@assemora/auth 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Assemora
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+

package/README.md

@@ -0,0 +1,69 @@
+# `@assemora/auth`
+
+Users, sessions, roles, permissions, policies, tokens.
+
+**Implementation phase:** 6 — implemented.
+
+```ts
+export const ArticlePolicy = policy('articles', {
+  read: () => true,
+  update: ({ actor, record }) => actor?.id === record.authorId,
+  delete: ({ can }) => can('articles.delete'),
+})
+
+const app = createApplication({
+  modules: [auth({ policies: [ArticlePolicy] }), blog()],
+  authorization: policies(),
+})
+```
+
+Registering this module is what makes `permitAll()` unnecessary: the authorization
+port core has declared since phase 1 finally has an implementation, and every command
+and query starts passing roles, permissions and policies.
+
+The check happens twice, because a rule about a record cannot be answered before the
+record is read: permissions before the write, the policy rule once the row is loaded
+(ADR-0015). Both are inside the command pipeline, so no caller can be the one that
+forgets.
+
+Nothing sensitive is stored as written. Passwords are Argon2id with OWASP's
+parameters; tokens are SHA-256 digests of 256 random bits, and a token's plaintext
+exists exactly once — when it is issued. An unknown email costs the same time as a
+wrong password, so the timing does not say which addresses are registered.
+
+`resolveActor` is what `@assemora/http` accepts to turn a bearer token or a session
+cookie into an actor; neither package depends on the other.
+
+## What makes an actor still an actor
+
+`permissionsOf` answers what an actor may do **now**, so it asks first whether this is
+still an actor at all:
+
+| Actor | Holds nothing once |
+| --- | --- |
+| `user` | the `User` row says `active: false` |
+| `api` | the token is gone, its expiry has passed, or the person it was issued for is deactivated |
+| `agent` | the agent is gone or `enabled: false` |
+
+That question belongs here rather than at the credential boundary, because not every
+path presents a credential. A session is checked when the cookie is read and a bearer
+token when the header is — but a **job** carries an actor sealed into an envelope and
+is replayed by a worker hours later with nothing to present (ADR-0023), and so does
+anything else that stores an identity and acts on it afterwards. `permissionsOf` is
+the one place all of them go through.
+
+It costs a row read: resolving a user's permissions is four queries rather than three,
+and the command pipeline resolves them twice — once for the permission check and once
+for the policy rule. It buys the only revocation the framework has, so it is paid on
+every command. A deactivated actor short-circuits to a single query.
+
+An **absent** `User` row is deliberately not a revocation. There is no user deletion in
+Assemora — `active: false` is the whole of how a person is cut off — so an absence is
+never something this system decided; it is an application whose identities live in an
+SSO directory and whose roles are assigned here.
+
+## Workspace dependencies
+
+- `@assemora/schema`
+- `@assemora/core`
+- `@assemora/data`

package/dist/actors.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Turning credentials into an actor (SPEC.md §12, §49).
+ *
+ * This is what `@assemora/http` accepts as `resolveActor`: the HTTP layer knows about
+ * headers and cookies, this package knows what a credential means, and neither
+ * depends on the other (SPEC.md §8).
+ */
+import type { Actor } from '@assemora/core';
+export declare const SESSION_COOKIE = "assemora_session";
+/**
+ * A bearer token first, then the Studio session cookie. An unrecognised credential
+ * is nobody, never an error: what a route does about that is the route's decision.
+ *
+ * A session token is accepted as a bearer credential too, which is how the SDK and
+ * the CLI act as a person rather than as an integration. The browser still gets the
+ * cookie, because a token JavaScript can read is a token an injected script can take
+ * (SPEC.md §85).
+ */
+export declare const resolveActor: (headers: Readonly<Record<string, string>>) => Promise<Actor | undefined>;
+//# sourceMappingURL=actors.d.ts.map

package/dist/actors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actors.d.ts","sourceRoot":"","sources":["../src/actors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAK3C,eAAO,MAAM,cAAc,qBAAqB,CAAA;AAsBhD;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,YACd,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KACxC,OAAO,CAAC,KAAK,GAAG,SAAS,CAU3B,CAAA"}

package/dist/actors.js

@@ -0,0 +1,37 @@
+import { SESSION_PREFIX, sessionActor } from './sessions.js';
+import { tokenActor } from './tokens.js';
+export const SESSION_COOKIE = 'assemora_session';
+const cookieValue = (header, name) => {
+    if (header === undefined)
+        return undefined;
+    for (const part of header.split(';')) {
+        const [key, ...rest] = part.trim().split('=');
+        if (key === name)
+            return rest.join('=');
+    }
+    return undefined;
+};
+const bearer = (header) => {
+    if (header === undefined)
+        return undefined;
+    const [scheme, ...rest] = header.split(' ');
+    return scheme?.toLowerCase() === 'bearer' && rest.length > 0 ? rest.join(' ') : undefined;
+};
+/**
+ * A bearer token first, then the Studio session cookie. An unrecognised credential
+ * is nobody, never an error: what a route does about that is the route's decision.
+ *
+ * A session token is accepted as a bearer credential too, which is how the SDK and
+ * the CLI act as a person rather than as an integration. The browser still gets the
+ * cookie, because a token JavaScript can read is a token an injected script can take
+ * (SPEC.md §85).
+ */
+export const resolveActor = async (headers) => {
+    const token = bearer(headers.authorization);
+    if (token !== undefined) {
+        return token.startsWith(`${SESSION_PREFIX}_`) ? sessionActor(token) : tokenActor(token);
+    }
+    const session = cookieValue(headers.cookie, SESSION_COOKIE);
+    return session === undefined ? undefined : sessionActor(session);
+};
+//# sourceMappingURL=actors.js.map

package/dist/actors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actors.js","sourceRoot":"","sources":["../src/actors.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,CAAA;AAEhD,MAAM,WAAW,GAAG,CAAC,MAA0B,EAAE,IAAY,EAAsB,EAAE;IACnF,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAE1C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAE7C,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACzC,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,MAA0B,EAAsB,EAAE;IAChE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAE1C,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAE3C,OAAO,MAAM,EAAE,WAAW,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAC3F,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,OAAyC,EACb,EAAE;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IAE3C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IACzF,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IAE3D,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;AAClE,CAAC,CAAA"}

package/dist/authorization.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The authorization provider (SPEC.md §50, §51, ADR-0008).
+ *
+ * `@assemora/core` declares the port and calls it inside the command pipeline; this
+ * is the implementation that consults roles, permissions and policies. Registering
+ * it is what makes `permitAll()` unnecessary.
+ *
+ * The check happens in two stages, because a rule about a record cannot be answered
+ * before the record is read:
+ *
+ * 1. `authorize` — permissions. Does this actor hold `articles.update` at all?
+ * 2. `authorizeRecord` — the policy rule, with the row in hand.
+ *
+ * Actions that act on an existing row defer to the second stage; the rest are decided
+ * at the first, where `record` is `undefined` by definition.
+ */
+import type { AuthorizationPort, AuthorizationRequest } from '@assemora/core';
+export type CommandSubject = {
+    readonly subject: string;
+    readonly action: string;
+};
+/**
+ * A command name is already a permission name.
+ *
+ * `pages.publish` is `publish` on `pages`, so the permission is `pages.publish` —
+ * which is exactly how SPEC.md §51 spells `actor.has('articles.delete')`. The
+ * `entries.*` commands are the exception: they name their subject in the input, so
+ * `entries.update` on `{ resource: 'articles' }` is `articles.update`.
+ *
+ * `list` and `get` both mean `read`, whatever the subject. A policy that grants
+ * reading should not have to say it twice, and `pages.read` reads better in a role
+ * than `pages.list` plus `pages.get` (SPEC.md §51).
+ */
+export declare const subjectOf: (request: AuthorizationRequest) => CommandSubject;
+export declare const policies: () => AuthorizationPort;
+//# sourceMappingURL=authorization.d.ts.map

package/dist/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../src/authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EACV,iBAAiB,EACjB,oBAAoB,EAErB,MAAM,gBAAgB,CAAA;AASvB,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB,CAAA;AAcD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,SAAS,YAAa,oBAAoB,KAAG,cAgBzD,CAAA;AAED,eAAO,MAAM,QAAQ,QAAO,iBA6D1B,CAAA"}

package/dist/authorization.js

@@ -0,0 +1,93 @@
+import { ForbiddenError } from '@assemora/core';
+import { holds, permissionsOf } from './permissions.js';
+import { policyFor } from './policies.js';
+/** Actions whose decision needs the row itself. */
+const RECORD_SCOPED = new Set(['update', 'delete', 'restore', 'publish']);
+/** Listing and fetching are the same right, and a policy says so once. */
+/**
+ * The actions that are reads, whatever the subject.
+ *
+ * `translations` is one: it answers which languages an entry is written in, and a role
+ * that may read an entry should not need a second grant to be told that (SPEC.md §131).
+ * Adding it here rather than granting `entries.translations` separately is what keeps
+ * "may read this" one permission instead of a list that grows with every read anybody
+ * adds.
+ */
+const READING = new Set(['list', 'get', 'translations']);
+/**
+ * A command name is already a permission name.
+ *
+ * `pages.publish` is `publish` on `pages`, so the permission is `pages.publish` —
+ * which is exactly how SPEC.md §51 spells `actor.has('articles.delete')`. The
+ * `entries.*` commands are the exception: they name their subject in the input, so
+ * `entries.update` on `{ resource: 'articles' }` is `articles.update`.
+ *
+ * `list` and `get` both mean `read`, whatever the subject. A policy that grants
+ * reading should not have to say it twice, and `pages.read` reads better in a role
+ * than `pages.list` plus `pages.get` (SPEC.md §51).
+ */
+export const subjectOf = (request) => {
+    const input = request.input;
+    const resource = typeof input?.resource === 'string' ? input.resource : undefined;
+    const separator = request.command.lastIndexOf('.');
+    const group = request.command.slice(0, Math.max(separator, 0));
+    const action = separator === -1 ? 'execute' : request.command.slice(separator + 1);
+    const read = (subject) => ({ subject, action: READING.has(action) ? 'read' : action });
+    // A command that names what it acts on has the last word: `blocks.update` edits a
+    // page, so `pages.update` is the one permission it takes, at both stages.
+    if (request.subject !== undefined)
+        return read(request.subject);
+    if (group === 'entries' && resource !== undefined)
+        return read(resource);
+    return read(group === '' ? request.command : group);
+};
+export const policies = () => ({
+    async authorize(request) {
+        const { subject, action } = subjectOf(request);
+        const permissions = await permissionsOf(request.context.actor);
+        // Held outright. Nothing is deferred, so nothing is owed at the second stage.
+        if (holds(permissions, `${subject}.${action}`))
+            return undefined;
+        const rules = policyFor(subject)?.rules;
+        if (rules === undefined) {
+            throw new ForbiddenError(`No permission and no policy allow ${action} on ${subject}`);
+        }
+        // The row decides, and it has not been read yet. The second stage will ask — and
+        // saying so is what makes that a guarantee rather than a convention: the bus
+        // refuses to commit a command that was let through here and never asked again.
+        if (RECORD_SCOPED.has(action))
+            return { deferredTo: { subject, action } };
+        const rule = rules[action];
+        if (rule === undefined) {
+            throw new ForbiddenError(`The policy for ${subject} says nothing about ${action}`);
+        }
+        const allowed = await rule({
+            actor: request.context.actor,
+            record: undefined,
+            context: request.context,
+            can: (permission) => holds(permissions, permission),
+        });
+        if (!allowed)
+            throw new ForbiddenError(`${action} on ${subject} is not allowed`);
+        return undefined;
+    },
+    async authorizeRecord(request) {
+        const permissions = await permissionsOf(request.context.actor);
+        if (holds(permissions, `${request.subject}.${request.action}`))
+            return;
+        const rule = policyFor(request.subject)?.rules[request.action];
+        if (rule === undefined) {
+            throw new ForbiddenError(`No permission and no policy allow ${request.action} on ${request.subject}`);
+        }
+        const allowed = await rule({
+            actor: request.context.actor,
+            record: request.record,
+            context: request.context,
+            can: (permission) => holds(permissions, permission),
+        });
+        if (!allowed) {
+            throw new ForbiddenError(`${request.action} on this ${request.subject} is not allowed`);
+        }
+    },
+});
+//# sourceMappingURL=authorization.js.map

package/dist/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../src/authorization.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAE/C,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAEzC,mDAAmD;AACnD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAA;AAOzE,0EAA0E;AAC1E;;;;;;;;GAQG;AACH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC,CAAA;AAExD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAA6B,EAAkB,EAAE;IACzE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAsC,CAAA;IAC5D,MAAM,QAAQ,GAAG,OAAO,KAAK,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;IACjF,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IAElD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAA;IAC9D,MAAM,MAAM,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;IAClF,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;IAE9F,kFAAkF;IAClF,0EAA0E;IAC1E,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAE/D,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAA;IAExE,OAAO,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;AACrD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAsB,EAAE,CAAC,CAAC;IAChD,KAAK,CAAC,SAAS,CAAC,OAAO;QACrB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;QAC9C,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAE9D,8EAA8E;QAC9E,IAAI,KAAK,CAAC,WAAW,EAAE,GAAG,OAAO,IAAI,MAAM,EAAE,CAAC;YAAE,OAAO,SAAS,CAAA;QAEhE,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,EAAE,KAAK,CAAA;QAEvC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,cAAc,CAAC,qCAAqC,MAAM,OAAO,OAAO,EAAE,CAAC,CAAA;QACvF,CAAC;QAED,iFAAiF;QACjF,6EAA6E;QAC7E,+EAA+E;QAC/E,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAA;QAEzE,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;QAE1B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,cAAc,CAAC,kBAAkB,OAAO,uBAAuB,MAAM,EAAE,CAAC,CAAA;QACpF,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC;YACzB,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK;YAC5B,MAAM,EAAE,SAAkB;YAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU,CAAC;SACpD,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,MAAM,OAAO,OAAO,iBAAiB,CAAC,CAAA;QAEhF,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,OAAmC;QACvD,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAE9D,IAAI,KAAK,CAAC,WAAW,EAAE,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAAE,OAAM;QAEtE,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAE9D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,cAAc,CACtB,qCAAqC,OAAO,CAAC,MAAM,OAAO,OAAO,CAAC,OAAO,EAAE,CAC5E,CAAA;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC;YACzB,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAe;YAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU,CAAC;SACpD,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,GAAG,OAAO,CAAC,MAAM,YAAY,OAAO,CAAC,OAAO,iBAAiB,CAAC,CAAA;QACzF,CAAC;IACH,CAAC;CACF,CAAC,CAAA"}