@aooth/arbac-moost 0.2.2 → 0.2.3

package/dist/atscript/index.mjs

@@ -475,7 +475,7 @@ var AoothArbacUserCredentials = class {
 		throwFeatureDisabled("JSON Schema", "jsonSchema", "emit.jsonSchema");
 	}
 };
-$ak("db.index.fulltext", "db.index.plain", "db.index.unique", "db.view.joins", "expect.pattern");
-$nr("aooth.auth.metadata", "aooth.user.email", "aooth.user.phone", "arbac.attenuate.attr", "arbac.attenuate.role", "arbac.attribute", "arbac.role", "arbac.userId", "db.agg.avg", "db.agg.count", "db.agg.countDistinct", "db.agg.max", "db.agg.min", "db.agg.sum", "db.alias", "db.amount.currency.ref", "db.column", "db.column.collate", "db.column.derived", "db.column.dimension", "db.column.filterable", "db.column.measure", "db.column.precision", "db.column.renamed", "db.column.searchable", "db.column.sortable", "db.column.version", "db.column.version.exempt", "db.compute", "db.default", "db.default.increment", "db.default.now", "db.default.uuid", "db.depth.limit", "db.encrypted", "db.http.path", "db.ignore", "db.index.fulltext", "db.index.geo", "db.index.plain", "db.index.unique", "db.json", "db.onUpdate.inc", "db.onUpdate.now", "db.patch.strategy", "db.rel.FK", "db.rel.filter", "db.rel.filterable", "db.rel.from", "db.rel.onDelete", "db.rel.onUpdate", "db.rel.to", "db.rel.via", "db.schema", "db.search.filter", "db.search.vector", "db.search.vector.threshold", "db.sort.nulls", "db.space", "db.sync.method", "db.table", "db.table.filterable", "db.table.preferredId.uniqueIndex", "db.table.renamed", "db.table.sortable", "db.unit.ref", "db.view", "db.view.filter", "db.view.for", "db.view.having", "db.view.joins", "db.view.materialized", "db.view.renamed", "db.writeOnly", "meta.default", "meta.id", "meta.readonly", "meta.required");
+$ak("db.index.fulltext", "db.index.fulltext.language", "db.index.fulltext.match", "db.index.plain", "db.index.unique", "db.view.joins", "expect.pattern");
+$nr("aooth.auth.metadata", "aooth.user.email", "aooth.user.phone", "arbac.attenuate.attr", "arbac.attenuate.role", "arbac.attribute", "arbac.role", "arbac.userId", "db.agg.avg", "db.agg.count", "db.agg.countDistinct", "db.agg.max", "db.agg.min", "db.agg.sum", "db.alias", "db.amount.currency.ref", "db.column", "db.column.collate", "db.column.derived", "db.column.dimension", "db.column.filterable", "db.column.measure", "db.column.precision", "db.column.renamed", "db.column.searchable", "db.column.sortable", "db.column.version", "db.column.version.exempt", "db.compute", "db.default", "db.default.increment", "db.default.now", "db.default.uuid", "db.depth.limit", "db.encrypted", "db.http.path", "db.ignore", "db.index.fulltext", "db.index.fulltext.language", "db.index.fulltext.match", "db.index.geo", "db.index.plain", "db.index.unique", "db.json", "db.onUpdate.inc", "db.onUpdate.now", "db.patch.strategy", "db.rel.FK", "db.rel.filter", "db.rel.filterable", "db.rel.from", "db.rel.onDelete", "db.rel.onUpdate", "db.rel.to", "db.rel.via", "db.schema", "db.search.filter", "db.search.vector", "db.search.vector.threshold", "db.sort.nulls", "db.space", "db.sync.method", "db.table", "db.table.filterable", "db.table.preferredId.uniqueIndex", "db.table.renamed", "db.table.sortable", "db.unit.ref", "db.view", "db.view.filter", "db.view.for", "db.view.having", "db.view.joins", "db.view.materialized", "db.view.renamed", "db.writeOnly", "meta.default", "meta.id", "meta.readonly", "meta.required");
 defineAnnotatedType("object", AoothArbacUserCredentials).prop("id", $f(AoothUserCredentials, "id")).prop("username", $f(AoothUserCredentials, "username")).prop("version", $f(AoothUserCredentials, "version")).prop("password", $f(AoothUserCredentials, "password")).prop("account", $f(AoothUserCredentials, "account")).prop("mfa", $f(AoothUserCredentials, "mfa")).prop("trustedDevices", $f(AoothUserCredentials, "trustedDevices")).prop("seenDevices", $f(AoothUserCredentials, "seenDevices")).prop("roles", defineAnnotatedType("array").of(defineAnnotatedType().designType("string").tags("string").$type).annotate("arbac.role", true).$type);
 export { AoothArbacUserCredentials, ArbacUserRecordCache, AtscriptArbacUserProvider, extractAttenuation, getAoothUserHandleSpec, getArbacAttenuationSpec, validateAttenuationTargets };

package/dist/index.d.mts

@@ -224,6 +224,37 @@ export interface ArbacEvaluateOptions {
    */
   table?: VisibilityTableSource;
 }
+/** The current user as ARBAC sees it — what `useArbac().principal()` returns. */
+export interface ArbacPrincipal<TUserAttrs extends object = object> {
+  /** The user id the `ArbacUserProvider` resolved for this event. */
+  userId: string;
+  /**
+   * The roles the user HOLDS (`ArbacUserProvider.getRoles`), before
+   * credential attenuation. Don't authorize on it — an attenuated credential
+   * may act with fewer roles; use {@link effectiveRoles} or `evaluate()`.
+   */
+  roles: string[];
+  /**
+   * The roles this request acts with: {@link roles} narrowed by the
+   * credential's attenuation (`roles ∩ attenuation.roles`; all held roles when
+   * the attenuation names none). A claimed role the user does not hold is
+   * never included, even with `allowUnheldRoles` — that "view as" mode only
+   * ever narrows through `evaluate()`. Use this for role checks in app code.
+   */
+  effectiveRoles: string[];
+  /** The user's attributes (`ArbacUserProvider.getAttrs`), loaded on the first call. */
+  attrs: () => Promise<TUserAttrs>;
+  /**
+   * The credential's restrict-only attenuation
+   * (`ArbacUserProvider.getAttenuation`), when it narrows the user's
+   * authority; absent otherwise.
+   */
+  attenuation?: {
+    roles?: string[];
+    attrs?: Record<string, unknown>;
+    allowUnheldRoles?: boolean;
+  };
+}
 interface ArbacBindings {
   getScopes: <TScope extends object>() => TScope[] | undefined;
   setScopes: <TScope extends object>(scope: TScope[] | undefined) => void;
@@ -246,6 +277,14 @@ interface ArbacBindings {
     scopes?: TScope[];
     userId: string;
   }>;
+  /**
+   * The current principal — user id, held and effective roles, lazy
+   * attributes and credential attenuation — read through the
+   * `ArbacUserProvider`, the same source `evaluate()` uses. Loaded fresh on
+   * every call (like `evaluate()`), so a role change applies immediately.
+   * Decide on `effectiveRoles` (or `evaluate()`), never on `roles`.
+   */
+  principal: <TUserAttrs extends object = object>() => Promise<ArbacPrincipal<TUserAttrs>>;
   resource: string;
   action: string;
   isPublic: boolean;

package/dist/index.mjs

@@ -871,6 +871,11 @@ async function loadPrincipal(user) {
 	};
 }
 const arbacDeps = cachedBy((_controller, ctx) => Promise.all([useControllerContext(ctx).instantiate(ArbacUserProviderToken), useControllerContext(ctx).instantiate(MoostArbac)]));
+/** Load the current principal through the controller's user provider (fresh, no memo). */
+async function loadCurrentPrincipal(ctx) {
+	const [user] = await arbacDeps(useControllerContext(ctx).getController(), ctx);
+	return loadPrincipal(user);
+}
 const principalKey = key("arbac.principal");
 function isHttpEvent(ctx) {
 	return ctx.has(eventTypeKey) && ctx.get(eventTypeKey) === "http";
@@ -1044,11 +1049,23 @@ const useArbac = (_ctx) => {
 			allowed: true
 		};
 	};
+	const principal = async () => {
+		const p = await loadCurrentPrincipal(ctx);
+		const claimed = p.attenuate?.roles;
+		return {
+			userId: p.userId,
+			roles: p.roles,
+			effectiveRoles: claimed ? p.roles.filter((r) => claimed.includes(r)) : p.roles,
+			attrs: () => p.attrs(p.userId),
+			...p.attenuate && { attenuation: p.attenuate }
+		};
+	};
 	return {
 		getScopes,
 		setScopes,
 		evaluate,
 		evaluateOrThrow,
+		principal,
 		resource,
 		action,
 		isPublic

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/arbac-moost",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Moost RBAC integration for aoothjs (migrated from @moostjs/arbac)",
   "keywords": [
     "abac",
@@ -60,30 +60,30 @@
     "access": "public"
   },
   "dependencies": {
-    "@uniqu/core": "^0.1.15",
-    "@aooth/arbac": "0.2.2",
-    "@aooth/user": "0.2.2",
-    "@aooth/arbac-core": "0.2.2"
+    "@uniqu/core": "^0.2.0",
+    "@aooth/arbac": "0.2.3",
+    "@aooth/user": "0.2.3",
+    "@aooth/arbac-core": "0.2.3"
   },
   "devDependencies": {
-    "@atscript/core": "^0.2.3",
-    "@atscript/db": "^0.1.167",
-    "@atscript/db-sql-tools": "^0.1.167",
-    "@atscript/db-sqlite": "^0.1.167",
-    "@atscript/moost-db": "^0.1.167",
-    "@atscript/typescript": "^0.2.3",
-    "@moostjs/event-http": "^0.7.1",
+    "@atscript/core": "^0.2.4",
+    "@atscript/db": "^0.1.168",
+    "@atscript/db-sql-tools": "^0.1.168",
+    "@atscript/db-sqlite": "^0.1.168",
+    "@atscript/moost-db": "^0.1.168",
+    "@atscript/typescript": "^0.2.4",
+    "@moostjs/event-http": "^0.7.2",
     "@types/better-sqlite3": "^7.6.13",
     "better-sqlite3": "^12.6.2",
-    "unplugin-atscript": "^0.2.3"
+    "unplugin-atscript": "^0.2.4"
   },
   "peerDependencies": {
-    "@atscript/db": "^0.1.167",
-    "@atscript/moost-db": "^0.1.167",
-    "@atscript/typescript": "^0.2.3",
-    "@moostjs/event-http": "^0.7.1",
+    "@atscript/db": "^0.1.168",
+    "@atscript/moost-db": "^0.1.168",
+    "@atscript/typescript": "^0.2.4",
+    "@moostjs/event-http": "^0.7.2",
     "@wooksjs/event-core": "^0.8.0",
-    "moost": "^0.7.1"
+    "moost": "^0.7.2"
   },
   "peerDependenciesMeta": {
     "@atscript/db": {