@auth-gate/rbac 0.8.0

package/dist/chunk-HE57TIQI.mjs

@@ -0,0 +1,566 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropSymbols = Object.getOwnPropertySymbols;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __propIsEnum = Object.prototype.propertyIsEnumerable;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp.call(b, prop))
+      __defNormalProp(a, prop, b[prop]);
+  if (__getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(b)) {
+      if (__propIsEnum.call(b, prop))
+        __defNormalProp(a, prop, b[prop]);
+    }
+  return a;
+};
+
+// src/validator.ts
+var KEY_PATTERN = /^[a-z][a-z0-9_]*$/;
+function validateRbacConfig(config) {
+  if (!config || typeof config !== "object") {
+    throw new Error(
+      "RBAC config must be an object. Did you forget `export default defineRbac({ ... })`?"
+    );
+  }
+  const c = config;
+  if (!c.resources || typeof c.resources !== "object" || Array.isArray(c.resources)) {
+    throw new Error("RBAC config must have a `resources` object.");
+  }
+  if (!c.roles || typeof c.roles !== "object" || Array.isArray(c.roles)) {
+    throw new Error("RBAC config must have a `roles` object.");
+  }
+  const resources = c.resources;
+  const roles = c.roles;
+  const resourceKeys = Object.keys(resources);
+  const roleKeys = Object.keys(roles);
+  if (resourceKeys.length === 0) {
+    throw new Error("RBAC config must define at least one resource.");
+  }
+  if (roleKeys.length === 0) {
+    throw new Error("RBAC config must define at least one role.");
+  }
+  const resourceActions = /* @__PURE__ */ new Map();
+  for (const key of resourceKeys) {
+    if (!KEY_PATTERN.test(key)) {
+      throw new Error(
+        `Resource key "${key}" is invalid. Use lowercase alphanumeric with underscores (e.g., "documents", "billing_plans").`
+      );
+    }
+    const resource = resources[key];
+    if (!resource || typeof resource !== "object") {
+      throw new Error(`Resource "${key}" must be an object.`);
+    }
+    if (!Array.isArray(resource.actions) || resource.actions.length === 0) {
+      throw new Error(
+        `Resource "${key}" must have a non-empty "actions" array.`
+      );
+    }
+    for (let i = 0; i < resource.actions.length; i++) {
+      if (typeof resource.actions[i] !== "string") {
+        throw new Error(
+          `Resource "${key}".actions[${i}] must be a string.`
+        );
+      }
+    }
+    resourceActions.set(key, new Set(resource.actions));
+    if (resource.scopes !== void 0) {
+      if (!Array.isArray(resource.scopes)) {
+        throw new Error(`Resource "${key}".scopes must be an array of strings.`);
+      }
+      for (let i = 0; i < resource.scopes.length; i++) {
+        if (typeof resource.scopes[i] !== "string") {
+          throw new Error(`Resource "${key}".scopes[${i}] must be a string.`);
+        }
+      }
+    }
+  }
+  for (const key of roleKeys) {
+    if (!KEY_PATTERN.test(key)) {
+      throw new Error(
+        `Role key "${key}" is invalid. Use lowercase alphanumeric with underscores (e.g., "admin", "org_owner").`
+      );
+    }
+    const role = roles[key];
+    if (!role || typeof role !== "object") {
+      throw new Error(`Role "${key}" must be an object.`);
+    }
+    if (!role.name || typeof role.name !== "string") {
+      throw new Error(`Role "${key}" must have a "name" string.`);
+    }
+    if (!role.grants || typeof role.grants !== "object" || Array.isArray(role.grants)) {
+      throw new Error(`Role "${key}" must have a "grants" object.`);
+    }
+    const grants = role.grants;
+    for (const resourceKey of Object.keys(grants)) {
+      if (!resourceActions.has(resourceKey)) {
+        throw new Error(
+          `Role "${key}".grants references undeclared resource "${resourceKey}". Declared resources: ${[...resourceActions.keys()].join(", ")}.`
+        );
+      }
+      const actionsGrant = grants[resourceKey];
+      if (!actionsGrant || typeof actionsGrant !== "object" || Array.isArray(actionsGrant)) {
+        throw new Error(
+          `Role "${key}".grants.${resourceKey} must be an object mapping actions to grant values.`
+        );
+      }
+      const declaredActions = resourceActions.get(resourceKey);
+      for (const actionKey of Object.keys(actionsGrant)) {
+        if (!declaredActions.has(actionKey)) {
+          throw new Error(
+            `Role "${key}".grants.${resourceKey} references undeclared action "${actionKey}". Declared actions for "${resourceKey}": ${[...declaredActions].join(", ")}.`
+          );
+        }
+        const value = actionsGrant[actionKey];
+        if (value !== true && typeof value !== "string" && !(value && typeof value === "object" && "when" in value && typeof value.when === "string")) {
+          throw new Error(
+            `Role "${key}".grants.${resourceKey}.${actionKey} has invalid value. Expected true, a scope string, or { when: string }.`
+          );
+        }
+      }
+    }
+  }
+  for (const key of roleKeys) {
+    const role = roles[key];
+    if (role.inherits !== void 0) {
+      if (!Array.isArray(role.inherits)) {
+        throw new Error(`Role "${key}".inherits must be an array of role key strings.`);
+      }
+      for (const parent of role.inherits) {
+        if (typeof parent !== "string") {
+          throw new Error(`Role "${key}".inherits contains a non-string value.`);
+        }
+        if (!roleKeys.includes(parent)) {
+          throw new Error(
+            `Role "${key}".inherits references unknown role "${parent}". Declared roles: ${roleKeys.join(", ")}.`
+          );
+        }
+      }
+    }
+  }
+  function detectCycle(roleKey) {
+    const visited = /* @__PURE__ */ new Set();
+    function dfs(current, path) {
+      if (visited.has(current)) {
+        const cycleStart = path.indexOf(current);
+        const cycle = [...path.slice(cycleStart), current].join(" -> ");
+        throw new Error(
+          `Circular inheritance detected: ${cycle}. A role cannot directly or indirectly inherit from itself.`
+        );
+      }
+      visited.add(current);
+      const role = roles[current];
+      if ((role == null ? void 0 : role.inherits) && Array.isArray(role.inherits)) {
+        for (const parent of role.inherits) {
+          dfs(parent, [...path, current]);
+        }
+      }
+      visited.delete(current);
+    }
+    dfs(roleKey, []);
+  }
+  for (const key of roleKeys) {
+    detectCycle(key);
+  }
+  const renameTargets = /* @__PURE__ */ new Map();
+  for (const key of roleKeys) {
+    const role = roles[key];
+    if (role.renamedFrom !== void 0) {
+      if (typeof role.renamedFrom !== "string") {
+        throw new Error(`Role "${key}".renamedFrom must be a string.`);
+      }
+      if (role.renamedFrom === key) {
+        throw new Error(`Role "${key}".renamedFrom cannot equal its own key.`);
+      }
+      if (roleKeys.includes(role.renamedFrom)) {
+        throw new Error(
+          `Role "${key}".renamedFrom "${role.renamedFrom}" cannot reference an existing role key.`
+        );
+      }
+      if (renameTargets.has(role.renamedFrom)) {
+        throw new Error(
+          `renamedFrom "${role.renamedFrom}" is claimed by multiple roles: "${renameTargets.get(role.renamedFrom)}" and "${key}".`
+        );
+      }
+      renameTargets.set(role.renamedFrom, key);
+    }
+  }
+  if (c.conditions !== void 0) {
+    if (typeof c.conditions !== "object" || Array.isArray(c.conditions) || c.conditions === null) {
+      throw new Error("RBAC config `conditions` must be an object mapping names to functions.");
+    }
+    const conditions = c.conditions;
+    for (const [condKey, condValue] of Object.entries(conditions)) {
+      if (typeof condValue !== "function") {
+        throw new Error(
+          `Condition "${condKey}" must be a function. Got ${typeof condValue}.`
+        );
+      }
+    }
+  }
+  return config;
+}
+
+// src/config-loader.ts
+import { resolve } from "path";
+import { existsSync } from "fs";
+var CONFIG_FILENAMES = [
+  "authgate.rbac.ts",
+  "authgate.rbac.js",
+  "authgate.rbac.mjs"
+];
+async function loadRbacConfig(cwd) {
+  var _a, _b;
+  let configPath = null;
+  for (const filename of CONFIG_FILENAMES) {
+    const candidate = resolve(cwd, filename);
+    if (existsSync(candidate)) {
+      configPath = candidate;
+      break;
+    }
+  }
+  if (!configPath) {
+    throw new Error(
+      `No RBAC config found. Expected one of: ${CONFIG_FILENAMES.join(", ")}
+Run \`npx @auth-gate/rbac init\` to create one.`
+    );
+  }
+  const { createJiti } = await import("jiti");
+  const jiti = createJiti(cwd, { interopDefault: true });
+  const mod = await jiti.import(configPath);
+  const raw = (_b = (_a = mod.default) != null ? _a : mod.rbac) != null ? _b : mod;
+  const config = raw && typeof raw === "object" && "_config" in raw ? raw._config : raw;
+  return validateRbacConfig(config);
+}
+
+// src/diff.ts
+function hashConditionSource(fn) {
+  const src = fn.toString();
+  let hash = 0;
+  for (let i = 0; i < src.length; i++) {
+    const ch = src.charCodeAt(i);
+    hash = (hash << 5) - hash + ch | 0;
+  }
+  return hash.toString(36);
+}
+function computeRbacDiff(config, server, memberCounts) {
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k;
+  const resourceOps = [];
+  const roleOps = [];
+  const conditionOps = [];
+  let hasDestructive = false;
+  const serverResourceByKey = /* @__PURE__ */ new Map();
+  for (const res of server.resources) {
+    if (res.managedBy === "config") {
+      serverResourceByKey.set(res.key, res);
+    }
+  }
+  for (const [key, resource] of Object.entries(config.resources)) {
+    const existing = serverResourceByKey.get(key);
+    if (!existing) {
+      resourceOps.push({ type: "create", key, resource });
+    } else {
+      const changes = [];
+      const existingActions = [...existing.actions].sort().join(",");
+      const configActions = [...resource.actions].sort().join(",");
+      if (existingActions !== configActions) {
+        changes.push(`actions: [${existing.actions.join(", ")}] -> [${[...resource.actions].join(", ")}]`);
+      }
+      const existingScopes = [...(_a = existing.scopes) != null ? _a : []].sort().join(",");
+      const configScopes = [...(_b = resource.scopes) != null ? _b : []].sort().join(",");
+      if (existingScopes !== configScopes) {
+        changes.push("scopes changed");
+      }
+      if (changes.length > 0) {
+        resourceOps.push({ type: "update", key, resource, existing, changes });
+      }
+    }
+    serverResourceByKey.delete(key);
+  }
+  for (const [key, resource] of serverResourceByKey) {
+    if (resource.isActive) {
+      resourceOps.push({ type: "archive", key, existing: resource });
+    }
+  }
+  const serverRoleByKey = /* @__PURE__ */ new Map();
+  const serverRoleByPreviousKey = /* @__PURE__ */ new Map();
+  for (const role of server.roles) {
+    if (role.managedBy === "config") {
+      serverRoleByKey.set(role.configKey, role);
+    }
+    for (const prevKey of (_c = role.previousConfigKeys) != null ? _c : []) {
+      serverRoleByPreviousKey.set(prevKey, role);
+    }
+  }
+  const renameMap = /* @__PURE__ */ new Map();
+  for (const [key, role] of Object.entries(config.roles)) {
+    if (role.renamedFrom) {
+      renameMap.set(role.renamedFrom, key);
+    }
+  }
+  for (const [key, role] of Object.entries(config.roles)) {
+    let existing = serverRoleByKey.get(key);
+    if (!existing && role.renamedFrom) {
+      existing = (_d = serverRoleByKey.get(role.renamedFrom)) != null ? _d : serverRoleByPreviousKey.get(role.renamedFrom);
+      if (existing) {
+        const members = (_e = memberCounts[existing.id]) != null ? _e : 0;
+        roleOps.push({
+          type: "rename",
+          key,
+          oldKey: role.renamedFrom,
+          role,
+          existing,
+          assignedMembers: members
+        });
+        serverRoleByKey.delete(existing.configKey);
+        serverRoleByKey.delete(key);
+        continue;
+      }
+    }
+    if (!existing) {
+      roleOps.push({ type: "create", key, role });
+    } else {
+      const changes = [];
+      if (existing.name !== role.name) {
+        changes.push(`name: "${existing.name}" -> "${role.name}"`);
+      }
+      if (((_f = existing.description) != null ? _f : void 0) !== ((_g = role.description) != null ? _g : void 0)) {
+        changes.push("description changed");
+      }
+      const existingGrants = JSON.stringify((_h = existing.grants) != null ? _h : null);
+      const configGrants = JSON.stringify(role.grants);
+      if (existingGrants !== configGrants) {
+        changes.push("grants changed");
+      }
+      const existingInherits = [...(_i = existing.inherits) != null ? _i : []].sort().join(",");
+      const configInherits = [...(_j = role.inherits) != null ? _j : []].sort().join(",");
+      if (existingInherits !== configInherits) {
+        changes.push("inherits changed");
+      }
+      if (changes.length > 0) {
+        roleOps.push({ type: "update", key, role, existing, changes });
+      }
+    }
+    serverRoleByKey.delete(key);
+  }
+  for (const [key, role] of serverRoleByKey) {
+    if (renameMap.has(key)) continue;
+    if (role.isActive) {
+      const members = (_k = memberCounts[role.id]) != null ? _k : 0;
+      if (members > 0) hasDestructive = true;
+      roleOps.push({ type: "archive", key, existing: role, assignedMembers: members });
+    }
+  }
+  const serverConditionByKey = /* @__PURE__ */ new Map();
+  for (const cond of server.conditions) {
+    serverConditionByKey.set(cond.key, cond);
+  }
+  if (config.conditions) {
+    for (const [key, condFn] of Object.entries(config.conditions)) {
+      const existing = serverConditionByKey.get(key);
+      const newHash = hashConditionSource(condFn);
+      if (!existing) {
+        conditionOps.push({ type: "create", key });
+      } else {
+        if (existing.sourceHash !== newHash) {
+          conditionOps.push({ type: "update", key, changes: ["source changed"] });
+        }
+      }
+      serverConditionByKey.delete(key);
+    }
+  }
+  for (const [key, cond] of serverConditionByKey) {
+    if (cond.isActive) {
+      conditionOps.push({ type: "archive", key, existing: cond });
+    }
+  }
+  return { resourceOps, roleOps, conditionOps, hasDestructive };
+}
+
+// src/formatter.ts
+import chalk from "chalk";
+function formatRbacDiff(diff, dryRun) {
+  const lines = [];
+  if (dryRun) {
+    lines.push(
+      chalk.bold("AuthGate RBAC Sync \u2014 DRY RUN") + chalk.dim(" (use --apply to execute)")
+    );
+  } else {
+    lines.push(chalk.bold("AuthGate RBAC Sync \u2014 APPLYING CHANGES"));
+  }
+  lines.push("");
+  const totalOps = diff.resourceOps.length + diff.roleOps.length + diff.conditionOps.length;
+  if (totalOps === 0) {
+    lines.push(chalk.green("  Everything is in sync. No changes needed."));
+    return lines.join("\n");
+  }
+  if (diff.resourceOps.length > 0) {
+    lines.push(chalk.bold.underline("  Resources"));
+    lines.push("");
+    for (const op of diff.resourceOps) {
+      if (op.type === "create") {
+        lines.push(chalk.green(`  + CREATE resource "${op.key}"`));
+        lines.push(
+          chalk.dim(`    actions: [${[...op.resource.actions].join(", ")}]`)
+        );
+        if (op.resource.scopes && op.resource.scopes.length > 0) {
+          lines.push(
+            chalk.dim(`    scopes: [${[...op.resource.scopes].join(", ")}]`)
+          );
+        }
+      } else if (op.type === "update") {
+        lines.push(chalk.yellow(`  ~ UPDATE resource "${op.key}"`));
+        for (const change of op.changes) {
+          lines.push(chalk.yellow(`    ${change}`));
+        }
+      } else if (op.type === "archive") {
+        lines.push(chalk.red(`  - ARCHIVE resource "${op.key}"`));
+      }
+    }
+    lines.push("");
+  }
+  if (diff.roleOps.length > 0) {
+    lines.push(chalk.bold.underline("  Roles"));
+    lines.push("");
+    for (const op of diff.roleOps) {
+      if (op.type === "create") {
+        lines.push(chalk.green(`  + CREATE role "${op.key}"`));
+        if (op.role.description) {
+          lines.push(chalk.dim(`    ${op.role.description}`));
+        }
+        if (op.role.inherits && op.role.inherits.length > 0) {
+          lines.push(
+            chalk.dim(`    inherits: [${[...op.role.inherits].join(", ")}]`)
+          );
+        }
+      } else if (op.type === "update") {
+        lines.push(chalk.yellow(`  ~ UPDATE role "${op.key}"`));
+        for (const change of op.changes) {
+          lines.push(chalk.yellow(`    ${change}`));
+        }
+      } else if (op.type === "archive") {
+        lines.push(chalk.red(`  - ARCHIVE role "${op.key}"`));
+        if (op.assignedMembers > 0) {
+          lines.push(
+            chalk.red.bold(
+              `    WARNING: ${op.assignedMembers} assigned member${op.assignedMembers > 1 ? "s" : ""} will lose this role`
+            )
+          );
+        }
+      } else if (op.type === "rename") {
+        lines.push(
+          chalk.cyan(`  ~ RENAME role "${op.oldKey}" -> "${op.key}"`)
+        );
+        if (op.assignedMembers > 0) {
+          lines.push(
+            chalk.dim(
+              `    ${op.assignedMembers} member${op.assignedMembers > 1 ? "s" : ""} preserved`
+            )
+          );
+        }
+      }
+    }
+    lines.push("");
+  }
+  if (diff.conditionOps.length > 0) {
+    lines.push(chalk.bold.underline("  Conditions"));
+    lines.push("");
+    for (const op of diff.conditionOps) {
+      if (op.type === "create") {
+        lines.push(chalk.green(`  + CREATE condition "${op.key}"`));
+      } else if (op.type === "update") {
+        lines.push(chalk.yellow(`  ~ UPDATE condition "${op.key}"`));
+        for (const change of op.changes) {
+          lines.push(chalk.yellow(`    ${change}`));
+        }
+      } else if (op.type === "archive") {
+        lines.push(chalk.red(`  - ARCHIVE condition "${op.key}"`));
+      }
+    }
+    lines.push("");
+  }
+  const allOps = [
+    ...diff.resourceOps.map((o) => o.type),
+    ...diff.roleOps.map((o) => o.type),
+    ...diff.conditionOps.map((o) => o.type)
+  ];
+  const creates = allOps.filter((t) => t === "create").length;
+  const updates = allOps.filter((t) => t === "update").length;
+  const renames = allOps.filter((t) => t === "rename").length;
+  const archives = allOps.filter((t) => t === "archive").length;
+  lines.push(
+    chalk.dim(
+      `  Summary: ${creates} create, ${updates} update, ${renames} rename, ${archives} archive.`
+    ) + (dryRun ? chalk.dim(" Run with --apply to execute.") : "")
+  );
+  if (diff.hasDestructive && dryRun) {
+    lines.push(
+      chalk.red.bold(
+        "\n  WARNING: Destructive changes detected (roles with assigned members)."
+      ) + chalk.red(" Use --apply --force to proceed.")
+    );
+  }
+  return lines.join("\n");
+}
+
+// src/sync.ts
+var RbacSyncClient = class {
+  constructor(config) {
+    this.baseUrl = config.baseUrl.replace(/\/$/, "");
+    this.apiKey = config.apiKey;
+  }
+  async request(method, path, body) {
+    var _a, _b;
+    const url = `${this.baseUrl}${path}`;
+    const headers = {
+      Authorization: `Bearer ${this.apiKey}`,
+      "Content-Type": "application/json"
+    };
+    const res = await fetch(url, {
+      method,
+      headers,
+      body: body ? JSON.stringify(body) : void 0
+    });
+    if (!res.ok) {
+      const text = await res.text();
+      let message;
+      try {
+        const json = JSON.parse(text);
+        message = (_b = (_a = json.error) != null ? _a : json.message) != null ? _b : text;
+      } catch (e) {
+        message = text;
+      }
+      throw new Error(`API error (${res.status}): ${message}`);
+    }
+    return res.json();
+  }
+  async getState() {
+    return this.request("GET", "/api/v1/rbac/sync/state");
+  }
+  async getMemberCounts() {
+    return this.request(
+      "GET",
+      "/api/v1/rbac/sync/member-counts"
+    );
+  }
+  async apply(config, force) {
+    return this.request("POST", "/api/v1/rbac/sync/apply", {
+      resources: config.resources,
+      roles: config.roles,
+      conditions: config.conditions ? Object.fromEntries(
+        Object.entries(config.conditions).map(([k]) => [k, { key: k }])
+      ) : void 0,
+      force
+    });
+  }
+};
+
+export {
+  __spreadValues,
+  validateRbacConfig,
+  loadRbacConfig,
+  hashConditionSource,
+  computeRbacDiff,
+  formatRbacDiff,
+  RbacSyncClient
+};