@atlasauth/emulator-core 0.2.0 → 0.3.1

package/dist/handlers/fga-engine.d.ts

@@ -0,0 +1,78 @@
+/**
+ * The relationship-model engine behind the FGA routes: an OpenFGA-style authorization model (JSON `type_definitions` or DSL
+ * text) with the six rewrite operators (direct, computed, tuple-to-userset, union, intersection, exclusion), tuple
+ * conditions over a small CEL subset, and check / list-objects / list-users / expand over a set of tuples.
+ *
+ * shortcut: conditions support comparisons, boolean and arithmetic operators, `in`, field and index access, list literals
+ * and the string functions startsWith, endsWith, contains, matches, size; no ipaddress, duration or map-typed parameters.
+ * Upgrade by running the real engine if a model depends on those.
+ */
+export declare class ModelError extends Error {
+    readonly errors: string[];
+    constructor(errors: string[]);
+}
+export declare class TupleError extends Error {
+}
+type Us = any;
+export interface Ref {
+    type: string;
+    relation?: string;
+    wildcard?: Record<string, never>;
+    condition?: string;
+}
+export interface Compiled {
+    types: Map<string, Map<string, Us>>;
+    refs: Map<string, Map<string, Ref[]>>;
+    conds: Map<string, {
+        params: Map<string, string>;
+        ast: Cel;
+    }>;
+}
+export interface FgaTuple {
+    user: string;
+    relation: string;
+    object: string;
+    condition?: {
+        name: string;
+        context?: Record<string, unknown>;
+    };
+}
+/** OpenFGA DSL text to the JSON model. */
+export declare function dslToModel(dsl: string): any;
+/** Validate and compile a JSON model. Throws ModelError with every problem found. */
+export declare function compileModel(model: unknown): Compiled;
+export declare function compileStored(model: unknown): Compiled | null;
+interface PUser {
+    type: string;
+    id: string;
+    rel: string | null;
+    wild: boolean;
+}
+export declare function parseUser(s: string): PUser;
+export declare function parseObject(s: string): {
+    type: string;
+    id: string;
+};
+/** Write-time type validation: the same rules the real store applies against the latest model. Null when allowed. */
+export declare function validateTuple(m: Compiled, t: FgaTuple): string | null;
+type Cel = any;
+export declare class Resolver {
+    readonly model: Compiled;
+    private readonly context;
+    private readonly by;
+    private readonly objects;
+    errors: number;
+    constructor(model: Compiled, tuples: readonly FgaTuple[], context: Record<string, unknown> | undefined);
+    private read;
+    private holds;
+    check(user: PUser, object: string, relation: string): boolean;
+    private relation;
+    private node;
+    /** Ids of `type` objects the user holds `relation` on (candidates are the objects named in any tuple). */
+    listObjects(user: PUser, relation: string, type: string): string[];
+    /** Concrete users of `userType` that hold `relation` on the object. */
+    listUsers(object: string, relation: string, userType: string): string[];
+    /** The userset tree of a relation (the rewrite structure with the direct users at each `this` leaf). */
+    expand(object: string, relation: string): any;
+}
+export {};