@authup/access 1.0.0-beta.27 → 1.0.0-beta.28

package/dist/index.cjs

@@ -1,1055 +0,0 @@
-'use strict';
-
-var errors = require('@authup/errors');
-var kit = require('@authup/kit');
-var adapterZod = require('@validup/adapter-zod');
-var validup = require('validup');
-var zod = require('zod');
-var mongo2js = require('@ucast/mongo2js');
-
-class PolicyError extends errors.AuthupError {
-    static evaluatorNotFound(type) {
-        return new PolicyError(`No evaluator is registered to handle the policy: ${type}`, errors.ErrorCode.POLICY_EVALUATOR_NOT_FOUND);
-    }
-    static evaluatorNotProcessable() {
-        throw new PolicyError('The evaluator can not process the policy.', errors.ErrorCode.POLICY_EVALUATOR_NOT_PROCESSABLE);
-    }
-    static evaluatorContextInvalid() {
-        throw new PolicyError('The evaluator context is not valid.', errors.ErrorCode.POLICY_EVALUATOR_CONTEXT_INVALID);
-    }
-    constructor(message, code){
-        super({
-            message,
-            code
-        });
-    }
-}
-
-/*
- * Copyright (c) 2024-2024.
- * Author Peter Placzek (tada5hi)
- * For the full copyright and license information,
- * view the LICENSE file that was distributed with this source code.
- */ function maybeInvertPolicyOutcome(outcome, invert) {
-    if (typeof invert === 'undefined') {
-        return outcome;
-    }
-    if (typeof invert === 'function') {
-        return invert(outcome);
-    }
-    if (!invert) {
-        return outcome;
-    }
-    return !outcome;
-}
-
-/*
- * Copyright (c) 2024-2024.
- * Author Peter Placzek (tada5hi)
- * For the full copyright and license information,
- * view the LICENSE file that was distributed with this source code.
- */ var BuiltInPolicyType = /*#__PURE__*/ function(BuiltInPolicyType) {
-    /**
-     * Bundles different policies.
-     */ BuiltInPolicyType["COMPOSITE"] = "composite";
-    /**
-     * Date Based Access Control (DBAC)
-     */ BuiltInPolicyType["DATE"] = "date";
-    /**
-     * Time Based Access Control (TBAC)
-     */ BuiltInPolicyType["TIME"] = "time";
-    /**
-     * Attribute Name Based Access Control (ANBAC)
-     */ BuiltInPolicyType["ATTRIBUTE_NAMES"] = "attributeNames";
-    /**
-     * Attribute Based Access Control (ABAC)
-     */ BuiltInPolicyType["ATTRIBUTES"] = "attributes";
-    /**
-     * Realm of Identity is for attribute realm.
-     */ BuiltInPolicyType["REALM_MATCH"] = "realmMatch";
-    /**
-     * Restriction based on identity (type, id, ...)
-     */ BuiltInPolicyType["IDENTITY"] = "identity";
-    /**
-     * Restriction based on a binding between identity <-> permission
-     */ BuiltInPolicyType["PERMISSION_BINDING"] = "permissionBinding";
-    return BuiltInPolicyType;
-}({});
-
-class AttributeNamesPolicyValidator extends validup.Container {
-    initialize() {
-        super.initialize();
-        this.mount('names', adapterZod.createValidator(zod.z.array(zod.z.string().min(3).max(128))));
-        this.mount('invert', adapterZod.createValidator(zod.z.boolean().or(zod.z.null()).or(zod.z.undefined()).optional()));
-    }
-}
-
-class AttributeNamesPolicyEvaluator {
-    async can(ctx) {
-        return ctx.config.type === BuiltInPolicyType.ATTRIBUTE_NAMES;
-    }
-    async validateConfig(ctx) {
-        return this.validator.run(ctx.config);
-    }
-    async validateInput(ctx) {
-        if (!kit.isObject(ctx.input.attributes)) {
-            throw PolicyError.evaluatorContextInvalid();
-        }
-        return ctx.input;
-    }
-    async evaluate(ctx) {
-        if (!ctx.input.attributes) {
-            throw PolicyError.evaluatorContextInvalid();
-        }
-        const attributes = kit.flattenObject(ctx.input.attributes);
-        const keys = Object.keys(attributes);
-        for(let i = 0; i < keys.length; i++){
-            const index = ctx.config.names.indexOf(keys[i]);
-            if (index === -1) {
-                return maybeInvertPolicyOutcome(false, ctx.config.invert);
-            }
-        }
-        return maybeInvertPolicyOutcome(true, ctx.config.invert);
-    }
-    constructor(){
-        this.validator = new AttributeNamesPolicyValidator();
-    }
-}
-
-/*
- * Copyright (c) 2025.
- * Author Peter Placzek (tada5hi)
- * For the full copyright and license information,
- * view the LICENSE file that was distributed with this source code.
- */ function defineAttributesPolicy(data) {
-    return data;
-}
-
-class AttributesPolicyValidator extends validup.Container {
-    initialize() {
-        super.initialize();
-        this.mount('query', adapterZod.createValidator(zod.z.object({}).passthrough()));
-        this.mount('invert', adapterZod.createValidator(zod.z.boolean().or(zod.z.null()).or(zod.z.undefined()).optional()));
-    }
-}
-
-class AttributesPolicyEvaluator {
-    async can(ctx) {
-        return ctx.config.type === BuiltInPolicyType.ATTRIBUTES;
-    }
-    async validateConfig(ctx) {
-        return this.validator.run(ctx.config);
-    }
-    async validateInput(ctx) {
-        if (!kit.isObject(ctx.input.attributes)) {
-            throw PolicyError.evaluatorContextInvalid();
-        }
-        return ctx.input;
-    }
-    async evaluate(ctx) {
-        if (!ctx.input.attributes) {
-            throw PolicyError.evaluatorContextInvalid();
-        }
-        this.fixQuery(ctx.config.query);
-        const testIt = mongo2js.guard(ctx.config.query);
-        return maybeInvertPolicyOutcome(testIt(ctx.input.attributes), ctx.config.invert);
-    }
-    fixQuery(query) {
-        const keys = Object.keys(query);
-        for(let i = 0; i < keys.length; i++){
-            const key = keys[i];
-            const value = query[key];
-            if (kit.isObject(value) || Array.isArray(value)) {
-                this.fixQuery(value);
-                continue;
-            }
-            if (key === '$regex' && typeof value === 'string') {
-                const fragments = value.match(/\/(.*?)\/([a-z]*)?$/i);
-                if (fragments) {
-                    query[key] = new RegExp(fragments[1], fragments[2]);
-                }
-            }
-        }
-    }
-    constructor(){
-        this.validator = new AttributesPolicyValidator();
-    }
-}
-
-/*
- * Copyright (c) 2024-2024.
- * Author Peter Placzek (tada5hi)
- * For the full copyright and license information,
- * view the LICENSE file that was distributed with this source code.
- */ var DecisionStrategy = /*#__PURE__*/ function(DecisionStrategy) {
-    /**
-     * One or more positive
-     */ DecisionStrategy["AFFIRMATIVE"] = "affirmative";
-    /**
-     * All positive
-     */ DecisionStrategy["UNANIMOUS"] = "unanimous";
-    /**
-     * More positive than negative
-     */ DecisionStrategy["CONSENSUS"] = "consensus";
-    return DecisionStrategy;
-}({});
-
-class PolicyDataIdentityValidator extends validup.Container {
-    initialize() {
-        super.initialize();
-        this.mount('type', adapterZod.createValidator(zod.z.string().min(3).max(128)));
-        this.mount('id', adapterZod.createValidator(zod.z.string().uuid()));
-        this.mount('clientId', adapterZod.createValidator(zod.z.string().uuid().or(zod.z.null()).or(zod.z.undefined()).optional()));
-        this.mount('realmId', adapterZod.createValidator(zod.z.string().uuid().or(zod.z.null()).or(zod.z.undefined()).optional()));
-        this.mount('realmName', adapterZod.createValidator(zod.z.string().min(3).max(128).or(zod.z.null()).or(zod.z.undefined()).optional()));
-    }
-}
-
-class PolicyDataPermissionValidator extends validup.Container {
-    initialize() {
-        super.initialize();
-        this.mount('name', adapterZod.createValidator(zod.z.string().min(3).max(256)));
-        this.mount('clientId', adapterZod.createValidator(zod.z.string().uuid().or(zod.z.null()).or(zod.z.undefined()).optional()));
-        this.mount('realmId', adapterZod.createValidator(zod.z.string().uuid().or(zod.z.null()).or(zod.z.undefined()).optional()));
-        this.mount('policy', adapterZod.createValidator(zod.z.object({
-            type: zod.z.string()
-        }).optional()));
-    }
-}
-
-class PolicyDataValidator extends validup.Container {
-    initialize() {
-        super.initialize();
-        // todo: optionalValue should be null
-        const identity = new PolicyDataIdentityValidator();
-        this.mount('identity', {
-            optional: true,
-            optionalValue: 'undefined',
-            optionalInclude: true
-        }, identity);
-        // todo: optionalValue should be null
-        const permission = new PolicyDataPermissionValidator();
-        this.mount('permission', {
-            optional: true,
-            optionalValue: 'undefined',
-            optionalInclude: true
-        }, permission);
-        this.mount('attributes', adapterZod.createValidator(zod.z.object({}).optional()));
-        this.mount('dateTime', adapterZod.createValidator(zod.z.date().or(zod.z.string()).or(zod.z.number()).optional()));
-    }
-}
-
-async function evaluatePolicy(ctx) {
-    if (ctx.options.exclude && ctx.options.exclude.length > 0 && ctx.options.exclude.indexOf(ctx.config.type) !== -1) {
-        if (typeof ctx.config.invert === 'boolean') {
-            return maybeInvertPolicyOutcome(true, ctx.config.invert);
-        }
-        return true;
-    }
-    if (ctx.options.include && ctx.options.include.length > 0 && ctx.options.include.indexOf(ctx.config.type) === -1) {
-        if (typeof ctx.config.invert === 'boolean') {
-            return maybeInvertPolicyOutcome(true, ctx.config.invert);
-        }
-        return true;
-    }
-    const evaluator = ctx.evaluators[ctx.config.type];
-    if (!evaluator) {
-        throw PolicyError.evaluatorNotFound(ctx.config.type);
-    }
-    try {
-        const canEvaluate = await evaluator.can(ctx);
-        if (canEvaluate) {
-            const config = await evaluator.validateConfig(ctx);
-            const input = await evaluator.validateInput(ctx);
-            return await evaluator.evaluate({
-                ...ctx,
-                input,
-                config
-            });
-        }
-    } catch (e) {
-        if (e instanceof PolicyError) {
-            throw e;
-        }
-        if (e instanceof Error) {
-            const error = new PolicyError(e.message);
-            error.stack = e.stack;
-            throw error;
-        }
-        throw new PolicyError();
-    }
-    throw PolicyError.evaluatorNotProcessable();
-}
-
-function isCompositePolicy(input) {
-    return input.type === BuiltInPolicyType.COMPOSITE;
-}
-
-class CompositePolicyValidator extends validup.Container {
-    initialize() {
-        super.initialize();
-        this.mount('decisionStrategy', adapterZod.createValidator(zod.z.nativeEnum(DecisionStrategy).or(zod.z.null()).or(zod.z.undefined()).optional()));
-        this.mount('children', adapterZod.createValidator(zod.z.array(zod.z.object({
-            type: zod.z.string().min(3)
-        }).passthrough())));
-        this.mount('invert', adapterZod.createValidator(zod.z.boolean().or(zod.z.null()).or(zod.z.undefined()).optional()));
-    }
-}
-
-class CompositePolicyEvaluator {
-    async can(ctx) {
-        return isCompositePolicy(ctx.config);
-    }
-    async validateConfig(ctx) {
-        return this.validator.run(ctx.config);
-    }
-    async validateInput(ctx) {
-        return ctx.input;
-    }
-    async evaluate(ctx) {
-        let count = 0;
-        const decisionStrategy = ctx.config.decisionStrategy ?? DecisionStrategy.UNANIMOUS;
-        for(let i = 0; i < ctx.config.children.length; i++){
-            const childPolicy = ctx.config.children[i];
-            let outcome;
-            if (isCompositePolicy(childPolicy)) {
-                outcome = await this.evaluate({
-                    ...ctx,
-                    config: childPolicy
-                });
-            } else {
-                outcome = await evaluatePolicy({
-                    ...ctx,
-                    config: childPolicy
-                });
-            }
-            if (outcome) {
-                if (decisionStrategy === DecisionStrategy.AFFIRMATIVE) {
-                    return maybeInvertPolicyOutcome(true, ctx.config.invert);
-                }
-                count++;
-            } else {
-                if (decisionStrategy === DecisionStrategy.UNANIMOUS) {
-                    return maybeInvertPolicyOutcome(false, ctx.config.invert);
-                }
-                count--;
-            }
-        }
-        return maybeInvertPolicyOutcome(count > 0, ctx.config.invert);
-    }
-    constructor(){
-        this.validator = new CompositePolicyValidator();
-    }
-}
-
-class DatePolicyValidator extends validup.Container {
-    initialize() {
-        super.initialize();
-        this.mount('start', adapterZod.createValidator(zod.z.date().or(zod.z.string().date()).or(zod.z.number()).or(zod.z.null()).or(zod.z.undefined()).optional()));
-        this.mount('end', adapterZod.createValidator(zod.z.date().or(zod.z.string().date()).or(zod.z.number()).or(zod.z.null()).or(zod.z.undefined()).optional()));
-        this.mount('invert', adapterZod.createValidator(zod.z.boolean().or(zod.z.undefined()).or(zod.z.null()).optional()));
-    }
-}
-
-function normalizeDate$1(input) {
-    return new Date(input.getFullYear(), input.getMonth(), input.getDate());
-}
-function toDate$1(input) {
-    if (typeof input === 'string') {
-        return new Date(input);
-    }
-    if (typeof input === 'number') {
-        return new Date(input);
-    }
-    return input;
-}
-class DatePolicyEvaluator {
-    async can(ctx) {
-        return ctx.config.type === BuiltInPolicyType.DATE;
-    }
-    async validateConfig(ctx) {
-        return this.validator.run(ctx.config);
-    }
-    async validateInput(ctx) {
-        return ctx.input;
-    }
-    async evaluate(ctx) {
-        let now;
-        if (ctx.input.dateTime) {
-            now = normalizeDate$1(toDate$1(ctx.input.dateTime));
-        } else {
-            now = normalizeDate$1(new Date());
-        }
-        if (ctx.config.start) {
-            const start = normalizeDate$1(toDate$1(ctx.config.start));
-            if (now < start) {
-                return maybeInvertPolicyOutcome(false, ctx.config.invert);
-            }
-        }
-        if (ctx.config.end) {
-            const end = normalizeDate$1(toDate$1(ctx.config.end));
-            if (now > end) {
-                return maybeInvertPolicyOutcome(false, ctx.config.invert);
-            }
-        }
-        return maybeInvertPolicyOutcome(true, ctx.config.invert);
-    }
-    constructor(){
-        this.validator = new DatePolicyValidator();
-    }
-}
-
-class IdentityPolicyValidator extends validup.Container {
-    initialize() {
-        this.mount('types', adapterZod.createValidator(zod.z.array(zod.z.string()).or(zod.z.null()).or(zod.z.undefined()).optional()));
-        this.mount('invert', adapterZod.createValidator(zod.z.boolean().or(zod.z.null()).or(zod.z.undefined()).optional()));
-    }
-}
-
-class IdentityPolicyEvaluator {
-    async can(ctx) {
-        return ctx.config.type === BuiltInPolicyType.IDENTITY;
-    }
-    async validateConfig(ctx) {
-        return this.validator.run(ctx.config);
-    }
-    async validateInput(ctx) {
-        return ctx.input;
-    }
-    async evaluate(ctx) {
-        if (!kit.isObject(ctx.input.identity)) {
-            return maybeInvertPolicyOutcome(false, ctx.config.invert);
-        }
-        const types = ctx.config.types || [];
-        if (types.length === 0) {
-            return maybeInvertPolicyOutcome(true, ctx.config.invert);
-        }
-        const typeAllowed = types.indexOf(ctx.input.identity.type) !== -1;
-        return maybeInvertPolicyOutcome(typeAllowed, ctx.config.invert);
-    }
-    constructor(){
-        this.validator = new IdentityPolicyValidator();
-    }
-}
-
-class PermissionBindingPolicyValidator extends validup.Container {
-    initialize() {}
-}
-
-class PermissionBindingPolicyEvaluator {
-    async can(ctx) {
-        return ctx.config.type === BuiltInPolicyType.PERMISSION_BINDING;
-    }
-    async validateConfig(ctx) {
-        return this.validator.run(ctx.config);
-    }
-    async validateInput(ctx) {
-        if (!kit.isObject(ctx.input.identity) && !kit.isObject(ctx.input.permission)) {
-            throw PolicyError.evaluatorContextInvalid();
-        }
-        return ctx.input;
-    }
-    async evaluate(ctx) {
-        // todo: this must be changed when the permission-checker not only checks owned permissions.
-        return maybeInvertPolicyOutcome(true, ctx.config.invert);
-    }
-    constructor(){
-        this.validator = new PermissionBindingPolicyValidator();
-    }
-}
-
-class RealmMatchPolicyValidator extends validup.Container {
-    initialize() {
-        super.initialize();
-        this.mount('decisionStrategy', adapterZod.createValidator(zod.z.nativeEnum(DecisionStrategy).or(zod.z.null()).or(zod.z.undefined()).optional()));
-        this.mount('attributeName', adapterZod.createValidator(zod.z.string().min(3).or(zod.z.array(zod.z.string().min(3))).or(zod.z.null()).or(zod.z.undefined()).optional()));
-        this.mount('attributeNameStrict', adapterZod.createValidator(zod.z.boolean().or(zod.z.null()).or(zod.z.undefined()).optional()));
-        this.mount('attributeNullMatchAll', adapterZod.createValidator(zod.z.boolean().or(zod.z.null()).or(zod.z.undefined()).optional()));
-        this.mount('identityMasterMatchAll', adapterZod.createValidator(zod.z.boolean().or(zod.z.null()).or(zod.z.undefined()).optional()));
-        this.mount('invert', adapterZod.createValidator(zod.z.boolean().or(zod.z.null()).or(zod.z.undefined()).optional()));
-    }
-}
-
-class RealmMatchPolicyEvaluator {
-    async can(ctx) {
-        return ctx.config.type === BuiltInPolicyType.REALM_MATCH;
-    }
-    async validateConfig(ctx) {
-        return this.validator.run(ctx.config);
-    }
-    async validateInput(ctx) {
-        if (!kit.isObject(ctx.input.attributes) || !kit.isObject(ctx.input.identity)) {
-            throw PolicyError.evaluatorContextInvalid();
-        }
-        return ctx.input;
-    }
-    async evaluate(ctx) {
-        if (!ctx.input.attributes || !ctx.input.identity) {
-            throw PolicyError.evaluatorContextInvalid();
-        }
-        const identityMasterMatchAll = ctx.config.identityMasterMatchAll ?? true;
-        if (identityMasterMatchAll && ctx.input.identity.realmName && ctx.input.identity.realmName === 'master') {
-            return maybeInvertPolicyOutcome(true, ctx.config.invert);
-        }
-        let keys;
-        if (ctx.config.attributeName) {
-            if (Array.isArray(ctx.config.attributeName)) {
-                keys = ctx.config.attributeName;
-            } else {
-                keys = [
-                    ctx.config.attributeName
-                ];
-            }
-        } else {
-            keys = [
-                'realm_id',
-                'realm_name',
-                'realmId',
-                'realmName'
-            ];
-            ctx.config.decisionStrategy = DecisionStrategy.CONSENSUS;
-        }
-        const attributeNameStrict = ctx.config.attributeNameStrict ?? true;
-        if (!attributeNameStrict) {
-            const resourceKeys = Object.keys(ctx.input.attributes);
-            const keysToAdd = [];
-            for(let i = 0; i < resourceKeys.length; i++){
-                let contains = false;
-                for(let j = 0; j < keys.length; j++){
-                    if (resourceKeys[i] !== keys[j] && resourceKeys[i].includes(keys[j])) {
-                        contains = true;
-                        break;
-                    }
-                }
-                if (contains) {
-                    keysToAdd.push(resourceKeys[i]);
-                }
-            }
-            if (keysToAdd.length > 0) {
-                keys.push(...keysToAdd);
-            }
-        }
-        let count = 0;
-        for(let i = 0; i < keys.length; i++){
-            if (!kit.hasOwnProperty(ctx.input.attributes, keys[i])) {
-                continue;
-            }
-            let outcome = false;
-            const attributeValue = ctx.input.attributes[keys[i]];
-            if (attributeValue === null && ctx.config.attributeNullMatchAll) {
-                outcome = true;
-            } else if (attributeValue === ctx.input.identity.realmId || attributeValue === ctx.input.identity.realmName) {
-                outcome = true;
-            }
-            if (outcome) {
-                if (ctx.config.decisionStrategy === DecisionStrategy.AFFIRMATIVE) {
-                    return maybeInvertPolicyOutcome(true, ctx.config.invert);
-                }
-                count++;
-            } else {
-                if (ctx.config.decisionStrategy === DecisionStrategy.UNANIMOUS) {
-                    return maybeInvertPolicyOutcome(false, ctx.config.invert);
-                }
-                count--;
-            }
-        }
-        return maybeInvertPolicyOutcome(count > 0, ctx.config.invert);
-    }
-    constructor(){
-        this.validator = new RealmMatchPolicyValidator();
-    }
-}
-
-/*
- * Copyright (c) 2024-2024.
- * Author Peter Placzek (tada5hi)
- * For the full copyright and license information,
- * view the LICENSE file that was distributed with this source code.
- */ var TimePolicyInterval = /*#__PURE__*/ function(TimePolicyInterval) {
-    TimePolicyInterval["DAILY"] = "daily";
-    TimePolicyInterval["WEEKLY"] = "weekly";
-    TimePolicyInterval["MONTHLY"] = "monthly";
-    TimePolicyInterval["YEARLY"] = "yearly";
-    return TimePolicyInterval;
-}({});
-
-function isIntervalForDayOfWeek(interval) {
-    return interval === TimePolicyInterval.WEEKLY || interval === TimePolicyInterval.MONTHLY || interval === TimePolicyInterval.YEARLY;
-}
-function isIntervalForDayOfMonth(interval) {
-    return interval === TimePolicyInterval.MONTHLY || interval === TimePolicyInterval.YEARLY;
-}
-function isIntervalForDayOfYear(interval) {
-    return interval === TimePolicyInterval.YEARLY;
-}
-
-class TimePolicyValidator extends validup.Container {
-    initialize() {
-        super.initialize();
-        this.mount('dayOfWeek', adapterZod.createValidator(zod.z.number().min(0).max(6).or(zod.z.null()).or(zod.z.undefined()).optional()));
-        this.mount('dayOfMonth', adapterZod.createValidator(zod.z.number().min(1).max(31).or(zod.z.null()).or(zod.z.undefined()).optional()));
-        this.mount('dayOfYear', adapterZod.createValidator(zod.z.number().min(1).max(366).or(zod.z.null()).or(zod.z.undefined()).optional()));
-        this.mount('start', adapterZod.createValidator(zod.z.date().or(zod.z.string().datetime()).or(zod.z.string().time()).or(zod.z.number()).or(zod.z.null()).or(zod.z.undefined()).optional()));
-        this.mount('end', adapterZod.createValidator(zod.z.date().or(zod.z.string().datetime()).or(zod.z.string().time()).or(zod.z.number()).or(zod.z.null()).or(zod.z.undefined()).optional()));
-        this.mount('interval', adapterZod.createValidator(zod.z.nativeEnum(TimePolicyInterval).or(zod.z.null()).or(zod.z.undefined()).optional()));
-        this.mount('invert', adapterZod.createValidator(zod.z.boolean().or(zod.z.undefined()).or(zod.z.null()).optional()));
-    }
-}
-
-const timeRegex = /^(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d)?$/;
-function normalizeDate(input, dateRef) {
-    const date = dateRef ? new Date(dateRef) : new Date();
-    date.setHours(input.getHours(), input.getMinutes());
-    return date;
-}
-function toDate(input, dateRef) {
-    if (typeof input === 'string') {
-        if (timeRegex.test(input)) {
-            const [startHours, startMinutes] = input.split(':').map(Number);
-            const date = dateRef ? new Date(dateRef) : new Date();
-            date.setHours(startHours, startMinutes);
-            return date;
-        }
-        return new Date(input);
-    }
-    if (typeof input === 'number') {
-        return new Date(input);
-    }
-    return input;
-}
-class TimePolicyEvaluator {
-    async can(ctx) {
-        return ctx.config.type === BuiltInPolicyType.TIME;
-    }
-    async validateConfig(ctx) {
-        return this.validator.run(ctx.config);
-    }
-    async validateInput(ctx) {
-        return ctx.input;
-    }
-    async evaluate(ctx) {
-        let now;
-        if (ctx.input.dateTime) {
-            now = toDate(ctx.input.dateTime);
-        } else {
-            now = new Date();
-        }
-        if (ctx.config.start) {
-            const start = normalizeDate(toDate(ctx.config.start, now), now);
-            if (now < start) {
-                return maybeInvertPolicyOutcome(false, ctx.config.invert);
-            }
-        }
-        if (ctx.config.end) {
-            const end = normalizeDate(toDate(ctx.config.end, now), now);
-            if (now > end) {
-                return maybeInvertPolicyOutcome(false, ctx.config.invert);
-            }
-        }
-        if (ctx.config.interval) {
-            if (isIntervalForDayOfWeek(ctx.config.interval) && ctx.config.dayOfWeek) {
-                if (now.getDay() !== ctx.config.dayOfWeek) {
-                    return maybeInvertPolicyOutcome(false, ctx.config.invert);
-                }
-            }
-            if (isIntervalForDayOfMonth(ctx.config.interval) && ctx.config.dayOfMonth) {
-                if (now.getDate() !== ctx.config.dayOfMonth) {
-                    return maybeInvertPolicyOutcome(false, ctx.config.invert);
-                }
-            }
-            if (isIntervalForDayOfYear(ctx.config.interval) && ctx.config.dayOfYear) {
-                const start = new Date(now.getFullYear(), 0, 0);
-                const diff = now.getTime() - start.getTime() + (start.getTimezoneOffset() - now.getTimezoneOffset()) * 60 * 1000;
-                const oneDay = 1000 * 60 * 60 * 24;
-                const dayOfYear = Math.floor(diff / oneDay);
-                if (dayOfYear !== ctx.config.dayOfYear) {
-                    return maybeInvertPolicyOutcome(false, ctx.config.invert);
-                }
-            }
-        }
-        return maybeInvertPolicyOutcome(true, ctx.config.invert);
-    }
-    constructor(){
-        this.validator = new TimePolicyValidator();
-    }
-}
-
-/*
- * Copyright (c) 2025.
- * Author Peter Placzek (tada5hi)
- * For the full copyright and license information,
- * view the LICENSE file that was distributed with this source code.
- */ function definePolicyWithType(type, data) {
-    return {
-        ...data,
-        type
-    };
-}
-
-/**
- * The policy engine is a component that interprets defined policies and makes decisions
- * on whether to allow or deny a particular access.
- */ class PolicyEngine {
-    registerEvaluator(type, evaluator) {
-        this.evaluators[type] = evaluator;
-    }
-    registerEvaluators(evaluators) {
-        const keys = Object.keys(evaluators);
-        for(let i = 0; i < keys.length; i++){
-            this.registerEvaluator(keys[i], evaluators[keys[i]]);
-        }
-    }
-    registerDefaultEvaluators() {
-        this.registerEvaluator(BuiltInPolicyType.COMPOSITE, new CompositePolicyEvaluator());
-        this.registerEvaluator(BuiltInPolicyType.ATTRIBUTES, new AttributesPolicyEvaluator());
-        this.registerEvaluator(BuiltInPolicyType.ATTRIBUTE_NAMES, new AttributeNamesPolicyEvaluator());
-        this.registerEvaluator(BuiltInPolicyType.DATE, new DatePolicyEvaluator());
-        this.registerEvaluator(BuiltInPolicyType.IDENTITY, new IdentityPolicyEvaluator());
-        this.registerEvaluator(BuiltInPolicyType.PERMISSION_BINDING, new PermissionBindingPolicyEvaluator());
-        this.registerEvaluator(BuiltInPolicyType.REALM_MATCH, new RealmMatchPolicyEvaluator());
-        this.registerEvaluator(BuiltInPolicyType.TIME, new TimePolicyEvaluator());
-    }
-    /**
-     * @throws PolicyError
-     *
-     * @param ctx
-     */ async evaluate(ctx) {
-        return evaluatePolicy({
-            ...ctx,
-            options: ctx.options || {},
-            evaluators: this.evaluators
-        });
-    }
-    constructor(evaluators = {}){
-        this.evaluators = {};
-        this.registerDefaultEvaluators();
-        this.registerEvaluators(evaluators);
-    }
-}
-
-class PermissionError extends errors.AuthupError {
-    static notFound(name) {
-        return new PermissionError({
-            message: `The permission ${name} was not found.`,
-            code: errors.ErrorCode.PERMISSION_NOT_FOUND
-        });
-    }
-    static denied(name) {
-        return new PermissionError({
-            message: `The permission ${name} has not been granted.`,
-            code: errors.ErrorCode.PERMISSION_DENIED
-        });
-    }
-    static deniedAll(names) {
-        return new PermissionError({
-            message: `None of the permissions ${names.join(', ')} has been granted.`,
-            code: errors.ErrorCode.PERMISSION_DENIED
-        });
-    }
-    static evaluationFailed(options) {
-        const error = new PermissionError({
-            message: `The evaluation of permission ${options.name} failed.`,
-            code: errors.ErrorCode.PERMISSION_EVALUATION_FAILED
-        });
-        if (options.policy) {
-            error.policy = options.policy;
-            if (options.policy.type === BuiltInPolicyType.IDENTITY) {
-                error.statusCode = 401;
-            }
-        }
-        if (options.policyError) {
-            error.policyError = options.policyError;
-        }
-        return error;
-    }
-    constructor(options = {}){
-        super({
-            ...options,
-            message: options.message || 'A permission error occurred.',
-            statusCode: options.statusCode || 403
-        });
-    }
-}
-
-/*
- * Copyright (c) 2025.
- * Author Peter Placzek (tada5hi)
- * For the full copyright and license information,
- * view the LICENSE file that was distributed with this source code.
- */ function buildPermissionItemKey(input) {
-    return `${input.realmId || '_'}/${input.clientId || '_'}/${input.name}`;
-}
-
-/*
- * Copyright (c) 2024-2024.
- * Author Peter Placzek (tada5hi)
- * For the full copyright and license information,
- * view the LICENSE file that was distributed with this source code.
- */ function isPermissionItemEqual(a, b) {
-    if (a.name !== b.name) {
-        return false;
-    }
-    if (typeof a.realmId === 'string' || typeof b.realmId === 'string') {
-        return a.realmId === b.realmId;
-    }
-    if (typeof a.clientId === 'string' || typeof b.clientId === 'string') {
-        return a.clientId === b.clientId;
-    }
-    return !!a.realmId === !!b.realmId && !!a.clientId === !!b.clientId;
-}
-
-function mergePermissionItems(input) {
-    const grouped = input.reduce((previous, current)=>{
-        const key = buildPermissionItemKey(current);
-        if (!previous[key]) {
-            previous[key] = [];
-        }
-        previous[key].push(current);
-        return previous;
-    }, {});
-    const output = [];
-    const keys = Object.keys(grouped);
-    for(let i = 0; i < keys.length; i++){
-        const [permission, ...permissions] = grouped[keys[i]];
-        if (permissions.length > 0) {
-            const policy = {
-                type: BuiltInPolicyType.COMPOSITE,
-                decisionStrategy: DecisionStrategy.AFFIRMATIVE,
-                children: permissions.map((el)=>el.policy).filter((el)=>typeof el !== 'undefined')
-            };
-            if (permission.policy) {
-                policy.children.push(permission.policy);
-            }
-            if (policy.children.length > 0) {
-                permission.policy = policy;
-            }
-        }
-        output.push(permission);
-    }
-    return output;
-}
-
-class PermissionMemoryProvider {
-    async get(options) {
-        return this.items[buildPermissionItemKey(options)];
-    }
-    setMany(input) {
-        this.items = mergePermissionItems(input).reduce((prev, current)=>{
-            prev[buildPermissionItemKey(current)] = current;
-            return prev;
-        }, {});
-    }
-    constructor(items = []){
-        this.items = {};
-        this.setMany(items);
-    }
-}
-
-class PermissionChecker {
-    // ----------------------------------------------
-    /**
-     * Get a permission.
-     *
-     * @param input
-     */ async get(input) {
-        const options = {
-            name: input
-        };
-        if (this.clientId) {
-            options.clientId = this.clientId;
-        }
-        if (this.realmId) {
-            options.realmId = this.realmId;
-        }
-        return this.provider.get(options);
-    }
-    // ----------------------------------------------
-    /**
-     * Verify if one or more possible owned permissions satisfy their conditions.
-     *
-     * @throws PermissionError
-     *
-     * @param ctx
-     */ async check(ctx) {
-        if (!Array.isArray(ctx.name)) {
-            await this.check({
-                ...ctx,
-                name: [
-                    ctx.name
-                ]
-            });
-            return;
-        }
-        const { options = {} } = ctx;
-        const decisionStrategy = options.decisionStrategy ?? DecisionStrategy.UNANIMOUS;
-        let lastError;
-        let count = 0;
-        for(let i = 0; i < ctx.name.length; i++){
-            const entity = await this.get(ctx.name[i]);
-            if (!entity) {
-                lastError = PermissionError.notFound(ctx.name[i]);
-                if (decisionStrategy === DecisionStrategy.UNANIMOUS) {
-                    throw lastError;
-                }
-                continue;
-            }
-            if (!entity.policy) {
-                if (decisionStrategy === DecisionStrategy.AFFIRMATIVE) {
-                    return;
-                }
-                count++;
-                continue;
-            }
-            let outcome;
-            try {
-                outcome = await this.policyEngine.evaluate({
-                    input: {
-                        ...ctx.input || {},
-                        permission: entity
-                    },
-                    config: entity.policy,
-                    options: {
-                        include: options.policiesIncluded,
-                        exclude: options.policiesExcluded
-                    }
-                });
-            } catch (e) {
-                if (e instanceof PolicyError) {
-                    lastError = PermissionError.evaluationFailed({
-                        name: entity.name,
-                        policy: entity.policy,
-                        policyError: e
-                    });
-                } else {
-                    lastError = PermissionError.evaluationFailed({
-                        name: entity.name,
-                        policy: entity.policy
-                    });
-                }
-                outcome = false;
-            }
-            if (outcome) {
-                if (decisionStrategy === DecisionStrategy.AFFIRMATIVE) {
-                    return;
-                }
-                count++;
-            } else {
-                if (!lastError) {
-                    lastError = PermissionError.evaluationFailed({
-                        name: entity.name,
-                        policy: entity.policy
-                    });
-                }
-                if (decisionStrategy === DecisionStrategy.UNANIMOUS) {
-                    throw lastError;
-                }
-                count--;
-            }
-        }
-        if (count > 0) {
-            return;
-        }
-        if (count > 1 || !lastError) {
-            throw PermissionError.deniedAll(ctx.name);
-        } else {
-            throw lastError;
-        }
-    }
-    /**
-     * Verify if one of the permissions evaluates to true.
-     *
-     * @throws PermissionError
-     *
-     * @param ctx
-     */ async checkOneOf(ctx) {
-        return this.check({
-            ...ctx,
-            options: {
-                ...ctx.options || {},
-                decisionStrategy: DecisionStrategy.AFFIRMATIVE
-            }
-        });
-    }
-    // ----------------------------------------------
-    async preCheck(ctx) {
-        return this.check({
-            ...ctx,
-            options: {
-                ...ctx.options || {},
-                policiesExcluded: [
-                    BuiltInPolicyType.ATTRIBUTES,
-                    BuiltInPolicyType.ATTRIBUTE_NAMES,
-                    BuiltInPolicyType.REALM_MATCH
-                ]
-            }
-        });
-    }
-    async preCheckOneOf(ctx) {
-        return this.preCheck({
-            ...ctx,
-            options: {
-                ...ctx.options || {},
-                decisionStrategy: DecisionStrategy.AFFIRMATIVE
-            }
-        });
-    }
-    // ----------------------------------------------
-    constructor(options = {}){
-        if (options.provider) {
-            this.provider = options.provider;
-        } else {
-            this.provider = new PermissionMemoryProvider();
-        }
-        if (options.clientId) {
-            this.clientId = options.clientId;
-        }
-        if (options.realmId) {
-            this.realmId = options.realmId;
-        }
-        if (options.policyEngine) {
-            this.policyEngine = options.policyEngine;
-        } else {
-            this.policyEngine = new PolicyEngine();
-        }
-    }
-}
-
-exports.AttributeNamesPolicyEvaluator = AttributeNamesPolicyEvaluator;
-exports.AttributeNamesPolicyValidator = AttributeNamesPolicyValidator;
-exports.AttributesPolicyEvaluator = AttributesPolicyEvaluator;
-exports.AttributesPolicyValidator = AttributesPolicyValidator;
-exports.BuiltInPolicyType = BuiltInPolicyType;
-exports.CompositePolicyEvaluator = CompositePolicyEvaluator;
-exports.CompositePolicyValidator = CompositePolicyValidator;
-exports.DatePolicyEvaluator = DatePolicyEvaluator;
-exports.DatePolicyValidator = DatePolicyValidator;
-exports.DecisionStrategy = DecisionStrategy;
-exports.IdentityPolicyEvaluator = IdentityPolicyEvaluator;
-exports.IdentityPolicyValidator = IdentityPolicyValidator;
-exports.PermissionBindingPolicyEvaluator = PermissionBindingPolicyEvaluator;
-exports.PermissionBindingPolicyValidator = PermissionBindingPolicyValidator;
-exports.PermissionChecker = PermissionChecker;
-exports.PermissionError = PermissionError;
-exports.PermissionMemoryProvider = PermissionMemoryProvider;
-exports.PolicyDataIdentityValidator = PolicyDataIdentityValidator;
-exports.PolicyDataPermissionValidator = PolicyDataPermissionValidator;
-exports.PolicyDataValidator = PolicyDataValidator;
-exports.PolicyEngine = PolicyEngine;
-exports.PolicyError = PolicyError;
-exports.RealmMatchPolicyEvaluator = RealmMatchPolicyEvaluator;
-exports.RealmMatchPolicyValidator = RealmMatchPolicyValidator;
-exports.TimePolicyEvaluator = TimePolicyEvaluator;
-exports.TimePolicyInterval = TimePolicyInterval;
-exports.TimePolicyValidator = TimePolicyValidator;
-exports.buildPermissionItemKey = buildPermissionItemKey;
-exports.defineAttributesPolicy = defineAttributesPolicy;
-exports.definePolicyWithType = definePolicyWithType;
-exports.evaluatePolicy = evaluatePolicy;
-exports.isCompositePolicy = isCompositePolicy;
-exports.isIntervalForDayOfMonth = isIntervalForDayOfMonth;
-exports.isIntervalForDayOfWeek = isIntervalForDayOfWeek;
-exports.isIntervalForDayOfYear = isIntervalForDayOfYear;
-exports.isPermissionItemEqual = isPermissionItemEqual;
-exports.maybeInvertPolicyOutcome = maybeInvertPolicyOutcome;
-exports.mergePermissionItems = mergePermissionItems;
-//# sourceMappingURL=index.cjs.map