@authup/access 1.0.0-beta.26 → 1.0.0-beta.28

package/dist/index.mjs

@@ -6,20 +6,20 @@ import { z } from 'zod';
 import { guard } from '@ucast/mongo2js';
 
 class PolicyError extends AuthupError {
+    constructor(message, code){
+        super({
+            message,
+            code
+        });
+    }
     static evaluatorNotFound(type) {
         return new PolicyError(`No evaluator is registered to handle the policy: ${type}`, ErrorCode.POLICY_EVALUATOR_NOT_FOUND);
     }
     static evaluatorNotProcessable() {
-        throw new PolicyError('The evaluator can not process the policy.', ErrorCode.POLICY_EVALUATOR_NOT_PROCESSABLE);
+        return new PolicyError('The evaluator can not process the policy.', ErrorCode.POLICY_EVALUATOR_NOT_PROCESSABLE);
     }
     static evaluatorContextInvalid() {
-        throw new PolicyError('The evaluator context is not valid.', ErrorCode.POLICY_EVALUATOR_CONTEXT_INVALID);
-    }
-    constructor(message, code){
-        super({
-            message,
-            code
-        });
+        return new PolicyError('The evaluator context is not valid.', ErrorCode.POLICY_EVALUATOR_CONTEXT_INVALID);
     }
 }
 
@@ -83,34 +83,35 @@ class AttributeNamesPolicyValidator extends Container {
 }
 
 class AttributeNamesPolicyEvaluator {
+    validator;
+    constructor(){
+        this.validator = new AttributeNamesPolicyValidator();
+    }
     async can(ctx) {
-        return ctx.spec.type === BuiltInPolicyType.ATTRIBUTE_NAMES;
+        return ctx.config.type === BuiltInPolicyType.ATTRIBUTE_NAMES;
     }
-    async validateSpecification(ctx) {
-        return this.validator.run(ctx.spec);
+    async validateConfig(ctx) {
+        return this.validator.run(ctx.config);
     }
-    async validateData(ctx) {
-        if (!isObject(ctx.data.attributes)) {
+    async validateInput(ctx) {
+        if (!isObject(ctx.input.attributes)) {
             throw PolicyError.evaluatorContextInvalid();
         }
-        return ctx.data;
+        return ctx.input;
     }
     async evaluate(ctx) {
-        if (!ctx.data.attributes) {
+        if (!ctx.input.attributes) {
             throw PolicyError.evaluatorContextInvalid();
         }
-        const attributes = flattenObject(ctx.data.attributes);
+        const attributes = flattenObject(ctx.input.attributes);
         const keys = Object.keys(attributes);
         for(let i = 0; i < keys.length; i++){
-            const index = ctx.spec.names.indexOf(keys[i]);
+            const index = ctx.config.names.indexOf(keys[i]);
             if (index === -1) {
-                return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+                return maybeInvertPolicyOutcome(false, ctx.config.invert);
             }
         }
-        return maybeInvertPolicyOutcome(true, ctx.spec.invert);
-    }
-    constructor(){
-        this.validator = new AttributeNamesPolicyValidator();
+        return maybeInvertPolicyOutcome(true, ctx.config.invert);
     }
 }
 
@@ -132,46 +133,55 @@ class AttributesPolicyValidator extends Container {
 }
 
 class AttributesPolicyEvaluator {
+    validator;
+    constructor(){
+        this.validator = new AttributesPolicyValidator();
+    }
     async can(ctx) {
-        return ctx.spec.type === BuiltInPolicyType.ATTRIBUTES;
+        return ctx.config.type === BuiltInPolicyType.ATTRIBUTES;
     }
-    async validateSpecification(ctx) {
-        return this.validator.run(ctx.spec);
+    async validateConfig(ctx) {
+        return this.validator.run(ctx.config);
     }
-    async validateData(ctx) {
-        if (!isObject(ctx.data.attributes)) {
+    async validateInput(ctx) {
+        if (!isObject(ctx.input.attributes)) {
             throw PolicyError.evaluatorContextInvalid();
         }
-        return ctx.data;
+        return ctx.input;
     }
     async evaluate(ctx) {
-        if (!ctx.data.attributes) {
+        if (!ctx.input.attributes) {
             throw PolicyError.evaluatorContextInvalid();
         }
-        this.fixQuery(ctx.spec.query);
-        const testIt = guard(ctx.spec.query);
-        return maybeInvertPolicyOutcome(testIt(ctx.data.attributes), ctx.spec.invert);
+        this.fixQuery(ctx.config.query);
+        const testIt = guard(ctx.config.query);
+        return maybeInvertPolicyOutcome(testIt(ctx.input.attributes), ctx.config.invert);
     }
     fixQuery(query) {
-        const keys = Object.keys(query);
-        for(let i = 0; i < keys.length; i++){
-            const key = keys[i];
-            const value = query[key];
-            if (isObject(value) || Array.isArray(value)) {
-                this.fixQuery(value);
-                continue;
+        if (Array.isArray(query)) {
+            for(let i = 0; i < query.length; i++){
+                this.fixQuery(query[i]);
             }
-            if (key === '$regex' && typeof value === 'string') {
-                const fragments = value.match(/\/(.*?)\/([a-z]*)?$/i);
-                if (fragments) {
-                    query[key] = new RegExp(fragments[1], fragments[2]);
+            return;
+        }
+        if (isObject(query)) {
+            const keys = Object.keys(query);
+            for(let i = 0; i < keys.length; i++){
+                const key = keys[i];
+                const value = query[key];
+                if (isObject(value) || Array.isArray(value)) {
+                    this.fixQuery(value);
+                    continue;
+                }
+                if (key === '$regex' && typeof value === 'string') {
+                    const fragments = value.match(/\/(.*?)\/([a-z]*)?$/i);
+                    if (fragments) {
+                        query[key] = new RegExp(fragments[1], fragments[2]);
+                    }
                 }
             }
         }
     }
-    constructor(){
-        this.validator = new AttributesPolicyValidator();
-    }
 }
 
 /*
@@ -238,31 +248,31 @@ class PolicyDataValidator extends Container {
 }
 
 async function evaluatePolicy(ctx) {
-    if (ctx.options.exclude && ctx.options.exclude.length > 0 && ctx.options.exclude.indexOf(ctx.spec.type) !== -1) {
-        if (typeof ctx.spec.invert === 'boolean') {
-            return maybeInvertPolicyOutcome(true, ctx.spec.invert);
+    if (ctx.options.exclude && ctx.options.exclude.length > 0 && ctx.options.exclude.indexOf(ctx.config.type) !== -1) {
+        if (typeof ctx.config.invert === 'boolean') {
+            return maybeInvertPolicyOutcome(true, ctx.config.invert);
         }
         return true;
     }
-    if (ctx.options.include && ctx.options.include.length > 0 && ctx.options.include.indexOf(ctx.spec.type) === -1) {
-        if (typeof ctx.spec.invert === 'boolean') {
-            return maybeInvertPolicyOutcome(true, ctx.spec.invert);
+    if (ctx.options.include && ctx.options.include.length > 0 && ctx.options.include.indexOf(ctx.config.type) === -1) {
+        if (typeof ctx.config.invert === 'boolean') {
+            return maybeInvertPolicyOutcome(true, ctx.config.invert);
         }
         return true;
     }
-    const evaluator = ctx.evaluators[ctx.spec.type];
+    const evaluator = ctx.evaluators[ctx.config.type];
     if (!evaluator) {
-        throw PolicyError.evaluatorNotFound(ctx.spec.type);
+        throw PolicyError.evaluatorNotFound(ctx.config.type);
     }
     try {
         const canEvaluate = await evaluator.can(ctx);
         if (canEvaluate) {
-            const spec = await evaluator.validateSpecification(ctx);
-            const data = await evaluator.validateData(ctx);
+            const config = await evaluator.validateConfig(ctx);
+            const input = await evaluator.validateInput(ctx);
             return await evaluator.evaluate({
                 ...ctx,
-                data,
-                spec
+                input,
+                config
             });
         }
     } catch (e) {
@@ -295,48 +305,49 @@ class CompositePolicyValidator extends Container {
 }
 
 class CompositePolicyEvaluator {
+    validator;
+    constructor(){
+        this.validator = new CompositePolicyValidator();
+    }
     async can(ctx) {
-        return isCompositePolicy(ctx.spec);
+        return isCompositePolicy(ctx.config);
     }
-    async validateSpecification(ctx) {
-        return this.validator.run(ctx.spec);
+    async validateConfig(ctx) {
+        return this.validator.run(ctx.config);
     }
-    async validateData(ctx) {
-        return ctx.data;
+    async validateInput(ctx) {
+        return ctx.input;
     }
     async evaluate(ctx) {
         let count = 0;
-        const decisionStrategy = ctx.spec.decisionStrategy ?? DecisionStrategy.UNANIMOUS;
-        for(let i = 0; i < ctx.spec.children.length; i++){
-            const childPolicy = ctx.spec.children[i];
+        const decisionStrategy = ctx.config.decisionStrategy ?? DecisionStrategy.UNANIMOUS;
+        for(let i = 0; i < ctx.config.children.length; i++){
+            const childPolicy = ctx.config.children[i];
             let outcome;
             if (isCompositePolicy(childPolicy)) {
                 outcome = await this.evaluate({
                     ...ctx,
-                    spec: childPolicy
+                    config: childPolicy
                 });
             } else {
                 outcome = await evaluatePolicy({
                     ...ctx,
-                    spec: childPolicy
+                    config: childPolicy
                 });
             }
             if (outcome) {
                 if (decisionStrategy === DecisionStrategy.AFFIRMATIVE) {
-                    return maybeInvertPolicyOutcome(true, ctx.spec.invert);
+                    return maybeInvertPolicyOutcome(true, ctx.config.invert);
                 }
                 count++;
             } else {
                 if (decisionStrategy === DecisionStrategy.UNANIMOUS) {
-                    return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+                    return maybeInvertPolicyOutcome(false, ctx.config.invert);
                 }
                 count--;
             }
         }
-        return maybeInvertPolicyOutcome(count > 0, ctx.spec.invert);
-    }
-    constructor(){
-        this.validator = new CompositePolicyValidator();
+        return maybeInvertPolicyOutcome(count > 0, ctx.config.invert);
     }
 }
 
@@ -362,38 +373,39 @@ function toDate$1(input) {
     return input;
 }
 class DatePolicyEvaluator {
+    validator;
+    constructor(){
+        this.validator = new DatePolicyValidator();
+    }
     async can(ctx) {
-        return ctx.spec.type === BuiltInPolicyType.DATE;
+        return ctx.config.type === BuiltInPolicyType.DATE;
     }
-    async validateSpecification(ctx) {
-        return this.validator.run(ctx.spec);
+    async validateConfig(ctx) {
+        return this.validator.run(ctx.config);
     }
-    async validateData(ctx) {
-        return ctx.data;
+    async validateInput(ctx) {
+        return ctx.input;
     }
     async evaluate(ctx) {
         let now;
-        if (ctx.data.dateTime) {
-            now = normalizeDate$1(toDate$1(ctx.data.dateTime));
+        if (ctx.input.dateTime) {
+            now = normalizeDate$1(toDate$1(ctx.input.dateTime));
         } else {
             now = normalizeDate$1(new Date());
         }
-        if (ctx.spec.start) {
-            const start = normalizeDate$1(toDate$1(ctx.spec.start));
+        if (ctx.config.start) {
+            const start = normalizeDate$1(toDate$1(ctx.config.start));
             if (now < start) {
-                return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+                return maybeInvertPolicyOutcome(false, ctx.config.invert);
             }
         }
-        if (ctx.spec.end) {
-            const end = normalizeDate$1(toDate$1(ctx.spec.end));
+        if (ctx.config.end) {
+            const end = normalizeDate$1(toDate$1(ctx.config.end));
             if (now > end) {
-                return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+                return maybeInvertPolicyOutcome(false, ctx.config.invert);
             }
         }
-        return maybeInvertPolicyOutcome(true, ctx.spec.invert);
-    }
-    constructor(){
-        this.validator = new DatePolicyValidator();
+        return maybeInvertPolicyOutcome(true, ctx.config.invert);
     }
 }
 
@@ -405,28 +417,29 @@ class IdentityPolicyValidator extends Container {
 }
 
 class IdentityPolicyEvaluator {
+    validator;
+    constructor(){
+        this.validator = new IdentityPolicyValidator();
+    }
     async can(ctx) {
-        return ctx.spec.type === BuiltInPolicyType.IDENTITY;
+        return ctx.config.type === BuiltInPolicyType.IDENTITY;
     }
-    async validateSpecification(ctx) {
-        return this.validator.run(ctx.spec);
+    async validateConfig(ctx) {
+        return this.validator.run(ctx.config);
     }
-    async validateData(ctx) {
-        return ctx.data;
+    async validateInput(ctx) {
+        return ctx.input;
     }
     async evaluate(ctx) {
-        if (!isObject(ctx.data.identity)) {
-            return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+        if (!isObject(ctx.input.identity)) {
+            return maybeInvertPolicyOutcome(false, ctx.config.invert);
         }
-        const types = ctx.spec.types || [];
+        const types = ctx.config.types || [];
         if (types.length === 0) {
-            return maybeInvertPolicyOutcome(true, ctx.spec.invert);
+            return maybeInvertPolicyOutcome(true, ctx.config.invert);
         }
-        const typeAllowed = types.indexOf(ctx.data.identity.type) !== -1;
-        return maybeInvertPolicyOutcome(typeAllowed, ctx.spec.invert);
-    }
-    constructor(){
-        this.validator = new IdentityPolicyValidator();
+        const typeAllowed = types.indexOf(ctx.input.identity.type) !== -1;
+        return maybeInvertPolicyOutcome(typeAllowed, ctx.config.invert);
     }
 }
 
@@ -435,24 +448,25 @@ class PermissionBindingPolicyValidator extends Container {
 }
 
 class PermissionBindingPolicyEvaluator {
+    validator;
+    constructor(){
+        this.validator = new PermissionBindingPolicyValidator();
+    }
     async can(ctx) {
-        return ctx.spec.type === BuiltInPolicyType.PERMISSION_BINDING;
+        return ctx.config.type === BuiltInPolicyType.PERMISSION_BINDING;
     }
-    async validateSpecification(ctx) {
-        return this.validator.run(ctx.spec);
+    async validateConfig(ctx) {
+        return this.validator.run(ctx.config);
     }
-    async validateData(ctx) {
-        if (!isObject(ctx.data.identity) && !isObject(ctx.data.permission)) {
+    async validateInput(ctx) {
+        if (!isObject(ctx.input.identity) && !isObject(ctx.input.permission)) {
             throw PolicyError.evaluatorContextInvalid();
         }
-        return ctx.data;
+        return ctx.input;
     }
     async evaluate(ctx) {
         // todo: this must be changed when the permission-checker not only checks owned permissions.
-        return maybeInvertPolicyOutcome(true, ctx.spec.invert);
-    }
-    constructor(){
-        this.validator = new PermissionBindingPolicyValidator();
+        return maybeInvertPolicyOutcome(true, ctx.config.invert);
     }
 }
 
@@ -469,33 +483,37 @@ class RealmMatchPolicyValidator extends Container {
 }
 
 class RealmMatchPolicyEvaluator {
+    validator;
+    constructor(){
+        this.validator = new RealmMatchPolicyValidator();
+    }
     async can(ctx) {
-        return ctx.spec.type === BuiltInPolicyType.REALM_MATCH;
+        return ctx.config.type === BuiltInPolicyType.REALM_MATCH;
     }
-    async validateSpecification(ctx) {
-        return this.validator.run(ctx.spec);
+    async validateConfig(ctx) {
+        return this.validator.run(ctx.config);
     }
-    async validateData(ctx) {
-        if (!isObject(ctx.data.attributes) || !isObject(ctx.data.identity)) {
+    async validateInput(ctx) {
+        if (!isObject(ctx.input.attributes) || !isObject(ctx.input.identity)) {
             throw PolicyError.evaluatorContextInvalid();
         }
-        return ctx.data;
+        return ctx.input;
     }
     async evaluate(ctx) {
-        if (!ctx.data.attributes || !ctx.data.identity) {
+        if (!ctx.input.attributes || !ctx.input.identity) {
             throw PolicyError.evaluatorContextInvalid();
         }
-        const identityMasterMatchAll = ctx.spec.identityMasterMatchAll ?? true;
-        if (identityMasterMatchAll && ctx.data.identity.realmName && ctx.data.identity.realmName === 'master') {
-            return maybeInvertPolicyOutcome(true, ctx.spec.invert);
+        const identityMasterMatchAll = ctx.config.identityMasterMatchAll ?? true;
+        if (identityMasterMatchAll && ctx.input.identity.realmName && ctx.input.identity.realmName === 'master') {
+            return maybeInvertPolicyOutcome(true, ctx.config.invert);
         }
         let keys;
-        if (ctx.spec.attributeName) {
-            if (Array.isArray(ctx.spec.attributeName)) {
-                keys = ctx.spec.attributeName;
+        if (ctx.config.attributeName) {
+            if (Array.isArray(ctx.config.attributeName)) {
+                keys = ctx.config.attributeName;
             } else {
                 keys = [
-                    ctx.spec.attributeName
+                    ctx.config.attributeName
                 ];
             }
         } else {
@@ -505,11 +523,11 @@ class RealmMatchPolicyEvaluator {
                 'realmId',
                 'realmName'
             ];
-            ctx.spec.decisionStrategy = DecisionStrategy.CONSENSUS;
+            ctx.config.decisionStrategy = DecisionStrategy.CONSENSUS;
         }
-        const attributeNameStrict = ctx.spec.attributeNameStrict ?? true;
+        const attributeNameStrict = ctx.config.attributeNameStrict ?? true;
         if (!attributeNameStrict) {
-            const resourceKeys = Object.keys(ctx.data.attributes);
+            const resourceKeys = Object.keys(ctx.input.attributes);
             const keysToAdd = [];
             for(let i = 0; i < resourceKeys.length; i++){
                 let contains = false;
@@ -529,32 +547,29 @@ class RealmMatchPolicyEvaluator {
         }
         let count = 0;
         for(let i = 0; i < keys.length; i++){
-            if (!hasOwnProperty(ctx.data.attributes, keys[i])) {
+            if (!hasOwnProperty(ctx.input.attributes, keys[i])) {
                 continue;
             }
             let outcome = false;
-            const attributeValue = ctx.data.attributes[keys[i]];
-            if (attributeValue === null && ctx.spec.attributeNullMatchAll) {
+            const attributeValue = ctx.input.attributes[keys[i]];
+            if (attributeValue === null && ctx.config.attributeNullMatchAll) {
                 outcome = true;
-            } else if (attributeValue === ctx.data.identity.realmId || attributeValue === ctx.data.identity.realmName) {
+            } else if (attributeValue === ctx.input.identity.realmId || attributeValue === ctx.input.identity.realmName) {
                 outcome = true;
             }
             if (outcome) {
-                if (ctx.spec.decisionStrategy === DecisionStrategy.AFFIRMATIVE) {
-                    return maybeInvertPolicyOutcome(true, ctx.spec.invert);
+                if (ctx.config.decisionStrategy === DecisionStrategy.AFFIRMATIVE) {
+                    return maybeInvertPolicyOutcome(true, ctx.config.invert);
                 }
                 count++;
             } else {
-                if (ctx.spec.decisionStrategy === DecisionStrategy.UNANIMOUS) {
-                    return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+                if (ctx.config.decisionStrategy === DecisionStrategy.UNANIMOUS) {
+                    return maybeInvertPolicyOutcome(false, ctx.config.invert);
                 }
                 count--;
             }
         }
-        return maybeInvertPolicyOutcome(count > 0, ctx.spec.invert);
-    }
-    constructor(){
-        this.validator = new RealmMatchPolicyValidator();
+        return maybeInvertPolicyOutcome(count > 0, ctx.config.invert);
     }
 }
 
@@ -586,7 +601,7 @@ class TimePolicyValidator extends Container {
         super.initialize();
         this.mount('dayOfWeek', createValidator(z.number().min(0).max(6).or(z.null()).or(z.undefined()).optional()));
         this.mount('dayOfMonth', createValidator(z.number().min(1).max(31).or(z.null()).or(z.undefined()).optional()));
-        this.mount('dayOfYear', createValidator(z.number().min(1).max(366).or(z.null()).or(z.undefined()).optional()));
+        this.mount('dayOfYear', createValidator(z.number().min(1).max(365).or(z.null()).or(z.undefined()).optional()));
         this.mount('start', createValidator(z.date().or(z.string().datetime()).or(z.string().time()).or(z.number()).or(z.null()).or(z.undefined()).optional()));
         this.mount('end', createValidator(z.date().or(z.string().datetime()).or(z.string().time()).or(z.number()).or(z.null()).or(z.undefined()).optional()));
         this.mount('interval', createValidator(z.nativeEnum(TimePolicyInterval).or(z.null()).or(z.undefined()).optional()));
@@ -616,59 +631,60 @@ function toDate(input, dateRef) {
     return input;
 }
 class TimePolicyEvaluator {
+    validator;
+    constructor(){
+        this.validator = new TimePolicyValidator();
+    }
     async can(ctx) {
-        return ctx.spec.type === BuiltInPolicyType.TIME;
+        return ctx.config.type === BuiltInPolicyType.TIME;
     }
-    async validateSpecification(ctx) {
-        return this.validator.run(ctx.spec);
+    async validateConfig(ctx) {
+        return this.validator.run(ctx.config);
     }
-    async validateData(ctx) {
-        return ctx.data;
+    async validateInput(ctx) {
+        return ctx.input;
     }
     async evaluate(ctx) {
         let now;
-        if (ctx.data.dateTime) {
-            now = toDate(ctx.data.dateTime);
+        if (ctx.input.dateTime) {
+            now = toDate(ctx.input.dateTime);
         } else {
             now = new Date();
         }
-        if (ctx.spec.start) {
-            const start = normalizeDate(toDate(ctx.spec.start, now), now);
+        if (ctx.config.start) {
+            const start = normalizeDate(toDate(ctx.config.start, now), now);
             if (now < start) {
-                return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+                return maybeInvertPolicyOutcome(false, ctx.config.invert);
             }
         }
-        if (ctx.spec.end) {
-            const end = normalizeDate(toDate(ctx.spec.end, now), now);
+        if (ctx.config.end) {
+            const end = normalizeDate(toDate(ctx.config.end, now), now);
             if (now > end) {
-                return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+                return maybeInvertPolicyOutcome(false, ctx.config.invert);
             }
         }
-        if (ctx.spec.interval) {
-            if (isIntervalForDayOfWeek(ctx.spec.interval) && ctx.spec.dayOfWeek) {
-                if (now.getDay() !== ctx.spec.dayOfWeek) {
-                    return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+        if (ctx.config.interval) {
+            if (isIntervalForDayOfWeek(ctx.config.interval) && ctx.config.dayOfWeek) {
+                if (now.getDay() !== ctx.config.dayOfWeek) {
+                    return maybeInvertPolicyOutcome(false, ctx.config.invert);
                 }
             }
-            if (isIntervalForDayOfMonth(ctx.spec.interval) && ctx.spec.dayOfMonth) {
-                if (now.getDate() !== ctx.spec.dayOfMonth) {
-                    return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+            if (isIntervalForDayOfMonth(ctx.config.interval) && ctx.config.dayOfMonth) {
+                if (now.getDate() !== ctx.config.dayOfMonth) {
+                    return maybeInvertPolicyOutcome(false, ctx.config.invert);
                 }
             }
-            if (isIntervalForDayOfYear(ctx.spec.interval) && ctx.spec.dayOfYear) {
+            if (isIntervalForDayOfYear(ctx.config.interval) && ctx.config.dayOfYear) {
                 const start = new Date(now.getFullYear(), 0, 0);
                 const diff = now.getTime() - start.getTime() + (start.getTimezoneOffset() - now.getTimezoneOffset()) * 60 * 1000;
                 const oneDay = 1000 * 60 * 60 * 24;
                 const dayOfYear = Math.floor(diff / oneDay);
-                if (dayOfYear !== ctx.spec.dayOfYear) {
-                    return maybeInvertPolicyOutcome(false, ctx.spec.invert);
+                if (dayOfYear !== ctx.config.dayOfYear) {
+                    return maybeInvertPolicyOutcome(false, ctx.config.invert);
                 }
             }
         }
-        return maybeInvertPolicyOutcome(true, ctx.spec.invert);
-    }
-    constructor(){
-        this.validator = new TimePolicyValidator();
+        return maybeInvertPolicyOutcome(true, ctx.config.invert);
     }
 }
 
@@ -688,6 +704,12 @@ class TimePolicyEvaluator {
  * The policy engine is a component that interprets defined policies and makes decisions
  * on whether to allow or deny a particular access.
  */ class PolicyEngine {
+    evaluators;
+    constructor(evaluators = {}){
+        this.evaluators = {};
+        this.registerDefaultEvaluators();
+        this.registerEvaluators(evaluators);
+    }
     registerEvaluator(type, evaluator) {
         this.evaluators[type] = evaluator;
     }
@@ -718,14 +740,18 @@ class TimePolicyEvaluator {
             evaluators: this.evaluators
         });
     }
-    constructor(evaluators = {}){
-        this.evaluators = {};
-        this.registerDefaultEvaluators();
-        this.registerEvaluators(evaluators);
-    }
 }
 
 class PermissionError extends AuthupError {
+    policy;
+    policyError;
+    constructor(options = {}){
+        super({
+            ...options,
+            message: options.message || 'A permission error occurred.',
+            statusCode: options.statusCode || 403
+        });
+    }
     static notFound(name) {
         return new PermissionError({
             message: `The permission ${name} was not found.`,
@@ -760,13 +786,6 @@ class PermissionError extends AuthupError {
         }
         return error;
     }
-    constructor(options = {}){
-        super({
-            ...options,
-            message: options.message || 'A permission error occurred.',
-            statusCode: options.statusCode || 403
-        });
-    }
 }
 
 /*
@@ -828,6 +847,10 @@ function mergePermissionItems(input) {
 }
 
 class PermissionMemoryProvider {
+    items = {};
+    constructor(items = []){
+        this.setMany(items);
+    }
     async get(options) {
         return this.items[buildPermissionItemKey(options)];
     }
@@ -837,13 +860,32 @@ class PermissionMemoryProvider {
             return prev;
         }, {});
     }
-    constructor(items = []){
-        this.items = {};
-        this.setMany(items);
-    }
 }
 
 class PermissionChecker {
+    provider;
+    policyEngine;
+    clientId;
+    realmId;
+    // ----------------------------------------------
+    constructor(options = {}){
+        if (options.provider) {
+            this.provider = options.provider;
+        } else {
+            this.provider = new PermissionMemoryProvider();
+        }
+        if (options.clientId) {
+            this.clientId = options.clientId;
+        }
+        if (options.realmId) {
+            this.realmId = options.realmId;
+        }
+        if (options.policyEngine) {
+            this.policyEngine = options.policyEngine;
+        } else {
+            this.policyEngine = new PolicyEngine();
+        }
+    }
     // ----------------------------------------------
     /**
      * Get a permission.
@@ -901,11 +943,11 @@ class PermissionChecker {
             let outcome;
             try {
                 outcome = await this.policyEngine.evaluate({
-                    data: {
-                        ...ctx.data || {},
+                    input: {
+                        ...ctx.input || {},
                         permission: entity
                     },
-                    spec: entity.policy,
+                    config: entity.policy,
                     options: {
                         include: options.policiesIncluded,
                         exclude: options.policiesExcluded
@@ -991,25 +1033,6 @@ class PermissionChecker {
             }
         });
     }
-    // ----------------------------------------------
-    constructor(options = {}){
-        if (options.provider) {
-            this.provider = options.provider;
-        } else {
-            this.provider = new PermissionMemoryProvider();
-        }
-        if (options.clientId) {
-            this.clientId = options.clientId;
-        }
-        if (options.realmId) {
-            this.realmId = options.realmId;
-        }
-        if (options.policyEngine) {
-            this.policyEngine = options.policyEngine;
-        } else {
-            this.policyEngine = new PolicyEngine();
-        }
-    }
 }
 
 export { AttributeNamesPolicyEvaluator, AttributeNamesPolicyValidator, AttributesPolicyEvaluator, AttributesPolicyValidator, BuiltInPolicyType, CompositePolicyEvaluator, CompositePolicyValidator, DatePolicyEvaluator, DatePolicyValidator, DecisionStrategy, IdentityPolicyEvaluator, IdentityPolicyValidator, PermissionBindingPolicyEvaluator, PermissionBindingPolicyValidator, PermissionChecker, PermissionError, PermissionMemoryProvider, PolicyDataIdentityValidator, PolicyDataPermissionValidator, PolicyDataValidator, PolicyEngine, PolicyError, RealmMatchPolicyEvaluator, RealmMatchPolicyValidator, TimePolicyEvaluator, TimePolicyInterval, TimePolicyValidator, buildPermissionItemKey, defineAttributesPolicy, definePolicyWithType, evaluatePolicy, isCompositePolicy, isIntervalForDayOfMonth, isIntervalForDayOfWeek, isIntervalForDayOfYear, isPermissionItemEqual, maybeInvertPolicyOutcome, mergePermissionItems };