@aooth/arbac-core 0.1.70 → 0.1.72

package/dist/index.cjs

@@ -99,9 +99,8 @@ var Arbac = class {
 		};
 		const userEval = await this.evaluateForRoles(res, user.roles, userAttrs, user.id);
 		if (!user.attenuate) return userEval;
-		const claimRoles = user.attenuate.roles;
-		const claimAttrs = user.attenuate.attrs;
-		const credRoles = claimRoles ? user.roles.filter((r) => claimRoles.includes(r)) : user.roles;
+		const { roles: claimRoles, attrs: claimAttrs, allowUnheldRoles } = user.attenuate;
+		const credRoles = !claimRoles ? user.roles : allowUnheldRoles ? [...new Set(claimRoles)].filter((r) => Object.hasOwn(this.roles, r) && !!this.roles[r]) : user.roles.filter((r) => claimRoles.includes(r));
 		const credAttrs = claimAttrs ? async () => ({
 			...await userAttrs(),
 			...claimAttrs

package/dist/index.d.cts

@@ -101,12 +101,17 @@ declare class Arbac<TUserAttrs extends object, TScope extends object> {
      *
      * `roles: []` → no roles (deny-all, fail-closed). An OMITTED `roles` key
      * → keep all the user's roles (attrs-only narrowing). A claimed role the
-     * user lacks is dropped by the intersection (fail-closed). Absent
-     * `attenuate` → a single evaluation, byte-for-byte today's behavior.
+     * user lacks is dropped by the intersection (fail-closed) — unless
+     * `allowUnheldRoles` is set: then the claimed roles are evaluated as
+     * given ("view as" — an unknown role id still contributes nothing), and
+     * the outcome is still intersected with the full-authority pass, so an
+     * unheld role can never widen beyond the user. Absent `attenuate` → a
+     * single evaluation, byte-for-byte today's behavior.
      */
     attenuate?: {
       roles?: string[];
       attrs?: Partial<TUserAttrs>;
+      allowUnheldRoles?: boolean;
     };
   }): Promise<TArbacEvalResult<TScope>>;
   /**

package/dist/index.d.mts

@@ -101,12 +101,17 @@ declare class Arbac<TUserAttrs extends object, TScope extends object> {
      *
      * `roles: []` → no roles (deny-all, fail-closed). An OMITTED `roles` key
      * → keep all the user's roles (attrs-only narrowing). A claimed role the
-     * user lacks is dropped by the intersection (fail-closed). Absent
-     * `attenuate` → a single evaluation, byte-for-byte today's behavior.
+     * user lacks is dropped by the intersection (fail-closed) — unless
+     * `allowUnheldRoles` is set: then the claimed roles are evaluated as
+     * given ("view as" — an unknown role id still contributes nothing), and
+     * the outcome is still intersected with the full-authority pass, so an
+     * unheld role can never widen beyond the user. Absent `attenuate` → a
+     * single evaluation, byte-for-byte today's behavior.
      */
     attenuate?: {
       roles?: string[];
       attrs?: Partial<TUserAttrs>;
+      allowUnheldRoles?: boolean;
     };
   }): Promise<TArbacEvalResult<TScope>>;
   /**

package/dist/index.mjs

@@ -98,9 +98,8 @@ var Arbac = class {
 		};
 		const userEval = await this.evaluateForRoles(res, user.roles, userAttrs, user.id);
 		if (!user.attenuate) return userEval;
-		const claimRoles = user.attenuate.roles;
-		const claimAttrs = user.attenuate.attrs;
-		const credRoles = claimRoles ? user.roles.filter((r) => claimRoles.includes(r)) : user.roles;
+		const { roles: claimRoles, attrs: claimAttrs, allowUnheldRoles } = user.attenuate;
+		const credRoles = !claimRoles ? user.roles : allowUnheldRoles ? [...new Set(claimRoles)].filter((r) => Object.hasOwn(this.roles, r) && !!this.roles[r]) : user.roles.filter((r) => claimRoles.includes(r));
 		const credAttrs = claimAttrs ? async () => ({
 			...await userAttrs(),
 			...claimAttrs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/arbac-core",
-  "version": "0.1.70",
+  "version": "0.1.72",
   "description": "Advanced Role-Based Access Control (ARBAC) engine",
   "keywords": [
     "access-control",