@auth-gate/rbac 0.8.0 → 0.8.1

package/dist/{chunk-HE57TIQI.mjs → chunk-5YEMXO7B.mjs}

@@ -14,6 +14,12 @@ var __spreadValues = (a, b) => {
     }
   return a;
 };
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
 
 // src/validator.ts
 var KEY_PATTERN = /^[a-z][a-z0-9_]*$/;
@@ -63,15 +69,28 @@ function validateRbacConfig(config) {
         );
       }
     }
-    resourceActions.set(key, new Set(resource.actions));
+    const actionSet = /* @__PURE__ */ new Set();
+    for (const action of resource.actions) {
+      if (actionSet.has(action)) {
+        throw new Error(`Resource "${key}" has duplicate action: "${action}".`);
+      }
+      actionSet.add(action);
+    }
+    resourceActions.set(key, actionSet);
     if (resource.scopes !== void 0) {
       if (!Array.isArray(resource.scopes)) {
         throw new Error(`Resource "${key}".scopes must be an array of strings.`);
       }
+      const scopeSet = /* @__PURE__ */ new Set();
       for (let i = 0; i < resource.scopes.length; i++) {
         if (typeof resource.scopes[i] !== "string") {
           throw new Error(`Resource "${key}".scopes[${i}] must be a string.`);
         }
+        const scope = resource.scopes[i];
+        if (scopeSet.has(scope)) {
+          throw new Error(`Resource "${key}" has duplicate scope: "${scope}".`);
+        }
+        scopeSet.add(scope);
       }
     }
   }
@@ -112,11 +131,22 @@ function validateRbacConfig(config) {
           );
         }
         const value = actionsGrant[actionKey];
-        if (value !== true && typeof value !== "string" && !(value && typeof value === "object" && "when" in value && typeof value.when === "string")) {
+        if (value !== true && (typeof value !== "string" || value === "") && !(value && typeof value === "object" && "when" in value && typeof value.when === "string" && value.when !== "")) {
           throw new Error(
-            `Role "${key}".grants.${resourceKey}.${actionKey} has invalid value. Expected true, a scope string, or { when: string }.`
+            `Role "${key}".grants.${resourceKey}.${actionKey} has invalid value. Expected true, a non-empty scope string, or { when: non-empty string }.`
           );
         }
+        if (typeof value === "string" && value !== "") {
+          const resource = resources[resourceKey];
+          if (resource.scopes && Array.isArray(resource.scopes)) {
+            const declaredScopes = new Set(resource.scopes);
+            if (!declaredScopes.has(value)) {
+              throw new Error(
+                `Role "${key}".grants.${resourceKey}.${actionKey} scope "${value}" is not in declared scopes for "${resourceKey}": ${[...declaredScopes].join(", ")}.`
+              );
+            }
+          }
+        }
       }
     }
   }
@@ -185,6 +215,7 @@ function validateRbacConfig(config) {
       renameTargets.set(role.renamedFrom, key);
     }
   }
+  const conditionKeys = /* @__PURE__ */ new Set();
   if (c.conditions !== void 0) {
     if (typeof c.conditions !== "object" || Array.isArray(c.conditions) || c.conditions === null) {
       throw new Error("RBAC config `conditions` must be an object mapping names to functions.");
@@ -196,6 +227,23 @@ function validateRbacConfig(config) {
           `Condition "${condKey}" must be a function. Got ${typeof condValue}.`
         );
       }
+      conditionKeys.add(condKey);
+    }
+  }
+  for (const key of roleKeys) {
+    const role = roles[key];
+    const grants = role.grants;
+    for (const [resourceKey, actionGrants] of Object.entries(grants)) {
+      for (const [actionKey, value] of Object.entries(actionGrants)) {
+        if (value && typeof value === "object" && "when" in value) {
+          const whenKey = value.when;
+          if (!conditionKeys.has(whenKey)) {
+            throw new Error(
+              `Role "${key}".grants.${resourceKey}.${actionKey} references condition "${whenKey}" but it is not declared in conditions.` + (conditionKeys.size > 0 ? ` Declared conditions: ${[...conditionKeys].join(", ")}.` : ` No conditions are declared.`)
+            );
+          }
+        }
+      }
     }
   }
   return config;
@@ -234,17 +282,27 @@ Run \`npx @auth-gate/rbac init\` to create one.`
 }
 
 // src/diff.ts
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (a === null || b === null || typeof a !== "object" || typeof b !== "object") return false;
+  if (Array.isArray(a) !== Array.isArray(b)) return false;
+  if (Array.isArray(a) && Array.isArray(b)) {
+    if (a.length !== b.length) return false;
+    return a.every((val, i) => deepEqual(val, b[i]));
+  }
+  const keysA = Object.keys(a).sort();
+  const keysB = Object.keys(b).sort();
+  if (keysA.length !== keysB.length) return false;
+  return keysA.every(
+    (key, i) => key === keysB[i] && deepEqual(a[key], b[key])
+  );
+}
 function hashConditionSource(fn) {
-  const src = fn.toString();
-  let hash = 0;
-  for (let i = 0; i < src.length; i++) {
-    const ch = src.charCodeAt(i);
-    hash = (hash << 5) - hash + ch | 0;
-  }
-  return hash.toString(36);
+  const { createHash } = __require("crypto");
+  return createHash("sha256").update(fn.toString()).digest("hex").slice(0, 16);
 }
 function computeRbacDiff(config, server, memberCounts) {
-  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k;
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l;
   const resourceOps = [];
   const roleOps = [];
   const conditionOps = [];
@@ -303,7 +361,7 @@ function computeRbacDiff(config, server, memberCounts) {
     if (!existing && role.renamedFrom) {
       existing = (_d = serverRoleByKey.get(role.renamedFrom)) != null ? _d : serverRoleByPreviousKey.get(role.renamedFrom);
       if (existing) {
-        const members = (_e = memberCounts[existing.id]) != null ? _e : 0;
+        const members = (_e = memberCounts[existing.configKey]) != null ? _e : 0;
         roleOps.push({
           type: "rename",
           key,
@@ -327,13 +385,11 @@ function computeRbacDiff(config, server, memberCounts) {
       if (((_f = existing.description) != null ? _f : void 0) !== ((_g = role.description) != null ? _g : void 0)) {
         changes.push("description changed");
       }
-      const existingGrants = JSON.stringify((_h = existing.grants) != null ? _h : null);
-      const configGrants = JSON.stringify(role.grants);
-      if (existingGrants !== configGrants) {
+      if (!deepEqual((_h = existing.grants) != null ? _h : null, (_i = role.grants) != null ? _i : null)) {
         changes.push("grants changed");
       }
-      const existingInherits = [...(_i = existing.inherits) != null ? _i : []].sort().join(",");
-      const configInherits = [...(_j = role.inherits) != null ? _j : []].sort().join(",");
+      const existingInherits = [...(_j = existing.inherits) != null ? _j : []].sort().join(",");
+      const configInherits = [...(_k = role.inherits) != null ? _k : []].sort().join(",");
       if (existingInherits !== configInherits) {
         changes.push("inherits changed");
       }
@@ -346,7 +402,7 @@ function computeRbacDiff(config, server, memberCounts) {
   for (const [key, role] of serverRoleByKey) {
     if (renameMap.has(key)) continue;
     if (role.isActive) {
-      const members = (_k = memberCounts[role.id]) != null ? _k : 0;
+      const members = (_l = memberCounts[role.configKey]) != null ? _l : 0;
       if (members > 0) hasDestructive = true;
       roleOps.push({ type: "archive", key, existing: role, assignedMembers: members });
     }
@@ -508,6 +564,11 @@ var RbacSyncClient = class {
   constructor(config) {
     this.baseUrl = config.baseUrl.replace(/\/$/, "");
     this.apiKey = config.apiKey;
+    if (!this.baseUrl.startsWith("https://") && !this.baseUrl.startsWith("http://localhost") && !this.baseUrl.startsWith("http://127.0.0.1")) {
+      console.warn(
+        "WARNING: AUTHGATE_BASE_URL does not use HTTPS. API key may be transmitted insecurely."
+      );
+    }
   }
   async request(method, path, body) {
     var _a, _b;
@@ -526,9 +587,12 @@ var RbacSyncClient = class {
       let message;
       try {
         const json = JSON.parse(text);
-        message = (_b = (_a = json.error) != null ? _a : json.message) != null ? _b : text;
+        message = (_b = (_a = json.error) != null ? _a : json.message) != null ? _b : "Unknown error";
       } catch (e) {
-        message = text;
+        message = text.length > 500 ? text.slice(0, 500) + "..." : text;
+      }
+      if (this.apiKey) {
+        message = message.replaceAll(this.apiKey, "[REDACTED]");
       }
       throw new Error(`API error (${res.status}): ${message}`);
     }
@@ -548,7 +612,10 @@ var RbacSyncClient = class {
       resources: config.resources,
       roles: config.roles,
       conditions: config.conditions ? Object.fromEntries(
-        Object.entries(config.conditions).map(([k]) => [k, { key: k }])
+        Object.entries(config.conditions).map(([k, fn]) => [
+          k,
+          { key: k, sourceHash: hashConditionSource(fn) }
+        ])
       ) : void 0,
       force
     });

package/dist/cli.cjs

@@ -89,15 +89,28 @@ function validateRbacConfig(config) {
         );
       }
     }
-    resourceActions.set(key, new Set(resource.actions));
+    const actionSet = /* @__PURE__ */ new Set();
+    for (const action of resource.actions) {
+      if (actionSet.has(action)) {
+        throw new Error(`Resource "${key}" has duplicate action: "${action}".`);
+      }
+      actionSet.add(action);
+    }
+    resourceActions.set(key, actionSet);
     if (resource.scopes !== void 0) {
       if (!Array.isArray(resource.scopes)) {
         throw new Error(`Resource "${key}".scopes must be an array of strings.`);
       }
+      const scopeSet = /* @__PURE__ */ new Set();
       for (let i = 0; i < resource.scopes.length; i++) {
         if (typeof resource.scopes[i] !== "string") {
           throw new Error(`Resource "${key}".scopes[${i}] must be a string.`);
         }
+        const scope = resource.scopes[i];
+        if (scopeSet.has(scope)) {
+          throw new Error(`Resource "${key}" has duplicate scope: "${scope}".`);
+        }
+        scopeSet.add(scope);
       }
     }
   }
@@ -138,11 +151,22 @@ function validateRbacConfig(config) {
           );
         }
         const value = actionsGrant[actionKey];
-        if (value !== true && typeof value !== "string" && !(value && typeof value === "object" && "when" in value && typeof value.when === "string")) {
+        if (value !== true && (typeof value !== "string" || value === "") && !(value && typeof value === "object" && "when" in value && typeof value.when === "string" && value.when !== "")) {
           throw new Error(
-            `Role "${key}".grants.${resourceKey}.${actionKey} has invalid value. Expected true, a scope string, or { when: string }.`
+            `Role "${key}".grants.${resourceKey}.${actionKey} has invalid value. Expected true, a non-empty scope string, or { when: non-empty string }.`
           );
         }
+        if (typeof value === "string" && value !== "") {
+          const resource = resources[resourceKey];
+          if (resource.scopes && Array.isArray(resource.scopes)) {
+            const declaredScopes = new Set(resource.scopes);
+            if (!declaredScopes.has(value)) {
+              throw new Error(
+                `Role "${key}".grants.${resourceKey}.${actionKey} scope "${value}" is not in declared scopes for "${resourceKey}": ${[...declaredScopes].join(", ")}.`
+              );
+            }
+          }
+        }
       }
     }
   }
@@ -211,6 +235,7 @@ function validateRbacConfig(config) {
       renameTargets.set(role.renamedFrom, key);
     }
   }
+  const conditionKeys = /* @__PURE__ */ new Set();
   if (c.conditions !== void 0) {
     if (typeof c.conditions !== "object" || Array.isArray(c.conditions) || c.conditions === null) {
       throw new Error("RBAC config `conditions` must be an object mapping names to functions.");
@@ -222,6 +247,23 @@ function validateRbacConfig(config) {
           `Condition "${condKey}" must be a function. Got ${typeof condValue}.`
         );
       }
+      conditionKeys.add(condKey);
+    }
+  }
+  for (const key of roleKeys) {
+    const role = roles[key];
+    const grants = role.grants;
+    for (const [resourceKey, actionGrants] of Object.entries(grants)) {
+      for (const [actionKey, value] of Object.entries(actionGrants)) {
+        if (value && typeof value === "object" && "when" in value) {
+          const whenKey = value.when;
+          if (!conditionKeys.has(whenKey)) {
+            throw new Error(
+              `Role "${key}".grants.${resourceKey}.${actionKey} references condition "${whenKey}" but it is not declared in conditions.` + (conditionKeys.size > 0 ? ` Declared conditions: ${[...conditionKeys].join(", ")}.` : ` No conditions are declared.`)
+            );
+          }
+        }
+      }
     }
   }
   return config;
@@ -258,17 +300,27 @@ Run \`npx @auth-gate/rbac init\` to create one.`
 }
 
 // src/diff.ts
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (a === null || b === null || typeof a !== "object" || typeof b !== "object") return false;
+  if (Array.isArray(a) !== Array.isArray(b)) return false;
+  if (Array.isArray(a) && Array.isArray(b)) {
+    if (a.length !== b.length) return false;
+    return a.every((val, i) => deepEqual(val, b[i]));
+  }
+  const keysA = Object.keys(a).sort();
+  const keysB = Object.keys(b).sort();
+  if (keysA.length !== keysB.length) return false;
+  return keysA.every(
+    (key, i) => key === keysB[i] && deepEqual(a[key], b[key])
+  );
+}
 function hashConditionSource(fn) {
-  const src = fn.toString();
-  let hash = 0;
-  for (let i = 0; i < src.length; i++) {
-    const ch = src.charCodeAt(i);
-    hash = (hash << 5) - hash + ch | 0;
-  }
-  return hash.toString(36);
+  const { createHash } = require("crypto");
+  return createHash("sha256").update(fn.toString()).digest("hex").slice(0, 16);
 }
 function computeRbacDiff(config, server, memberCounts) {
-  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k;
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l;
   const resourceOps = [];
   const roleOps = [];
   const conditionOps = [];
@@ -327,7 +379,7 @@ function computeRbacDiff(config, server, memberCounts) {
     if (!existing && role.renamedFrom) {
       existing = (_d = serverRoleByKey.get(role.renamedFrom)) != null ? _d : serverRoleByPreviousKey.get(role.renamedFrom);
       if (existing) {
-        const members = (_e = memberCounts[existing.id]) != null ? _e : 0;
+        const members = (_e = memberCounts[existing.configKey]) != null ? _e : 0;
         roleOps.push({
           type: "rename",
           key,
@@ -351,13 +403,11 @@ function computeRbacDiff(config, server, memberCounts) {
       if (((_f = existing.description) != null ? _f : void 0) !== ((_g = role.description) != null ? _g : void 0)) {
         changes.push("description changed");
       }
-      const existingGrants = JSON.stringify((_h = existing.grants) != null ? _h : null);
-      const configGrants = JSON.stringify(role.grants);
-      if (existingGrants !== configGrants) {
+      if (!deepEqual((_h = existing.grants) != null ? _h : null, (_i = role.grants) != null ? _i : null)) {
         changes.push("grants changed");
       }
-      const existingInherits = [...(_i = existing.inherits) != null ? _i : []].sort().join(",");
-      const configInherits = [...(_j = role.inherits) != null ? _j : []].sort().join(",");
+      const existingInherits = [...(_j = existing.inherits) != null ? _j : []].sort().join(",");
+      const configInherits = [...(_k = role.inherits) != null ? _k : []].sort().join(",");
       if (existingInherits !== configInherits) {
         changes.push("inherits changed");
       }
@@ -370,7 +420,7 @@ function computeRbacDiff(config, server, memberCounts) {
   for (const [key, role] of serverRoleByKey) {
     if (renameMap.has(key)) continue;
     if (role.isActive) {
-      const members = (_k = memberCounts[role.id]) != null ? _k : 0;
+      const members = (_l = memberCounts[role.configKey]) != null ? _l : 0;
       if (members > 0) hasDestructive = true;
       roleOps.push({ type: "archive", key, existing: role, assignedMembers: members });
     }
@@ -532,6 +582,11 @@ var RbacSyncClient = class {
   constructor(config) {
     this.baseUrl = config.baseUrl.replace(/\/$/, "");
     this.apiKey = config.apiKey;
+    if (!this.baseUrl.startsWith("https://") && !this.baseUrl.startsWith("http://localhost") && !this.baseUrl.startsWith("http://127.0.0.1")) {
+      console.warn(
+        "WARNING: AUTHGATE_BASE_URL does not use HTTPS. API key may be transmitted insecurely."
+      );
+    }
   }
   async request(method, path, body) {
     var _a, _b;
@@ -550,9 +605,12 @@ var RbacSyncClient = class {
       let message;
       try {
         const json = JSON.parse(text);
-        message = (_b = (_a = json.error) != null ? _a : json.message) != null ? _b : text;
+        message = (_b = (_a = json.error) != null ? _a : json.message) != null ? _b : "Unknown error";
       } catch (e) {
-        message = text;
+        message = text.length > 500 ? text.slice(0, 500) + "..." : text;
+      }
+      if (this.apiKey) {
+        message = message.replaceAll(this.apiKey, "[REDACTED]");
       }
       throw new Error(`API error (${res.status}): ${message}`);
     }
@@ -572,7 +630,10 @@ var RbacSyncClient = class {
       resources: config.resources,
       roles: config.roles,
       conditions: config.conditions ? Object.fromEntries(
-        Object.entries(config.conditions).map(([k]) => [k, { key: k }])
+        Object.entries(config.conditions).map(([k, fn]) => [
+          k,
+          { key: k, sourceHash: hashConditionSource(fn) }
+        ])
       ) : void 0,
       force
     });

package/dist/cli.mjs

@@ -5,7 +5,7 @@ import {
   computeRbacDiff,
   formatRbacDiff,
   loadRbacConfig
-} from "./chunk-HE57TIQI.mjs";
+} from "./chunk-5YEMXO7B.mjs";
 
 // src/cli.ts
 import chalk from "chalk";

package/dist/index.cjs

@@ -88,15 +88,28 @@ function validateRbacConfig(config) {
         );
       }
     }
-    resourceActions.set(key, new Set(resource.actions));
+    const actionSet = /* @__PURE__ */ new Set();
+    for (const action of resource.actions) {
+      if (actionSet.has(action)) {
+        throw new Error(`Resource "${key}" has duplicate action: "${action}".`);
+      }
+      actionSet.add(action);
+    }
+    resourceActions.set(key, actionSet);
     if (resource.scopes !== void 0) {
       if (!Array.isArray(resource.scopes)) {
         throw new Error(`Resource "${key}".scopes must be an array of strings.`);
       }
+      const scopeSet = /* @__PURE__ */ new Set();
       for (let i = 0; i < resource.scopes.length; i++) {
         if (typeof resource.scopes[i] !== "string") {
           throw new Error(`Resource "${key}".scopes[${i}] must be a string.`);
         }
+        const scope = resource.scopes[i];
+        if (scopeSet.has(scope)) {
+          throw new Error(`Resource "${key}" has duplicate scope: "${scope}".`);
+        }
+        scopeSet.add(scope);
       }
     }
   }
@@ -137,11 +150,22 @@ function validateRbacConfig(config) {
           );
         }
         const value = actionsGrant[actionKey];
-        if (value !== true && typeof value !== "string" && !(value && typeof value === "object" && "when" in value && typeof value.when === "string")) {
+        if (value !== true && (typeof value !== "string" || value === "") && !(value && typeof value === "object" && "when" in value && typeof value.when === "string" && value.when !== "")) {
           throw new Error(
-            `Role "${key}".grants.${resourceKey}.${actionKey} has invalid value. Expected true, a scope string, or { when: string }.`
+            `Role "${key}".grants.${resourceKey}.${actionKey} has invalid value. Expected true, a non-empty scope string, or { when: non-empty string }.`
           );
         }
+        if (typeof value === "string" && value !== "") {
+          const resource = resources[resourceKey];
+          if (resource.scopes && Array.isArray(resource.scopes)) {
+            const declaredScopes = new Set(resource.scopes);
+            if (!declaredScopes.has(value)) {
+              throw new Error(
+                `Role "${key}".grants.${resourceKey}.${actionKey} scope "${value}" is not in declared scopes for "${resourceKey}": ${[...declaredScopes].join(", ")}.`
+              );
+            }
+          }
+        }
       }
     }
   }
@@ -210,6 +234,7 @@ function validateRbacConfig(config) {
       renameTargets.set(role.renamedFrom, key);
     }
   }
+  const conditionKeys = /* @__PURE__ */ new Set();
   if (c.conditions !== void 0) {
     if (typeof c.conditions !== "object" || Array.isArray(c.conditions) || c.conditions === null) {
       throw new Error("RBAC config `conditions` must be an object mapping names to functions.");
@@ -221,6 +246,23 @@ function validateRbacConfig(config) {
           `Condition "${condKey}" must be a function. Got ${typeof condValue}.`
         );
       }
+      conditionKeys.add(condKey);
+    }
+  }
+  for (const key of roleKeys) {
+    const role = roles[key];
+    const grants = role.grants;
+    for (const [resourceKey, actionGrants] of Object.entries(grants)) {
+      for (const [actionKey, value] of Object.entries(actionGrants)) {
+        if (value && typeof value === "object" && "when" in value) {
+          const whenKey = value.when;
+          if (!conditionKeys.has(whenKey)) {
+            throw new Error(
+              `Role "${key}".grants.${resourceKey}.${actionKey} references condition "${whenKey}" but it is not declared in conditions.` + (conditionKeys.size > 0 ? ` Declared conditions: ${[...conditionKeys].join(", ")}.` : ` No conditions are declared.`)
+            );
+          }
+        }
+      }
     }
   }
   return config;
@@ -259,17 +301,27 @@ Run \`npx @auth-gate/rbac init\` to create one.`
 }
 
 // src/diff.ts
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (a === null || b === null || typeof a !== "object" || typeof b !== "object") return false;
+  if (Array.isArray(a) !== Array.isArray(b)) return false;
+  if (Array.isArray(a) && Array.isArray(b)) {
+    if (a.length !== b.length) return false;
+    return a.every((val, i) => deepEqual(val, b[i]));
+  }
+  const keysA = Object.keys(a).sort();
+  const keysB = Object.keys(b).sort();
+  if (keysA.length !== keysB.length) return false;
+  return keysA.every(
+    (key, i) => key === keysB[i] && deepEqual(a[key], b[key])
+  );
+}
 function hashConditionSource(fn) {
-  const src = fn.toString();
-  let hash = 0;
-  for (let i = 0; i < src.length; i++) {
-    const ch = src.charCodeAt(i);
-    hash = (hash << 5) - hash + ch | 0;
-  }
-  return hash.toString(36);
+  const { createHash } = require("crypto");
+  return createHash("sha256").update(fn.toString()).digest("hex").slice(0, 16);
 }
 function computeRbacDiff(config, server, memberCounts) {
-  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k;
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l;
   const resourceOps = [];
   const roleOps = [];
   const conditionOps = [];
@@ -328,7 +380,7 @@ function computeRbacDiff(config, server, memberCounts) {
     if (!existing && role.renamedFrom) {
       existing = (_d = serverRoleByKey.get(role.renamedFrom)) != null ? _d : serverRoleByPreviousKey.get(role.renamedFrom);
       if (existing) {
-        const members = (_e = memberCounts[existing.id]) != null ? _e : 0;
+        const members = (_e = memberCounts[existing.configKey]) != null ? _e : 0;
         roleOps.push({
           type: "rename",
           key,
@@ -352,13 +404,11 @@ function computeRbacDiff(config, server, memberCounts) {
       if (((_f = existing.description) != null ? _f : void 0) !== ((_g = role.description) != null ? _g : void 0)) {
         changes.push("description changed");
       }
-      const existingGrants = JSON.stringify((_h = existing.grants) != null ? _h : null);
-      const configGrants = JSON.stringify(role.grants);
-      if (existingGrants !== configGrants) {
+      if (!deepEqual((_h = existing.grants) != null ? _h : null, (_i = role.grants) != null ? _i : null)) {
         changes.push("grants changed");
       }
-      const existingInherits = [...(_i = existing.inherits) != null ? _i : []].sort().join(",");
-      const configInherits = [...(_j = role.inherits) != null ? _j : []].sort().join(",");
+      const existingInherits = [...(_j = existing.inherits) != null ? _j : []].sort().join(",");
+      const configInherits = [...(_k = role.inherits) != null ? _k : []].sort().join(",");
       if (existingInherits !== configInherits) {
         changes.push("inherits changed");
       }
@@ -371,7 +421,7 @@ function computeRbacDiff(config, server, memberCounts) {
   for (const [key, role] of serverRoleByKey) {
     if (renameMap.has(key)) continue;
     if (role.isActive) {
-      const members = (_k = memberCounts[role.id]) != null ? _k : 0;
+      const members = (_l = memberCounts[role.configKey]) != null ? _l : 0;
       if (members > 0) hasDestructive = true;
       roleOps.push({ type: "archive", key, existing: role, assignedMembers: members });
     }
@@ -407,6 +457,11 @@ var RbacSyncClient = class {
   constructor(config) {
     this.baseUrl = config.baseUrl.replace(/\/$/, "");
     this.apiKey = config.apiKey;
+    if (!this.baseUrl.startsWith("https://") && !this.baseUrl.startsWith("http://localhost") && !this.baseUrl.startsWith("http://127.0.0.1")) {
+      console.warn(
+        "WARNING: AUTHGATE_BASE_URL does not use HTTPS. API key may be transmitted insecurely."
+      );
+    }
   }
   async request(method, path, body) {
     var _a, _b;
@@ -425,9 +480,12 @@ var RbacSyncClient = class {
       let message;
       try {
         const json = JSON.parse(text);
-        message = (_b = (_a = json.error) != null ? _a : json.message) != null ? _b : text;
+        message = (_b = (_a = json.error) != null ? _a : json.message) != null ? _b : "Unknown error";
       } catch (e) {
-        message = text;
+        message = text.length > 500 ? text.slice(0, 500) + "..." : text;
+      }
+      if (this.apiKey) {
+        message = message.replaceAll(this.apiKey, "[REDACTED]");
       }
       throw new Error(`API error (${res.status}): ${message}`);
     }
@@ -447,7 +505,10 @@ var RbacSyncClient = class {
       resources: config.resources,
       roles: config.roles,
       conditions: config.conditions ? Object.fromEntries(
-        Object.entries(config.conditions).map(([k]) => [k, { key: k }])
+        Object.entries(config.conditions).map(([k, fn]) => [
+          k,
+          { key: k, sourceHash: hashConditionSource(fn) }
+        ])
       ) : void 0,
       force
     });
@@ -581,7 +642,10 @@ function formatRbacDiff(diff, dryRun) {
 }
 
 // src/index.ts
-function defineRbac(config) {
+function defineRbac(config, opts) {
+  if ((opts == null ? void 0 : opts.validate) !== false) {
+    validateRbacConfig(config);
+  }
   const resources = {};
   for (const [key, resource] of Object.entries(config.resources)) {
     const actions = {};

package/dist/index.d.cts

@@ -245,7 +245,7 @@ interface DiffResult {
     conditionOps: ConditionOp[];
     hasDestructive: boolean;
 }
-/** Simple hash of a condition function's source code for change detection. */
+/** Hash of a condition function's source code for change detection. */
 declare function hashConditionSource(fn: Function): string;
 declare function computeRbacDiff(config: RbacConfig, server: ServerState, memberCounts: Record<string, number>): DiffResult;
 
@@ -310,6 +310,8 @@ declare function formatRbacDiff(diff: DiffResult, dryRun: boolean): string;
  * rbac.permissions.documents.write       // "documents:write"
  * ```
  */
-declare function defineRbac<const T extends RbacConfig>(config: T): TypedRbac<T>;
+declare function defineRbac<const T extends RbacConfig>(config: T, opts?: {
+    validate?: boolean;
+}): TypedRbac<T>;
 
 export { type ApplyResult, type ConditionContext, type ConditionFn, type ConditionOp, type DiffResult, type GrantValue, type InferActions, type InferConditionKeys, type InferPermissions, type InferResourceKeys, type InferRoleKeys, type InferScopes, type Permission, type RbacConfig, RbacSyncClient, type RbacSyncClientConfig, type ResourceConfig, type ResourceKey, type ResourceOp, type RoleConfig, type RoleKey, type RoleOp, type ServerCondition, type ServerResource, type ServerRole, type ServerState, type TypedRbac, computeRbacDiff, defineRbac, formatRbacDiff, hashConditionSource, loadRbacConfig, validateRbacConfig };

package/dist/index.d.ts

@@ -245,7 +245,7 @@ interface DiffResult {
     conditionOps: ConditionOp[];
     hasDestructive: boolean;
 }
-/** Simple hash of a condition function's source code for change detection. */
+/** Hash of a condition function's source code for change detection. */
 declare function hashConditionSource(fn: Function): string;
 declare function computeRbacDiff(config: RbacConfig, server: ServerState, memberCounts: Record<string, number>): DiffResult;
 
@@ -310,6 +310,8 @@ declare function formatRbacDiff(diff: DiffResult, dryRun: boolean): string;
  * rbac.permissions.documents.write       // "documents:write"
  * ```
  */
-declare function defineRbac<const T extends RbacConfig>(config: T): TypedRbac<T>;
+declare function defineRbac<const T extends RbacConfig>(config: T, opts?: {
+    validate?: boolean;
+}): TypedRbac<T>;
 
 export { type ApplyResult, type ConditionContext, type ConditionFn, type ConditionOp, type DiffResult, type GrantValue, type InferActions, type InferConditionKeys, type InferPermissions, type InferResourceKeys, type InferRoleKeys, type InferScopes, type Permission, type RbacConfig, RbacSyncClient, type RbacSyncClientConfig, type ResourceConfig, type ResourceKey, type ResourceOp, type RoleConfig, type RoleKey, type RoleOp, type ServerCondition, type ServerResource, type ServerRole, type ServerState, type TypedRbac, computeRbacDiff, defineRbac, formatRbacDiff, hashConditionSource, loadRbacConfig, validateRbacConfig };

package/dist/index.mjs

@@ -5,10 +5,13 @@ import {
   hashConditionSource,
   loadRbacConfig,
   validateRbacConfig
-} from "./chunk-HE57TIQI.mjs";
+} from "./chunk-5YEMXO7B.mjs";
 
 // src/index.ts
-function defineRbac(config) {
+function defineRbac(config, opts) {
+  if ((opts == null ? void 0 : opts.validate) !== false) {
+    validateRbacConfig(config);
+  }
   const resources = {};
   for (const [key, resource] of Object.entries(config.resources)) {
     const actions = {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@auth-gate/rbac",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "type": "module",
   "exports": {
     ".": {