@authup/access 1.0.0-beta.24 → 1.0.0-beta.26

package/LICENSE

@@ -186,7 +186,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2021-2024 Peter Placzek
+   Copyright 2021-2025 Peter Placzek <peter.placzek1996@gmail.com>
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

package/dist/index.cjs

@@ -7,78 +7,7 @@ var validup = require('validup');
 var zod = require('zod');
 var mongo2js = require('@ucast/mongo2js');
 
-class PermissionError extends Error {
-    static notFound(name) {
-        return new PermissionError({
-            message: `The permission ${name} was not found.`,
-            code: errors.ErrorCode.PERMISSION_NOT_FOUND
-        });
-    }
-    static denied(name) {
-        return new PermissionError({
-            message: `The permission ${name} has not been granted.`,
-            code: errors.ErrorCode.PERMISSION_DENIED
-        });
-    }
-    static deniedAll(names) {
-        return new PermissionError({
-            message: `None of the permissions ${names.join(', ')} has been granted.`,
-            code: errors.ErrorCode.PERMISSION_DENIED
-        });
-    }
-    static evaluationFailed(options) {
-        const error = new PermissionError({
-            message: `The evaluation of permission ${options.name} failed.`,
-            code: errors.ErrorCode.PERMISSION_EVALUATION_FAILED
-        });
-        if (options.policy) {
-            error.policy = options.policy;
-        }
-        if (options.policyError) {
-            error.policyError = options.policyError;
-        }
-        return error;
-    }
-    constructor(options = {}){
-        super(options.message || 'A permission error occurred.');
-        this.code = options.code ?? null;
-    }
-}
-
-/*
- * Copyright (c) 2024-2024.
- * Author Peter Placzek (tada5hi)
- * For the full copyright and license information,
- * view the LICENSE file that was distributed with this source code.
- */ function isPermissionItemEqual(a, b) {
-    if (a.name !== b.name) {
-        return false;
-    }
-    if (typeof a.realm_id === 'string' || typeof b.realm_id === 'string') {
-        return a.realm_id === b.realm_id;
-    }
-    return !!a.realm_id === !!b.realm_id;
-}
-
-/*
- * Copyright (c) 2024-2024.
- * Author Peter Placzek (tada5hi)
- * For the full copyright and license information,
- * view the LICENSE file that was distributed with this source code.
- */ var DecisionStrategy = /*#__PURE__*/ function(DecisionStrategy) {
-    /**
-     * One or more positive
-     */ DecisionStrategy["AFFIRMATIVE"] = "affirmative";
-    /**
-     * All positive
-     */ DecisionStrategy["UNANIMOUS"] = "unanimous";
-    /**
-     * More positive than negative
-     */ DecisionStrategy["CONSENSUS"] = "consensus";
-    return DecisionStrategy;
-}({});
-
-class PolicyError extends Error {
+class PolicyError extends errors.AuthupError {
     static evaluatorNotFound(type) {
         return new PolicyError(`No evaluator is registered to handle the policy: ${type}`, errors.ErrorCode.POLICY_EVALUATOR_NOT_FOUND);
     }
@@ -89,8 +18,10 @@ class PolicyError extends Error {
         throw new PolicyError('The evaluator context is not valid.', errors.ErrorCode.POLICY_EVALUATOR_CONTEXT_INVALID);
     }
     constructor(message, code){
-        super(message);
-        this.code = code ?? null;
+        super({
+            message,
+            code
+        });
     }
 }
 
@@ -147,8 +78,9 @@ class PolicyError extends Error {
 
 class AttributeNamesPolicyValidator extends validup.Container {
     initialize() {
+        super.initialize();
         this.mount('names', adapterZod.createValidator(zod.z.array(zod.z.string().min(3).max(128))));
-        this.mount('invert', adapterZod.createValidator(zod.z.boolean().optional()));
+        this.mount('invert', adapterZod.createValidator(zod.z.boolean().or(zod.z.null()).or(zod.z.undefined()).optional()));
     }
 }
 
@@ -184,14 +116,20 @@ class AttributeNamesPolicyEvaluator {
     }
 }
 
+/*
+ * Copyright (c) 2025.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */ function defineAttributesPolicy(data) {
+    return data;
+}
+
 class AttributesPolicyValidator extends validup.Container {
-    mountAll() {
+    initialize() {
+        super.initialize();
         this.mount('query', adapterZod.createValidator(zod.z.object({}).passthrough()));
-        this.mount('invert', adapterZod.createValidator(zod.z.boolean().optional()));
-    }
-    constructor(options = {}){
-        super(options);
-        this.mountAll();
+        this.mount('invert', adapterZod.createValidator(zod.z.boolean().or(zod.z.null()).or(zod.z.undefined()).optional()));
     }
 }
 
@@ -238,35 +176,50 @@ class AttributesPolicyEvaluator {
     }
 }
 
+/*
+ * Copyright (c) 2024-2024.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */ var DecisionStrategy = /*#__PURE__*/ function(DecisionStrategy) {
+    /**
+     * One or more positive
+     */ DecisionStrategy["AFFIRMATIVE"] = "affirmative";
+    /**
+     * All positive
+     */ DecisionStrategy["UNANIMOUS"] = "unanimous";
+    /**
+     * More positive than negative
+     */ DecisionStrategy["CONSENSUS"] = "consensus";
+    return DecisionStrategy;
+}({});
+
 class PolicyDataIdentityValidator extends validup.Container {
-    mountAll() {
+    initialize() {
+        super.initialize();
         this.mount('type', adapterZod.createValidator(zod.z.string().min(3).max(128)));
         this.mount('id', adapterZod.createValidator(zod.z.string().uuid()));
-        this.mount('realmId', adapterZod.createValidator(zod.z.string().uuid().optional()));
-        this.mount('realmName', adapterZod.createValidator(zod.z.string().min(3).max(128).optional()));
-    }
-    constructor(options = {}){
-        super(options);
-        this.mountAll();
+        this.mount('clientId', adapterZod.createValidator(zod.z.string().uuid().or(zod.z.null()).or(zod.z.undefined()).optional()));
+        this.mount('realmId', adapterZod.createValidator(zod.z.string().uuid().or(zod.z.null()).or(zod.z.undefined()).optional()));
+        this.mount('realmName', adapterZod.createValidator(zod.z.string().min(3).max(128).or(zod.z.null()).or(zod.z.undefined()).optional()));
     }
 }
 
 class PolicyDataPermissionValidator extends validup.Container {
-    mountAll() {
+    initialize() {
+        super.initialize();
         this.mount('name', adapterZod.createValidator(zod.z.string().min(3).max(256)));
-        this.mount('realm_id', adapterZod.createValidator(zod.z.string().uuid().optional()));
+        this.mount('clientId', adapterZod.createValidator(zod.z.string().uuid().or(zod.z.null()).or(zod.z.undefined()).optional()));
+        this.mount('realmId', adapterZod.createValidator(zod.z.string().uuid().or(zod.z.null()).or(zod.z.undefined()).optional()));
         this.mount('policy', adapterZod.createValidator(zod.z.object({
             type: zod.z.string()
         }).optional()));
     }
-    constructor(options = {}){
-        super(options);
-        this.mountAll();
-    }
 }
 
 class PolicyDataValidator extends validup.Container {
-    mountAll() {
+    initialize() {
+        super.initialize();
         // todo: optionalValue should be null
         const identity = new PolicyDataIdentityValidator();
         this.mount('identity', {
@@ -284,10 +237,6 @@ class PolicyDataValidator extends validup.Container {
         this.mount('attributes', adapterZod.createValidator(zod.z.object({}).optional()));
         this.mount('dateTime', adapterZod.createValidator(zod.z.date().or(zod.z.string()).or(zod.z.number()).optional()));
     }
-    constructor(options = {}){
-        super(options);
-        this.mountAll();
-    }
 }
 
 async function evaluatePolicy(ctx) {
@@ -337,16 +286,13 @@ function isCompositePolicy(input) {
 }
 
 class CompositePolicyValidator extends validup.Container {
-    mountAll() {
-        this.mount('decisionStrategy', adapterZod.createValidator(zod.z.nativeEnum(DecisionStrategy).optional()));
+    initialize() {
+        super.initialize();
+        this.mount('decisionStrategy', adapterZod.createValidator(zod.z.nativeEnum(DecisionStrategy).or(zod.z.null()).or(zod.z.undefined()).optional()));
         this.mount('children', adapterZod.createValidator(zod.z.array(zod.z.object({
             type: zod.z.string().min(3)
         }).passthrough())));
-        this.mount('invert', adapterZod.createValidator(zod.z.boolean().optional()));
-    }
-    constructor(options = {}){
-        super(options);
-        this.mountAll();
+        this.mount('invert', adapterZod.createValidator(zod.z.boolean().or(zod.z.null()).or(zod.z.undefined()).optional()));
     }
 }
 
@@ -397,14 +343,11 @@ class CompositePolicyEvaluator {
 }
 
 class DatePolicyValidator extends validup.Container {
-    mountAll() {
-        this.mount('start', adapterZod.createValidator(zod.z.date().or(zod.z.string()).or(zod.z.number()).optional()));
-        this.mount('end', adapterZod.createValidator(zod.z.date().or(zod.z.string()).or(zod.z.number()).optional()));
-        this.mount('invert', adapterZod.createValidator(zod.z.boolean().optional()));
-    }
-    constructor(options = {}){
-        super(options);
-        this.mountAll();
+    initialize() {
+        super.initialize();
+        this.mount('start', adapterZod.createValidator(zod.z.date().or(zod.z.string().date()).or(zod.z.number()).or(zod.z.null()).or(zod.z.undefined()).optional()));
+        this.mount('end', adapterZod.createValidator(zod.z.date().or(zod.z.string().date()).or(zod.z.number()).or(zod.z.null()).or(zod.z.undefined()).optional()));
+        this.mount('invert', adapterZod.createValidator(zod.z.boolean().or(zod.z.undefined()).or(zod.z.null()).optional()));
     }
 }
 
@@ -458,8 +401,8 @@ class DatePolicyEvaluator {
 
 class IdentityPolicyValidator extends validup.Container {
     initialize() {
-        this.mount('types', adapterZod.createValidator(zod.z.array(zod.z.string()).optional()));
-        this.mount('invert', adapterZod.createValidator(zod.z.boolean().optional()));
+        this.mount('types', adapterZod.createValidator(zod.z.array(zod.z.string()).or(zod.z.null()).or(zod.z.undefined()).optional()));
+        this.mount('invert', adapterZod.createValidator(zod.z.boolean().or(zod.z.null()).or(zod.z.undefined()).optional()));
     }
 }
 
@@ -516,17 +459,14 @@ class PermissionBindingPolicyEvaluator {
 }
 
 class RealmMatchPolicyValidator extends validup.Container {
-    mountAll() {
-        this.mount('decisionStrategy', adapterZod.createValidator(zod.z.nativeEnum(DecisionStrategy).optional()));
-        this.mount('attributeName', adapterZod.createValidator(zod.z.string().min(3).or(zod.z.array(zod.z.string().min(3))).optional()));
-        this.mount('attributeNameStrict', adapterZod.createValidator(zod.z.boolean().optional()));
-        this.mount('attributeNullMatchAll', adapterZod.createValidator(zod.z.boolean().optional()));
-        this.mount('identityMasterMatchAll', adapterZod.createValidator(zod.z.boolean().optional()));
-        this.mount('invert', adapterZod.createValidator(zod.z.boolean().optional()));
-    }
-    constructor(options = {}){
-        super(options);
-        this.mountAll();
+    initialize() {
+        super.initialize();
+        this.mount('decisionStrategy', adapterZod.createValidator(zod.z.nativeEnum(DecisionStrategy).or(zod.z.null()).or(zod.z.undefined()).optional()));
+        this.mount('attributeName', adapterZod.createValidator(zod.z.string().min(3).or(zod.z.array(zod.z.string().min(3))).or(zod.z.null()).or(zod.z.undefined()).optional()));
+        this.mount('attributeNameStrict', adapterZod.createValidator(zod.z.boolean().or(zod.z.null()).or(zod.z.undefined()).optional()));
+        this.mount('attributeNullMatchAll', adapterZod.createValidator(zod.z.boolean().or(zod.z.null()).or(zod.z.undefined()).optional()));
+        this.mount('identityMasterMatchAll', adapterZod.createValidator(zod.z.boolean().or(zod.z.null()).or(zod.z.undefined()).optional()));
+        this.mount('invert', adapterZod.createValidator(zod.z.boolean().or(zod.z.null()).or(zod.z.undefined()).optional()));
     }
 }
 
@@ -633,23 +573,30 @@ class RealmMatchPolicyEvaluator {
     return TimePolicyInterval;
 }({});
 
+function isIntervalForDayOfWeek(interval) {
+    return interval === TimePolicyInterval.WEEKLY || interval === TimePolicyInterval.MONTHLY || interval === TimePolicyInterval.YEARLY;
+}
+function isIntervalForDayOfMonth(interval) {
+    return interval === TimePolicyInterval.MONTHLY || interval === TimePolicyInterval.YEARLY;
+}
+function isIntervalForDayOfYear(interval) {
+    return interval === TimePolicyInterval.YEARLY;
+}
+
 class TimePolicyValidator extends validup.Container {
-    mountAll() {
-        this.mount('dayOfWeek', adapterZod.createValidator(zod.z.number().min(0).max(6).optional()));
-        this.mount('dayOfMonth', adapterZod.createValidator(zod.z.number().min(1).max(31).optional()));
-        this.mount('dayOfYear', adapterZod.createValidator(zod.z.number().min(1).max(366).optional()));
-        this.mount('start', adapterZod.createValidator(zod.z.date().or(zod.z.string()).or(zod.z.number()).optional()));
-        this.mount('end', adapterZod.createValidator(zod.z.date().or(zod.z.string()).or(zod.z.number()).optional()));
-        this.mount('interval', adapterZod.createValidator(zod.z.nativeEnum(TimePolicyInterval).optional()));
-        this.mount('invert', adapterZod.createValidator(zod.z.boolean().optional()));
-    }
-    constructor(options = {}){
-        super(options);
-        this.mountAll();
+    initialize() {
+        super.initialize();
+        this.mount('dayOfWeek', adapterZod.createValidator(zod.z.number().min(0).max(6).or(zod.z.null()).or(zod.z.undefined()).optional()));
+        this.mount('dayOfMonth', adapterZod.createValidator(zod.z.number().min(1).max(31).or(zod.z.null()).or(zod.z.undefined()).optional()));
+        this.mount('dayOfYear', adapterZod.createValidator(zod.z.number().min(1).max(366).or(zod.z.null()).or(zod.z.undefined()).optional()));
+        this.mount('start', adapterZod.createValidator(zod.z.date().or(zod.z.string().datetime()).or(zod.z.string().time()).or(zod.z.number()).or(zod.z.null()).or(zod.z.undefined()).optional()));
+        this.mount('end', adapterZod.createValidator(zod.z.date().or(zod.z.string().datetime()).or(zod.z.string().time()).or(zod.z.number()).or(zod.z.null()).or(zod.z.undefined()).optional()));
+        this.mount('interval', adapterZod.createValidator(zod.z.nativeEnum(TimePolicyInterval).or(zod.z.null()).or(zod.z.undefined()).optional()));
+        this.mount('invert', adapterZod.createValidator(zod.z.boolean().or(zod.z.undefined()).or(zod.z.null()).optional()));
     }
 }
 
-const timeRegex = /^(?:[01]\d|2[0-3]):[0-5]\d$/;
+const timeRegex = /^(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d)?$/;
 function normalizeDate(input, dateRef) {
     const date = dateRef ? new Date(dateRef) : new Date();
     date.setHours(input.getHours(), input.getMinutes());
@@ -699,23 +646,25 @@ class TimePolicyEvaluator {
                 return maybeInvertPolicyOutcome(false, ctx.spec.invert);
             }
         }
-        if (ctx.spec.dayOfWeek) {
-            if (now.getDay() !== ctx.spec.dayOfWeek) {
-                return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+        if (ctx.spec.interval) {
+            if (isIntervalForDayOfWeek(ctx.spec.interval) && ctx.spec.dayOfWeek) {
+                if (now.getDay() !== ctx.spec.dayOfWeek) {
+                    return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+                }
             }
-        }
-        if (ctx.spec.dayOfMonth) {
-            if (now.getDate() !== ctx.spec.dayOfMonth) {
-                return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+            if (isIntervalForDayOfMonth(ctx.spec.interval) && ctx.spec.dayOfMonth) {
+                if (now.getDate() !== ctx.spec.dayOfMonth) {
+                    return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+                }
             }
-        }
-        if (ctx.spec.dayOfYear) {
-            const start = new Date(now.getFullYear(), 0, 0);
-            const diff = now.getTime() - start.getTime() + (start.getTimezoneOffset() - now.getTimezoneOffset()) * 60 * 1000;
-            const oneDay = 1000 * 60 * 60 * 24;
-            const dayOfYear = Math.floor(diff / oneDay);
-            if (dayOfYear !== ctx.spec.dayOfYear) {
-                return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+            if (isIntervalForDayOfYear(ctx.spec.interval) && ctx.spec.dayOfYear) {
+                const start = new Date(now.getFullYear(), 0, 0);
+                const diff = now.getTime() - start.getTime() + (start.getTimezoneOffset() - now.getTimezoneOffset()) * 60 * 1000;
+                const oneDay = 1000 * 60 * 60 * 24;
+                const dayOfYear = Math.floor(diff / oneDay);
+                if (dayOfYear !== ctx.spec.dayOfYear) {
+                    return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+                }
             }
         }
         return maybeInvertPolicyOutcome(true, ctx.spec.invert);
@@ -725,6 +674,18 @@ class TimePolicyEvaluator {
     }
 }
 
+/*
+ * Copyright (c) 2025.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */ function definePolicyWithType(type, data) {
+    return {
+        ...data,
+        type
+    };
+}
+
 /**
  * The policy engine is a component that interprets defined policies and makes decisions
  * on whether to allow or deny a particular access.
@@ -766,9 +727,80 @@ class TimePolicyEvaluator {
     }
 }
 
+class PermissionError extends errors.AuthupError {
+    static notFound(name) {
+        return new PermissionError({
+            message: `The permission ${name} was not found.`,
+            code: errors.ErrorCode.PERMISSION_NOT_FOUND
+        });
+    }
+    static denied(name) {
+        return new PermissionError({
+            message: `The permission ${name} has not been granted.`,
+            code: errors.ErrorCode.PERMISSION_DENIED
+        });
+    }
+    static deniedAll(names) {
+        return new PermissionError({
+            message: `None of the permissions ${names.join(', ')} has been granted.`,
+            code: errors.ErrorCode.PERMISSION_DENIED
+        });
+    }
+    static evaluationFailed(options) {
+        const error = new PermissionError({
+            message: `The evaluation of permission ${options.name} failed.`,
+            code: errors.ErrorCode.PERMISSION_EVALUATION_FAILED
+        });
+        if (options.policy) {
+            error.policy = options.policy;
+            if (options.policy.type === BuiltInPolicyType.IDENTITY) {
+                error.statusCode = 401;
+            }
+        }
+        if (options.policyError) {
+            error.policyError = options.policyError;
+        }
+        return error;
+    }
+    constructor(options = {}){
+        super({
+            ...options,
+            message: options.message || 'A permission error occurred.',
+            statusCode: options.statusCode || 403
+        });
+    }
+}
+
+/*
+ * Copyright (c) 2025.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */ function buildPermissionItemKey(input) {
+    return `${input.realmId || '_'}/${input.clientId || '_'}/${input.name}`;
+}
+
+/*
+ * Copyright (c) 2024-2024.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */ function isPermissionItemEqual(a, b) {
+    if (a.name !== b.name) {
+        return false;
+    }
+    if (typeof a.realmId === 'string' || typeof b.realmId === 'string') {
+        return a.realmId === b.realmId;
+    }
+    if (typeof a.clientId === 'string' || typeof b.clientId === 'string') {
+        return a.clientId === b.clientId;
+    }
+    return !!a.realmId === !!b.realmId && !!a.clientId === !!b.clientId;
+}
+
 function mergePermissionItems(input) {
     const grouped = input.reduce((previous, current)=>{
-        const key = current.realm_id || `/${current.name}`;
+        const key = buildPermissionItemKey(current);
         if (!previous[key]) {
             previous[key] = [];
         }
@@ -799,11 +831,11 @@ function mergePermissionItems(input) {
 
 class PermissionMemoryProvider {
     async get(options) {
-        return this.items[`${options.realmId || '/'}:${options.name}`];
+        return this.items[buildPermissionItemKey(options)];
     }
     setMany(input) {
         this.items = mergePermissionItems(input).reduce((prev, current)=>{
-            prev[`${current.realm_id || '/'}:${current.name}`] = current;
+            prev[buildPermissionItemKey(current)] = current;
             return prev;
         }, {});
     }
@@ -823,7 +855,10 @@ class PermissionChecker {
         const options = {
             name: input
         };
-        if (typeof this.realmId !== 'undefined') {
+        if (this.clientId) {
+            options.clientId = this.clientId;
+        }
+        if (this.realmId) {
             options.realmId = this.realmId;
         }
         return this.provider.get(options);
@@ -852,7 +887,11 @@ class PermissionChecker {
         for(let i = 0; i < ctx.name.length; i++){
             const entity = await this.get(ctx.name[i]);
             if (!entity) {
-                throw PermissionError.notFound(ctx.name[i]);
+                lastError = PermissionError.notFound(ctx.name[i]);
+                if (decisionStrategy === DecisionStrategy.UNANIMOUS) {
+                    throw lastError;
+                }
+                continue;
             }
             if (!entity.policy) {
                 if (decisionStrategy === DecisionStrategy.AFFIRMATIVE) {
@@ -961,6 +1000,9 @@ class PermissionChecker {
         } else {
             this.provider = new PermissionMemoryProvider();
         }
+        if (options.clientId) {
+            this.clientId = options.clientId;
+        }
         if (options.realmId) {
             this.realmId = options.realmId;
         }
@@ -999,8 +1041,14 @@ exports.RealmMatchPolicyValidator = RealmMatchPolicyValidator;
 exports.TimePolicyEvaluator = TimePolicyEvaluator;
 exports.TimePolicyInterval = TimePolicyInterval;
 exports.TimePolicyValidator = TimePolicyValidator;
+exports.buildPermissionItemKey = buildPermissionItemKey;
+exports.defineAttributesPolicy = defineAttributesPolicy;
+exports.definePolicyWithType = definePolicyWithType;
 exports.evaluatePolicy = evaluatePolicy;
 exports.isCompositePolicy = isCompositePolicy;
+exports.isIntervalForDayOfMonth = isIntervalForDayOfMonth;
+exports.isIntervalForDayOfWeek = isIntervalForDayOfWeek;
+exports.isIntervalForDayOfYear = isIntervalForDayOfYear;
 exports.isPermissionItemEqual = isPermissionItemEqual;
 exports.maybeInvertPolicyOutcome = maybeInvertPolicyOutcome;
 exports.mergePermissionItems = mergePermissionItems;