@ankhorage/infra 4.1.12 → 5.0.0

package/dist/adapters/minikube/authz/cerbos/index.js

@@ -1,382 +0,0 @@
-import { resolveAuthFlow } from '@ankhorage/contracts/auth';
-const CERBOS_NAMESPACE = 'cerbos';
-export function generateCerbosAuthzArtifacts(args) {
-    const { manifest, appManifest } = args;
-    const namespace = CERBOS_NAMESPACE;
-    const root = 'infra/minikube/k8s/authz/cerbos';
-    const resourceRoot = 'authz/cerbos';
-    const intent = buildCerbosPolicyIntent({ manifest, appManifest });
-    const endpointUrl = `http://cerbos.${namespace}.svc.cluster.local:3592`;
-    const lifecycle = {
-        id: 'cerbos',
-        namespace,
-        endpoints: [{ name: 'http', url: endpointUrl }],
-        readinessChecks: [
-            {
-                label: 'cerbos',
-                namespace,
-                resource: 'deployment/cerbos',
-                timeoutSeconds: 180,
-            },
-        ],
-        migrationCommands: [],
-        reconciliationCommands: [],
-        statusChecks: [],
-    };
-    return {
-        files: [
-            {
-                path: `${root}/cerbos.configmap.yaml`,
-                content: getCerbosConfigMap(namespace),
-            },
-            {
-                path: `${root}/cerbos.policy.configmap.yaml`,
-                content: getCerbosPolicyConfigMap({ namespace, intent }),
-            },
-            {
-                path: `${root}/cerbos.deployment.yaml`,
-                content: getCerbosDeployment(namespace),
-            },
-            {
-                path: `${root}/cerbos.service.yaml`,
-                content: getCerbosService(namespace),
-            },
-        ],
-        resources: [
-            `${resourceRoot}/cerbos.configmap.yaml`,
-            `${resourceRoot}/cerbos.policy.configmap.yaml`,
-            `${resourceRoot}/cerbos.deployment.yaml`,
-            `${resourceRoot}/cerbos.service.yaml`,
-        ],
-        providerLifecycle: [lifecycle],
-        envEntries: [`CERBOS_URL=${endpointUrl}`],
-        warnings: [],
-    };
-}
-function getCerbosConfigMap(namespace) {
-    return `apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: cerbos-config
-  namespace: ${namespace}
-data:
-  config.yaml: |
-    server:
-      httpListenAddr: ":3592"
-    storage:
-      driver: "disk"
-      disk:
-        directory: /policies
-`;
-}
-function getCerbosPolicyConfigMap(args) {
-    const { namespace, intent } = args;
-    const entries = getCerbosPolicyEntries(intent);
-    const renderedEntries = entries
-        .map((entry) => {
-        const indented = indentLines(entry.content, 4);
-        return `  ${entry.key}: |
-${indented}`;
-    })
-        .join('\n');
-    return `apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: cerbos-policy
-  namespace: ${namespace}
-data:
-${renderedEntries}
-`;
-}
-function getCerbosDeployment(namespace) {
-    return `apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cerbos
-  namespace: ${namespace}
-  labels:
-    app.kubernetes.io/name: cerbos
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: cerbos
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: cerbos
-    spec:
-      containers:
-        - name: cerbos
-          image: ghcr.io/cerbos/cerbos:0.40.0
-          args:
-            - server
-            - --config=/config/config.yaml
-          ports:
-            - containerPort: 3592
-          volumeMounts:
-            - name: cerbos-config
-              mountPath: /config
-            - name: cerbos-policy
-              mountPath: /policies
-      volumes:
-        - name: cerbos-config
-          configMap:
-            name: cerbos-config
-        - name: cerbos-policy
-          configMap:
-            name: cerbos-policy
-`;
-}
-function getCerbosService(namespace) {
-    return `apiVersion: v1
-kind: Service
-metadata:
-  name: cerbos
-  namespace: ${namespace}
-spec:
-  selector:
-    app.kubernetes.io/name: cerbos
-  ports:
-    - name: http
-      port: 3592
-      targetPort: 3592
-`;
-}
-const PUBLIC_GUARD_HINTS = new Set(['public', 'guest', 'anonymous', 'unauthenticated']);
-const AUTH_GUARD_HINTS = new Set([
-    'auth',
-    'authenticated',
-    'private',
-    'protected',
-    'requiresauth',
-    'requires-auth',
-]);
-function getCerbosPolicyEntries(intent) {
-    const entries = [
-        {
-            key: 'app.resource_policy.yaml',
-            content: getAppPolicy(intent),
-        },
-    ];
-    if (intent.publicRoutes.length > 0 || intent.protectedRoutes.length > 0) {
-        entries.push({
-            key: 'route.resource_policy.yaml',
-            content: getRoutePolicy(intent),
-        });
-    }
-    if (intent.publicScreens.length > 0 || intent.protectedScreens.length > 0) {
-        entries.push({
-            key: 'screen.resource_policy.yaml',
-            content: getScreenPolicy(intent),
-        });
-    }
-    return entries;
-}
-function getAppPolicy(intent) {
-    const roles = intent.authScope === 'global' ? ['authenticated'] : ['anonymous', 'authenticated'];
-    return `apiVersion: api.cerbos.dev/v1
-resourcePolicy:
-  version: "default"
-  resource: "app"
-  rules:
-${indentLines(renderRule({ actions: ['*'], roles }), 4)}
-`;
-}
-function getRoutePolicy(intent) {
-    const rules = [];
-    if (intent.publicRoutes.length > 0) {
-        rules.push(renderRule({
-            actions: ['view', 'navigate'],
-            roles: ['anonymous', 'authenticated'],
-            conditionExpr: getInConditionExpr('route', intent.publicRoutes),
-        }));
-    }
-    if (intent.protectedRoutes.length > 0) {
-        rules.push(renderRule({
-            actions: ['view', 'navigate'],
-            roles: ['authenticated'],
-            conditionExpr: getInConditionExpr('route', intent.protectedRoutes),
-        }));
-    }
-    return `apiVersion: api.cerbos.dev/v1
-resourcePolicy:
-  version: "default"
-  resource: "route"
-  rules:
-${indentLines(rules.join('\n'), 4)}
-`;
-}
-function getScreenPolicy(intent) {
-    const rules = [];
-    if (intent.publicScreens.length > 0) {
-        rules.push(renderRule({
-            actions: ['view', 'render'],
-            roles: ['anonymous', 'authenticated'],
-            conditionExpr: getInConditionExpr('screen_id', intent.publicScreens),
-        }));
-    }
-    if (intent.protectedScreens.length > 0) {
-        rules.push(renderRule({
-            actions: ['view', 'render'],
-            roles: ['authenticated'],
-            conditionExpr: getInConditionExpr('screen_id', intent.protectedScreens),
-        }));
-    }
-    return `apiVersion: api.cerbos.dev/v1
-resourcePolicy:
-  version: "default"
-  resource: "screen"
-  rules:
-${indentLines(rules.join('\n'), 4)}
-`;
-}
-function renderRule(args) {
-    const { actions, roles, conditionExpr } = args;
-    const lines = [
-        `- actions: ${JSON.stringify(actions)}`,
-        '  effect: EFFECT_ALLOW',
-        `  roles: ${JSON.stringify(roles)}`,
-    ];
-    if (conditionExpr) {
-        lines.push('  condition:');
-        lines.push('    match:');
-        lines.push(`      expr: ${JSON.stringify(conditionExpr)}`);
-    }
-    return lines.join('\n');
-}
-function getInConditionExpr(attribute, values) {
-    return `request.resource.attr.${attribute} in ${JSON.stringify(values)}`;
-}
-function indentLines(content, spaces) {
-    const prefix = ' '.repeat(spaces);
-    return content
-        .trimEnd()
-        .split('\n')
-        .map((line) => `${prefix}${line}`)
-        .join('\n');
-}
-function buildCerbosPolicyIntent(args) {
-    const { manifest, appManifest } = args;
-    const authScope = manifest.auth?.scope ?? 'none';
-    const routes = appManifest?.navigator ? flattenNavigatorRoutes(appManifest.navigator) : [];
-    const flow = resolveAuthFlow(appManifest?.infra?.auth?.flow);
-    const { signInRoute } = flow;
-    const { signUpRoute } = flow;
-    const { unauthorizedRoute } = flow;
-    const publicRouteSet = new Set();
-    const protectedRouteSet = new Set();
-    for (const route of routes) {
-        const isPublic = isPublicRoute({
-            route,
-            authScope,
-            signInRoute,
-            signUpRoute,
-            unauthorizedRoute,
-        });
-        if (isPublic) {
-            publicRouteSet.add(route.name);
-        }
-        else {
-            protectedRouteSet.add(route.name);
-        }
-    }
-    const screenVisibility = new Map();
-    for (const route of routes) {
-        if (!route.screenId)
-            continue;
-        const isPublic = publicRouteSet.has(route.name);
-        const current = screenVisibility.get(route.screenId);
-        if (current === 'protected')
-            continue;
-        screenVisibility.set(route.screenId, isPublic ? 'public' : 'protected');
-    }
-    if (appManifest?.screens) {
-        const defaultVisibility = authScope === 'global' ? 'protected' : 'public';
-        for (const screenId of Object.keys(appManifest.screens)) {
-            if (!screenVisibility.has(screenId)) {
-                screenVisibility.set(screenId, defaultVisibility);
-            }
-        }
-    }
-    const publicScreens = [...screenVisibility.entries()]
-        .filter(([, visibility]) => visibility === 'public')
-        .map(([screenId]) => screenId)
-        .sort();
-    const protectedScreens = [...screenVisibility.entries()]
-        .filter(([, visibility]) => visibility === 'protected')
-        .map(([screenId]) => screenId)
-        .sort();
-    return {
-        authScope,
-        publicRoutes: [...publicRouteSet].sort(),
-        protectedRoutes: [...protectedRouteSet].sort(),
-        publicScreens,
-        protectedScreens,
-    };
-}
-function flattenNavigatorRoutes(navigator) {
-    const deduped = new Map();
-    const walk = (current) => {
-        for (const route of current.routes) {
-            const normalizedGuards = normalizeGuards(route.guards);
-            const existing = deduped.get(route.name);
-            deduped.set(route.name, {
-                name: route.name,
-                guards: unique([...(existing?.guards ?? []), ...normalizedGuards]),
-                screenId: route.screenId ?? existing?.screenId,
-            });
-            if (route.navigator) {
-                walk(route.navigator);
-            }
-        }
-    };
-    walk(navigator);
-    return [...deduped.values()];
-}
-function normalizeGuards(guards) {
-    return (guards ?? []).map((guard) => guard.trim().toLowerCase()).filter(Boolean);
-}
-function isPublicRoute(args) {
-    const { route, authScope, signInRoute, signUpRoute, unauthorizedRoute } = args;
-    const guardSet = new Set(route.guards);
-    const signInRouteName = authFlowPathToRouteName(signInRoute);
-    const signUpRouteName = authFlowPathToRouteName(signUpRoute);
-    const unauthorizedRouteName = authFlowPathToRouteName(unauthorizedRoute);
-    if (route.name === signInRouteName ||
-        route.name === signUpRouteName ||
-        route.name === unauthorizedRouteName) {
-        return true;
-    }
-    if (hasAny(guardSet, PUBLIC_GUARD_HINTS)) {
-        return true;
-    }
-    if (hasAny(guardSet, AUTH_GUARD_HINTS)) {
-        return false;
-    }
-    switch (authScope) {
-        case 'none':
-            return true;
-        case 'global':
-        default:
-            return false;
-    }
-}
-function hasAny(values, candidates) {
-    for (const candidate of candidates) {
-        if (values.has(candidate))
-            return true;
-    }
-    return false;
-}
-function unique(values) {
-    return [...new Set(values)];
-}
-function authFlowPathToRouteName(routePath) {
-    if (!routePath) {
-        return undefined;
-    }
-    const normalized = routePath.trim().replace(/^\/+/, '').replace(/\/+$/, '');
-    return normalized === '' ? 'index' : normalized;
-}
-//# sourceMappingURL=index.js.map

package/dist/adapters/minikube/authz/cerbos/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/adapters/minikube/authz/cerbos/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAK5D,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAElC,MAAM,UAAU,4BAA4B,CAAC,IAI5C;IACC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,SAAS,GAAG,gBAAgB,CAAC;IAEnC,MAAM,IAAI,GAAG,iCAAiC,CAAC;IAC/C,MAAM,YAAY,GAAG,cAAc,CAAC;IACpC,MAAM,MAAM,GAAG,uBAAuB,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IAElE,MAAM,WAAW,GAAG,iBAAiB,SAAS,yBAAyB,CAAC;IACxE,MAAM,SAAS,GAA8B;QAC3C,EAAE,EAAE,QAAQ;QACZ,SAAS;QACT,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;QAC/C,eAAe,EAAE;YACf;gBACE,KAAK,EAAE,QAAQ;gBACf,SAAS;gBACT,QAAQ,EAAE,mBAAmB;gBAC7B,cAAc,EAAE,GAAG;aACpB;SACF;QACD,iBAAiB,EAAE,EAAE;QACrB,sBAAsB,EAAE,EAAE;QAC1B,YAAY,EAAE,EAAE;KACjB,CAAC;IAEF,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,GAAG,IAAI,wBAAwB;gBACrC,OAAO,EAAE,kBAAkB,CAAC,SAAS,CAAC;aACvC;YACD;gBACE,IAAI,EAAE,GAAG,IAAI,+BAA+B;gBAC5C,OAAO,EAAE,wBAAwB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;aACzD;YACD;gBACE,IAAI,EAAE,GAAG,IAAI,yBAAyB;gBACtC,OAAO,EAAE,mBAAmB,CAAC,SAAS,CAAC;aACxC;YACD;gBACE,IAAI,EAAE,GAAG,IAAI,sBAAsB;gBACnC,OAAO,EAAE,gBAAgB,CAAC,SAAS,CAAC;aACrC;SACF;QACD,SAAS,EAAE;YACT,GAAG,YAAY,wBAAwB;YACvC,GAAG,YAAY,+BAA+B;YAC9C,GAAG,YAAY,yBAAyB;YACxC,GAAG,YAAY,sBAAsB;SACtC;QACD,iBAAiB,EAAE,CAAC,SAAS,CAAC;QAC9B,UAAU,EAAE,CAAC,cAAc,WAAW,EAAE,CAAC;QACzC,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAiB;IAC3C,OAAO;;;;eAIM,SAAS;;;;;;;;;CASvB,CAAC;AACF,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAuD;IACvF,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACnC,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,eAAe,GAAG,OAAO;SAC5B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC/C,OAAO,KAAK,KAAK,CAAC,GAAG;EACzB,QAAQ,EAAE,CAAC;IACT,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;;;eAIM,SAAS;;EAEtB,eAAe;CAChB,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,SAAiB;IAC5C,OAAO;;;;eAIM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiCvB,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB;IACzC,OAAO;;;;eAIM,SAAS;;;;;;;;CAQvB,CAAC;AACF,CAAC;AAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC;AACxF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,MAAM;IACN,eAAe;IACf,SAAS;IACT,WAAW;IACX,cAAc;IACd,eAAe;CAChB,CAAC,CAAC;AA2BH,SAAS,sBAAsB,CAAC,MAA0B;IACxD,MAAM,OAAO,GAAwB;QACnC;YACE,GAAG,EAAE,0BAA0B;YAC/B,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC;SAC9B;KACF,CAAC;IAEF,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,EAAE,4BAA4B;YACjC,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,EAAE,6BAA6B;YAClC,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC;SACjC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,MAA0B;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IAEjG,OAAO;;;;;EAKP,WAAW,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;CACtD,CAAC;AACF,CAAC;AAED,SAAS,cAAc,CAAC,MAA0B;IAChD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CACR,UAAU,CAAC;YACT,OAAO,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;YAC7B,KAAK,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC;YACrC,aAAa,EAAE,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;SAChE,CAAC,CACH,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CACR,UAAU,CAAC;YACT,OAAO,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;YAC7B,KAAK,EAAE,CAAC,eAAe,CAAC;YACxB,aAAa,EAAE,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,eAAe,CAAC;SACnE,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO;;;;;EAKP,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;CACjC,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CAAC,MAA0B;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CACR,UAAU,CAAC;YACT,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;YAC3B,KAAK,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC;YACrC,aAAa,EAAE,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC;SACrE,CAAC,CACH,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CACR,UAAU,CAAC;YACT,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;YAC3B,KAAK,EAAE,CAAC,eAAe,CAAC;YACxB,aAAa,EAAE,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,gBAAgB,CAAC;SACxE,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO;;;;;EAKP,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;CACjC,CAAC;AACF,CAAC;AAED,SAAS,UAAU,CAAC,IAAoE;IACtF,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAE/C,MAAM,KAAK,GAAG;QACZ,cAAc,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;QACvC,wBAAwB;QACxB,YAAY,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;KACpC,CAAC;IAEF,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAiB,EAAE,MAAgB;IAC7D,OAAO,yBAAyB,SAAS,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,MAAc;IAClD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,OAAO;SACX,OAAO,EAAE;SACT,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;SACjC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,uBAAuB,CAAC,IAGhC;IACC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,MAAM,CAAC;IAEjD,MAAM,MAAM,GAAG,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7D,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC;IAEnC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE5C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,aAAa,CAAC;YAC7B,KAAK;YACL,SAAS;YACT,WAAW;YACX,WAAW;YACX,iBAAiB;SAClB,CAAC,CAAC;QAEH,IAAI,QAAQ,EAAE,CAAC;YACb,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkC,CAAC;IACnE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,QAAQ;YAAE,SAAS;QAC9B,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEhD,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,OAAO,KAAK,WAAW;YAAE,SAAS;QACtC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,WAAW,EAAE,OAAO,EAAE,CAAC;QACzB,MAAM,iBAAiB,GACrB,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;QAElD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC;SAClD,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,KAAK,QAAQ,CAAC;SACnD,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC;SAC7B,IAAI,EAAE,CAAC;IACV,MAAM,gBAAgB,GAAG,CAAC,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC;SACrD,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,KAAK,WAAW,CAAC;SACtD,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC;SAC7B,IAAI,EAAE,CAAC;IAEV,OAAO;QACL,SAAS;QACT,YAAY,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,EAAE;QACxC,eAAe,EAAE,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,EAAE;QAC9C,aAAa;QACb,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,SAAwB;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA6B,CAAC;IAErD,MAAM,IAAI,GAAG,CAAC,OAAsB,EAAE,EAAE;QACtC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,gBAAgB,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;gBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,gBAAgB,CAAC,CAAC;gBAClE,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,QAAQ,EAAE,QAAQ;aAC/C,CAAC,CAAC;YAEH,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACpB,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC,SAAS,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,eAAe,CAAC,MAAkC;IACzD,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,aAAa,CAAC,IAMtB;IACC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC;IAC/E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,eAAe,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,eAAe,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,qBAAqB,GAAG,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAEzE,IACE,KAAK,CAAC,IAAI,KAAK,eAAe;QAC9B,KAAK,CAAC,IAAI,KAAK,eAAe;QAC9B,KAAK,CAAC,IAAI,KAAK,qBAAqB,EACpC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,MAAM;YACT,OAAO,IAAI,CAAC;QACd,KAAK,QAAQ,CAAC;QACd;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,MAAmB,EAAE,UAAuB;IAC1D,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,uBAAuB,CAAC,SAA6B;IAC5D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5E,OAAO,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;AAClD,CAAC","sourcesContent":["import type { AppManifest, NavigatorNode, RouteDefinition } from '@ankhorage/contracts';\nimport { resolveAuthFlow } from '@ankhorage/contracts/auth';\n\nimport type { InfraManifestInput } from '../../../../types';\nimport type { MinikubeAdapterArtifacts, MinikubeProviderLifecycle } from '../../contracts';\n\nconst CERBOS_NAMESPACE = 'cerbos';\n\nexport function generateCerbosAuthzArtifacts(args: {\n  manifest: InfraManifestInput;\n  namespace: string;\n  appManifest?: CerbosAppManifest;\n}): MinikubeAdapterArtifacts {\n  const { manifest, appManifest } = args;\n  const namespace = CERBOS_NAMESPACE;\n\n  const root = 'infra/minikube/k8s/authz/cerbos';\n  const resourceRoot = 'authz/cerbos';\n  const intent = buildCerbosPolicyIntent({ manifest, appManifest });\n\n  const endpointUrl = `http://cerbos.${namespace}.svc.cluster.local:3592`;\n  const lifecycle: MinikubeProviderLifecycle = {\n    id: 'cerbos',\n    namespace,\n    endpoints: [{ name: 'http', url: endpointUrl }],\n    readinessChecks: [\n      {\n        label: 'cerbos',\n        namespace,\n        resource: 'deployment/cerbos',\n        timeoutSeconds: 180,\n      },\n    ],\n    migrationCommands: [],\n    reconciliationCommands: [],\n    statusChecks: [],\n  };\n\n  return {\n    files: [\n      {\n        path: `${root}/cerbos.configmap.yaml`,\n        content: getCerbosConfigMap(namespace),\n      },\n      {\n        path: `${root}/cerbos.policy.configmap.yaml`,\n        content: getCerbosPolicyConfigMap({ namespace, intent }),\n      },\n      {\n        path: `${root}/cerbos.deployment.yaml`,\n        content: getCerbosDeployment(namespace),\n      },\n      {\n        path: `${root}/cerbos.service.yaml`,\n        content: getCerbosService(namespace),\n      },\n    ],\n    resources: [\n      `${resourceRoot}/cerbos.configmap.yaml`,\n      `${resourceRoot}/cerbos.policy.configmap.yaml`,\n      `${resourceRoot}/cerbos.deployment.yaml`,\n      `${resourceRoot}/cerbos.service.yaml`,\n    ],\n    providerLifecycle: [lifecycle],\n    envEntries: [`CERBOS_URL=${endpointUrl}`],\n    warnings: [],\n  };\n}\n\nfunction getCerbosConfigMap(namespace: string) {\n  return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: cerbos-config\n  namespace: ${namespace}\ndata:\n  config.yaml: |\n    server:\n      httpListenAddr: \":3592\"\n    storage:\n      driver: \"disk\"\n      disk:\n        directory: /policies\n`;\n}\n\nfunction getCerbosPolicyConfigMap(args: { namespace: string; intent: CerbosPolicyIntent }) {\n  const { namespace, intent } = args;\n  const entries = getCerbosPolicyEntries(intent);\n  const renderedEntries = entries\n    .map((entry) => {\n      const indented = indentLines(entry.content, 4);\n      return `  ${entry.key}: |\n${indented}`;\n    })\n    .join('\\n');\n\n  return `apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: cerbos-policy\n  namespace: ${namespace}\ndata:\n${renderedEntries}\n`;\n}\n\nfunction getCerbosDeployment(namespace: string) {\n  return `apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: cerbos\n  namespace: ${namespace}\n  labels:\n    app.kubernetes.io/name: cerbos\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app.kubernetes.io/name: cerbos\n  template:\n    metadata:\n      labels:\n        app.kubernetes.io/name: cerbos\n    spec:\n      containers:\n        - name: cerbos\n          image: ghcr.io/cerbos/cerbos:0.40.0\n          args:\n            - server\n            - --config=/config/config.yaml\n          ports:\n            - containerPort: 3592\n          volumeMounts:\n            - name: cerbos-config\n              mountPath: /config\n            - name: cerbos-policy\n              mountPath: /policies\n      volumes:\n        - name: cerbos-config\n          configMap:\n            name: cerbos-config\n        - name: cerbos-policy\n          configMap:\n            name: cerbos-policy\n`;\n}\n\nfunction getCerbosService(namespace: string) {\n  return `apiVersion: v1\nkind: Service\nmetadata:\n  name: cerbos\n  namespace: ${namespace}\nspec:\n  selector:\n    app.kubernetes.io/name: cerbos\n  ports:\n    - name: http\n      port: 3592\n      targetPort: 3592\n`;\n}\n\nconst PUBLIC_GUARD_HINTS = new Set(['public', 'guest', 'anonymous', 'unauthenticated']);\nconst AUTH_GUARD_HINTS = new Set([\n  'auth',\n  'authenticated',\n  'private',\n  'protected',\n  'requiresauth',\n  'requires-auth',\n]);\n\ntype CerbosAppManifest = Pick<AppManifest, 'metadata' | 'navigator' | 'screens'> & {\n  infra?: AppManifest['infra'];\n};\n\ntype AuthScope = NonNullable<InfraManifestInput['auth']>['scope'] | 'none';\n\ninterface CerbosRouteIntent {\n  name: string;\n  guards: string[];\n  screenId?: string;\n}\n\ninterface CerbosPolicyIntent {\n  authScope: AuthScope;\n  publicRoutes: string[];\n  protectedRoutes: string[];\n  publicScreens: string[];\n  protectedScreens: string[];\n}\n\ninterface CerbosPolicyEntry {\n  key: string;\n  content: string;\n}\n\nfunction getCerbosPolicyEntries(intent: CerbosPolicyIntent): CerbosPolicyEntry[] {\n  const entries: CerbosPolicyEntry[] = [\n    {\n      key: 'app.resource_policy.yaml',\n      content: getAppPolicy(intent),\n    },\n  ];\n\n  if (intent.publicRoutes.length > 0 || intent.protectedRoutes.length > 0) {\n    entries.push({\n      key: 'route.resource_policy.yaml',\n      content: getRoutePolicy(intent),\n    });\n  }\n\n  if (intent.publicScreens.length > 0 || intent.protectedScreens.length > 0) {\n    entries.push({\n      key: 'screen.resource_policy.yaml',\n      content: getScreenPolicy(intent),\n    });\n  }\n\n  return entries;\n}\n\nfunction getAppPolicy(intent: CerbosPolicyIntent): string {\n  const roles = intent.authScope === 'global' ? ['authenticated'] : ['anonymous', 'authenticated'];\n\n  return `apiVersion: api.cerbos.dev/v1\nresourcePolicy:\n  version: \"default\"\n  resource: \"app\"\n  rules:\n${indentLines(renderRule({ actions: ['*'], roles }), 4)}\n`;\n}\n\nfunction getRoutePolicy(intent: CerbosPolicyIntent): string {\n  const rules: string[] = [];\n\n  if (intent.publicRoutes.length > 0) {\n    rules.push(\n      renderRule({\n        actions: ['view', 'navigate'],\n        roles: ['anonymous', 'authenticated'],\n        conditionExpr: getInConditionExpr('route', intent.publicRoutes),\n      }),\n    );\n  }\n\n  if (intent.protectedRoutes.length > 0) {\n    rules.push(\n      renderRule({\n        actions: ['view', 'navigate'],\n        roles: ['authenticated'],\n        conditionExpr: getInConditionExpr('route', intent.protectedRoutes),\n      }),\n    );\n  }\n\n  return `apiVersion: api.cerbos.dev/v1\nresourcePolicy:\n  version: \"default\"\n  resource: \"route\"\n  rules:\n${indentLines(rules.join('\\n'), 4)}\n`;\n}\n\nfunction getScreenPolicy(intent: CerbosPolicyIntent): string {\n  const rules: string[] = [];\n\n  if (intent.publicScreens.length > 0) {\n    rules.push(\n      renderRule({\n        actions: ['view', 'render'],\n        roles: ['anonymous', 'authenticated'],\n        conditionExpr: getInConditionExpr('screen_id', intent.publicScreens),\n      }),\n    );\n  }\n\n  if (intent.protectedScreens.length > 0) {\n    rules.push(\n      renderRule({\n        actions: ['view', 'render'],\n        roles: ['authenticated'],\n        conditionExpr: getInConditionExpr('screen_id', intent.protectedScreens),\n      }),\n    );\n  }\n\n  return `apiVersion: api.cerbos.dev/v1\nresourcePolicy:\n  version: \"default\"\n  resource: \"screen\"\n  rules:\n${indentLines(rules.join('\\n'), 4)}\n`;\n}\n\nfunction renderRule(args: { actions: string[]; roles: string[]; conditionExpr?: string }): string {\n  const { actions, roles, conditionExpr } = args;\n\n  const lines = [\n    `- actions: ${JSON.stringify(actions)}`,\n    '  effect: EFFECT_ALLOW',\n    `  roles: ${JSON.stringify(roles)}`,\n  ];\n\n  if (conditionExpr) {\n    lines.push('  condition:');\n    lines.push('    match:');\n    lines.push(`      expr: ${JSON.stringify(conditionExpr)}`);\n  }\n\n  return lines.join('\\n');\n}\n\nfunction getInConditionExpr(attribute: string, values: string[]): string {\n  return `request.resource.attr.${attribute} in ${JSON.stringify(values)}`;\n}\n\nfunction indentLines(content: string, spaces: number): string {\n  const prefix = ' '.repeat(spaces);\n  return content\n    .trimEnd()\n    .split('\\n')\n    .map((line) => `${prefix}${line}`)\n    .join('\\n');\n}\n\nfunction buildCerbosPolicyIntent(args: {\n  manifest: InfraManifestInput;\n  appManifest?: CerbosAppManifest;\n}): CerbosPolicyIntent {\n  const { manifest, appManifest } = args;\n  const authScope = manifest.auth?.scope ?? 'none';\n\n  const routes = appManifest?.navigator ? flattenNavigatorRoutes(appManifest.navigator) : [];\n  const flow = resolveAuthFlow(appManifest?.infra?.auth?.flow);\n  const { signInRoute } = flow;\n  const { signUpRoute } = flow;\n  const { unauthorizedRoute } = flow;\n\n  const publicRouteSet = new Set<string>();\n  const protectedRouteSet = new Set<string>();\n\n  for (const route of routes) {\n    const isPublic = isPublicRoute({\n      route,\n      authScope,\n      signInRoute,\n      signUpRoute,\n      unauthorizedRoute,\n    });\n\n    if (isPublic) {\n      publicRouteSet.add(route.name);\n    } else {\n      protectedRouteSet.add(route.name);\n    }\n  }\n\n  const screenVisibility = new Map<string, 'public' | 'protected'>();\n  for (const route of routes) {\n    if (!route.screenId) continue;\n    const isPublic = publicRouteSet.has(route.name);\n\n    const current = screenVisibility.get(route.screenId);\n    if (current === 'protected') continue;\n    screenVisibility.set(route.screenId, isPublic ? 'public' : 'protected');\n  }\n\n  if (appManifest?.screens) {\n    const defaultVisibility: 'public' | 'protected' =\n      authScope === 'global' ? 'protected' : 'public';\n\n    for (const screenId of Object.keys(appManifest.screens)) {\n      if (!screenVisibility.has(screenId)) {\n        screenVisibility.set(screenId, defaultVisibility);\n      }\n    }\n  }\n\n  const publicScreens = [...screenVisibility.entries()]\n    .filter(([, visibility]) => visibility === 'public')\n    .map(([screenId]) => screenId)\n    .sort();\n  const protectedScreens = [...screenVisibility.entries()]\n    .filter(([, visibility]) => visibility === 'protected')\n    .map(([screenId]) => screenId)\n    .sort();\n\n  return {\n    authScope,\n    publicRoutes: [...publicRouteSet].sort(),\n    protectedRoutes: [...protectedRouteSet].sort(),\n    publicScreens,\n    protectedScreens,\n  };\n}\n\nfunction flattenNavigatorRoutes(navigator: NavigatorNode): CerbosRouteIntent[] {\n  const deduped = new Map<string, CerbosRouteIntent>();\n\n  const walk = (current: NavigatorNode) => {\n    for (const route of current.routes) {\n      const normalizedGuards = normalizeGuards(route.guards);\n      const existing = deduped.get(route.name);\n      deduped.set(route.name, {\n        name: route.name,\n        guards: unique([...(existing?.guards ?? []), ...normalizedGuards]),\n        screenId: route.screenId ?? existing?.screenId,\n      });\n\n      if (route.navigator) {\n        walk(route.navigator);\n      }\n    }\n  };\n\n  walk(navigator);\n  return [...deduped.values()];\n}\n\nfunction normalizeGuards(guards?: RouteDefinition['guards']): string[] {\n  return (guards ?? []).map((guard) => guard.trim().toLowerCase()).filter(Boolean);\n}\n\nfunction isPublicRoute(args: {\n  route: CerbosRouteIntent;\n  authScope: AuthScope;\n  signInRoute?: string;\n  signUpRoute?: string;\n  unauthorizedRoute?: string;\n}): boolean {\n  const { route, authScope, signInRoute, signUpRoute, unauthorizedRoute } = args;\n  const guardSet = new Set(route.guards);\n  const signInRouteName = authFlowPathToRouteName(signInRoute);\n  const signUpRouteName = authFlowPathToRouteName(signUpRoute);\n  const unauthorizedRouteName = authFlowPathToRouteName(unauthorizedRoute);\n\n  if (\n    route.name === signInRouteName ||\n    route.name === signUpRouteName ||\n    route.name === unauthorizedRouteName\n  ) {\n    return true;\n  }\n\n  if (hasAny(guardSet, PUBLIC_GUARD_HINTS)) {\n    return true;\n  }\n\n  if (hasAny(guardSet, AUTH_GUARD_HINTS)) {\n    return false;\n  }\n\n  switch (authScope) {\n    case 'none':\n      return true;\n    case 'global':\n    default:\n      return false;\n  }\n}\n\nfunction hasAny(values: Set<string>, candidates: Set<string>): boolean {\n  for (const candidate of candidates) {\n    if (values.has(candidate)) return true;\n  }\n  return false;\n}\n\nfunction unique(values: string[]): string[] {\n  return [...new Set(values)];\n}\n\nfunction authFlowPathToRouteName(routePath: string | undefined): string | undefined {\n  if (!routePath) {\n    return undefined;\n  }\n\n  const normalized = routePath.trim().replace(/^\\/+/, '').replace(/\\/+$/, '');\n  return normalized === '' ? 'index' : normalized;\n}\n"]}

package/dist/adapters/minikube/authz/index.d.ts

@@ -1,9 +0,0 @@
-import type { AppManifest } from '@ankhorage/contracts';
-import type { InfraManifestInput } from '../../../types';
-import { type MinikubeAdapterArtifacts } from '../contracts';
-export declare function generateAuthorizationArtifacts(args: {
-    manifest: InfraManifestInput;
-    namespace: string;
-    appManifest?: Pick<AppManifest, 'infra' | 'metadata' | 'navigator' | 'screens'>;
-}): MinikubeAdapterArtifacts;
-//# sourceMappingURL=index.d.ts.map

package/dist/adapters/minikube/authz/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/minikube/authz/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAA0B,KAAK,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAGrF,wBAAgB,8BAA8B,CAAC,IAAI,EAAE;IACnD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC,CAAC;CACjF,GAAG,wBAAwB,CAqB3B"}

package/dist/adapters/minikube/authz/index.js

@@ -1,23 +0,0 @@
-import { emptyMinikubeArtifacts } from '../contracts';
-import { generateCerbosAuthzArtifacts } from './cerbos';
-export function generateAuthorizationArtifacts(args) {
-    const { manifest, namespace, appManifest } = args;
-    const engine = manifest.auth?.authorization?.engine;
-    if (!engine) {
-        return emptyMinikubeArtifacts();
-    }
-    switch (engine) {
-        case 'cerbos':
-            return generateCerbosAuthzArtifacts({ manifest, namespace, appManifest });
-        case 'native':
-            return {
-                ...emptyMinikubeArtifacts(),
-                warnings: [
-                    'Authorization engine "native" selected. No dedicated authz infrastructure artifacts were generated.',
-                ],
-            };
-        default:
-            throw new Error(`Unsupported authorization engine for minikube adapter: ${String(engine)}`);
-    }
-}
-//# sourceMappingURL=index.js.map

package/dist/adapters/minikube/authz/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/adapters/minikube/authz/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,sBAAsB,EAAiC,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,4BAA4B,EAAE,MAAM,UAAU,CAAC;AAExD,MAAM,UAAU,8BAA8B,CAAC,IAI9C;IACC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC;IAEpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,sBAAsB,EAAE,CAAC;IAClC,CAAC;IAED,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,4BAA4B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;QAC5E,KAAK,QAAQ;YACX,OAAO;gBACL,GAAG,sBAAsB,EAAE;gBAC3B,QAAQ,EAAE;oBACR,qGAAqG;iBACtG;aACF,CAAC;QACJ;YACE,MAAM,IAAI,KAAK,CAAC,0DAA0D,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;AACH,CAAC","sourcesContent":["import type { AppManifest } from '@ankhorage/contracts';\n\nimport type { InfraManifestInput } from '../../../types';\nimport { emptyMinikubeArtifacts, type MinikubeAdapterArtifacts } from '../contracts';\nimport { generateCerbosAuthzArtifacts } from './cerbos';\n\nexport function generateAuthorizationArtifacts(args: {\n  manifest: InfraManifestInput;\n  namespace: string;\n  appManifest?: Pick<AppManifest, 'infra' | 'metadata' | 'navigator' | 'screens'>;\n}): MinikubeAdapterArtifacts {\n  const { manifest, namespace, appManifest } = args;\n  const engine = manifest.auth?.authorization?.engine;\n\n  if (!engine) {\n    return emptyMinikubeArtifacts();\n  }\n\n  switch (engine) {\n    case 'cerbos':\n      return generateCerbosAuthzArtifacts({ manifest, namespace, appManifest });\n    case 'native':\n      return {\n        ...emptyMinikubeArtifacts(),\n        warnings: [\n          'Authorization engine \"native\" selected. No dedicated authz infrastructure artifacts were generated.',\n        ],\n      };\n    default:\n      throw new Error(`Unsupported authorization engine for minikube adapter: ${String(engine)}`);\n  }\n}\n"]}

package/dist/adapters/minikube/base/index.d.ts

@@ -1,14 +0,0 @@
-import type { GeneratedInfrastructureFile } from '../../../types';
-import type { InfraManifestInput } from '../../../types';
-import type { MinikubeProviderLifecycle } from '../contracts';
-export declare const APP_NAMESPACE = "app";
-export declare function generateMinikubeBaseArtifacts(args: {
-    manifest: InfraManifestInput;
-    appSlug: string;
-    appRuntimeEnabled: boolean;
-    extraResources: string[];
-    providerNamespaces: string[];
-    providerLifecycle: MinikubeProviderLifecycle[];
-    extraEnvEntries: string[];
-}): GeneratedInfrastructureFile[];
-//# sourceMappingURL=index.d.ts.map

package/dist/adapters/minikube/base/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapters/minikube/base/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGzD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAG9D,eAAO,MAAM,aAAa,QAAQ,CAAC;AAoDnC,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,iBAAiB,EAAE,yBAAyB,EAAE,CAAC;IAC/C,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B,GAAG,2BAA2B,EAAE,CA8LhC"}