@authup/access 1.0.0-beta.24 → 1.0.0-beta.26

package/dist/index.mjs

@@ -1,82 +1,11 @@
-import { ErrorCode } from '@authup/errors';
+import { AuthupError, ErrorCode } from '@authup/errors';
 import { isObject, flattenObject, hasOwnProperty } from '@authup/kit';
 import { createValidator } from '@validup/adapter-zod';
 import { Container } from 'validup';
 import { z } from 'zod';
 import { guard } from '@ucast/mongo2js';
 
-class PermissionError extends Error {
-    static notFound(name) {
-        return new PermissionError({
-            message: `The permission ${name} was not found.`,
-            code: ErrorCode.PERMISSION_NOT_FOUND
-        });
-    }
-    static denied(name) {
-        return new PermissionError({
-            message: `The permission ${name} has not been granted.`,
-            code: ErrorCode.PERMISSION_DENIED
-        });
-    }
-    static deniedAll(names) {
-        return new PermissionError({
-            message: `None of the permissions ${names.join(', ')} has been granted.`,
-            code: ErrorCode.PERMISSION_DENIED
-        });
-    }
-    static evaluationFailed(options) {
-        const error = new PermissionError({
-            message: `The evaluation of permission ${options.name} failed.`,
-            code: ErrorCode.PERMISSION_EVALUATION_FAILED
-        });
-        if (options.policy) {
-            error.policy = options.policy;
-        }
-        if (options.policyError) {
-            error.policyError = options.policyError;
-        }
-        return error;
-    }
-    constructor(options = {}){
-        super(options.message || 'A permission error occurred.');
-        this.code = options.code ?? null;
-    }
-}
-
-/*
- * Copyright (c) 2024-2024.
- * Author Peter Placzek (tada5hi)
- * For the full copyright and license information,
- * view the LICENSE file that was distributed with this source code.
- */ function isPermissionItemEqual(a, b) {
-    if (a.name !== b.name) {
-        return false;
-    }
-    if (typeof a.realm_id === 'string' || typeof b.realm_id === 'string') {
-        return a.realm_id === b.realm_id;
-    }
-    return !!a.realm_id === !!b.realm_id;
-}
-
-/*
- * Copyright (c) 2024-2024.
- * Author Peter Placzek (tada5hi)
- * For the full copyright and license information,
- * view the LICENSE file that was distributed with this source code.
- */ var DecisionStrategy = /*#__PURE__*/ function(DecisionStrategy) {
-    /**
-     * One or more positive
-     */ DecisionStrategy["AFFIRMATIVE"] = "affirmative";
-    /**
-     * All positive
-     */ DecisionStrategy["UNANIMOUS"] = "unanimous";
-    /**
-     * More positive than negative
-     */ DecisionStrategy["CONSENSUS"] = "consensus";
-    return DecisionStrategy;
-}({});
-
-class PolicyError extends Error {
+class PolicyError extends AuthupError {
     static evaluatorNotFound(type) {
         return new PolicyError(`No evaluator is registered to handle the policy: ${type}`, ErrorCode.POLICY_EVALUATOR_NOT_FOUND);
     }
@@ -87,8 +16,10 @@ class PolicyError extends Error {
         throw new PolicyError('The evaluator context is not valid.', ErrorCode.POLICY_EVALUATOR_CONTEXT_INVALID);
     }
     constructor(message, code){
-        super(message);
-        this.code = code ?? null;
+        super({
+            message,
+            code
+        });
     }
 }
 
@@ -145,8 +76,9 @@ class PolicyError extends Error {
 
 class AttributeNamesPolicyValidator extends Container {
     initialize() {
+        super.initialize();
         this.mount('names', createValidator(z.array(z.string().min(3).max(128))));
-        this.mount('invert', createValidator(z.boolean().optional()));
+        this.mount('invert', createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
     }
 }
 
@@ -182,14 +114,20 @@ class AttributeNamesPolicyEvaluator {
     }
 }
 
+/*
+ * Copyright (c) 2025.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */ function defineAttributesPolicy(data) {
+    return data;
+}
+
 class AttributesPolicyValidator extends Container {
-    mountAll() {
+    initialize() {
+        super.initialize();
         this.mount('query', createValidator(z.object({}).passthrough()));
-        this.mount('invert', createValidator(z.boolean().optional()));
-    }
-    constructor(options = {}){
-        super(options);
-        this.mountAll();
+        this.mount('invert', createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
     }
 }
 
@@ -236,35 +174,50 @@ class AttributesPolicyEvaluator {
     }
 }
 
+/*
+ * Copyright (c) 2024-2024.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */ var DecisionStrategy = /*#__PURE__*/ function(DecisionStrategy) {
+    /**
+     * One or more positive
+     */ DecisionStrategy["AFFIRMATIVE"] = "affirmative";
+    /**
+     * All positive
+     */ DecisionStrategy["UNANIMOUS"] = "unanimous";
+    /**
+     * More positive than negative
+     */ DecisionStrategy["CONSENSUS"] = "consensus";
+    return DecisionStrategy;
+}({});
+
 class PolicyDataIdentityValidator extends Container {
-    mountAll() {
+    initialize() {
+        super.initialize();
         this.mount('type', createValidator(z.string().min(3).max(128)));
         this.mount('id', createValidator(z.string().uuid()));
-        this.mount('realmId', createValidator(z.string().uuid().optional()));
-        this.mount('realmName', createValidator(z.string().min(3).max(128).optional()));
-    }
-    constructor(options = {}){
-        super(options);
-        this.mountAll();
+        this.mount('clientId', createValidator(z.string().uuid().or(z.null()).or(z.undefined()).optional()));
+        this.mount('realmId', createValidator(z.string().uuid().or(z.null()).or(z.undefined()).optional()));
+        this.mount('realmName', createValidator(z.string().min(3).max(128).or(z.null()).or(z.undefined()).optional()));
     }
 }
 
 class PolicyDataPermissionValidator extends Container {
-    mountAll() {
+    initialize() {
+        super.initialize();
         this.mount('name', createValidator(z.string().min(3).max(256)));
-        this.mount('realm_id', createValidator(z.string().uuid().optional()));
+        this.mount('clientId', createValidator(z.string().uuid().or(z.null()).or(z.undefined()).optional()));
+        this.mount('realmId', createValidator(z.string().uuid().or(z.null()).or(z.undefined()).optional()));
         this.mount('policy', createValidator(z.object({
             type: z.string()
         }).optional()));
     }
-    constructor(options = {}){
-        super(options);
-        this.mountAll();
-    }
 }
 
 class PolicyDataValidator extends Container {
-    mountAll() {
+    initialize() {
+        super.initialize();
         // todo: optionalValue should be null
         const identity = new PolicyDataIdentityValidator();
         this.mount('identity', {
@@ -282,10 +235,6 @@ class PolicyDataValidator extends Container {
         this.mount('attributes', createValidator(z.object({}).optional()));
         this.mount('dateTime', createValidator(z.date().or(z.string()).or(z.number()).optional()));
     }
-    constructor(options = {}){
-        super(options);
-        this.mountAll();
-    }
 }
 
 async function evaluatePolicy(ctx) {
@@ -335,16 +284,13 @@ function isCompositePolicy(input) {
 }
 
 class CompositePolicyValidator extends Container {
-    mountAll() {
-        this.mount('decisionStrategy', createValidator(z.nativeEnum(DecisionStrategy).optional()));
+    initialize() {
+        super.initialize();
+        this.mount('decisionStrategy', createValidator(z.nativeEnum(DecisionStrategy).or(z.null()).or(z.undefined()).optional()));
         this.mount('children', createValidator(z.array(z.object({
             type: z.string().min(3)
         }).passthrough())));
-        this.mount('invert', createValidator(z.boolean().optional()));
-    }
-    constructor(options = {}){
-        super(options);
-        this.mountAll();
+        this.mount('invert', createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
     }
 }
 
@@ -395,14 +341,11 @@ class CompositePolicyEvaluator {
 }
 
 class DatePolicyValidator extends Container {
-    mountAll() {
-        this.mount('start', createValidator(z.date().or(z.string()).or(z.number()).optional()));
-        this.mount('end', createValidator(z.date().or(z.string()).or(z.number()).optional()));
-        this.mount('invert', createValidator(z.boolean().optional()));
-    }
-    constructor(options = {}){
-        super(options);
-        this.mountAll();
+    initialize() {
+        super.initialize();
+        this.mount('start', createValidator(z.date().or(z.string().date()).or(z.number()).or(z.null()).or(z.undefined()).optional()));
+        this.mount('end', createValidator(z.date().or(z.string().date()).or(z.number()).or(z.null()).or(z.undefined()).optional()));
+        this.mount('invert', createValidator(z.boolean().or(z.undefined()).or(z.null()).optional()));
     }
 }
 
@@ -456,8 +399,8 @@ class DatePolicyEvaluator {
 
 class IdentityPolicyValidator extends Container {
     initialize() {
-        this.mount('types', createValidator(z.array(z.string()).optional()));
-        this.mount('invert', createValidator(z.boolean().optional()));
+        this.mount('types', createValidator(z.array(z.string()).or(z.null()).or(z.undefined()).optional()));
+        this.mount('invert', createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
     }
 }
 
@@ -514,17 +457,14 @@ class PermissionBindingPolicyEvaluator {
 }
 
 class RealmMatchPolicyValidator extends Container {
-    mountAll() {
-        this.mount('decisionStrategy', createValidator(z.nativeEnum(DecisionStrategy).optional()));
-        this.mount('attributeName', createValidator(z.string().min(3).or(z.array(z.string().min(3))).optional()));
-        this.mount('attributeNameStrict', createValidator(z.boolean().optional()));
-        this.mount('attributeNullMatchAll', createValidator(z.boolean().optional()));
-        this.mount('identityMasterMatchAll', createValidator(z.boolean().optional()));
-        this.mount('invert', createValidator(z.boolean().optional()));
-    }
-    constructor(options = {}){
-        super(options);
-        this.mountAll();
+    initialize() {
+        super.initialize();
+        this.mount('decisionStrategy', createValidator(z.nativeEnum(DecisionStrategy).or(z.null()).or(z.undefined()).optional()));
+        this.mount('attributeName', createValidator(z.string().min(3).or(z.array(z.string().min(3))).or(z.null()).or(z.undefined()).optional()));
+        this.mount('attributeNameStrict', createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
+        this.mount('attributeNullMatchAll', createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
+        this.mount('identityMasterMatchAll', createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
+        this.mount('invert', createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
     }
 }
 
@@ -631,23 +571,30 @@ class RealmMatchPolicyEvaluator {
     return TimePolicyInterval;
 }({});
 
+function isIntervalForDayOfWeek(interval) {
+    return interval === TimePolicyInterval.WEEKLY || interval === TimePolicyInterval.MONTHLY || interval === TimePolicyInterval.YEARLY;
+}
+function isIntervalForDayOfMonth(interval) {
+    return interval === TimePolicyInterval.MONTHLY || interval === TimePolicyInterval.YEARLY;
+}
+function isIntervalForDayOfYear(interval) {
+    return interval === TimePolicyInterval.YEARLY;
+}
+
 class TimePolicyValidator extends Container {
-    mountAll() {
-        this.mount('dayOfWeek', createValidator(z.number().min(0).max(6).optional()));
-        this.mount('dayOfMonth', createValidator(z.number().min(1).max(31).optional()));
-        this.mount('dayOfYear', createValidator(z.number().min(1).max(366).optional()));
-        this.mount('start', createValidator(z.date().or(z.string()).or(z.number()).optional()));
-        this.mount('end', createValidator(z.date().or(z.string()).or(z.number()).optional()));
-        this.mount('interval', createValidator(z.nativeEnum(TimePolicyInterval).optional()));
-        this.mount('invert', createValidator(z.boolean().optional()));
-    }
-    constructor(options = {}){
-        super(options);
-        this.mountAll();
+    initialize() {
+        super.initialize();
+        this.mount('dayOfWeek', createValidator(z.number().min(0).max(6).or(z.null()).or(z.undefined()).optional()));
+        this.mount('dayOfMonth', createValidator(z.number().min(1).max(31).or(z.null()).or(z.undefined()).optional()));
+        this.mount('dayOfYear', createValidator(z.number().min(1).max(366).or(z.null()).or(z.undefined()).optional()));
+        this.mount('start', createValidator(z.date().or(z.string().datetime()).or(z.string().time()).or(z.number()).or(z.null()).or(z.undefined()).optional()));
+        this.mount('end', createValidator(z.date().or(z.string().datetime()).or(z.string().time()).or(z.number()).or(z.null()).or(z.undefined()).optional()));
+        this.mount('interval', createValidator(z.nativeEnum(TimePolicyInterval).or(z.null()).or(z.undefined()).optional()));
+        this.mount('invert', createValidator(z.boolean().or(z.undefined()).or(z.null()).optional()));
     }
 }
 
-const timeRegex = /^(?:[01]\d|2[0-3]):[0-5]\d$/;
+const timeRegex = /^(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d)?$/;
 function normalizeDate(input, dateRef) {
     const date = dateRef ? new Date(dateRef) : new Date();
     date.setHours(input.getHours(), input.getMinutes());
@@ -697,23 +644,25 @@ class TimePolicyEvaluator {
                 return maybeInvertPolicyOutcome(false, ctx.spec.invert);
             }
         }
-        if (ctx.spec.dayOfWeek) {
-            if (now.getDay() !== ctx.spec.dayOfWeek) {
-                return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+        if (ctx.spec.interval) {
+            if (isIntervalForDayOfWeek(ctx.spec.interval) && ctx.spec.dayOfWeek) {
+                if (now.getDay() !== ctx.spec.dayOfWeek) {
+                    return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+                }
             }
-        }
-        if (ctx.spec.dayOfMonth) {
-            if (now.getDate() !== ctx.spec.dayOfMonth) {
-                return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+            if (isIntervalForDayOfMonth(ctx.spec.interval) && ctx.spec.dayOfMonth) {
+                if (now.getDate() !== ctx.spec.dayOfMonth) {
+                    return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+                }
             }
-        }
-        if (ctx.spec.dayOfYear) {
-            const start = new Date(now.getFullYear(), 0, 0);
-            const diff = now.getTime() - start.getTime() + (start.getTimezoneOffset() - now.getTimezoneOffset()) * 60 * 1000;
-            const oneDay = 1000 * 60 * 60 * 24;
-            const dayOfYear = Math.floor(diff / oneDay);
-            if (dayOfYear !== ctx.spec.dayOfYear) {
-                return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+            if (isIntervalForDayOfYear(ctx.spec.interval) && ctx.spec.dayOfYear) {
+                const start = new Date(now.getFullYear(), 0, 0);
+                const diff = now.getTime() - start.getTime() + (start.getTimezoneOffset() - now.getTimezoneOffset()) * 60 * 1000;
+                const oneDay = 1000 * 60 * 60 * 24;
+                const dayOfYear = Math.floor(diff / oneDay);
+                if (dayOfYear !== ctx.spec.dayOfYear) {
+                    return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+                }
             }
         }
         return maybeInvertPolicyOutcome(true, ctx.spec.invert);
@@ -723,6 +672,18 @@ class TimePolicyEvaluator {
     }
 }
 
+/*
+ * Copyright (c) 2025.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */ function definePolicyWithType(type, data) {
+    return {
+        ...data,
+        type
+    };
+}
+
 /**
  * The policy engine is a component that interprets defined policies and makes decisions
  * on whether to allow or deny a particular access.
@@ -764,9 +725,80 @@ class TimePolicyEvaluator {
     }
 }
 
+class PermissionError extends AuthupError {
+    static notFound(name) {
+        return new PermissionError({
+            message: `The permission ${name} was not found.`,
+            code: ErrorCode.PERMISSION_NOT_FOUND
+        });
+    }
+    static denied(name) {
+        return new PermissionError({
+            message: `The permission ${name} has not been granted.`,
+            code: ErrorCode.PERMISSION_DENIED
+        });
+    }
+    static deniedAll(names) {
+        return new PermissionError({
+            message: `None of the permissions ${names.join(', ')} has been granted.`,
+            code: ErrorCode.PERMISSION_DENIED
+        });
+    }
+    static evaluationFailed(options) {
+        const error = new PermissionError({
+            message: `The evaluation of permission ${options.name} failed.`,
+            code: ErrorCode.PERMISSION_EVALUATION_FAILED
+        });
+        if (options.policy) {
+            error.policy = options.policy;
+            if (options.policy.type === BuiltInPolicyType.IDENTITY) {
+                error.statusCode = 401;
+            }
+        }
+        if (options.policyError) {
+            error.policyError = options.policyError;
+        }
+        return error;
+    }
+    constructor(options = {}){
+        super({
+            ...options,
+            message: options.message || 'A permission error occurred.',
+            statusCode: options.statusCode || 403
+        });
+    }
+}
+
+/*
+ * Copyright (c) 2025.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */ function buildPermissionItemKey(input) {
+    return `${input.realmId || '_'}/${input.clientId || '_'}/${input.name}`;
+}
+
+/*
+ * Copyright (c) 2024-2024.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */ function isPermissionItemEqual(a, b) {
+    if (a.name !== b.name) {
+        return false;
+    }
+    if (typeof a.realmId === 'string' || typeof b.realmId === 'string') {
+        return a.realmId === b.realmId;
+    }
+    if (typeof a.clientId === 'string' || typeof b.clientId === 'string') {
+        return a.clientId === b.clientId;
+    }
+    return !!a.realmId === !!b.realmId && !!a.clientId === !!b.clientId;
+}
+
 function mergePermissionItems(input) {
     const grouped = input.reduce((previous, current)=>{
-        const key = current.realm_id || `/${current.name}`;
+        const key = buildPermissionItemKey(current);
         if (!previous[key]) {
             previous[key] = [];
         }
@@ -797,11 +829,11 @@ function mergePermissionItems(input) {
 
 class PermissionMemoryProvider {
     async get(options) {
-        return this.items[`${options.realmId || '/'}:${options.name}`];
+        return this.items[buildPermissionItemKey(options)];
     }
     setMany(input) {
         this.items = mergePermissionItems(input).reduce((prev, current)=>{
-            prev[`${current.realm_id || '/'}:${current.name}`] = current;
+            prev[buildPermissionItemKey(current)] = current;
             return prev;
         }, {});
     }
@@ -821,7 +853,10 @@ class PermissionChecker {
         const options = {
             name: input
         };
-        if (typeof this.realmId !== 'undefined') {
+        if (this.clientId) {
+            options.clientId = this.clientId;
+        }
+        if (this.realmId) {
             options.realmId = this.realmId;
         }
         return this.provider.get(options);
@@ -850,7 +885,11 @@ class PermissionChecker {
         for(let i = 0; i < ctx.name.length; i++){
             const entity = await this.get(ctx.name[i]);
             if (!entity) {
-                throw PermissionError.notFound(ctx.name[i]);
+                lastError = PermissionError.notFound(ctx.name[i]);
+                if (decisionStrategy === DecisionStrategy.UNANIMOUS) {
+                    throw lastError;
+                }
+                continue;
             }
             if (!entity.policy) {
                 if (decisionStrategy === DecisionStrategy.AFFIRMATIVE) {
@@ -959,6 +998,9 @@ class PermissionChecker {
         } else {
             this.provider = new PermissionMemoryProvider();
         }
+        if (options.clientId) {
+            this.clientId = options.clientId;
+        }
         if (options.realmId) {
             this.realmId = options.realmId;
         }
@@ -970,5 +1012,5 @@ class PermissionChecker {
     }
 }
 
-export { AttributeNamesPolicyEvaluator, AttributeNamesPolicyValidator, AttributesPolicyEvaluator, AttributesPolicyValidator, BuiltInPolicyType, CompositePolicyEvaluator, CompositePolicyValidator, DatePolicyEvaluator, DatePolicyValidator, DecisionStrategy, IdentityPolicyEvaluator, IdentityPolicyValidator, PermissionBindingPolicyEvaluator, PermissionBindingPolicyValidator, PermissionChecker, PermissionError, PermissionMemoryProvider, PolicyDataIdentityValidator, PolicyDataPermissionValidator, PolicyDataValidator, PolicyEngine, PolicyError, RealmMatchPolicyEvaluator, RealmMatchPolicyValidator, TimePolicyEvaluator, TimePolicyInterval, TimePolicyValidator, evaluatePolicy, isCompositePolicy, isPermissionItemEqual, maybeInvertPolicyOutcome, mergePermissionItems };
+export { AttributeNamesPolicyEvaluator, AttributeNamesPolicyValidator, AttributesPolicyEvaluator, AttributesPolicyValidator, BuiltInPolicyType, CompositePolicyEvaluator, CompositePolicyValidator, DatePolicyEvaluator, DatePolicyValidator, DecisionStrategy, IdentityPolicyEvaluator, IdentityPolicyValidator, PermissionBindingPolicyEvaluator, PermissionBindingPolicyValidator, PermissionChecker, PermissionError, PermissionMemoryProvider, PolicyDataIdentityValidator, PolicyDataPermissionValidator, PolicyDataValidator, PolicyEngine, PolicyError, RealmMatchPolicyEvaluator, RealmMatchPolicyValidator, TimePolicyEvaluator, TimePolicyInterval, TimePolicyValidator, buildPermissionItemKey, defineAttributesPolicy, definePolicyWithType, evaluatePolicy, isCompositePolicy, isIntervalForDayOfMonth, isIntervalForDayOfWeek, isIntervalForDayOfYear, isPermissionItemEqual, maybeInvertPolicyOutcome, mergePermissionItems };
 //# sourceMappingURL=index.mjs.map