@aooth/arbac-moost 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 aoothjs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,38 @@
+<p align="center">
+  <a href="https://aooth.moost.org">
+    <img src="https://aooth.moost.org/logo.svg" alt="aoothjs" width="120" />
+  </a>
+</p>
+
+<h1 align="center">@aooth/arbac-moost</h1>
+
+<p align="center">
+  Moost RBAC integration — DI-injectable <code>MoostArbac</code>, an authorize interceptor, <code>@ArbacResource</code> / <code>@ArbacAction</code> decorators, <code>AsArbacDbController</code> for scoped DB controllers, and auto-wired provider plumbing for <code>.as</code> user models.
+</p>
+
+<p align="center">
+  <a href="https://aooth.moost.org/moost/"><strong>Documentation →</strong></a>
+</p>
+
+---
+
+## Install
+
+```bash
+pnpm add @aooth/arbac-moost @aooth/arbac @aooth/user
+```
+
+## Documentation
+
+Full docs, API reference, and recipes: **https://aooth.moost.org/moost/**
+
+- [Setup](https://aooth.moost.org/moost/setup)
+- [`@ArbacAuthorize`](https://aooth.moost.org/moost/arbac-authorize)
+- [DB controllers (`AsArbacDbController`)](https://aooth.moost.org/moost/db-controllers)
+- [Atscript wiring (`@arbac.*` annotations)](https://aooth.moost.org/moost/atscript)
+- [Decorators](https://aooth.moost.org/moost/decorators)
+- [API reference](https://aooth.moost.org/api/arbac-moost)
+
+## License
+
+MIT

package/dist/atscript/index.d.mts

@@ -0,0 +1,80 @@
+import { t as AoothArbacUserCredentials } from "../user-CFXfHtsb.mjs";
+import { t as ArbacUserProvider } from "../user.provider-JpI5dD6Z.mjs";
+import { TAtscriptAnnotatedType } from "@atscript/typescript/utils";
+
+//#region src/atscript/auto-provider.d.ts
+/**
+ * Minimal atscript-db readable surface used to fetch the user record. Matches
+ * `AtscriptDbTable.findOne` exactly so consumers pass the table directly.
+ * Kept loose to avoid pulling `@atscript/db` types into the public surface.
+ *
+ * `controls.$with` is optional — included so providers can request nav-prop
+ * expansion when `@arbac.role` is declared on a `@db.rel.from` field.
+ */
+interface ArbacUserTable<T extends object> {
+  findOne(query: {
+    filter: Record<string, unknown>;
+    controls?: {
+      $select?: Record<string, 1>;
+      $with?: Array<{
+        name: string;
+      }>;
+    };
+  }): Promise<T | null>;
+}
+/**
+ * `@Injectable()` (SINGLETON) — moost@0.6.x's `Injectable` metadata is NOT
+ * inherited from the base `ArbacUserProvider` by infact, so the decorator
+ * must be re-applied here. SINGLETON is the right scope: there is no
+ * per-instance state worth scoping per event, and FOR_EVENT trips a
+ * scope-id mismatch when the interceptor resolves the provider in a
+ * multi-adapter app (HTTP + WF). Per-event memoization is provided via
+ * a wooks-slot cache keyed by `this` — see `useFetchCache` above.
+ *
+ * Consumers extend this class, implement `getUserId()` (typically reading
+ * the JWT subject from the auth composable), inject their atscript-db
+ * table, and register the subclass via `setReplaceRegistry`.
+ *
+ * `extractRoles` and `extractAttrs` are protected seams — override to
+ * reshape roles/attrs without re-implementing the fetch path.
+ */
+declare abstract class AtscriptArbacUserProvider<T extends object = object> extends ArbacUserProvider {
+  protected readonly userType: TAtscriptAnnotatedType;
+  protected readonly table: ArbacUserTable<T>;
+  private readonly spec;
+  private readonly projection;
+  private readonly withClause;
+  constructor(userType: TAtscriptAnnotatedType, table: ArbacUserTable<T>);
+  abstract getUserId(): string | Promise<string>;
+  getRoles(id: string): Promise<string[]>;
+  getAttrs(id: string): Promise<object>;
+  /**
+   * Override seam: role identifiers pulled off the record.
+   *
+   * - inline (`string | string[]`): the field value, with empty / nullish /
+   *   non-string entries dropped and duplicates collapsed in first-seen order.
+   * - `@db.rel.from` (joined array of role records): each entry's
+   *   `roleTargetIdField` value (resolved at spec time on the target type
+   *   using the same `@arbac.userId` → preferred unique index → `@meta.id`
+   *   chain). Same dedup / drop-empty rules.
+   *
+   * Returns `[]` when the role field is undeclared or its value is null /
+   * undefined / empty.
+   */
+  protected extractRoles(record: T): string[];
+  /**
+   * Override seam: `@arbac.attribute` fields keyed by prop name. Undefined
+   * entries are retained so consumers can distinguish "declared but empty"
+   * from "not declared".
+   */
+  protected extractAttrs(record: T): object;
+  /**
+   * Per-event, per-instance, per-userId memoized fetch. The cache lives on
+   * the wooks event context so two distinct events never share state, and
+   * is keyed by `this` so multiple replacement subclasses in the same
+   * process do not collide.
+   */
+  private fetchRecord;
+}
+//#endregion
+export { AoothArbacUserCredentials, type ArbacUserTable, AtscriptArbacUserProvider };

package/dist/atscript/index.mjs

@@ -0,0 +1,229 @@
+import { r as __decorate, t as ArbacUserProvider } from "../user.provider-CGWueNjx.mjs";
+import { t as AoothArbacUserCredentials } from "../user-CFXfHtsb.mjs";
+import { defineWook, key } from "@wooksjs/event-core";
+import { Injectable } from "moost";
+//#region \0@oxc-project+runtime@0.129.0/helpers/decorateMetadata.js
+function __decorateMetadata(k, v) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+//#endregion
+//#region src/atscript/auto-provider.ts
+const specCache = /* @__PURE__ */ new WeakMap();
+/**
+* Resolve the identifier field on an object type using the three-step chain
+* documented on `ArbacExtractSpec.userIdField`. Used for the user type AND
+* for the role target type referenced by `@db.rel.from`-shaped role fields.
+*/
+function resolveIdentifierField(type) {
+	const def = type.type;
+	if (def.kind !== "object") return void 0;
+	let explicit;
+	let metaId;
+	const uniqueIndexFields = /* @__PURE__ */ new Map();
+	const anyUniqueField = [];
+	for (const [fieldName, fieldType] of def.props) {
+		const md = fieldType.metadata;
+		if (md.get("arbac.userId")) explicit = fieldName;
+		if (md.get("meta.id")) metaId = fieldName;
+		const unique = md.get("db.index.unique");
+		if (Array.isArray(unique)) {
+			for (const entry of unique) if (entry === true) anyUniqueField.push(fieldName);
+			else if (typeof entry === "string") {
+				const bucket = uniqueIndexFields.get(entry);
+				if (bucket) bucket.push(fieldName);
+				else uniqueIndexFields.set(entry, [fieldName]);
+			}
+		}
+	}
+	if (explicit) return explicit;
+	const preferred = type.metadata.get("db.table.preferredId.uniqueIndex");
+	if (preferred !== void 0) if (typeof preferred === "string") {
+		const fields = uniqueIndexFields.get(preferred);
+		if (fields && fields.length === 1) return fields[0];
+	} else {
+		for (const fields of uniqueIndexFields.values()) if (fields.length === 1) return fields[0];
+		if (anyUniqueField.length > 0) return anyUniqueField[0];
+	}
+	return metaId;
+}
+function getArbacExtractSpec(type) {
+	const cached = specCache.get(type);
+	if (cached !== void 0) return cached;
+	const spec = {
+		userIdField: void 0,
+		roleField: void 0,
+		attrFields: []
+	};
+	const def = type.type;
+	if (def.kind !== "object") {
+		specCache.set(type, spec);
+		return spec;
+	}
+	const roleCandidates = [];
+	for (const [fieldName, fieldType] of def.props) {
+		const md = fieldType.metadata;
+		if (md.get("arbac.role")) roleCandidates.push({
+			name: fieldName,
+			fieldType
+		});
+		if (md.get("arbac.attribute")) spec.attrFields.push(fieldName);
+	}
+	if (roleCandidates.length > 1) throw new Error(`AtscriptArbacUserProvider: multiple @arbac.role fields declared (${roleCandidates.map((c) => c.name).join(", ")}). Exactly one role source is supported — drop the @arbac.role from all but the canonical field.`);
+	if (roleCandidates.length === 1) {
+		const { name, fieldType } = roleCandidates[0];
+		if (fieldType.metadata.get("db.rel.from") !== void 0) {
+			const target = resolveRelTargetType(fieldType);
+			if (!target) throw new Error(`AtscriptArbacUserProvider: @arbac.role on @db.rel.from field "${name}" — could not resolve the target role type. Declare the nav prop as \`<RoleType>[]\`.`);
+			const roleTargetIdField = resolveIdentifierField(target);
+			if (!roleTargetIdField) throw new Error(`AtscriptArbacUserProvider: @arbac.role on @db.rel.from field "${name}" — target role type has no @arbac.userId / preferred unique index / @meta.id to identify role names by.`);
+			spec.roleField = {
+				name,
+				shape: "rel.from",
+				roleTargetIdField
+			};
+		} else spec.roleField = {
+			name,
+			shape: "inline"
+		};
+	}
+	spec.userIdField = resolveIdentifierField(type);
+	specCache.set(type, spec);
+	return spec;
+}
+/**
+* Walk an annotated type to the target type of a navigation prop. Most cases
+* are `Role[]` (array of annotated types), so we descend through `array.of`
+* once. If the descent doesn't land on an `object`, the caller treats it as
+* unresolvable.
+*/
+function resolveRelTargetType(fieldType) {
+	const def = fieldType.type;
+	if (def.kind === "array") {
+		const of = def.of;
+		if (of && of.type.kind === "object") return of;
+	}
+	if (def.kind === "object") return fieldType;
+}
+/** Mongo-style projection covering id + `@arbac.role` (when inline) + `@arbac.attribute` fields. */
+const projectionCache = /* @__PURE__ */ new WeakMap();
+function getArbacProjection(type) {
+	const cached = projectionCache.get(type);
+	if (cached !== void 0) return cached;
+	const spec = getArbacExtractSpec(type);
+	const projection = {};
+	if (spec.userIdField) projection[spec.userIdField] = 1;
+	if (spec.roleField && spec.roleField.shape === "inline") projection[spec.roleField.name] = 1;
+	for (const f of spec.attrFields) projection[f] = 1;
+	projectionCache.set(type, projection);
+	return projection;
+}
+const fetchCacheKey = key("aooth.arbacFetchCache");
+const useFetchCache = defineWook((ctx) => {
+	let cache = ctx.has(fetchCacheKey) ? ctx.get(fetchCacheKey) : void 0;
+	if (!cache) {
+		cache = /* @__PURE__ */ new WeakMap();
+		ctx.set(fetchCacheKey, cache);
+	}
+	return cache;
+});
+let AtscriptArbacUserProvider = class AtscriptArbacUserProvider extends ArbacUserProvider {
+	spec;
+	projection;
+	withClause;
+	constructor(userType, table) {
+		super();
+		this.userType = userType;
+		this.table = table;
+		this.spec = getArbacExtractSpec(userType);
+		if (!this.spec.userIdField) throw new Error("AtscriptArbacUserProvider: userType has no @arbac.userId, @db.table.preferredId.uniqueIndex field, or @meta.id — annotate one to identify users");
+		this.projection = getArbacProjection(userType);
+		this.withClause = this.spec.roleField?.shape === "rel.from" ? [{ name: this.spec.roleField.name }] : void 0;
+	}
+	async getRoles(id) {
+		const record = await this.fetchRecord(id);
+		if (record === null) return [];
+		return this.extractRoles(record);
+	}
+	async getAttrs(id) {
+		const record = await this.fetchRecord(id);
+		if (record === null) return {};
+		return this.extractAttrs(record);
+	}
+	/**
+	* Override seam: role identifiers pulled off the record.
+	*
+	* - inline (`string | string[]`): the field value, with empty / nullish /
+	*   non-string entries dropped and duplicates collapsed in first-seen order.
+	* - `@db.rel.from` (joined array of role records): each entry's
+	*   `roleTargetIdField` value (resolved at spec time on the target type
+	*   using the same `@arbac.userId` → preferred unique index → `@meta.id`
+	*   chain). Same dedup / drop-empty rules.
+	*
+	* Returns `[]` when the role field is undeclared or its value is null /
+	* undefined / empty.
+	*/
+	extractRoles(record) {
+		const roleField = this.spec.roleField;
+		if (!roleField) return [];
+		const raw = record[roleField.name];
+		if (raw === void 0 || raw === null) return [];
+		const seen = /* @__PURE__ */ new Set();
+		const out = [];
+		const push = (val) => {
+			if (typeof val === "string" && val !== "" && !seen.has(val)) {
+				seen.add(val);
+				out.push(val);
+			}
+		};
+		if (roleField.shape === "inline") if (Array.isArray(raw)) for (const item of raw) push(item);
+		else push(raw);
+		else {
+			if (!Array.isArray(raw)) return out;
+			const idField = roleField.roleTargetIdField;
+			for (const item of raw) if (item && typeof item === "object") push(item[idField]);
+		}
+		return out;
+	}
+	/**
+	* Override seam: `@arbac.attribute` fields keyed by prop name. Undefined
+	* entries are retained so consumers can distinguish "declared but empty"
+	* from "not declared".
+	*/
+	extractAttrs(record) {
+		const attrFields = this.spec.attrFields;
+		if (attrFields.length === 0) return {};
+		const out = {};
+		const rec = record;
+		for (const field of attrFields) out[field] = rec[field];
+		return out;
+	}
+	/**
+	* Per-event, per-instance, per-userId memoized fetch. The cache lives on
+	* the wooks event context so two distinct events never share state, and
+	* is keyed by `this` so multiple replacement subclasses in the same
+	* process do not collide.
+	*/
+	fetchRecord(userId) {
+		const ctxCache = useFetchCache();
+		let perProvider = ctxCache.get(this);
+		if (!perProvider) {
+			perProvider = /* @__PURE__ */ new Map();
+			ctxCache.set(this, perProvider);
+		}
+		const cached = perProvider.get(userId);
+		if (cached !== void 0) return cached;
+		const userIdField = this.spec.userIdField;
+		const controls = { $select: this.projection };
+		if (this.withClause) controls.$with = this.withClause;
+		const promise = this.table.findOne({
+			filter: { [userIdField]: userId },
+			controls
+		});
+		promise.catch(() => perProvider?.delete(userId));
+		perProvider.set(userId, promise);
+		return promise;
+	}
+};
+AtscriptArbacUserProvider = __decorate([Injectable(), __decorateMetadata("design:paramtypes", [Object, Object])], AtscriptArbacUserProvider);
+//#endregion
+export { AoothArbacUserCredentials, AtscriptArbacUserProvider };