@authup/access 1.0.0-beta.24

package/dist/index.mjs

@@ -0,0 +1,974 @@
+import { ErrorCode } from '@authup/errors';
+import { isObject, flattenObject, hasOwnProperty } from '@authup/kit';
+import { createValidator } from '@validup/adapter-zod';
+import { Container } from 'validup';
+import { z } from 'zod';
+import { guard } from '@ucast/mongo2js';
+
+class PermissionError extends Error {
+    static notFound(name) {
+        return new PermissionError({
+            message: `The permission ${name} was not found.`,
+            code: ErrorCode.PERMISSION_NOT_FOUND
+        });
+    }
+    static denied(name) {
+        return new PermissionError({
+            message: `The permission ${name} has not been granted.`,
+            code: ErrorCode.PERMISSION_DENIED
+        });
+    }
+    static deniedAll(names) {
+        return new PermissionError({
+            message: `None of the permissions ${names.join(', ')} has been granted.`,
+            code: ErrorCode.PERMISSION_DENIED
+        });
+    }
+    static evaluationFailed(options) {
+        const error = new PermissionError({
+            message: `The evaluation of permission ${options.name} failed.`,
+            code: ErrorCode.PERMISSION_EVALUATION_FAILED
+        });
+        if (options.policy) {
+            error.policy = options.policy;
+        }
+        if (options.policyError) {
+            error.policyError = options.policyError;
+        }
+        return error;
+    }
+    constructor(options = {}){
+        super(options.message || 'A permission error occurred.');
+        this.code = options.code ?? null;
+    }
+}
+
+/*
+ * Copyright (c) 2024-2024.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */ function isPermissionItemEqual(a, b) {
+    if (a.name !== b.name) {
+        return false;
+    }
+    if (typeof a.realm_id === 'string' || typeof b.realm_id === 'string') {
+        return a.realm_id === b.realm_id;
+    }
+    return !!a.realm_id === !!b.realm_id;
+}
+
+/*
+ * Copyright (c) 2024-2024.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */ var DecisionStrategy = /*#__PURE__*/ function(DecisionStrategy) {
+    /**
+     * One or more positive
+     */ DecisionStrategy["AFFIRMATIVE"] = "affirmative";
+    /**
+     * All positive
+     */ DecisionStrategy["UNANIMOUS"] = "unanimous";
+    /**
+     * More positive than negative
+     */ DecisionStrategy["CONSENSUS"] = "consensus";
+    return DecisionStrategy;
+}({});
+
+class PolicyError extends Error {
+    static evaluatorNotFound(type) {
+        return new PolicyError(`No evaluator is registered to handle the policy: ${type}`, ErrorCode.POLICY_EVALUATOR_NOT_FOUND);
+    }
+    static evaluatorNotProcessable() {
+        throw new PolicyError('The evaluator can not process the policy.', ErrorCode.POLICY_EVALUATOR_NOT_PROCESSABLE);
+    }
+    static evaluatorContextInvalid() {
+        throw new PolicyError('The evaluator context is not valid.', ErrorCode.POLICY_EVALUATOR_CONTEXT_INVALID);
+    }
+    constructor(message, code){
+        super(message);
+        this.code = code ?? null;
+    }
+}
+
+/*
+ * Copyright (c) 2024-2024.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */ function maybeInvertPolicyOutcome(outcome, invert) {
+    if (typeof invert === 'undefined') {
+        return outcome;
+    }
+    if (typeof invert === 'function') {
+        return invert(outcome);
+    }
+    if (!invert) {
+        return outcome;
+    }
+    return !outcome;
+}
+
+/*
+ * Copyright (c) 2024-2024.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */ var BuiltInPolicyType = /*#__PURE__*/ function(BuiltInPolicyType) {
+    /**
+     * Bundles different policies.
+     */ BuiltInPolicyType["COMPOSITE"] = "composite";
+    /**
+     * Date Based Access Control (DBAC)
+     */ BuiltInPolicyType["DATE"] = "date";
+    /**
+     * Time Based Access Control (TBAC)
+     */ BuiltInPolicyType["TIME"] = "time";
+    /**
+     * Attribute Name Based Access Control (ANBAC)
+     */ BuiltInPolicyType["ATTRIBUTE_NAMES"] = "attributeNames";
+    /**
+     * Attribute Based Access Control (ABAC)
+     */ BuiltInPolicyType["ATTRIBUTES"] = "attributes";
+    /**
+     * Realm of Identity is for attribute realm.
+     */ BuiltInPolicyType["REALM_MATCH"] = "realmMatch";
+    /**
+     * Restriction based on identity (type, id, ...)
+     */ BuiltInPolicyType["IDENTITY"] = "identity";
+    /**
+     * Restriction based on a binding between identity <-> permission
+     */ BuiltInPolicyType["PERMISSION_BINDING"] = "permissionBinding";
+    return BuiltInPolicyType;
+}({});
+
+class AttributeNamesPolicyValidator extends Container {
+    initialize() {
+        this.mount('names', createValidator(z.array(z.string().min(3).max(128))));
+        this.mount('invert', createValidator(z.boolean().optional()));
+    }
+}
+
+class AttributeNamesPolicyEvaluator {
+    async can(ctx) {
+        return ctx.spec.type === BuiltInPolicyType.ATTRIBUTE_NAMES;
+    }
+    async validateSpecification(ctx) {
+        return this.validator.run(ctx.spec);
+    }
+    async validateData(ctx) {
+        if (!isObject(ctx.data.attributes)) {
+            throw PolicyError.evaluatorContextInvalid();
+        }
+        return ctx.data;
+    }
+    async evaluate(ctx) {
+        if (!ctx.data.attributes) {
+            throw PolicyError.evaluatorContextInvalid();
+        }
+        const attributes = flattenObject(ctx.data.attributes);
+        const keys = Object.keys(attributes);
+        for(let i = 0; i < keys.length; i++){
+            const index = ctx.spec.names.indexOf(keys[i]);
+            if (index === -1) {
+                return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+            }
+        }
+        return maybeInvertPolicyOutcome(true, ctx.spec.invert);
+    }
+    constructor(){
+        this.validator = new AttributeNamesPolicyValidator();
+    }
+}
+
+class AttributesPolicyValidator extends Container {
+    mountAll() {
+        this.mount('query', createValidator(z.object({}).passthrough()));
+        this.mount('invert', createValidator(z.boolean().optional()));
+    }
+    constructor(options = {}){
+        super(options);
+        this.mountAll();
+    }
+}
+
+class AttributesPolicyEvaluator {
+    async can(ctx) {
+        return ctx.spec.type === BuiltInPolicyType.ATTRIBUTES;
+    }
+    async validateSpecification(ctx) {
+        return this.validator.run(ctx.spec);
+    }
+    async validateData(ctx) {
+        if (!isObject(ctx.data.attributes)) {
+            throw PolicyError.evaluatorContextInvalid();
+        }
+        return ctx.data;
+    }
+    async evaluate(ctx) {
+        if (!ctx.data.attributes) {
+            throw PolicyError.evaluatorContextInvalid();
+        }
+        this.fixQuery(ctx.spec.query);
+        const testIt = guard(ctx.spec.query);
+        return maybeInvertPolicyOutcome(testIt(ctx.data.attributes), ctx.spec.invert);
+    }
+    fixQuery(query) {
+        const keys = Object.keys(query);
+        for(let i = 0; i < keys.length; i++){
+            const key = keys[i];
+            const value = query[key];
+            if (isObject(value) || Array.isArray(value)) {
+                this.fixQuery(value);
+                continue;
+            }
+            if (key === '$regex' && typeof value === 'string') {
+                const fragments = value.match(/\/(.*?)\/([a-z]*)?$/i);
+                if (fragments) {
+                    query[key] = new RegExp(fragments[1], fragments[2]);
+                }
+            }
+        }
+    }
+    constructor(){
+        this.validator = new AttributesPolicyValidator();
+    }
+}
+
+class PolicyDataIdentityValidator extends Container {
+    mountAll() {
+        this.mount('type', createValidator(z.string().min(3).max(128)));
+        this.mount('id', createValidator(z.string().uuid()));
+        this.mount('realmId', createValidator(z.string().uuid().optional()));
+        this.mount('realmName', createValidator(z.string().min(3).max(128).optional()));
+    }
+    constructor(options = {}){
+        super(options);
+        this.mountAll();
+    }
+}
+
+class PolicyDataPermissionValidator extends Container {
+    mountAll() {
+        this.mount('name', createValidator(z.string().min(3).max(256)));
+        this.mount('realm_id', createValidator(z.string().uuid().optional()));
+        this.mount('policy', createValidator(z.object({
+            type: z.string()
+        }).optional()));
+    }
+    constructor(options = {}){
+        super(options);
+        this.mountAll();
+    }
+}
+
+class PolicyDataValidator extends Container {
+    mountAll() {
+        // todo: optionalValue should be null
+        const identity = new PolicyDataIdentityValidator();
+        this.mount('identity', {
+            optional: true,
+            optionalValue: 'undefined',
+            optionalInclude: true
+        }, identity);
+        // todo: optionalValue should be null
+        const permission = new PolicyDataPermissionValidator();
+        this.mount('permission', {
+            optional: true,
+            optionalValue: 'undefined',
+            optionalInclude: true
+        }, permission);
+        this.mount('attributes', createValidator(z.object({}).optional()));
+        this.mount('dateTime', createValidator(z.date().or(z.string()).or(z.number()).optional()));
+    }
+    constructor(options = {}){
+        super(options);
+        this.mountAll();
+    }
+}
+
+async function evaluatePolicy(ctx) {
+    if (ctx.options.exclude && ctx.options.exclude.length > 0 && ctx.options.exclude.indexOf(ctx.spec.type) !== -1) {
+        if (typeof ctx.spec.invert === 'boolean') {
+            return maybeInvertPolicyOutcome(true, ctx.spec.invert);
+        }
+        return true;
+    }
+    if (ctx.options.include && ctx.options.include.length > 0 && ctx.options.include.indexOf(ctx.spec.type) === -1) {
+        if (typeof ctx.spec.invert === 'boolean') {
+            return maybeInvertPolicyOutcome(true, ctx.spec.invert);
+        }
+        return true;
+    }
+    const evaluator = ctx.evaluators[ctx.spec.type];
+    if (!evaluator) {
+        throw PolicyError.evaluatorNotFound(ctx.spec.type);
+    }
+    try {
+        const canEvaluate = await evaluator.can(ctx);
+        if (canEvaluate) {
+            const spec = await evaluator.validateSpecification(ctx);
+            const data = await evaluator.validateData(ctx);
+            return await evaluator.evaluate({
+                ...ctx,
+                data,
+                spec
+            });
+        }
+    } catch (e) {
+        if (e instanceof PolicyError) {
+            throw e;
+        }
+        if (e instanceof Error) {
+            const error = new PolicyError(e.message);
+            error.stack = e.stack;
+            throw error;
+        }
+        throw new PolicyError();
+    }
+    throw PolicyError.evaluatorNotProcessable();
+}
+
+function isCompositePolicy(input) {
+    return input.type === BuiltInPolicyType.COMPOSITE;
+}
+
+class CompositePolicyValidator extends Container {
+    mountAll() {
+        this.mount('decisionStrategy', createValidator(z.nativeEnum(DecisionStrategy).optional()));
+        this.mount('children', createValidator(z.array(z.object({
+            type: z.string().min(3)
+        }).passthrough())));
+        this.mount('invert', createValidator(z.boolean().optional()));
+    }
+    constructor(options = {}){
+        super(options);
+        this.mountAll();
+    }
+}
+
+class CompositePolicyEvaluator {
+    async can(ctx) {
+        return isCompositePolicy(ctx.spec);
+    }
+    async validateSpecification(ctx) {
+        return this.validator.run(ctx.spec);
+    }
+    async validateData(ctx) {
+        return ctx.data;
+    }
+    async evaluate(ctx) {
+        let count = 0;
+        const decisionStrategy = ctx.spec.decisionStrategy ?? DecisionStrategy.UNANIMOUS;
+        for(let i = 0; i < ctx.spec.children.length; i++){
+            const childPolicy = ctx.spec.children[i];
+            let outcome;
+            if (isCompositePolicy(childPolicy)) {
+                outcome = await this.evaluate({
+                    ...ctx,
+                    spec: childPolicy
+                });
+            } else {
+                outcome = await evaluatePolicy({
+                    ...ctx,
+                    spec: childPolicy
+                });
+            }
+            if (outcome) {
+                if (decisionStrategy === DecisionStrategy.AFFIRMATIVE) {
+                    return maybeInvertPolicyOutcome(true, ctx.spec.invert);
+                }
+                count++;
+            } else {
+                if (decisionStrategy === DecisionStrategy.UNANIMOUS) {
+                    return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+                }
+                count--;
+            }
+        }
+        return maybeInvertPolicyOutcome(count > 0, ctx.spec.invert);
+    }
+    constructor(){
+        this.validator = new CompositePolicyValidator();
+    }
+}
+
+class DatePolicyValidator extends Container {
+    mountAll() {
+        this.mount('start', createValidator(z.date().or(z.string()).or(z.number()).optional()));
+        this.mount('end', createValidator(z.date().or(z.string()).or(z.number()).optional()));
+        this.mount('invert', createValidator(z.boolean().optional()));
+    }
+    constructor(options = {}){
+        super(options);
+        this.mountAll();
+    }
+}
+
+function normalizeDate$1(input) {
+    return new Date(input.getFullYear(), input.getMonth(), input.getDate());
+}
+function toDate$1(input) {
+    if (typeof input === 'string') {
+        return new Date(input);
+    }
+    if (typeof input === 'number') {
+        return new Date(input);
+    }
+    return input;
+}
+class DatePolicyEvaluator {
+    async can(ctx) {
+        return ctx.spec.type === BuiltInPolicyType.DATE;
+    }
+    async validateSpecification(ctx) {
+        return this.validator.run(ctx.spec);
+    }
+    async validateData(ctx) {
+        return ctx.data;
+    }
+    async evaluate(ctx) {
+        let now;
+        if (ctx.data.dateTime) {
+            now = normalizeDate$1(toDate$1(ctx.data.dateTime));
+        } else {
+            now = normalizeDate$1(new Date());
+        }
+        if (ctx.spec.start) {
+            const start = normalizeDate$1(toDate$1(ctx.spec.start));
+            if (now < start) {
+                return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+            }
+        }
+        if (ctx.spec.end) {
+            const end = normalizeDate$1(toDate$1(ctx.spec.end));
+            if (now > end) {
+                return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+            }
+        }
+        return maybeInvertPolicyOutcome(true, ctx.spec.invert);
+    }
+    constructor(){
+        this.validator = new DatePolicyValidator();
+    }
+}
+
+class IdentityPolicyValidator extends Container {
+    initialize() {
+        this.mount('types', createValidator(z.array(z.string()).optional()));
+        this.mount('invert', createValidator(z.boolean().optional()));
+    }
+}
+
+class IdentityPolicyEvaluator {
+    async can(ctx) {
+        return ctx.spec.type === BuiltInPolicyType.IDENTITY;
+    }
+    async validateSpecification(ctx) {
+        return this.validator.run(ctx.spec);
+    }
+    async validateData(ctx) {
+        return ctx.data;
+    }
+    async evaluate(ctx) {
+        if (!isObject(ctx.data.identity)) {
+            return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+        }
+        const types = ctx.spec.types || [];
+        if (types.length === 0) {
+            return maybeInvertPolicyOutcome(true, ctx.spec.invert);
+        }
+        const typeAllowed = types.indexOf(ctx.data.identity.type) !== -1;
+        return maybeInvertPolicyOutcome(typeAllowed, ctx.spec.invert);
+    }
+    constructor(){
+        this.validator = new IdentityPolicyValidator();
+    }
+}
+
+class PermissionBindingPolicyValidator extends Container {
+    initialize() {}
+}
+
+class PermissionBindingPolicyEvaluator {
+    async can(ctx) {
+        return ctx.spec.type === BuiltInPolicyType.PERMISSION_BINDING;
+    }
+    async validateSpecification(ctx) {
+        return this.validator.run(ctx.spec);
+    }
+    async validateData(ctx) {
+        if (!isObject(ctx.data.identity) && !isObject(ctx.data.permission)) {
+            throw PolicyError.evaluatorContextInvalid();
+        }
+        return ctx.data;
+    }
+    async evaluate(ctx) {
+        // todo: this must be changed when the permission-checker not only checks owned permissions.
+        return maybeInvertPolicyOutcome(true, ctx.spec.invert);
+    }
+    constructor(){
+        this.validator = new PermissionBindingPolicyValidator();
+    }
+}
+
+class RealmMatchPolicyValidator extends Container {
+    mountAll() {
+        this.mount('decisionStrategy', createValidator(z.nativeEnum(DecisionStrategy).optional()));
+        this.mount('attributeName', createValidator(z.string().min(3).or(z.array(z.string().min(3))).optional()));
+        this.mount('attributeNameStrict', createValidator(z.boolean().optional()));
+        this.mount('attributeNullMatchAll', createValidator(z.boolean().optional()));
+        this.mount('identityMasterMatchAll', createValidator(z.boolean().optional()));
+        this.mount('invert', createValidator(z.boolean().optional()));
+    }
+    constructor(options = {}){
+        super(options);
+        this.mountAll();
+    }
+}
+
+class RealmMatchPolicyEvaluator {
+    async can(ctx) {
+        return ctx.spec.type === BuiltInPolicyType.REALM_MATCH;
+    }
+    async validateSpecification(ctx) {
+        return this.validator.run(ctx.spec);
+    }
+    async validateData(ctx) {
+        if (!isObject(ctx.data.attributes) || !isObject(ctx.data.identity)) {
+            throw PolicyError.evaluatorContextInvalid();
+        }
+        return ctx.data;
+    }
+    async evaluate(ctx) {
+        if (!ctx.data.attributes || !ctx.data.identity) {
+            throw PolicyError.evaluatorContextInvalid();
+        }
+        const identityMasterMatchAll = ctx.spec.identityMasterMatchAll ?? true;
+        if (identityMasterMatchAll && ctx.data.identity.realmName && ctx.data.identity.realmName === 'master') {
+            return maybeInvertPolicyOutcome(true, ctx.spec.invert);
+        }
+        let keys;
+        if (ctx.spec.attributeName) {
+            if (Array.isArray(ctx.spec.attributeName)) {
+                keys = ctx.spec.attributeName;
+            } else {
+                keys = [
+                    ctx.spec.attributeName
+                ];
+            }
+        } else {
+            keys = [
+                'realm_id',
+                'realm_name',
+                'realmId',
+                'realmName'
+            ];
+            ctx.spec.decisionStrategy = DecisionStrategy.CONSENSUS;
+        }
+        const attributeNameStrict = ctx.spec.attributeNameStrict ?? true;
+        if (!attributeNameStrict) {
+            const resourceKeys = Object.keys(ctx.data.attributes);
+            const keysToAdd = [];
+            for(let i = 0; i < resourceKeys.length; i++){
+                let contains = false;
+                for(let j = 0; j < keys.length; j++){
+                    if (resourceKeys[i] !== keys[j] && resourceKeys[i].includes(keys[j])) {
+                        contains = true;
+                        break;
+                    }
+                }
+                if (contains) {
+                    keysToAdd.push(resourceKeys[i]);
+                }
+            }
+            if (keysToAdd.length > 0) {
+                keys.push(...keysToAdd);
+            }
+        }
+        let count = 0;
+        for(let i = 0; i < keys.length; i++){
+            if (!hasOwnProperty(ctx.data.attributes, keys[i])) {
+                continue;
+            }
+            let outcome = false;
+            const attributeValue = ctx.data.attributes[keys[i]];
+            if (attributeValue === null && ctx.spec.attributeNullMatchAll) {
+                outcome = true;
+            } else if (attributeValue === ctx.data.identity.realmId || attributeValue === ctx.data.identity.realmName) {
+                outcome = true;
+            }
+            if (outcome) {
+                if (ctx.spec.decisionStrategy === DecisionStrategy.AFFIRMATIVE) {
+                    return maybeInvertPolicyOutcome(true, ctx.spec.invert);
+                }
+                count++;
+            } else {
+                if (ctx.spec.decisionStrategy === DecisionStrategy.UNANIMOUS) {
+                    return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+                }
+                count--;
+            }
+        }
+        return maybeInvertPolicyOutcome(count > 0, ctx.spec.invert);
+    }
+    constructor(){
+        this.validator = new RealmMatchPolicyValidator();
+    }
+}
+
+/*
+ * Copyright (c) 2024-2024.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */ var TimePolicyInterval = /*#__PURE__*/ function(TimePolicyInterval) {
+    TimePolicyInterval["DAILY"] = "daily";
+    TimePolicyInterval["WEEKLY"] = "weekly";
+    TimePolicyInterval["MONTHLY"] = "monthly";
+    TimePolicyInterval["YEARLY"] = "yearly";
+    return TimePolicyInterval;
+}({});
+
+class TimePolicyValidator extends Container {
+    mountAll() {
+        this.mount('dayOfWeek', createValidator(z.number().min(0).max(6).optional()));
+        this.mount('dayOfMonth', createValidator(z.number().min(1).max(31).optional()));
+        this.mount('dayOfYear', createValidator(z.number().min(1).max(366).optional()));
+        this.mount('start', createValidator(z.date().or(z.string()).or(z.number()).optional()));
+        this.mount('end', createValidator(z.date().or(z.string()).or(z.number()).optional()));
+        this.mount('interval', createValidator(z.nativeEnum(TimePolicyInterval).optional()));
+        this.mount('invert', createValidator(z.boolean().optional()));
+    }
+    constructor(options = {}){
+        super(options);
+        this.mountAll();
+    }
+}
+
+const timeRegex = /^(?:[01]\d|2[0-3]):[0-5]\d$/;
+function normalizeDate(input, dateRef) {
+    const date = dateRef ? new Date(dateRef) : new Date();
+    date.setHours(input.getHours(), input.getMinutes());
+    return date;
+}
+function toDate(input, dateRef) {
+    if (typeof input === 'string') {
+        if (timeRegex.test(input)) {
+            const [startHours, startMinutes] = input.split(':').map(Number);
+            const date = dateRef ? new Date(dateRef) : new Date();
+            date.setHours(startHours, startMinutes);
+            return date;
+        }
+        return new Date(input);
+    }
+    if (typeof input === 'number') {
+        return new Date(input);
+    }
+    return input;
+}
+class TimePolicyEvaluator {
+    async can(ctx) {
+        return ctx.spec.type === BuiltInPolicyType.TIME;
+    }
+    async validateSpecification(ctx) {
+        return this.validator.run(ctx.spec);
+    }
+    async validateData(ctx) {
+        return ctx.data;
+    }
+    async evaluate(ctx) {
+        let now;
+        if (ctx.data.dateTime) {
+            now = toDate(ctx.data.dateTime);
+        } else {
+            now = new Date();
+        }
+        if (ctx.spec.start) {
+            const start = normalizeDate(toDate(ctx.spec.start, now), now);
+            if (now < start) {
+                return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+            }
+        }
+        if (ctx.spec.end) {
+            const end = normalizeDate(toDate(ctx.spec.end, now), now);
+            if (now > end) {
+                return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+            }
+        }
+        if (ctx.spec.dayOfWeek) {
+            if (now.getDay() !== ctx.spec.dayOfWeek) {
+                return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+            }
+        }
+        if (ctx.spec.dayOfMonth) {
+            if (now.getDate() !== ctx.spec.dayOfMonth) {
+                return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+            }
+        }
+        if (ctx.spec.dayOfYear) {
+            const start = new Date(now.getFullYear(), 0, 0);
+            const diff = now.getTime() - start.getTime() + (start.getTimezoneOffset() - now.getTimezoneOffset()) * 60 * 1000;
+            const oneDay = 1000 * 60 * 60 * 24;
+            const dayOfYear = Math.floor(diff / oneDay);
+            if (dayOfYear !== ctx.spec.dayOfYear) {
+                return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+            }
+        }
+        return maybeInvertPolicyOutcome(true, ctx.spec.invert);
+    }
+    constructor(){
+        this.validator = new TimePolicyValidator();
+    }
+}
+
+/**
+ * The policy engine is a component that interprets defined policies and makes decisions
+ * on whether to allow or deny a particular access.
+ */ class PolicyEngine {
+    registerEvaluator(type, evaluator) {
+        this.evaluators[type] = evaluator;
+    }
+    registerEvaluators(evaluators) {
+        const keys = Object.keys(evaluators);
+        for(let i = 0; i < keys.length; i++){
+            this.registerEvaluator(keys[i], evaluators[keys[i]]);
+        }
+    }
+    registerDefaultEvaluators() {
+        this.registerEvaluator(BuiltInPolicyType.COMPOSITE, new CompositePolicyEvaluator());
+        this.registerEvaluator(BuiltInPolicyType.ATTRIBUTES, new AttributesPolicyEvaluator());
+        this.registerEvaluator(BuiltInPolicyType.ATTRIBUTE_NAMES, new AttributeNamesPolicyEvaluator());
+        this.registerEvaluator(BuiltInPolicyType.DATE, new DatePolicyEvaluator());
+        this.registerEvaluator(BuiltInPolicyType.IDENTITY, new IdentityPolicyEvaluator());
+        this.registerEvaluator(BuiltInPolicyType.PERMISSION_BINDING, new PermissionBindingPolicyEvaluator());
+        this.registerEvaluator(BuiltInPolicyType.REALM_MATCH, new RealmMatchPolicyEvaluator());
+        this.registerEvaluator(BuiltInPolicyType.TIME, new TimePolicyEvaluator());
+    }
+    /**
+     * @throws PolicyError
+     *
+     * @param ctx
+     */ async evaluate(ctx) {
+        return evaluatePolicy({
+            ...ctx,
+            options: ctx.options || {},
+            evaluators: this.evaluators
+        });
+    }
+    constructor(evaluators = {}){
+        this.evaluators = {};
+        this.registerDefaultEvaluators();
+        this.registerEvaluators(evaluators);
+    }
+}
+
+function mergePermissionItems(input) {
+    const grouped = input.reduce((previous, current)=>{
+        const key = current.realm_id || `/${current.name}`;
+        if (!previous[key]) {
+            previous[key] = [];
+        }
+        previous[key].push(current);
+        return previous;
+    }, {});
+    const output = [];
+    const keys = Object.keys(grouped);
+    for(let i = 0; i < keys.length; i++){
+        const [permission, ...permissions] = grouped[keys[i]];
+        if (permissions.length > 0) {
+            const policy = {
+                type: BuiltInPolicyType.COMPOSITE,
+                decisionStrategy: DecisionStrategy.AFFIRMATIVE,
+                children: permissions.map((el)=>el.policy).filter((el)=>typeof el !== 'undefined')
+            };
+            if (permission.policy) {
+                policy.children.push(permission.policy);
+            }
+            if (policy.children.length > 0) {
+                permission.policy = policy;
+            }
+        }
+        output.push(permission);
+    }
+    return output;
+}
+
+class PermissionMemoryProvider {
+    async get(options) {
+        return this.items[`${options.realmId || '/'}:${options.name}`];
+    }
+    setMany(input) {
+        this.items = mergePermissionItems(input).reduce((prev, current)=>{
+            prev[`${current.realm_id || '/'}:${current.name}`] = current;
+            return prev;
+        }, {});
+    }
+    constructor(items = []){
+        this.items = {};
+        this.setMany(items);
+    }
+}
+
+class PermissionChecker {
+    // ----------------------------------------------
+    /**
+     * Get a permission.
+     *
+     * @param input
+     */ async get(input) {
+        const options = {
+            name: input
+        };
+        if (typeof this.realmId !== 'undefined') {
+            options.realmId = this.realmId;
+        }
+        return this.provider.get(options);
+    }
+    // ----------------------------------------------
+    /**
+     * Verify if one or more possible owned permissions satisfy their conditions.
+     *
+     * @throws PermissionError
+     *
+     * @param ctx
+     */ async check(ctx) {
+        if (!Array.isArray(ctx.name)) {
+            await this.check({
+                ...ctx,
+                name: [
+                    ctx.name
+                ]
+            });
+            return;
+        }
+        const { options = {} } = ctx;
+        const decisionStrategy = options.decisionStrategy ?? DecisionStrategy.UNANIMOUS;
+        let lastError;
+        let count = 0;
+        for(let i = 0; i < ctx.name.length; i++){
+            const entity = await this.get(ctx.name[i]);
+            if (!entity) {
+                throw PermissionError.notFound(ctx.name[i]);
+            }
+            if (!entity.policy) {
+                if (decisionStrategy === DecisionStrategy.AFFIRMATIVE) {
+                    return;
+                }
+                count++;
+                continue;
+            }
+            let outcome;
+            try {
+                outcome = await this.policyEngine.evaluate({
+                    data: {
+                        ...ctx.data || {},
+                        permission: entity
+                    },
+                    spec: entity.policy,
+                    options: {
+                        include: options.policiesIncluded,
+                        exclude: options.policiesExcluded
+                    }
+                });
+            } catch (e) {
+                if (e instanceof PolicyError) {
+                    lastError = PermissionError.evaluationFailed({
+                        name: entity.name,
+                        policy: entity.policy,
+                        policyError: e
+                    });
+                } else {
+                    lastError = PermissionError.evaluationFailed({
+                        name: entity.name,
+                        policy: entity.policy
+                    });
+                }
+                outcome = false;
+            }
+            if (outcome) {
+                if (decisionStrategy === DecisionStrategy.AFFIRMATIVE) {
+                    return;
+                }
+                count++;
+            } else {
+                if (!lastError) {
+                    lastError = PermissionError.evaluationFailed({
+                        name: entity.name,
+                        policy: entity.policy
+                    });
+                }
+                if (decisionStrategy === DecisionStrategy.UNANIMOUS) {
+                    throw lastError;
+                }
+                count--;
+            }
+        }
+        if (count > 0) {
+            return;
+        }
+        if (count > 1 || !lastError) {
+            throw PermissionError.deniedAll(ctx.name);
+        } else {
+            throw lastError;
+        }
+    }
+    /**
+     * Verify if one of the permissions evaluates to true.
+     *
+     * @throws PermissionError
+     *
+     * @param ctx
+     */ async checkOneOf(ctx) {
+        return this.check({
+            ...ctx,
+            options: {
+                ...ctx.options || {},
+                decisionStrategy: DecisionStrategy.AFFIRMATIVE
+            }
+        });
+    }
+    // ----------------------------------------------
+    async preCheck(ctx) {
+        return this.check({
+            ...ctx,
+            options: {
+                ...ctx.options || {},
+                policiesExcluded: [
+                    BuiltInPolicyType.ATTRIBUTES,
+                    BuiltInPolicyType.ATTRIBUTE_NAMES,
+                    BuiltInPolicyType.REALM_MATCH
+                ]
+            }
+        });
+    }
+    async preCheckOneOf(ctx) {
+        return this.preCheck({
+            ...ctx,
+            options: {
+                ...ctx.options || {},
+                decisionStrategy: DecisionStrategy.AFFIRMATIVE
+            }
+        });
+    }
+    // ----------------------------------------------
+    constructor(options = {}){
+        if (options.provider) {
+            this.provider = options.provider;
+        } else {
+            this.provider = new PermissionMemoryProvider();
+        }
+        if (options.realmId) {
+            this.realmId = options.realmId;
+        }
+        if (options.policyEngine) {
+            this.policyEngine = options.policyEngine;
+        } else {
+            this.policyEngine = new PolicyEngine();
+        }
+    }
+}
+
+export { AttributeNamesPolicyEvaluator, AttributeNamesPolicyValidator, AttributesPolicyEvaluator, AttributesPolicyValidator, BuiltInPolicyType, CompositePolicyEvaluator, CompositePolicyValidator, DatePolicyEvaluator, DatePolicyValidator, DecisionStrategy, IdentityPolicyEvaluator, IdentityPolicyValidator, PermissionBindingPolicyEvaluator, PermissionBindingPolicyValidator, PermissionChecker, PermissionError, PermissionMemoryProvider, PolicyDataIdentityValidator, PolicyDataPermissionValidator, PolicyDataValidator, PolicyEngine, PolicyError, RealmMatchPolicyEvaluator, RealmMatchPolicyValidator, TimePolicyEvaluator, TimePolicyInterval, TimePolicyValidator, evaluatePolicy, isCompositePolicy, isPermissionItemEqual, maybeInvertPolicyOutcome, mergePermissionItems };
+//# sourceMappingURL=index.mjs.map