n    }\n    const { fields: fieldsFromRule } = rule\n    /* istanbul ignore else */\n    if (fieldsFromRule) {\n        for (const field of fields) {\n            if (!fieldsFromRule.includes(field)) {\n                throw new UnauthorizedField(field)\n            }\n        }\n    }\n}\n\nconst validateInputs = (inputs, fieldsFromRule) => {\n    for (const input of inputs) {\n        const inputFields = Object.keys(input)\n        for (const inputField of inputFields) {\n            if (!fieldsFromRule.includes(inputField)) {\n                throw new UnauthorizedField(inputField)\n            }\n        }\n    }\n}\n\nfunction checkInputFromRuleFields(rule, inputs) {\n    const { fields: fieldsFromRule } = rule\n    /* istanbul ignore else */\n    if (fieldsFromRule) {\n        if (!Array.isArray(inputs)) {\n            // save\n            validateInputs([inputs], fieldsFromRule)\n        } else {\n            // insert\n            validateInputs(inputs, fieldsFromRule)\n        }\n    }\n}\n\nfunction checkSaveMandatoryFieldsInRules(type: Entity, rules) {\n    // List of not nullable, not PKs field to validate save/insert when allowed fields are specified on the rule\n    const mandatoryFields =\n        Object.values(type.fields)\n            .filter(k => (!k.isNullable && !k.primaryKey))\n            .map(({ camelcase }) => (camelcase))\n\n    for (const rule of rules) {\n        const { entity, save } = rule\n        if (save && save.fields) {\n            const fields = save.fields\n            for (const mField of mandatoryFields) {\n                if (!fields.includes(mField)) {\n                    throw new MissingNotNullableError(mField, entity)\n                }\n            }\n        }\n    }\n}\n\n/**\n * Check the permissions version\n * @throws PermissionsOutdated if versions don't match\n */\nasync function checkPermissionsVersion(app: FastifyInstance, opts: PlatformaticLogtoAuthOptions, user = null) {\n\n    if (!opts.enableTokenVersionCheck || !opts.redis || !app.redis || !user) {\n            return;\n    }\n\n    const sessionVersionKey = opts.sessionVersionKey || 'version'\n    const tokenVersion = user?.[sessionVersionKey];\n    const userId = user?.sub;\n\n    try {\n        const redisKey = `permissions:version:${userId}`;\n        const currentVersionStr = await app.redis.get(redisKey);\n        const currentVersion = parseInt(currentVersionStr, 10);\n\n        if (currentVersionStr === null) {\n            await app.redis.set(redisKey, tokenVersion.toString());\n            app.log.debug({ userId, version: tokenVersion }, 'Initialized permissions version in Redis');\n            if (tokenVersion > 1) {\n                app.log.warn({\n                    userId,\n                    tokenVersion,\n                    currentVersion\n                }, 'Permissions version mismatch detected');\n                throw new PermissionsOutdated();            \n            }\n            return;\n        }\n\n        // Compare versions\n        if (currentVersion !== tokenVersion) {\n            app.log.warn({\n                userId,\n                tokenVersion,\n                currentVersion\n            }, 'Permissions version mismatch detected');\n            throw new PermissionsOutdated();\n        }\n\n        app.log.trace({ userId, version: tokenVersion }, 'Token version check passed');\n    } catch (error) {\n        if (error.name === 'FastifyError' && error.code === 'PLT_DB_AUTH_VERSION_OUTDATED') {\n            throw error;\n        }\n        app.log.error({ err: error, userId }, 'Error checking token version');\n    }\n}\n\nexport default platformaticLogto;\n\ndeclare module 'fastify' {\n    interface FastifyInstance {\n        platformaticLogTo: {\n            opts: PlatformaticLogtoAuthOptions,\n            rules?: PlatformaticRule[]\n        }\n    }\n}","'use strict'\n\nimport { PlatformaticRule } from '../index.js'\n\nfunction findRule(rules: PlatformaticRule[], roles: string[]) {\n  let found = null\n  for (const rule of rules) {\n    for (const role of roles) {\n      if (rule.role === role) {\n        found = rule\n        break\n      }\n    }\n    if (found) {\n      break\n    }\n  }\n  return found\n}\n\nexport default findRule\n","'use strict'\n\nimport createError from '@fastify/error'\n\nconst ERROR_PREFIX = 'PLT_DB_AUTH'\n\nexport const Unauthorized = createError(`${ERROR_PREFIX}_UNAUTHORIZED`, 'operation not allowed', 401)\nexport const UnauthorizedField = createError(`${ERROR_PREFIX}_FIELD_UNAUTHORIZED`, 'field not allowed: %s', 401)\nexport const MissingNotNullableError = createError(`${ERROR_PREFIX}_NOT_NULLABLE_MISSING`, 'missing not nullable field: \"%s\" in save rule for entity \"%s\"')\nexport const PermissionsOutdated = createError(`${ERROR_PREFIX}_VERSION_OUTDATED`, 'Verision has been updated. Please logout and login again.', 403)\n","'use strict'\n\nimport type { FastifyInstance } from 'fastify'\n\n/**\n * Increment the permissions version\n * @param app - Fastify instance with Redis client and Logto\n * @param userId - User ID\n * @returns New version number\n */\nexport async function incrementPermissionsVersion(app: FastifyInstance, userId: string): Promise<number> {\n    if (!app.logto) {\n        throw new Error('Logto client not available')\n    }\n\n    const userResp = await app.logto.callAPI(`/api/users/${userId}`, 'GET')\n    const userData = await userResp.json()\n    const existingCustomData = userData.customData || {}\n    const currentVersion = existingCustomData.sessionVersion || 0\n    const newVersion = currentVersion + 1\n\n    await app.logto.callAPI(`/api/users/${userId}`, 'PATCH', JSON.stringify({ customData: { ...existingCustomData, sessionVersion: newVersion } }))\n\n    if (app.redis) {\n        const redisKey = `permissions:version:${userId}`\n        await app.redis.set(redisKey, newVersion.toString())\n    }\n\n    return newVersion\n}\n\n/**\n * Delete the permissions version for a user\n * @param app - Fastify instance with Redis client\n * @param userId - User ID\n */\nexport async function deletePermissionsVersion(app: FastifyInstance, userId: string): Promise<void> {\n    if (!app.redis) {\n        throw new Error('Redis client not available')\n    }\n\n    const redisKey = `permissions:version:${userId}`\n    await app.redis.del(redisKey)\n}\n\n","'use strict'\n\nexport function getRequestFromContext (ctx) {\n  if (ctx && !ctx.reply) {\n    throw new Error('Missing reply in context. You should call this function with { ctx: { reply }}')\n  }\n  return ctx.reply.request\n}\n\nexport function getRoles (request, roleKey, anonymousRole, isRolePath = false) {\n  let output = []\n  const user = request.user\n  if (!user) {\n    output.push(anonymousRole)\n    return output\n  }\n\n  let rolesRaw\n  if (isRolePath) {\n    const roleKeys = roleKey.split('.')\n    rolesRaw = user\n    for (const key of roleKeys) {\n      rolesRaw = rolesRaw[key]\n    }\n  } else {\n    rolesRaw = user[roleKey]\n  }\n\n  if (typeof rolesRaw === 'string') {\n    output = rolesRaw.split(',')\n  } else if (Array.isArray(rolesRaw)) {\n    output = rolesRaw\n  }\n  if (output.length === 0) {\n    output.push(anonymousRole)\n  }\n\n  return output\n}\n"],"mappings":";AAAA,OAAO,QAAQ;AACf,YAAY,iBAAiB;;;ACG7B,SAAS,SAAS,OAA2B,OAAiB;AAC5D,MAAI,QAAQ;AACZ,aAAW,QAAQ,OAAO;AACxB,eAAW,QAAQ,OAAO;AACxB,UAAI,KAAK,SAAS,MAAM;AACtB,gBAAQ;AACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO;AACT;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,IAAO,oBAAQ;;;AClBf,OAAO,iBAAiB;AAExB,IAAM,eAAe;AAEd,IAAM,eAAe,YAAY,GAAG,YAAY,iBAAiB,yBAAyB,GAAG;AAC7F,IAAM,oBAAoB,YAAY,GAAG,YAAY,uBAAuB,yBAAyB,GAAG;AACxG,IAAM,0BAA0B,YAAY,GAAG,YAAY,yBAAyB,+DAA+D;AACnJ,IAAM,sBAAsB,YAAY,GAAG,YAAY,qBAAqB,6DAA6D,GAAG;;;AFJnJ,OAAO,kBAAkB;AACzB,OAAO,kBAAkB;AAKzB,SAAS,gBAAAA,qBAAoB;;;AGD7B,eAAsB,4BAA4B,KAAsB,QAAiC;AACrG,MAAI,CAAC,IAAI,OAAO;AACZ,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAChD;AAEA,QAAM,WAAW,MAAM,IAAI,MAAM,QAAQ,cAAc,MAAM,IAAI,KAAK;AACtE,QAAM,WAAW,MAAM,SAAS,KAAK;AACrC,QAAM,qBAAqB,SAAS,cAAc,CAAC;AACnD,QAAM,iBAAiB,mBAAmB,kBAAkB;AAC5D,QAAM,aAAa,iBAAiB;AAEpC,QAAM,IAAI,MAAM,QAAQ,cAAc,MAAM,IAAI,SAAS,KAAK,UAAU,EAAE,YAAY,EAAE,GAAG,oBAAoB,gBAAgB,WAAW,EAAE,CAAC,CAAC;AAE9I,MAAI,IAAI,OAAO;AACX,UAAM,WAAW,uBAAuB,MAAM;AAC9C,UAAM,IAAI,MAAM,IAAI,UAAU,WAAW,SAAS,CAAC;AAAA,EACvD;AAEA,SAAO;AACX;AAOA,eAAsB,yBAAyB,KAAsB,QAA+B;AAChG,MAAI,CAAC,IAAI,OAAO;AACZ,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAChD;AAEA,QAAM,WAAW,uBAAuB,MAAM;AAC9C,QAAM,IAAI,MAAM,IAAI,QAAQ;AAChC;;;ACzCO,SAAS,sBAAuB,KAAK;AAC1C,MAAI,OAAO,CAAC,IAAI,OAAO;AACrB,UAAM,IAAI,MAAM,gFAAgF;AAAA,EAClG;AACA,SAAO,IAAI,MAAM;AACnB;AAEO,SAAS,SAAU,SAAS,SAAS,eAAe,aAAa,OAAO;AAC7E,MAAI,SAAS,CAAC;AACd,QAAM,OAAO,QAAQ;AACrB,MAAI,CAAC,MAAM;AACT,WAAO,KAAK,aAAa;AACzB,WAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI,YAAY;AACd,UAAM,WAAW,QAAQ,MAAM,GAAG;AAClC,eAAW;AACX,eAAW,OAAO,UAAU;AAC1B,iBAAW,SAAS,GAAG;AAAA,IACzB;AAAA,EACF,OAAO;AACL,eAAW,KAAK,OAAO;AAAA,EACzB;AAEA,MAAI,OAAO,aAAa,UAAU;AAChC,aAAS,SAAS,MAAM,GAAG;AAAA,EAC7B,WAAW,MAAM,QAAQ,QAAQ,GAAG;AAClC,aAAS;AAAA,EACX;AACA,MAAI,OAAO,WAAW,GAAG;AACvB,WAAO,KAAK,aAAa;AAAA,EAC3B;AAEA,SAAO;AACT;;;AJrBA,IAAM,iBAAiB;AAyChB,IAAM,oBAAsE,GAAG,OAAO,KAAsB,SAAuC;AACtJ,MAAI,SAAS,qBAAqB;AAAA,IAC9B;AAAA,EACJ,CAAC;AAGD,MAAI,KAAK,OAAO;AACZ,UAAM,IAAI,SAAS,cAAc;AAAA,MAC7B,MAAM,KAAK,MAAM,QAAQ;AAAA,MACzB,MAAM,KAAK,MAAM,QAAQ;AAAA,MACzB,UAAU,KAAK,MAAM;AAAA,MACrB,UAAU,KAAK,MAAM;AAAA,MACrB,IAAI,KAAK,MAAM,MAAM;AAAA,IACzB,CAAC;AACD,QAAI,IAAI,KAAK,uDAAuD;AAAA,EACxE;AAEA,MAAI,SAAS,cAAc;AAAA,IACvB,UAAU,KAAK,gBAAgB;AAAA,IAC/B,OAAO,KAAK,cAAc;AAAA,IAC1B,WAAW,KAAK,kBAAkB;AAAA,EACtC,CAAC;AAED,QAAM,IAAI,SAAS,aAA8C,KAAK,SAAS;AAE/E,QAAM,cAAc,KAAK;AACzB,QAAM,UAAU,KAAK,YAAY,KAAK,WAAW;AACjD,QAAM,UAAU,KAAK,YAAY,KAAK,WAAW;AACjD,QAAM,aAAa,CAAC,CAAC,KAAK;AAC1B,QAAM,gBAAgB,KAAK,iBAAiB;AAE5C,iBAAe,oBAAoB;AAC/B,UAAM,YAAY,MAAM,IAAI,MAAM,QAAQ,wBAAwB,KAAK;AAEvE,QAAI,CAAC,UAAU,IAAI;AACf,YAAM;AAAA,IACV;AAEA,UAAM,QAAQ,MAAM,UAAU,KAAK;AACnC,UAAM,QAA4B,CAAC;AAAA,MAC/B,MAAM;AAAA,MACN,UAAU,OAAO,KAAK,IAAI,aAAa,QAAQ;AAAA,MAC/C,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,QAAQ,KAAK;AAAA,IACjB,CAAC;AAED,eAAW,QAAQ,OAAO;AACtB,YAAM,aAAa,MAAM,IAAI,MAAM,QAAQ,cAAc,KAAK,EAAE,WAAW,KAAK;AAEhF,UAAI,CAAC,WAAW,IAAI;AAChB,cAAM;AAAA,MACV;AAEA,YAAM,SAAS,MAAM,WAAW,KAAK;AAErC,iBAAW,SAAS,QAAQ;AACxB,cAAM,WAAW,KAAK;AAEtB,YAAI,CAAC,aAAa,MAAM,IAAI,MAAM,KAAK,MAAM,GAAG;AAEhD,YAAI,CAAC,IAAI,aAAa,SAAS,MAAM,GAAG;AACpC,cAAI,IAAI,MAAM,mBAAmB,MAAM,yBAAyB;AAChE;AAAA,QACJ;AAEA,gBAAQ,aAAa;AAAA,UACjB,KAAK;AACD,0BAAc;AACd;AAAA,UACJ,KAAK;AACD,0BAAc;AACd;AAAA,UACJ,KAAK;AACD,0BAAc;AACd;AAAA,QACR;AAEA,cAAM,cAAc,MAAM,KAAK,OAAK,EAAE,SAAS,YAAY,EAAE,WAAW,MAAM;AAC9E,YAAI,aAAa;AACb,cAAI,KAAK,QAAQ;AACb,wBAAY,WAAW,IAAI;AAAA,cACvB,QAAQ;AAAA,gBACJ,QAAQ;AAAA,cACZ;AAAA,YACJ;AAAA,UACJ,OAAO;AACH,wBAAY,WAAW,IAAI;AAAA,UAC/B;AAAA,QACJ,OAAO;AACH,gBAAM,UAA4B;AAAA,YAC9B,MAAM;AAAA,YACN;AAAA,UACJ;AAEA,cAAI,KAAK,QAAQ;AACb,oBAAQ,WAAW,IAAI;AAAA,cACnB,QAAQ;AAAA,gBACJ,QAAQ;AAAA,cACZ;AAAA,YACJ;AAAA,UACJ,OAAO;AACH,oBAAQ,WAAW,IAAI;AAAA,UAC3B;AAEA,cAAI,KAAK,UAAU;AACf,oBAAQ,WAAW;AAAA,cACf,QAAQ;AAAA,YACZ;AAAA,UACJ;AAEA,gBAAM,KAAK,OAAO;AAAA,QACtB;AAAA,MACJ;AAAA,IACJ;AAEA,UAAM,WAAW,MAAM,OAAO,CAAC,MAAM,SAAS;AAC1C,OAAC,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI;AACrC,aAAO;AAAA,IACX,GAAG,CAAC,CAAC;AAEL,eAAW,OAAO,UAAU;AACxB,UAAI,IAAI,KAAK,sBAAsB,GAAG,EAAE;AAExC,iBAAW,WAAW,SAAS,GAAG,GAAG;AAEjC,cAAM,EAAE,QAAQ,UAAU,MAAM,GAAG,MAAM,IAAI;AAC7C,YAAI,IAAI,KAAK,IAAK,UAAU,SAAS,KAAK,GAAG,CAAC,KAAK,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,MAC9E;AAAA,IACJ;AAEA,UAAM,kBAAkB,OAAO,KAAK,IAAI,aAAa,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAEpH,QAAI,gBAAgB,QAAQ;AACxB,UAAI,IAAI,KAAK,+BAA+B,gBAAgB,KAAK,IAAI,CAAC,EAAE;AAAA,IAC5E;AAEA,QAAI,IAAI,MAAM,wBAAwB;AACtC,QAAI,IAAI,MAAM,KAAK;AACnB,WAAO;AAAA,EACX;AAEA,MAAI,gBAAgB,4BAA4B,SAAS;AAEzD,iBAAe,YAAY;AAEvB,UAAM,KAAK,YAAY;AAGvB,QAAI,iBAAiB;AACrB,QAAI,eAAe,KAAK,QAAQ,6BAA6B,MAAM,aAAa;AAC5E,UAAI,KAAK,UAAU,KAAK;AACpB,yBAAiB;AAAA,MACrB,OAAO;AACH,aAAK,IAAI,KAAK,uBAAuB;AACrC,aAAK,OAAO,IAAI,MAAM,KAAK,SAAS;AAAA,UAChC,KAAK,CAAC,QAAQ,QAAQ;AAClB,gBAAI;AACJ,gBAAI,CAAC,OAAO,IAAI,SAAS,CAAC,GAAG;AACzB,oBAAM,SAAS,IAAI,SAAS,EAAE,YAAY;AAC1C,sBAAQ,OAAO,MAAM;AAAA,YACzB,OAAO;AACH,sBAAQ,OAAO,IAAI,SAAS,CAAC;AAAA,YACjC;AAEA,gBAAI,CAAC,SAAS,IAAI,SAAS,EAAE,YAAY,MAAM,QAAQ,YAAY,GAAG;AAClE,sBAAQ;AAAA,YACZ;AACA,mBAAO;AAAA,UACX;AAAA,QACJ,CAAC;AAAA,MACL;AAAA,IACJ,OAAO;AACH,YAAM,wBAAwB,KAAK,MAAM,KAAK,IAAI;AAAA,IACtD;AAEA,QAAI,gBAAgB;AAEhB,WAAK,OAAO;AAAA;AAAA,QAER,CAAC,OAAO,GAAG,KAAK,QAAQ,qBAAqB,IAAI,CAAC,KAAK,QAAQ,qBAAqB,CAAC,IAAI,CAAC,cAAc;AAAA,MAC5G;AAAA,IACJ;AAAA,EACJ;AAEA,MAAI,QAAQ,WAAW,iBAAkB;AACrC,UAAM,aAAa,MAAM,kBAAkB;AAE3C,QAAI,kBAAkB,QAAQ;AAG9B,UAAM,cAAc,CAAC;AACrB,aAAS,IAAI,GAAG,IAAI,WAAW,QAAQ,KAAK;AACxC,YAAM,OAAO,WAAW,CAAC;AAEzB,UAAI,eAAe;AACnB,UAAI,KAAK,QAAQ;AACb,uBAAe,CAAC,KAAK,MAAM;AAAA,MAC/B,WAAW,KAAK,UAAU;AACtB,uBAAe,CAAC,GAAG,KAAK,QAAQ;AAAA,MACpC,OAAO;AACH,cAAM,IAAI,MAAM,wCAAwC,CAAC,EAAE;AAAA,MAC/D;AAEA,iBAAW,cAAc,cAAc;AACnC,cAAM,UAAU,EAAE,GAAG,MAAM,QAAQ,YAAY,UAAU,OAAU;AACnE,YAAI,CAAC,IAAI,aAAa,SAAS,QAAQ,MAAM,GAAG;AAC5C,gBAAM,IAAI,MAAM,mBAAmB,UAAU,2BAA2B,CAAC,EAAE;AAAA,QAC/E;AAEA,YAAI,CAAC,YAAY,UAAU,GAAG;AAC1B,sBAAY,UAAU,IAAI,CAAC;AAAA,QAC/B;AACA,oBAAY,UAAU,EAAE,KAAK,OAAO;AAAA,MACxC;AAAA,IACJ;AAEA,eAAW,aAAa,OAAO,KAAK,IAAI,aAAa,QAAQ,GAAG;AAiD5D,UAAS,cAAT,SAAqB,KAA0B;AAC3C,eAAO,CAAC;AAAA,MACZ;AAlDA,YAAM,QAAQ,YAAY,SAAS,KAAK,CAAC;AACzC,YAAM,OAAO,IAAI,aAAa,SAAS,SAAS;AAGhD,UAAI;AACJ,YAAM,sBAAsB;AAwB5B,UAAI,4BAA4B,qBAAqB;AACjD,cAAM,IAAI,MAAM,4BAA4B,SAAS,wCAAwC;AAAA,MACjG;AAGA,UAAI,aAAa;AACb,cAAM,KAAK;AAAA,UACP,MAAM;AAAA,UACN,MAAM;AAAA,UACN,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,YAAY;AAAA,QAChB,CAAC;AAAA,MACL;AAIA,sCAAgC,MAAM,KAAK;AAM3C,UAAI,aAAa,eAAe,WAAW;AAAA,QACvC,MAAM,KAAK,cAAc,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,IAAI,CAAC,GAAG;AAC/D,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,aAAa,EAAE,GAAG,UAAU,OAAO,KAAK,OAAO,CAAC;AAAA,UAC3D;AACA,gBAAM,UAAU,sBAAsB,GAAG;AACzC,gBAAM,OAAO,MAAM,uBAAuB,KAAK,OAAO,SAAS,eAAe,UAAU;AACxF,8BAAoB,KAAK,MAAM,UAAU,OAAO,KAAK,IAAI,aAAa,SAAS,SAAS,EAAE,MAAM,CAAC;AACjG,kBAAQ,MAAM,gBAAgB,KAAK,KAAK,MAAM,OAAO,QAAQ,IAAI;AAEjE,iBAAO,aAAa,EAAE,GAAG,UAAU,OAAO,KAAK,OAAO,CAAC;AAAA,QAC3D;AAAA,QACA,MAAM,KAAK,cAAc,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,GAAG;AAC1D,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,aAAa,EAAE,KAAK,OAAO,QAAQ,GAAG,SAAS,CAAC;AAAA,UAC3D;AACA,gBAAM,UAAU,sBAAsB,GAAG;AACzC,gBAAM,OAAO,MAAM,uBAAuB,KAAK,OAAO,SAAS,eAAe,UAAU;AAExF,cAAI,CAAC,KAAK,MAAM;AACZ,kBAAM,IAAI,aAAa;AAAA,UAC3B;AACA,8BAAoB,KAAK,MAAM,MAAM;AACrC,mCAAyB,KAAK,MAAM,KAAK;AAEzC,cAAI,KAAK,UAAU;AACf,uBAAW,OAAO,OAAO,KAAK,KAAK,QAAQ,GAAG;AAC1C,oBAAM,WAAW,KAAK,SAAS,GAAG;AAClC,kBAAI,OAAO,aAAa,YAAY;AAChC,sBAAM,GAAG,IAAI,MAAM,SAAS,EAAE,MAAM,QAAQ,MAAM,KAAK,MAAM,CAAC;AAAA,cAClE,OAAO;AACH,sBAAM,GAAG,IAAI,QAAQ,KAAK,QAAQ;AAAA,cACtC;AAAA,YACJ;AAAA,UACJ;AAEA,gBAAM,oBAAoB,MAAM,KAAK,UAAU,MAAM;AACrD,gBAAM,kBAAkB,CAAC;AACzB,0BAAgB,KAAK,UAAU,IAAI,EAAE,IAAI,MAAM,KAAK,UAAU,EAAE;AAEhE,cAAI,mBAAmB;AACnB,kBAAM,QAAQ,MAAM,gBAAgB,KAAK,KAAK,MAAM,iBAAiB,QAAQ,IAAI;AAEjF,kBAAM,QAAQ,MAAM,KAAK,KAAK;AAAA,cAC1B;AAAA,cACA;AAAA,cACA;AAAA,YACJ,CAAC;AAED,gBAAI,MAAM,WAAW,GAAG;AACpB,oBAAM,IAAI,aAAa;AAAA,YAC3B;AAEA,mBAAO,aAAa,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,UAC3D;AAEA,iBAAO,aAAa,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,QAC3D;AAAA,QAEA,MAAM,OAAO,gBAAgB,EAAE,QAAQ,KAAK,QAAQ,GAAG,SAAS,GAAG;AAC/D,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,eAAe,EAAE,QAAQ,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,UAC9D;AACA,gBAAM,UAAU,sBAAsB,GAAG;AACzC,gBAAM,OAAO,MAAM,uBAAuB,KAAK,OAAO,SAAS,eAAe,UAAU;AAExF,cAAI,CAAC,KAAK,MAAM;AACZ,kBAAM,IAAI,aAAa;AAAA,UAC3B;AAEA,8BAAoB,KAAK,MAAM,MAAM;AACrC,mCAAyB,KAAK,MAAM,MAAM;AAG1C,cAAI,KAAK,UAAU;AACf,uBAAW,SAAS,QAAQ;AACxB,yBAAW,OAAO,OAAO,KAAK,KAAK,QAAQ,GAAG;AAC1C,sBAAM,WAAW,KAAK,SAAS,GAAG;AAClC,oBAAI,OAAO,aAAa,YAAY;AAChC,wBAAM,GAAG,IAAI,MAAM,SAAS,EAAE,MAAM,QAAQ,MAAM,KAAK,MAAM,CAAC;AAAA,gBAClE,OAAO;AACH,wBAAM,GAAG,IAAI,QAAQ,KAAK,QAAQ;AAAA,gBACtC;AAAA,cACJ;AAAA,YACJ;AAAA,UACJ;AAEA,iBAAO,eAAe,EAAE,QAAQ,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,QAC9D;AAAA,QAEA,MAAM,OAAO,gBAAgB,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,GAAG;AAC9D,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,eAAe,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,UAC7D;AACA,gBAAM,UAAU,sBAAsB,GAAG;AACzC,gBAAM,OAAO,MAAM,uBAAuB,KAAK,OAAO,SAAS,eAAe,UAAU;AAExF,kBAAQ,MAAM,gBAAgB,KAAK,KAAK,QAAQ,OAAO,QAAQ,IAAI;AAEnE,iBAAO,eAAe,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,QAC7D;AAAA,QAEA,MAAM,WAAW,oBAAoB,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,GAAG;AACtE,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,mBAAmB,EAAE,GAAG,UAAU,OAAO,KAAK,OAAO,CAAC;AAAA,UACjE;AACA,gBAAM,UAAU,sBAAsB,GAAG;AACzC,gBAAM,OAAO,MAAM,uBAAuB,KAAK,OAAO,SAAS,eAAe,UAAU;AAExF,kBAAQ,MAAM,gBAAgB,KAAK,KAAK,YAAY,OAAO,QAAQ,IAAI;AAEvE,iBAAO,mBAAmB,EAAE,GAAG,UAAU,OAAO,KAAK,OAAO,CAAC;AAAA,QACjE;AAAA,MACJ,CAAC;AAAA,IACL;AAAA,EACJ,CAAC;AACL,GAAG,EAAE,MAAM,8BAA8B,CAAC;AAE1C,eAAe,gBAAgB,KAA0B,MAAM,OAAO,MAAM;AACxE,MAAI,CAAC,MAAM;AACP,UAAM,IAAI,aAAa;AAAA,EAC3B;AACA,QAAM,UAAU,sBAAsB,GAAG;AAEzC,UAAQ,SAAS,CAAC;AAElB,MAAI,OAAO,SAAS,UAAU;AAC1B,UAAM,EAAE,OAAO,IAAI;AAGnB,QAAI,QAAQ;AACR,iBAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACnC,cAAM,UAAU,OAAO,GAAG;AAC1B,YAAI,OAAO,YAAY,UAAU;AAE7B,gBAAM,GAAG,IAAI;AAAA,YACT,IAAI,QAAQ,KAAK,OAAO;AAAA,UAC5B;AAAA,QACJ,OAAO;AAKH,qBAAW,aAAa,OAAO,KAAK,OAAO,GAAG;AAC1C,kBAAM,SAAS,QAAQ,SAAS;AAChC,kBAAM,GAAG,IAAI;AAAA,cACT,CAAC,SAAS,GAAG,QAAQ,KAAK,MAAM;AAAA,YACpC;AAAA,UACJ;AAAA,QACJ;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ,WAAW,OAAO,SAAS,YAAY;AACnC,YAAQ,MAAM,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;AAAA,EAC3C;AACA,SAAO;AACX;AAEA,eAAsB,uBAAuB,KAA0B,OAA2B,SAAiB,eAAuB,aAAa,OAAO;AAC1J,QAAM,UAAU,sBAAsB,GAAG;AACzC,QAAM,QAAQ,yBAAyB;AACvC,QAAM,QAAQ,SAAS,SAAS,SAAS,eAAe,UAAU;AAClE,QAAM,OAAO,kBAAS,OAAO,KAAK;AAClC,MAAI,CAAC,MAAM;AACP,QAAI,MAAM,QAAQ,IAAI,KAAK,EAAE,OAAO,MAAM,GAAG,mBAAmB;AAChE,UAAM,IAAI,aAAa;AAAA,EAC3B;AACA,MAAI,MAAM,QAAQ,IAAI,MAAM,EAAE,OAAO,KAAK,GAAG,YAAY;AACzD,SAAO;AACX;AAEO,SAAS,oBAAoB,MAAM,QAAQ;AAC9C,MAAI,CAAC,MAAM;AACP,UAAM,IAAI,aAAa;AAAA,EAC3B;AACA,QAAM,EAAE,QAAQ,eAAe,IAAI;AAEnC,MAAI,gBAAgB;AAChB,eAAW,SAAS,QAAQ;AACxB,UAAI,CAAC,eAAe,SAAS,KAAK,GAAG;AACjC,cAAM,IAAI,kBAAkB,KAAK;AAAA,MACrC;AAAA,IACJ;AAAA,EACJ;AACJ;AAEA,IAAM,iBAAiB,CAAC,QAAQ,mBAAmB;AAC/C,aAAW,SAAS,QAAQ;AACxB,UAAM,cAAc,OAAO,KAAK,KAAK;AACrC,eAAW,cAAc,aAAa;AAClC,UAAI,CAAC,eAAe,SAAS,UAAU,GAAG;AACtC,cAAM,IAAI,kBAAkB,UAAU;AAAA,MAC1C;AAAA,IACJ;AAAA,EACJ;AACJ;AAEA,SAAS,yBAAyB,MAAM,QAAQ;AAC5C,QAAM,EAAE,QAAQ,eAAe,IAAI;AAEnC,MAAI,gBAAgB;AAChB,QAAI,CAAC,MAAM,QAAQ,MAAM,GAAG;AAExB,qBAAe,CAAC,MAAM,GAAG,cAAc;AAAA,IAC3C,OAAO;AAEH,qBAAe,QAAQ,cAAc;AAAA,IACzC;AAAA,EACJ;AACJ;AAEA,SAAS,gCAAgC,MAAc,OAAO;AAE1D,QAAM,kBACF,OAAO,OAAO,KAAK,MAAM,EACpB,OAAO,OAAM,CAAC,EAAE,cAAc,CAAC,EAAE,UAAW,EAC5C,IAAI,CAAC,EAAE,UAAU,MAAO,SAAU;AAE3C,aAAW,QAAQ,OAAO;AACtB,UAAM,EAAE,QAAQ,KAAK,IAAI;AACzB,QAAI,QAAQ,KAAK,QAAQ;AACrB,YAAM,SAAS,KAAK;AACpB,iBAAW,UAAU,iBAAiB;AAClC,YAAI,CAAC,OAAO,SAAS,MAAM,GAAG;AAC1B,gBAAM,IAAI,wBAAwB,QAAQ,MAAM;AAAA,QACpD;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ;AACJ;AAMA,eAAe,wBAAwB,KAAsB,MAAoC,OAAO,MAAM;AAE1G,MAAI,CAAC,KAAK,2BAA2B,CAAC,KAAK,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM;AACjE;AAAA,EACR;AAEA,QAAM,oBAAoB,KAAK,qBAAqB;AACpD,QAAM,eAAe,OAAO,iBAAiB;AAC7C,QAAM,SAAS,MAAM;AAErB,MAAI;AACA,UAAM,WAAW,uBAAuB,MAAM;AAC9C,UAAM,oBAAoB,MAAM,IAAI,MAAM,IAAI,QAAQ;AACtD,UAAM,iBAAiB,SAAS,mBAAmB,EAAE;AAErD,QAAI,sBAAsB,MAAM;AAC5B,YAAM,IAAI,MAAM,IAAI,UAAU,aAAa,SAAS,CAAC;AACrD,UAAI,IAAI,MAAM,EAAE,QAAQ,SAAS,aAAa,GAAG,0CAA0C;AAC3F,UAAI,eAAe,GAAG;AAClB,YAAI,IAAI,KAAK;AAAA,UACT;AAAA,UACA;AAAA,UACA;AAAA,QACJ,GAAG,uCAAuC;AAC1C,cAAM,IAAI,oBAAoB;AAAA,MAClC;AACA;AAAA,IACJ;AAGA,QAAI,mBAAmB,cAAc;AACjC,UAAI,IAAI,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,MACJ,GAAG,uCAAuC;AAC1C,YAAM,IAAI,oBAAoB;AAAA,IAClC;AAEA,QAAI,IAAI,MAAM,EAAE,QAAQ,SAAS,aAAa,GAAG,4BAA4B;AAAA,EACjF,SAAS,OAAO;AACZ,QAAI,MAAM,SAAS,kBAAkB,MAAM,SAAS,gCAAgC;AAChF,YAAM;AAAA,IACV;AACA,QAAI,IAAI,MAAM,EAAE,KAAK,OAAO,OAAO,GAAG,8BAA8B;AAAA,EACxE;AACJ;AAEA,IAAO,gBAAQ;","names":["fastifyLogto"]}
+{"version":3,"sources":["../src/index.ts","../src/utils/find-rule.ts","../src/utils/errors.ts","../src/utils/permissions-version.ts","../src/utils/utils.ts"],"sourcesContent":["import fp from 'fastify-plugin'\nimport * as fastifyUser from 'fastify-user'\n\nimport findRule from './utils/find-rule.js'\nimport { Unauthorized, UnauthorizedField, MissingNotNullableError, PermissionsOutdated } from './utils/errors.js'\nimport fastifyLogto from '@albirex/fastify-logto';\nimport fastifyRedis from '@fastify/redis';\nimport { FastifyInstance, FastifyPluginAsync } from 'fastify'\nimport type { FastifyUserPluginOptions } from 'fastify-user';\nimport type { Entity, PlatformaticContext } from '@platformatic/sql-mapper'\n\nexport { fastifyLogto } from '@albirex/fastify-logto';\nexport { incrementPermissionsVersion, deletePermissionsVersion } from './utils/permissions-version.js';\n\nimport { getRequestFromContext, getRoles, getScopes } from './utils/utils.js'\nexport { getRequestFromContext, getRoles } from './utils/utils.js'\n\nconst PLT_ADMIN_ROLE = 'platformatic-admin'\nconst PLT_ADMIN_SCOPES = '*'\n\nexport type EntityActions = 'find' | 'save' | 'insert' | 'updateMany' | 'delete';\n\nexport type PlatformaticRule = {\n    role: string;\n    entity?: string;\n    entities?: string[];\n    defaults?: Record<string, string>;\n    checks?: boolean;\n    find?: boolean;\n    save?: boolean;\n    delete?: boolean;\n    [action: string]: unknown;\n};\n\nexport type RedisConfig = {\n    host?: string;\n    port?: number;\n    password?: string;\n    username?: string;\n    db?: number;\n};\n\nexport type PlatformaticLogToRoleBasedAuthOptions = {\n    logtoBaseUrl?: string;\n    logtoAppId?: string;\n    logtoAppSecret?: string;\n    rolePath?: string;\n    roleKey?: string;\n    userPath?: string;\n    userKey?: string;\n}\n\nexport type PlatformaticLogToScopeBasedAuthOptions = {\n    scopesPath?: string;\n    scopesKey?: string;\n}\n\nexport type PlatformaticLogtoAuthOptions = {\n    adminSecret?: string;\n    roleBasedAuth?: PlatformaticLogToRoleBasedAuthOptions,\n    scopeBasedAuth?: PlatformaticLogToScopeBasedAuthOptions,\n    checks?: boolean;\n    defaults?: boolean;\n    anonymousRole?: string;\n    allowAnonymous?: boolean;\n    jwtPlugin: FastifyUserPluginOptions;\n    redis?: RedisConfig;\n    enableTokenVersionCheck?: boolean;\n    sessionVersionKey?: string;\n};\n\nexport const platformaticLogto: FastifyPluginAsync<PlatformaticLogtoAuthOptions> = fp(async (app: FastifyInstance, opts: PlatformaticLogtoAuthOptions) => {\n    app.decorate('platformaticLogTo', {\n        opts\n    })\n\n    // Register Redis if configured\n    if (opts.redis) {\n        await app.register(fastifyRedis, {\n            host: opts.redis.host || '127.0.0.1',\n            port: opts.redis.port || 6379,\n            password: opts.redis.password,\n            username: opts.redis.username,\n            db: opts.redis.db || 0,\n        });\n        app.log.info('Redis client registered for permissions version check');\n    }\n\n    if (opts.roleBasedAuth) {\n        app.register(fastifyLogto, {\n            endpoint: opts.roleBasedAuth.logtoBaseUrl || 'https://auth.example.com',\n            appId: opts.roleBasedAuth.logtoAppId || 'your-app-id',\n            appSecret: opts.roleBasedAuth.logtoAppSecret || 'your-app-secret',\n        });\n    }\n\n    await app.register(fastifyUser as unknown as FastifyPluginAsync, opts.jwtPlugin);\n\n    const roleKey = opts.roleBasedAuth?.rolePath || opts.roleBasedAuth?.roleKey || 'X-PLATFORMATIC-ROLE';\n    const scopesKey = opts.scopeBasedAuth.scopesPath || opts.scopeBasedAuth.scopesKey || 'X-PLATFORMATIC-SCOPES'\n    const adminSecret = opts.adminSecret\n    const isRolePath = !!opts.roleBasedAuth?.rolePath // if `true` the role is intepreted as path like `user.role`\n    const anonymousRole = opts.anonymousRole || 'anonymous'\n\n    app.decorateRequest('setupDBAuthorizationUser', setupUser)\n\n    async function setupUser() {\n        // if (!adminSecret) {\n        await this.extractUser()\n        // }\n\n        let forceAdminRole = false\n        if (adminSecret && this.headers['x-platformatic-admin-secret'] === adminSecret) {\n            if (opts.jwtPlugin.jwt) {\n                forceAdminRole = true\n            } else {\n                this.log.info('admin secret is valid')\n                this.user = new Proxy(this.headers, {\n                    get: (target, key) => {\n                        let value;\n                        if (!target[key.toString()]) {\n                            const newKey = key.toString().toLowerCase()\n                            value = target[newKey]\n                        } else {\n                            value = target[key.toString()]\n                        }\n\n                        if (!value && key.toString().toLowerCase() === roleKey.toLowerCase()) {\n                            value = PLT_ADMIN_ROLE\n                        }\n                        return value\n                    },\n                })\n            }\n        } else {\n            await checkPermissionsVersion(app, opts, this.user)\n        }\n\n        if (forceAdminRole) {\n            // We replace just the role in `request.user`, all the rest is untouched\n            if (opts.roleBasedAuth) {\n                this.user = {\n                    // ...request.user,\n                    [roleKey]: this.headers['x-platformatic-role'] ? [this.headers['x-platformatic-role']] : [PLT_ADMIN_ROLE]\n                }\n            }\n\n            if (opts.scopeBasedAuth) {\n                this.user = {\n                    // ...request.user,\n                    [scopesKey]: this.headers['x-platformatic-scopes'] ? [this.headers['x-platformatic-scopes']] : [PLT_ADMIN_SCOPES]\n                }\n            }\n        }\n    }\n\n    async function roleBasedAuth() {\n        const userKey = opts.roleBasedAuth.userKey || opts.roleBasedAuth.userPath || 'X-PLATFORMATIC-USER-ID';\n\n        async function composeLogToRules() {\n            const rolesResp = await app.logto.callAPI('/api/roles?type=User', 'GET');\n\n            if (!rolesResp.ok) {\n                throw rolesResp;\n            }\n\n            const roles = await rolesResp.json();\n            const rules: PlatformaticRule[] = [{\n                role: anonymousRole,\n                entities: Object.keys(app.platformatic.entities),\n                find: opts.allowAnonymous,\n                save: opts.allowAnonymous,\n                delete: opts.allowAnonymous,\n            }];\n\n            for (const role of roles) {\n                const scopesResp = await app.logto.callAPI(`/api/roles/${role.id}/scopes`, 'GET');\n\n                if (!scopesResp.ok) {\n                    throw scopesResp;\n                }\n\n                const scopes = await scopesResp.json();\n\n                for (const scope of scopes) {\n                    const roleName = role.name;\n                    // eslint-disable-next-line prefer-const\n                    let [scopeAction, entity] = scope.name.split(':');\n\n                    if (!app.platformatic.entities[entity]) {\n                        app.log.debug(`Unknown entity '${entity}' in authorization rule`)\n                        continue;\n                    }\n\n                    switch (scopeAction) {\n                        case 'create':\n                            scopeAction = 'save'\n                            break;\n                        case 'read':\n                            scopeAction = 'find'\n                            break;\n                        case 'update':\n                            scopeAction = 'updateMany'\n                            break;\n                    }\n\n                    const checkExists = rules.find(r => r.role === roleName && r.entity === entity);\n                    if (checkExists) {\n                        if (opts.checks) {\n                            checkExists[scopeAction] = {\n                                checks: {\n                                    userId: userKey\n                                }\n                            };\n                        } else {\n                            checkExists[scopeAction] = true;\n                        }\n                    } else {\n                        const newRule: PlatformaticRule = {\n                            role: roleName,\n                            entity,\n                        };\n\n                        if (opts.checks) {\n                            newRule[scopeAction] = {\n                                checks: {\n                                    userId: userKey\n                                }\n                            };\n                        } else {\n                            newRule[scopeAction] = true;\n                        }\n\n                        if (opts.defaults) {\n                            newRule.defaults = {\n                                userId: userKey\n                            };\n                        }\n\n                        rules.push(newRule);\n                    }\n                }\n            }\n\n            const logRules = rules.reduce((prev, curr) => {\n                (prev[curr['role']] ??= []).push(curr);\n                return prev;\n            }, {})\n\n            for (const key in logRules) {\n                app.log.info(`Rules set for role ${key}`);\n\n                for (const element of logRules[key]) {\n                    // eslint-disable-next-line @typescript-eslint/no-unused-vars\n                    const { entity, entities, role, ...other } = element;\n                    app.log.info(`\\t${entity ?? entities.join(',')}: ${JSON.stringify(other)}`);\n                }\n            }\n\n            const missingEntities = Object.keys(app.platformatic.entities).filter((e) => !rules.map((r) => r.entity).includes(e));\n\n            if (missingEntities.length) {\n                app.log.warn(`Missing rules for entities: ${missingEntities.join(', ')}`);\n            }\n\n            app.log.debug('LogTo calculated rules');\n            app.log.debug(rules);\n            return rules;\n        }\n\n        const logToRules = await composeLogToRules();\n\n        app.platformaticLogTo.rules = logToRules;\n\n        // TODO validate that there is at most a rule for a given role\n        const entityRules = {};\n        for (let i = 0; i < logToRules.length; i++) {\n            const rule = logToRules[i]\n\n            let ruleEntities = null\n            if (rule.entity) {\n                ruleEntities = [rule.entity]\n            } else if (rule.entities) {\n                ruleEntities = [...rule.entities]\n            } else {\n                throw new Error(`Missing entity in authorization rule ${i}`)\n            }\n\n            for (const ruleEntity of ruleEntities) {\n                const newRule = { ...rule, entity: ruleEntity, entities: undefined }\n                if (!app.platformatic.entities[newRule.entity]) {\n                    throw new Error(`Unknown entity '${ruleEntity}' in authorization rule ${i}`)\n                }\n\n                if (!entityRules[ruleEntity]) {\n                    entityRules[ruleEntity] = []\n                }\n                entityRules[ruleEntity].push(newRule)\n            }\n        }\n\n        for (const entityKey of Object.keys(app.platformatic.entities)) {\n            const rules = entityRules[entityKey] || []\n            const type = app.platformatic.entities[entityKey]\n\n            // We have subscriptions!\n            let userPropToFillForPublish\n            const topicsWithoutChecks = false\n\n            if (userPropToFillForPublish && topicsWithoutChecks) {\n                throw new Error(`Subscription for entity \"${entityKey}\" have conflictling rules across roles`)\n            }\n\n            // MUST set this after doing the security checks on the subscriptions\n            if (adminSecret) {\n                rules.push({\n                    role: PLT_ADMIN_ROLE,\n                    find: true,\n                    save: true,\n                    delete: true,\n                    updateMany: true\n                })\n            }\n\n            // If we have `fields` in save rules, we need to check if all the not-nullable\n            // fields are specified\n            checkSaveMandatoryFieldsInRules(type, rules)\n\n            function useOriginal(ctx: PlatformaticContext) {\n                return !ctx\n            }\n\n            app.platformatic.addEntityHooks(entityKey, {\n                async find(originalFind, { where, ctx, fields, ...restOpts } = {}) {\n                    if (useOriginal(ctx)) {\n                        return originalFind({ ...restOpts, where, ctx, fields })\n                    }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n                    checkFieldsFromRule(rule.find, fields || Object.keys(app.platformatic.entities[entityKey].fields))\n                    where = await fromRuleToWhere(ctx, rule.find, where, request.user)\n\n                    return originalFind({ ...restOpts, where, ctx, fields })\n                },\n                async save(originalSave, { input, ctx, fields, ...restOpts }) {\n                    if (useOriginal(ctx)) {\n                        return originalSave({ ctx, input, fields, ...restOpts })\n                    }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n\n                    if (!rule.save) {\n                        throw new Unauthorized()\n                    }\n                    checkFieldsFromRule(rule.save, fields)\n                    checkInputFromRuleFields(rule.save, input)\n\n                    if (rule.defaults) {\n                        for (const key of Object.keys(rule.defaults)) {\n                            const defaults = rule.defaults[key]\n                            if (typeof defaults === 'function') {\n                                input[key] = await defaults({ user: request.user, ctx, input })\n                            } else {\n                                input[key] = request.user[defaults]\n                            }\n                        }\n                    }\n\n                    const hasAllPrimaryKeys = input[type.primaryKey] !== undefined;\n                    const whereConditions = {}\n                    whereConditions[type.primaryKey] = { eq: input[type.primaryKey] }\n\n                    if (hasAllPrimaryKeys) {\n                        const where = await fromRuleToWhere(ctx, rule.save, whereConditions, request.user)\n\n                        const found = await type.find({\n                            where,\n                            ctx,\n                            fields,\n                        })\n\n                        if (found.length === 0) {\n                            throw new Unauthorized()\n                        }\n\n                        return originalSave({ input, ctx, fields, ...restOpts })\n                    }\n\n                    return originalSave({ input, ctx, fields, ...restOpts })\n                },\n\n                async insert(originalInsert, { inputs, ctx, fields, ...restOpts }) {\n                    if (useOriginal(ctx)) {\n                        return originalInsert({ inputs, ctx, fields, ...restOpts })\n                    }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n\n                    if (!rule.save) {\n                        throw new Unauthorized()\n                    }\n\n                    checkFieldsFromRule(rule.save, fields)\n                    checkInputFromRuleFields(rule.save, inputs)\n\n                    /* istanbul ignore else */\n                    if (rule.defaults) {\n                        for (const input of inputs) {\n                            for (const key of Object.keys(rule.defaults)) {\n                                const defaults = rule.defaults[key]\n                                if (typeof defaults === 'function') {\n                                    input[key] = await defaults({ user: request.user, ctx, input })\n                                } else {\n                                    input[key] = request.user[defaults]\n                                }\n                            }\n                        }\n                    }\n\n                    return originalInsert({ inputs, ctx, fields, ...restOpts })\n                },\n\n                async delete(originalDelete, { where, ctx, fields, ...restOpts }) {\n                    if (useOriginal(ctx)) {\n                        return originalDelete({ where, ctx, fields, ...restOpts })\n                    }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n\n                    where = await fromRuleToWhere(ctx, rule.delete, where, request.user)\n\n                    return originalDelete({ where, ctx, fields, ...restOpts })\n                },\n\n                async updateMany(originalUpdateMany, { where, ctx, fields, ...restOpts }) {\n                    if (useOriginal(ctx)) {\n                        return originalUpdateMany({ ...restOpts, where, ctx, fields })\n                    }\n                    const request = getRequestFromContext(ctx)\n                    const rule = await findRuleForRequestUser(ctx, rules, roleKey, anonymousRole, isRolePath)\n\n                    where = await fromRuleToWhere(ctx, rule.updateMany, where, request.user)\n\n                    return originalUpdateMany({ ...restOpts, where, ctx, fields })\n                },\n            })\n        }\n    }\n\n    async function scopeBasedAuth() {\n        for (const entityKey of Object.keys(app.platformatic.entities)) {\n            // const type = app.platformatic.entities[entityKey]\n\n            // We have subscriptions!\n            let userPropToFillForPublish\n            const topicsWithoutChecks = false\n\n            if (userPropToFillForPublish && topicsWithoutChecks) {\n                throw new Error(`Subscription for entity \"${entityKey}\" have conflictling rules across roles`)\n            }\n\n            function useOriginal(ctx: PlatformaticContext) {\n                return !ctx\n            }\n\n            app.platformatic.addEntityHooks(entityKey, {\n                async find(originalFind, { where, ctx, fields, ...restOpts } = {}) {\n                    if (useOriginal(ctx)) {\n                        return originalFind({ ...restOpts, where, ctx, fields })\n                    }\n                    await findScopeForRequestUser(ctx, entityKey, 'find', scopesKey, anonymousRole, isRolePath)\n\n                    // checkFieldsFromRule(scope.find, fields || Object.keys(app.platformatic.entities[entityKey].fields))\n                    // where = await fromRuleToWhere(ctx, scope.find, where, request.user)\n\n                    return originalFind({ ...restOpts, where, ctx, fields })\n                },\n                async save(originalSave, { input, ctx, fields, ...restOpts }) {\n                    if (useOriginal(ctx)) {\n                        return originalSave({ ctx, input, fields, ...restOpts })\n                    }\n                    await findScopeForRequestUser(ctx, entityKey, 'save', scopesKey, anonymousRole, isRolePath)\n\n                    // checkFieldsFromRule(rule.save, fields)\n                    // checkInputFromRuleFields(rule.save, input)\n\n                    // if (rule.defaults) {\n                    //     for (const key of Object.keys(rule.defaults)) {\n                    //         const defaults = rule.defaults[key]\n                    //         if (typeof defaults === 'function') {\n                    //             input[key] = await defaults({ user: request.user, ctx, input })\n                    //         } else {\n                    //             input[key] = request.user[defaults]\n                    //         }\n                    //     }\n                    // }\n\n                    // const hasAllPrimaryKeys = input[type.primaryKey] !== undefined;\n                    // const whereConditions = {}\n                    // whereConditions[type.primaryKey] = { eq: input[type.primaryKey] }\n\n                    // if (hasAllPrimaryKeys) {\n                    //     const where = await fromRuleToWhere(ctx, rule.save, whereConditions, request.user)\n\n                    //     const found = await type.find({\n                    //         where,\n                    //         ctx,\n                    //         fields,\n                    //     })\n\n                    //     if (found.length === 0) {\n                    //         throw new Unauthorized()\n                    //     }\n\n                    //     return originalSave({ input, ctx, fields, ...restOpts })\n                    // }\n\n                    return originalSave({ input, ctx, fields, ...restOpts })\n                },\n\n                async insert(originalInsert, { inputs, ctx, fields, ...restOpts }) {\n                    if (useOriginal(ctx)) {\n                        return originalInsert({ inputs, ctx, fields, ...restOpts })\n                    }\n                    await findScopeForRequestUser(ctx, entityKey, 'insert', scopesKey, anonymousRole, isRolePath)\n\n                    // checkFieldsFromRule(rule.save, fields)\n                    // checkInputFromRuleFields(rule.save, inputs)\n\n                    /* istanbul ignore else */\n                    // if (rule.defaults) {\n                    //     for (const input of inputs) {\n                    //         for (const key of Object.keys(rule.defaults)) {\n                    //             const defaults = rule.defaults[key]\n                    //             if (typeof defaults === 'function') {\n                    //                 input[key] = await defaults({ user: request.user, ctx, input })\n                    //             } else {\n                    //                 input[key] = request.user[defaults]\n                    //             }\n                    //         }\n                    //     }\n                    // }\n\n                    return originalInsert({ inputs, ctx, fields, ...restOpts })\n                },\n\n                async delete(originalDelete, { where, ctx, fields, ...restOpts }) {\n                    if (useOriginal(ctx)) {\n                        return originalDelete({ where, ctx, fields, ...restOpts })\n                    }\n                    await findScopeForRequestUser(ctx, entityKey, 'delete', scopesKey, anonymousRole, isRolePath)\n\n                    // where = await fromRuleToWhere(ctx, rule.delete, where, request.user)\n\n                    return originalDelete({ where, ctx, fields, ...restOpts })\n                },\n\n                async updateMany(originalUpdateMany, { where, ctx, fields, ...restOpts }) {\n                    if (useOriginal(ctx)) {\n                        return originalUpdateMany({ ...restOpts, where, ctx, fields })\n                    }\n                    await findScopeForRequestUser(ctx, entityKey, 'updateMany', scopesKey, anonymousRole, isRolePath)\n\n                    // where = await fromRuleToWhere(ctx, rule.updateMany, where, request.user)\n\n                    return originalUpdateMany({ ...restOpts, where, ctx, fields })\n                },\n            })\n        }\n    }\n\n    app.addHook('onReady', async function () {\n        if (opts.roleBasedAuth) {\n            await roleBasedAuth();\n        }\n\n        if (opts.scopeBasedAuth) {\n            await scopeBasedAuth();\n        }\n    })\n}, { name: '@albirex/platformatic-logto' });\n\nasync function fromRuleToWhere(ctx: PlatformaticContext, rule, where, user) {\n    if (!rule) {\n        throw new Unauthorized()\n    }\n    const request = getRequestFromContext(ctx)\n    /* istanbul ignore next */\n    where = where || {}\n\n    if (typeof rule === 'object') {\n        const { checks } = rule\n\n        /* istanbul ignore else */\n        if (checks) {\n            for (const key of Object.keys(checks)) {\n                const clauses = checks[key]\n                if (typeof clauses === 'string') {\n                    // case: \"userId\": \"X-PLATFORMATIC-USER-ID\"\n                    where[key] = {\n                        eq: request.user[clauses],\n                    }\n                } else {\n                    // case:\n                    // userId: {\n                    //   eq: 'X-PLATFORMATIC-USER-ID'\n                    // }\n                    for (const clauseKey of Object.keys(clauses)) {\n                        const clause = clauses[clauseKey]\n                        where[key] = {\n                            [clauseKey]: request.user[clause],\n                        }\n                    }\n                }\n            }\n        }\n    } else if (typeof rule === 'function') {\n        where = await rule({ user, ctx, where })\n    }\n    return where\n}\n\nexport async function findRuleForRequestUser(ctx: PlatformaticContext, rules: PlatformaticRule[], roleKey: string, anonymousRole: string, isRolePath = false) {\n    const request = getRequestFromContext(ctx)\n    await request.setupDBAuthorizationUser()\n    const roles = getRoles(request, roleKey, anonymousRole, isRolePath)\n    const rule = findRule(rules, roles)\n    if (!rule) {\n        ctx.reply.request.log.warn({ roles, rules }, 'no rule for roles')\n        throw new Unauthorized()\n    }\n    ctx.reply.request.log.trace({ roles, rule }, 'found rule')\n    return rule\n}\n\nexport async function findScopeForRequestUser(ctx: PlatformaticContext, entityKey: string, action: EntityActions, scopesKey: string, anonymousRole: string, isScopePath = false) {\n    const request = getRequestFromContext(ctx)\n    await request.setupDBAuthorizationUser()\n    const scopes = getScopes(request, scopesKey, anonymousRole, isScopePath)\n    const scope = scopes.find(s => {\n        if (s === PLT_ADMIN_SCOPES) {\n            return true;\n        }\n\n        if (action !== 'find') {\n            return s === `${action}:${entityKey}`\n        }\n        else {\n            return s === `${action}:${entityKey}` || s === `read:${entityKey}`\n        }\n    });\n\n    if (!scope) {\n        ctx.reply.request.log.warn('no scope found')\n        throw new Unauthorized()\n    }\n    ctx.reply.request.log.trace({ scopes, scope }, 'found scope')\n}\n\nexport function checkFieldsFromRule(rule, fields) {\n    if (!rule) {\n        throw new Unauthorized()\n    }\n    const { fields: fieldsFromRule } = rule\n    /* istanbul ignore else */\n    if (fieldsFromRule) {\n        for (const field of fields) {\n            if (!fieldsFromRule.includes(field)) {\n                throw new UnauthorizedField(field)\n            }\n        }\n    }\n}\n\nconst validateInputs = (inputs, fieldsFromRule) => {\n    for (const input of inputs) {\n        const inputFields = Object.keys(input)\n        for (const inputField of inputFields) {\n            if (!fieldsFromRule.includes(inputField)) {\n                throw new UnauthorizedField(inputField)\n            }\n        }\n    }\n}\n\nfunction checkInputFromRuleFields(rule, inputs) {\n    const { fields: fieldsFromRule } = rule\n    /* istanbul ignore else */\n    if (fieldsFromRule) {\n        if (!Array.isArray(inputs)) {\n            // save\n            validateInputs([inputs], fieldsFromRule)\n        } else {\n            // insert\n            validateInputs(inputs, fieldsFromRule)\n        }\n    }\n}\n\nfunction checkSaveMandatoryFieldsInRules(type: Entity, rules) {\n    // List of not nullable, not PKs field to validate save/insert when allowed fields are specified on the rule\n    const mandatoryFields =\n        Object.values(type.fields)\n            .filter(k => (!k.isNullable && !k.primaryKey))\n            .map(({ camelcase }) => (camelcase))\n\n    for (const rule of rules) {\n        const { entity, save } = rule\n        if (save && save.fields) {\n            const fields = save.fields\n            for (const mField of mandatoryFields) {\n                if (!fields.includes(mField)) {\n                    throw new MissingNotNullableError(mField, entity)\n                }\n            }\n        }\n    }\n}\n\n/**\n * Check the permissions version\n * @throws PermissionsOutdated if versions don't match\n */\nasync function checkPermissionsVersion(app: FastifyInstance, opts: PlatformaticLogtoAuthOptions, user = null) {\n\n    if (!opts.enableTokenVersionCheck || !opts.redis || !app.redis || !user) {\n        return;\n    }\n\n    const sessionVersionKey = opts.sessionVersionKey || 'version'\n    const tokenVersion = user?.[sessionVersionKey];\n    const userId = user?.sub;\n\n    try {\n        const redisKey = `permissions:version:${userId}`;\n        const currentVersionStr = await app.redis.get(redisKey);\n        const currentVersion = parseInt(currentVersionStr, 10);\n\n        if (currentVersionStr === null) {\n            await app.redis.set(redisKey, tokenVersion.toString());\n            app.log.debug({ userId, version: tokenVersion }, 'Initialized permissions version in Redis');\n            if (tokenVersion > 1) {\n                app.log.warn({\n                    userId,\n                    tokenVersion,\n                    currentVersion\n                }, 'Permissions version mismatch detected');\n                throw new PermissionsOutdated();\n            }\n            return;\n        }\n\n        // Compare versions\n        if (currentVersion !== tokenVersion) {\n            app.log.warn({\n                userId,\n                tokenVersion,\n                currentVersion\n            }, 'Permissions version mismatch detected');\n            throw new PermissionsOutdated();\n        }\n\n        app.log.trace({ userId, version: tokenVersion }, 'Token version check passed');\n    } catch (error) {\n        if (error.name === 'FastifyError' && error.code === 'PLT_DB_AUTH_VERSION_OUTDATED') {\n            throw error;\n        }\n        app.log.error({ err: error, userId }, 'Error checking token version');\n    }\n}\n\nexport default platformaticLogto;\n\ndeclare module 'fastify' {\n    interface FastifyInstance {\n        platformaticLogTo: {\n            opts: PlatformaticLogtoAuthOptions,\n            rules?: PlatformaticRule[]\n        }\n    }\n}","'use strict'\n\nimport { PlatformaticRule } from '../index.js'\n\nfunction findRule(rules: PlatformaticRule[], roles: string[]) {\n  let found = null\n  for (const rule of rules) {\n    for (const role of roles) {\n      if (rule.role === role) {\n        found = rule\n        break\n      }\n    }\n    if (found) {\n      break\n    }\n  }\n  return found\n}\n\nexport default findRule\n","'use strict'\n\nimport createError from '@fastify/error'\n\nconst ERROR_PREFIX = 'PLT_DB_AUTH'\n\nexport const Unauthorized = createError(`${ERROR_PREFIX}_UNAUTHORIZED`, 'operation not allowed', 401)\nexport const UnauthorizedField = createError(`${ERROR_PREFIX}_FIELD_UNAUTHORIZED`, 'field not allowed: %s', 401)\nexport const MissingNotNullableError = createError(`${ERROR_PREFIX}_NOT_NULLABLE_MISSING`, 'missing not nullable field: \"%s\" in save rule for entity \"%s\"')\nexport const PermissionsOutdated = createError(`${ERROR_PREFIX}_VERSION_OUTDATED`, 'Verision has been updated. Please logout and login again.', 403)\n","'use strict'\n\nimport type { FastifyInstance } from 'fastify'\n\n/**\n * Increment the permissions version\n * @param app - Fastify instance with Redis client and Logto\n * @param userId - User ID\n * @returns New version number\n */\nexport async function incrementPermissionsVersion(app: FastifyInstance, userId: string): Promise<number> {\n    if (!app.logto) {\n        throw new Error('Logto client not available')\n    }\n\n    const userResp = await app.logto.callAPI(`/api/users/${userId}`, 'GET')\n    const userData = await userResp.json()\n    const existingCustomData = userData.customData || {}\n    const currentVersion = existingCustomData.sessionVersion || 0\n    const newVersion = currentVersion + 1\n\n    await app.logto.callAPI(`/api/users/${userId}`, 'PATCH', JSON.stringify({ customData: { ...existingCustomData, sessionVersion: newVersion } }))\n\n    if (app.redis) {\n        const redisKey = `permissions:version:${userId}`\n        await app.redis.set(redisKey, newVersion.toString())\n    }\n\n    return newVersion\n}\n\n/**\n * Delete the permissions version for a user\n * @param app - Fastify instance with Redis client\n * @param userId - User ID\n */\nexport async function deletePermissionsVersion(app: FastifyInstance, userId: string): Promise<void> {\n    if (!app.redis) {\n        throw new Error('Redis client not available')\n    }\n\n    const redisKey = `permissions:version:${userId}`\n    await app.redis.del(redisKey)\n}\n\n","'use strict'\n\nexport function getRequestFromContext (ctx) {\n  if (ctx && !ctx.reply) {\n    throw new Error('Missing reply in context. You should call this function with { ctx: { reply }}')\n  }\n  return ctx.reply.request\n}\n\nexport function getRoles (request, roleKey, anonymousRole, isRolePath = false) {\n  let output = []\n  const user = request.user\n  if (!user) {\n    output.push(anonymousRole)\n    return output\n  }\n\n  let rolesRaw\n  if (isRolePath) {\n    const roleKeys = roleKey.split('.')\n    rolesRaw = user\n    for (const key of roleKeys) {\n      rolesRaw = rolesRaw[key]\n    }\n  } else {\n    rolesRaw = user[roleKey]\n  }\n\n  if (typeof rolesRaw === 'string') {\n    output = rolesRaw.split(',')\n  } else if (Array.isArray(rolesRaw)) {\n    output = rolesRaw\n  }\n  if (output.length === 0) {\n    output.push(anonymousRole)\n  }\n\n  return output\n}\n\nexport function getScopes(request, scopesKey, anonymousRole, isScopePath = false) {\n  let output = []\n  const user = request.user\n  if (!user) {\n    output.push(anonymousRole)\n    return output\n  }\n\n  let scopesRaw\n  if (isScopePath) {\n    const roleKeys = scopesKey.split('.')\n    scopesRaw = user\n    for (const key of roleKeys) {\n      scopesRaw = scopesRaw[key]\n    }\n  } else {\n    scopesRaw = user[scopesKey]\n  }\n\n  if (typeof scopesRaw === 'string') {\n    output = scopesRaw.split(' ')\n  } else if (Array.isArray(scopesRaw)) {\n    output = scopesRaw\n  }\n  if (output.length === 0) {\n    output.push(anonymousRole)\n  }\n\n  return output\n}\n"],"mappings":";AAAA,OAAO,QAAQ;AACf,YAAY,iBAAiB;;;ACG7B,SAAS,SAAS,OAA2B,OAAiB;AAC5D,MAAI,QAAQ;AACZ,aAAW,QAAQ,OAAO;AACxB,eAAW,QAAQ,OAAO;AACxB,UAAI,KAAK,SAAS,MAAM;AACtB,gBAAQ;AACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO;AACT;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,IAAO,oBAAQ;;;AClBf,OAAO,iBAAiB;AAExB,IAAM,eAAe;AAEd,IAAM,eAAe,YAAY,GAAG,YAAY,iBAAiB,yBAAyB,GAAG;AAC7F,IAAM,oBAAoB,YAAY,GAAG,YAAY,uBAAuB,yBAAyB,GAAG;AACxG,IAAM,0BAA0B,YAAY,GAAG,YAAY,yBAAyB,+DAA+D;AACnJ,IAAM,sBAAsB,YAAY,GAAG,YAAY,qBAAqB,6DAA6D,GAAG;;;AFJnJ,OAAO,kBAAkB;AACzB,OAAO,kBAAkB;AAKzB,SAAS,gBAAAA,qBAAoB;;;AGD7B,eAAsB,4BAA4B,KAAsB,QAAiC;AACrG,MAAI,CAAC,IAAI,OAAO;AACZ,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAChD;AAEA,QAAM,WAAW,MAAM,IAAI,MAAM,QAAQ,cAAc,MAAM,IAAI,KAAK;AACtE,QAAM,WAAW,MAAM,SAAS,KAAK;AACrC,QAAM,qBAAqB,SAAS,cAAc,CAAC;AACnD,QAAM,iBAAiB,mBAAmB,kBAAkB;AAC5D,QAAM,aAAa,iBAAiB;AAEpC,QAAM,IAAI,MAAM,QAAQ,cAAc,MAAM,IAAI,SAAS,KAAK,UAAU,EAAE,YAAY,EAAE,GAAG,oBAAoB,gBAAgB,WAAW,EAAE,CAAC,CAAC;AAE9I,MAAI,IAAI,OAAO;AACX,UAAM,WAAW,uBAAuB,MAAM;AAC9C,UAAM,IAAI,MAAM,IAAI,UAAU,WAAW,SAAS,CAAC;AAAA,EACvD;AAEA,SAAO;AACX;AAOA,eAAsB,yBAAyB,KAAsB,QAA+B;AAChG,MAAI,CAAC,IAAI,OAAO;AACZ,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAChD;AAEA,QAAM,WAAW,uBAAuB,MAAM;AAC9C,QAAM,IAAI,MAAM,IAAI,QAAQ;AAChC;;;ACzCO,SAAS,sBAAuB,KAAK;AAC1C,MAAI,OAAO,CAAC,IAAI,OAAO;AACrB,UAAM,IAAI,MAAM,gFAAgF;AAAA,EAClG;AACA,SAAO,IAAI,MAAM;AACnB;AAEO,SAAS,SAAU,SAAS,SAAS,eAAe,aAAa,OAAO;AAC7E,MAAI,SAAS,CAAC;AACd,QAAM,OAAO,QAAQ;AACrB,MAAI,CAAC,MAAM;AACT,WAAO,KAAK,aAAa;AACzB,WAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI,YAAY;AACd,UAAM,WAAW,QAAQ,MAAM,GAAG;AAClC,eAAW;AACX,eAAW,OAAO,UAAU;AAC1B,iBAAW,SAAS,GAAG;AAAA,IACzB;AAAA,EACF,OAAO;AACL,eAAW,KAAK,OAAO;AAAA,EACzB;AAEA,MAAI,OAAO,aAAa,UAAU;AAChC,aAAS,SAAS,MAAM,GAAG;AAAA,EAC7B,WAAW,MAAM,QAAQ,QAAQ,GAAG;AAClC,aAAS;AAAA,EACX;AACA,MAAI,OAAO,WAAW,GAAG;AACvB,WAAO,KAAK,aAAa;AAAA,EAC3B;AAEA,SAAO;AACT;AAEO,SAAS,UAAU,SAAS,WAAW,eAAe,cAAc,OAAO;AAChF,MAAI,SAAS,CAAC;AACd,QAAM,OAAO,QAAQ;AACrB,MAAI,CAAC,MAAM;AACT,WAAO,KAAK,aAAa;AACzB,WAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI,aAAa;AACf,UAAM,WAAW,UAAU,MAAM,GAAG;AACpC,gBAAY;AACZ,eAAW,OAAO,UAAU;AAC1B,kBAAY,UAAU,GAAG;AAAA,IAC3B;AAAA,EACF,OAAO;AACL,gBAAY,KAAK,SAAS;AAAA,EAC5B;AAEA,MAAI,OAAO,cAAc,UAAU;AACjC,aAAS,UAAU,MAAM,GAAG;AAAA,EAC9B,WAAW,MAAM,QAAQ,SAAS,GAAG;AACnC,aAAS;AAAA,EACX;AACA,MAAI,OAAO,WAAW,GAAG;AACvB,WAAO,KAAK,aAAa;AAAA,EAC3B;AAEA,SAAO;AACT;;;AJpDA,IAAM,iBAAiB;AACvB,IAAM,mBAAmB;AAqDlB,IAAM,oBAAsE,GAAG,OAAO,KAAsB,SAAuC;AACtJ,MAAI,SAAS,qBAAqB;AAAA,IAC9B;AAAA,EACJ,CAAC;AAGD,MAAI,KAAK,OAAO;AACZ,UAAM,IAAI,SAAS,cAAc;AAAA,MAC7B,MAAM,KAAK,MAAM,QAAQ;AAAA,MACzB,MAAM,KAAK,MAAM,QAAQ;AAAA,MACzB,UAAU,KAAK,MAAM;AAAA,MACrB,UAAU,KAAK,MAAM;AAAA,MACrB,IAAI,KAAK,MAAM,MAAM;AAAA,IACzB,CAAC;AACD,QAAI,IAAI,KAAK,uDAAuD;AAAA,EACxE;AAEA,MAAI,KAAK,eAAe;AACpB,QAAI,SAAS,cAAc;AAAA,MACvB,UAAU,KAAK,cAAc,gBAAgB;AAAA,MAC7C,OAAO,KAAK,cAAc,cAAc;AAAA,MACxC,WAAW,KAAK,cAAc,kBAAkB;AAAA,IACpD,CAAC;AAAA,EACL;AAEA,QAAM,IAAI,SAAS,aAA8C,KAAK,SAAS;AAE/E,QAAM,UAAU,KAAK,eAAe,YAAY,KAAK,eAAe,WAAW;AAC/E,QAAM,YAAY,KAAK,eAAe,cAAc,KAAK,eAAe,aAAa;AACrF,QAAM,cAAc,KAAK;AACzB,QAAM,aAAa,CAAC,CAAC,KAAK,eAAe;AACzC,QAAM,gBAAgB,KAAK,iBAAiB;AAE5C,MAAI,gBAAgB,4BAA4B,SAAS;AAEzD,iBAAe,YAAY;AAEvB,UAAM,KAAK,YAAY;AAGvB,QAAI,iBAAiB;AACrB,QAAI,eAAe,KAAK,QAAQ,6BAA6B,MAAM,aAAa;AAC5E,UAAI,KAAK,UAAU,KAAK;AACpB,yBAAiB;AAAA,MACrB,OAAO;AACH,aAAK,IAAI,KAAK,uBAAuB;AACrC,aAAK,OAAO,IAAI,MAAM,KAAK,SAAS;AAAA,UAChC,KAAK,CAAC,QAAQ,QAAQ;AAClB,gBAAI;AACJ,gBAAI,CAAC,OAAO,IAAI,SAAS,CAAC,GAAG;AACzB,oBAAM,SAAS,IAAI,SAAS,EAAE,YAAY;AAC1C,sBAAQ,OAAO,MAAM;AAAA,YACzB,OAAO;AACH,sBAAQ,OAAO,IAAI,SAAS,CAAC;AAAA,YACjC;AAEA,gBAAI,CAAC,SAAS,IAAI,SAAS,EAAE,YAAY,MAAM,QAAQ,YAAY,GAAG;AAClE,sBAAQ;AAAA,YACZ;AACA,mBAAO;AAAA,UACX;AAAA,QACJ,CAAC;AAAA,MACL;AAAA,IACJ,OAAO;AACH,YAAM,wBAAwB,KAAK,MAAM,KAAK,IAAI;AAAA,IACtD;AAEA,QAAI,gBAAgB;AAEhB,UAAI,KAAK,eAAe;AACpB,aAAK,OAAO;AAAA;AAAA,UAER,CAAC,OAAO,GAAG,KAAK,QAAQ,qBAAqB,IAAI,CAAC,KAAK,QAAQ,qBAAqB,CAAC,IAAI,CAAC,cAAc;AAAA,QAC5G;AAAA,MACJ;AAEA,UAAI,KAAK,gBAAgB;AACrB,aAAK,OAAO;AAAA;AAAA,UAER,CAAC,SAAS,GAAG,KAAK,QAAQ,uBAAuB,IAAI,CAAC,KAAK,QAAQ,uBAAuB,CAAC,IAAI,CAAC,gBAAgB;AAAA,QACpH;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ;AAEA,iBAAe,gBAAgB;AAC3B,UAAM,UAAU,KAAK,cAAc,WAAW,KAAK,cAAc,YAAY;AAE7E,mBAAe,oBAAoB;AAC/B,YAAM,YAAY,MAAM,IAAI,MAAM,QAAQ,wBAAwB,KAAK;AAEvE,UAAI,CAAC,UAAU,IAAI;AACf,cAAM;AAAA,MACV;AAEA,YAAM,QAAQ,MAAM,UAAU,KAAK;AACnC,YAAM,QAA4B,CAAC;AAAA,QAC/B,MAAM;AAAA,QACN,UAAU,OAAO,KAAK,IAAI,aAAa,QAAQ;AAAA,QAC/C,MAAM,KAAK;AAAA,QACX,MAAM,KAAK;AAAA,QACX,QAAQ,KAAK;AAAA,MACjB,CAAC;AAED,iBAAW,QAAQ,OAAO;AACtB,cAAM,aAAa,MAAM,IAAI,MAAM,QAAQ,cAAc,KAAK,EAAE,WAAW,KAAK;AAEhF,YAAI,CAAC,WAAW,IAAI;AAChB,gBAAM;AAAA,QACV;AAEA,cAAM,SAAS,MAAM,WAAW,KAAK;AAErC,mBAAW,SAAS,QAAQ;AACxB,gBAAM,WAAW,KAAK;AAEtB,cAAI,CAAC,aAAa,MAAM,IAAI,MAAM,KAAK,MAAM,GAAG;AAEhD,cAAI,CAAC,IAAI,aAAa,SAAS,MAAM,GAAG;AACpC,gBAAI,IAAI,MAAM,mBAAmB,MAAM,yBAAyB;AAChE;AAAA,UACJ;AAEA,kBAAQ,aAAa;AAAA,YACjB,KAAK;AACD,4BAAc;AACd;AAAA,YACJ,KAAK;AACD,4BAAc;AACd;AAAA,YACJ,KAAK;AACD,4BAAc;AACd;AAAA,UACR;AAEA,gBAAM,cAAc,MAAM,KAAK,OAAK,EAAE,SAAS,YAAY,EAAE,WAAW,MAAM;AAC9E,cAAI,aAAa;AACb,gBAAI,KAAK,QAAQ;AACb,0BAAY,WAAW,IAAI;AAAA,gBACvB,QAAQ;AAAA,kBACJ,QAAQ;AAAA,gBACZ;AAAA,cACJ;AAAA,YACJ,OAAO;AACH,0BAAY,WAAW,IAAI;AAAA,YAC/B;AAAA,UACJ,OAAO;AACH,kBAAM,UAA4B;AAAA,cAC9B,MAAM;AAAA,cACN;AAAA,YACJ;AAEA,gBAAI,KAAK,QAAQ;AACb,sBAAQ,WAAW,IAAI;AAAA,gBACnB,QAAQ;AAAA,kBACJ,QAAQ;AAAA,gBACZ;AAAA,cACJ;AAAA,YACJ,OAAO;AACH,sBAAQ,WAAW,IAAI;AAAA,YAC3B;AAEA,gBAAI,KAAK,UAAU;AACf,sBAAQ,WAAW;AAAA,gBACf,QAAQ;AAAA,cACZ;AAAA,YACJ;AAEA,kBAAM,KAAK,OAAO;AAAA,UACtB;AAAA,QACJ;AAAA,MACJ;AAEA,YAAM,WAAW,MAAM,OAAO,CAAC,MAAM,SAAS;AAC1C,SAAC,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI;AACrC,eAAO;AAAA,MACX,GAAG,CAAC,CAAC;AAEL,iBAAW,OAAO,UAAU;AACxB,YAAI,IAAI,KAAK,sBAAsB,GAAG,EAAE;AAExC,mBAAW,WAAW,SAAS,GAAG,GAAG;AAEjC,gBAAM,EAAE,QAAQ,UAAU,MAAM,GAAG,MAAM,IAAI;AAC7C,cAAI,IAAI,KAAK,IAAK,UAAU,SAAS,KAAK,GAAG,CAAC,KAAK,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,QAC9E;AAAA,MACJ;AAEA,YAAM,kBAAkB,OAAO,KAAK,IAAI,aAAa,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAEpH,UAAI,gBAAgB,QAAQ;AACxB,YAAI,IAAI,KAAK,+BAA+B,gBAAgB,KAAK,IAAI,CAAC,EAAE;AAAA,MAC5E;AAEA,UAAI,IAAI,MAAM,wBAAwB;AACtC,UAAI,IAAI,MAAM,KAAK;AACnB,aAAO;AAAA,IACX;AAEA,UAAM,aAAa,MAAM,kBAAkB;AAE3C,QAAI,kBAAkB,QAAQ;AAG9B,UAAM,cAAc,CAAC;AACrB,aAAS,IAAI,GAAG,IAAI,WAAW,QAAQ,KAAK;AACxC,YAAM,OAAO,WAAW,CAAC;AAEzB,UAAI,eAAe;AACnB,UAAI,KAAK,QAAQ;AACb,uBAAe,CAAC,KAAK,MAAM;AAAA,MAC/B,WAAW,KAAK,UAAU;AACtB,uBAAe,CAAC,GAAG,KAAK,QAAQ;AAAA,MACpC,OAAO;AACH,cAAM,IAAI,MAAM,wCAAwC,CAAC,EAAE;AAAA,MAC/D;AAEA,iBAAW,cAAc,cAAc;AACnC,cAAM,UAAU,EAAE,GAAG,MAAM,QAAQ,YAAY,UAAU,OAAU;AACnE,YAAI,CAAC,IAAI,aAAa,SAAS,QAAQ,MAAM,GAAG;AAC5C,gBAAM,IAAI,MAAM,mBAAmB,UAAU,2BAA2B,CAAC,EAAE;AAAA,QAC/E;AAEA,YAAI,CAAC,YAAY,UAAU,GAAG;AAC1B,sBAAY,UAAU,IAAI,CAAC;AAAA,QAC/B;AACA,oBAAY,UAAU,EAAE,KAAK,OAAO;AAAA,MACxC;AAAA,IACJ;AAEA,eAAW,aAAa,OAAO,KAAK,IAAI,aAAa,QAAQ,GAAG;AA2B5D,UAAS,cAAT,SAAqB,KAA0B;AAC3C,eAAO,CAAC;AAAA,MACZ;AA5BA,YAAM,QAAQ,YAAY,SAAS,KAAK,CAAC;AACzC,YAAM,OAAO,IAAI,aAAa,SAAS,SAAS;AAGhD,UAAI;AACJ,YAAM,sBAAsB;AAE5B,UAAI,4BAA4B,qBAAqB;AACjD,cAAM,IAAI,MAAM,4BAA4B,SAAS,wCAAwC;AAAA,MACjG;AAGA,UAAI,aAAa;AACb,cAAM,KAAK;AAAA,UACP,MAAM;AAAA,UACN,MAAM;AAAA,UACN,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,YAAY;AAAA,QAChB,CAAC;AAAA,MACL;AAIA,sCAAgC,MAAM,KAAK;AAM3C,UAAI,aAAa,eAAe,WAAW;AAAA,QACvC,MAAM,KAAK,cAAc,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,IAAI,CAAC,GAAG;AAC/D,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,aAAa,EAAE,GAAG,UAAU,OAAO,KAAK,OAAO,CAAC;AAAA,UAC3D;AACA,gBAAM,UAAU,sBAAsB,GAAG;AACzC,gBAAM,OAAO,MAAM,uBAAuB,KAAK,OAAO,SAAS,eAAe,UAAU;AACxF,8BAAoB,KAAK,MAAM,UAAU,OAAO,KAAK,IAAI,aAAa,SAAS,SAAS,EAAE,MAAM,CAAC;AACjG,kBAAQ,MAAM,gBAAgB,KAAK,KAAK,MAAM,OAAO,QAAQ,IAAI;AAEjE,iBAAO,aAAa,EAAE,GAAG,UAAU,OAAO,KAAK,OAAO,CAAC;AAAA,QAC3D;AAAA,QACA,MAAM,KAAK,cAAc,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,GAAG;AAC1D,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,aAAa,EAAE,KAAK,OAAO,QAAQ,GAAG,SAAS,CAAC;AAAA,UAC3D;AACA,gBAAM,UAAU,sBAAsB,GAAG;AACzC,gBAAM,OAAO,MAAM,uBAAuB,KAAK,OAAO,SAAS,eAAe,UAAU;AAExF,cAAI,CAAC,KAAK,MAAM;AACZ,kBAAM,IAAI,aAAa;AAAA,UAC3B;AACA,8BAAoB,KAAK,MAAM,MAAM;AACrC,mCAAyB,KAAK,MAAM,KAAK;AAEzC,cAAI,KAAK,UAAU;AACf,uBAAW,OAAO,OAAO,KAAK,KAAK,QAAQ,GAAG;AAC1C,oBAAM,WAAW,KAAK,SAAS,GAAG;AAClC,kBAAI,OAAO,aAAa,YAAY;AAChC,sBAAM,GAAG,IAAI,MAAM,SAAS,EAAE,MAAM,QAAQ,MAAM,KAAK,MAAM,CAAC;AAAA,cAClE,OAAO;AACH,sBAAM,GAAG,IAAI,QAAQ,KAAK,QAAQ;AAAA,cACtC;AAAA,YACJ;AAAA,UACJ;AAEA,gBAAM,oBAAoB,MAAM,KAAK,UAAU,MAAM;AACrD,gBAAM,kBAAkB,CAAC;AACzB,0BAAgB,KAAK,UAAU,IAAI,EAAE,IAAI,MAAM,KAAK,UAAU,EAAE;AAEhE,cAAI,mBAAmB;AACnB,kBAAM,QAAQ,MAAM,gBAAgB,KAAK,KAAK,MAAM,iBAAiB,QAAQ,IAAI;AAEjF,kBAAM,QAAQ,MAAM,KAAK,KAAK;AAAA,cAC1B;AAAA,cACA;AAAA,cACA;AAAA,YACJ,CAAC;AAED,gBAAI,MAAM,WAAW,GAAG;AACpB,oBAAM,IAAI,aAAa;AAAA,YAC3B;AAEA,mBAAO,aAAa,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,UAC3D;AAEA,iBAAO,aAAa,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,QAC3D;AAAA,QAEA,MAAM,OAAO,gBAAgB,EAAE,QAAQ,KAAK,QAAQ,GAAG,SAAS,GAAG;AAC/D,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,eAAe,EAAE,QAAQ,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,UAC9D;AACA,gBAAM,UAAU,sBAAsB,GAAG;AACzC,gBAAM,OAAO,MAAM,uBAAuB,KAAK,OAAO,SAAS,eAAe,UAAU;AAExF,cAAI,CAAC,KAAK,MAAM;AACZ,kBAAM,IAAI,aAAa;AAAA,UAC3B;AAEA,8BAAoB,KAAK,MAAM,MAAM;AACrC,mCAAyB,KAAK,MAAM,MAAM;AAG1C,cAAI,KAAK,UAAU;AACf,uBAAW,SAAS,QAAQ;AACxB,yBAAW,OAAO,OAAO,KAAK,KAAK,QAAQ,GAAG;AAC1C,sBAAM,WAAW,KAAK,SAAS,GAAG;AAClC,oBAAI,OAAO,aAAa,YAAY;AAChC,wBAAM,GAAG,IAAI,MAAM,SAAS,EAAE,MAAM,QAAQ,MAAM,KAAK,MAAM,CAAC;AAAA,gBAClE,OAAO;AACH,wBAAM,GAAG,IAAI,QAAQ,KAAK,QAAQ;AAAA,gBACtC;AAAA,cACJ;AAAA,YACJ;AAAA,UACJ;AAEA,iBAAO,eAAe,EAAE,QAAQ,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,QAC9D;AAAA,QAEA,MAAM,OAAO,gBAAgB,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,GAAG;AAC9D,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,eAAe,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,UAC7D;AACA,gBAAM,UAAU,sBAAsB,GAAG;AACzC,gBAAM,OAAO,MAAM,uBAAuB,KAAK,OAAO,SAAS,eAAe,UAAU;AAExF,kBAAQ,MAAM,gBAAgB,KAAK,KAAK,QAAQ,OAAO,QAAQ,IAAI;AAEnE,iBAAO,eAAe,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,QAC7D;AAAA,QAEA,MAAM,WAAW,oBAAoB,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,GAAG;AACtE,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,mBAAmB,EAAE,GAAG,UAAU,OAAO,KAAK,OAAO,CAAC;AAAA,UACjE;AACA,gBAAM,UAAU,sBAAsB,GAAG;AACzC,gBAAM,OAAO,MAAM,uBAAuB,KAAK,OAAO,SAAS,eAAe,UAAU;AAExF,kBAAQ,MAAM,gBAAgB,KAAK,KAAK,YAAY,OAAO,QAAQ,IAAI;AAEvE,iBAAO,mBAAmB,EAAE,GAAG,UAAU,OAAO,KAAK,OAAO,CAAC;AAAA,QACjE;AAAA,MACJ,CAAC;AAAA,IACL;AAAA,EACJ;AAEA,iBAAe,iBAAiB;AAC5B,eAAW,aAAa,OAAO,KAAK,IAAI,aAAa,QAAQ,GAAG;AAW5D,UAAS,cAAT,SAAqB,KAA0B;AAC3C,eAAO,CAAC;AAAA,MACZ;AATA,UAAI;AACJ,YAAM,sBAAsB;AAE5B,UAAI,4BAA4B,qBAAqB;AACjD,cAAM,IAAI,MAAM,4BAA4B,SAAS,wCAAwC;AAAA,MACjG;AAMA,UAAI,aAAa,eAAe,WAAW;AAAA,QACvC,MAAM,KAAK,cAAc,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,IAAI,CAAC,GAAG;AAC/D,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,aAAa,EAAE,GAAG,UAAU,OAAO,KAAK,OAAO,CAAC;AAAA,UAC3D;AACA,gBAAM,wBAAwB,KAAK,WAAW,QAAQ,WAAW,eAAe,UAAU;AAK1F,iBAAO,aAAa,EAAE,GAAG,UAAU,OAAO,KAAK,OAAO,CAAC;AAAA,QAC3D;AAAA,QACA,MAAM,KAAK,cAAc,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,GAAG;AAC1D,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,aAAa,EAAE,KAAK,OAAO,QAAQ,GAAG,SAAS,CAAC;AAAA,UAC3D;AACA,gBAAM,wBAAwB,KAAK,WAAW,QAAQ,WAAW,eAAe,UAAU;AAoC1F,iBAAO,aAAa,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,QAC3D;AAAA,QAEA,MAAM,OAAO,gBAAgB,EAAE,QAAQ,KAAK,QAAQ,GAAG,SAAS,GAAG;AAC/D,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,eAAe,EAAE,QAAQ,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,UAC9D;AACA,gBAAM,wBAAwB,KAAK,WAAW,UAAU,WAAW,eAAe,UAAU;AAmB5F,iBAAO,eAAe,EAAE,QAAQ,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,QAC9D;AAAA,QAEA,MAAM,OAAO,gBAAgB,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,GAAG;AAC9D,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,eAAe,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,UAC7D;AACA,gBAAM,wBAAwB,KAAK,WAAW,UAAU,WAAW,eAAe,UAAU;AAI5F,iBAAO,eAAe,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,QAC7D;AAAA,QAEA,MAAM,WAAW,oBAAoB,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,GAAG;AACtE,cAAI,YAAY,GAAG,GAAG;AAClB,mBAAO,mBAAmB,EAAE,GAAG,UAAU,OAAO,KAAK,OAAO,CAAC;AAAA,UACjE;AACA,gBAAM,wBAAwB,KAAK,WAAW,cAAc,WAAW,eAAe,UAAU;AAIhG,iBAAO,mBAAmB,EAAE,GAAG,UAAU,OAAO,KAAK,OAAO,CAAC;AAAA,QACjE;AAAA,MACJ,CAAC;AAAA,IACL;AAAA,EACJ;AAEA,MAAI,QAAQ,WAAW,iBAAkB;AACrC,QAAI,KAAK,eAAe;AACpB,YAAM,cAAc;AAAA,IACxB;AAEA,QAAI,KAAK,gBAAgB;AACrB,YAAM,eAAe;AAAA,IACzB;AAAA,EACJ,CAAC;AACL,GAAG,EAAE,MAAM,8BAA8B,CAAC;AAE1C,eAAe,gBAAgB,KAA0B,MAAM,OAAO,MAAM;AACxE,MAAI,CAAC,MAAM;AACP,UAAM,IAAI,aAAa;AAAA,EAC3B;AACA,QAAM,UAAU,sBAAsB,GAAG;AAEzC,UAAQ,SAAS,CAAC;AAElB,MAAI,OAAO,SAAS,UAAU;AAC1B,UAAM,EAAE,OAAO,IAAI;AAGnB,QAAI,QAAQ;AACR,iBAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACnC,cAAM,UAAU,OAAO,GAAG;AAC1B,YAAI,OAAO,YAAY,UAAU;AAE7B,gBAAM,GAAG,IAAI;AAAA,YACT,IAAI,QAAQ,KAAK,OAAO;AAAA,UAC5B;AAAA,QACJ,OAAO;AAKH,qBAAW,aAAa,OAAO,KAAK,OAAO,GAAG;AAC1C,kBAAM,SAAS,QAAQ,SAAS;AAChC,kBAAM,GAAG,IAAI;AAAA,cACT,CAAC,SAAS,GAAG,QAAQ,KAAK,MAAM;AAAA,YACpC;AAAA,UACJ;AAAA,QACJ;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ,WAAW,OAAO,SAAS,YAAY;AACnC,YAAQ,MAAM,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;AAAA,EAC3C;AACA,SAAO;AACX;AAEA,eAAsB,uBAAuB,KAA0B,OAA2B,SAAiB,eAAuB,aAAa,OAAO;AAC1J,QAAM,UAAU,sBAAsB,GAAG;AACzC,QAAM,QAAQ,yBAAyB;AACvC,QAAM,QAAQ,SAAS,SAAS,SAAS,eAAe,UAAU;AAClE,QAAM,OAAO,kBAAS,OAAO,KAAK;AAClC,MAAI,CAAC,MAAM;AACP,QAAI,MAAM,QAAQ,IAAI,KAAK,EAAE,OAAO,MAAM,GAAG,mBAAmB;AAChE,UAAM,IAAI,aAAa;AAAA,EAC3B;AACA,MAAI,MAAM,QAAQ,IAAI,MAAM,EAAE,OAAO,KAAK,GAAG,YAAY;AACzD,SAAO;AACX;AAEA,eAAsB,wBAAwB,KAA0B,WAAmB,QAAuB,WAAmB,eAAuB,cAAc,OAAO;AAC7K,QAAM,UAAU,sBAAsB,GAAG;AACzC,QAAM,QAAQ,yBAAyB;AACvC,QAAM,SAAS,UAAU,SAAS,WAAW,eAAe,WAAW;AACvE,QAAM,QAAQ,OAAO,KAAK,OAAK;AAC3B,QAAI,MAAM,kBAAkB;AACxB,aAAO;AAAA,IACX;AAEA,QAAI,WAAW,QAAQ;AACnB,aAAO,MAAM,GAAG,MAAM,IAAI,SAAS;AAAA,IACvC,OACK;AACD,aAAO,MAAM,GAAG,MAAM,IAAI,SAAS,MAAM,MAAM,QAAQ,SAAS;AAAA,IACpE;AAAA,EACJ,CAAC;AAED,MAAI,CAAC,OAAO;AACR,QAAI,MAAM,QAAQ,IAAI,KAAK,gBAAgB;AAC3C,UAAM,IAAI,aAAa;AAAA,EAC3B;AACA,MAAI,MAAM,QAAQ,IAAI,MAAM,EAAE,QAAQ,MAAM,GAAG,aAAa;AAChE;AAEO,SAAS,oBAAoB,MAAM,QAAQ;AAC9C,MAAI,CAAC,MAAM;AACP,UAAM,IAAI,aAAa;AAAA,EAC3B;AACA,QAAM,EAAE,QAAQ,eAAe,IAAI;AAEnC,MAAI,gBAAgB;AAChB,eAAW,SAAS,QAAQ;AACxB,UAAI,CAAC,eAAe,SAAS,KAAK,GAAG;AACjC,cAAM,IAAI,kBAAkB,KAAK;AAAA,MACrC;AAAA,IACJ;AAAA,EACJ;AACJ;AAEA,IAAM,iBAAiB,CAAC,QAAQ,mBAAmB;AAC/C,aAAW,SAAS,QAAQ;AACxB,UAAM,cAAc,OAAO,KAAK,KAAK;AACrC,eAAW,cAAc,aAAa;AAClC,UAAI,CAAC,eAAe,SAAS,UAAU,GAAG;AACtC,cAAM,IAAI,kBAAkB,UAAU;AAAA,MAC1C;AAAA,IACJ;AAAA,EACJ;AACJ;AAEA,SAAS,yBAAyB,MAAM,QAAQ;AAC5C,QAAM,EAAE,QAAQ,eAAe,IAAI;AAEnC,MAAI,gBAAgB;AAChB,QAAI,CAAC,MAAM,QAAQ,MAAM,GAAG;AAExB,qBAAe,CAAC,MAAM,GAAG,cAAc;AAAA,IAC3C,OAAO;AAEH,qBAAe,QAAQ,cAAc;AAAA,IACzC;AAAA,EACJ;AACJ;AAEA,SAAS,gCAAgC,MAAc,OAAO;AAE1D,QAAM,kBACF,OAAO,OAAO,KAAK,MAAM,EACpB,OAAO,OAAM,CAAC,EAAE,cAAc,CAAC,EAAE,UAAW,EAC5C,IAAI,CAAC,EAAE,UAAU,MAAO,SAAU;AAE3C,aAAW,QAAQ,OAAO;AACtB,UAAM,EAAE,QAAQ,KAAK,IAAI;AACzB,QAAI,QAAQ,KAAK,QAAQ;AACrB,YAAM,SAAS,KAAK;AACpB,iBAAW,UAAU,iBAAiB;AAClC,YAAI,CAAC,OAAO,SAAS,MAAM,GAAG;AAC1B,gBAAM,IAAI,wBAAwB,QAAQ,MAAM;AAAA,QACpD;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ;AACJ;AAMA,eAAe,wBAAwB,KAAsB,MAAoC,OAAO,MAAM;AAE1G,MAAI,CAAC,KAAK,2BAA2B,CAAC,KAAK,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM;AACrE;AAAA,EACJ;AAEA,QAAM,oBAAoB,KAAK,qBAAqB;AACpD,QAAM,eAAe,OAAO,iBAAiB;AAC7C,QAAM,SAAS,MAAM;AAErB,MAAI;AACA,UAAM,WAAW,uBAAuB,MAAM;AAC9C,UAAM,oBAAoB,MAAM,IAAI,MAAM,IAAI,QAAQ;AACtD,UAAM,iBAAiB,SAAS,mBAAmB,EAAE;AAErD,QAAI,sBAAsB,MAAM;AAC5B,YAAM,IAAI,MAAM,IAAI,UAAU,aAAa,SAAS,CAAC;AACrD,UAAI,IAAI,MAAM,EAAE,QAAQ,SAAS,aAAa,GAAG,0CAA0C;AAC3F,UAAI,eAAe,GAAG;AAClB,YAAI,IAAI,KAAK;AAAA,UACT;AAAA,UACA;AAAA,UACA;AAAA,QACJ,GAAG,uCAAuC;AAC1C,cAAM,IAAI,oBAAoB;AAAA,MAClC;AACA;AAAA,IACJ;AAGA,QAAI,mBAAmB,cAAc;AACjC,UAAI,IAAI,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,MACJ,GAAG,uCAAuC;AAC1C,YAAM,IAAI,oBAAoB;AAAA,IAClC;AAEA,QAAI,IAAI,MAAM,EAAE,QAAQ,SAAS,aAAa,GAAG,4BAA4B;AAAA,EACjF,SAAS,OAAO;AACZ,QAAI,MAAM,SAAS,kBAAkB,MAAM,SAAS,gCAAgC;AAChF,YAAM;AAAA,IACV;AACA,QAAI,IAAI,MAAM,EAAE,KAAK,OAAO,OAAO,GAAG,8BAA8B;AAAA,EACxE;AACJ;AAEA,IAAO,gBAAQ;","names":["fastifyLogto"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@albirex/platformatic-logto",
-  "version": "1.6.4",
+  "version": "1.7.1",
   "description": "LogTo roles and scopes integrated in Platformatic authorization",
   "type": "module",
   "main": "./lib/index.cjs",