@authup/access 1.0.0-beta.27 → 1.0.0-beta.29

package/dist/index.mjs

@@ -1,28 +1,101 @@
 import { AuthupError, ErrorCode } from '@authup/errors';
+import { defineIssueItem, defineIssueGroup, Container } from 'validup';
 import { isObject, flattenObject, hasOwnProperty } from '@authup/kit';
 import { createValidator } from '@validup/adapter-zod';
-import { Container } from 'validup';
 import { z } from 'zod';
 import { guard } from '@ucast/mongo2js';
 
-class PolicyError extends AuthupError {
-    static evaluatorNotFound(type) {
-        return new PolicyError(`No evaluator is registered to handle the policy: ${type}`, ErrorCode.POLICY_EVALUATOR_NOT_FOUND);
+class PermissionError extends AuthupError {
+    constructor(options = {}){
+        super({
+            ...options,
+            message: options.message || 'A permission error occurred.',
+            statusCode: options.statusCode || 403
+        });
     }
-    static evaluatorNotProcessable() {
-        throw new PolicyError('The evaluator can not process the policy.', ErrorCode.POLICY_EVALUATOR_NOT_PROCESSABLE);
+    addIssue(data) {
+        this.issues.push(data);
     }
-    static evaluatorContextInvalid() {
-        throw new PolicyError('The evaluator context is not valid.', ErrorCode.POLICY_EVALUATOR_CONTEXT_INVALID);
+    addIssues(data) {
+        this.issues.push(...data);
     }
-    constructor(message, code){
-        super({
-            message,
-            code
+    static notFound(name) {
+        return new PermissionError({
+            message: `The permission ${name} was not found.`,
+            code: ErrorCode.PERMISSION_NOT_FOUND
+        });
+    }
+    static denied(name) {
+        return new PermissionError({
+            message: `The permission ${name} has not been granted.`,
+            code: ErrorCode.PERMISSION_DENIED
+        });
+    }
+    static deniedAll(names) {
+        return new PermissionError({
+            message: `None of the permissions ${names.join(', ')} has been granted.`,
+            code: ErrorCode.PERMISSION_DENIED
+        });
+    }
+    static evaluationFailed(name) {
+        if (Array.isArray(name)) {
+            return new PermissionError({
+                message: `The evaluation of permissions ${name.join(', ')} failed`,
+                code: ErrorCode.PERMISSION_EVALUATION_FAILED
+            });
+        }
+        return new PermissionError({
+            message: `The evaluation of permission ${name} failed`,
+            code: ErrorCode.PERMISSION_EVALUATION_FAILED
         });
     }
 }
 
+/*
+ * Copyright (c) 2025.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */ function buildPermissionItemKey(input) {
+    return `${input.realmId || '_'}/${input.clientId || '_'}/${input.name}`;
+}
+
+/*
+ * Copyright (c) 2024-2024.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */ function isPermissionItemEqual(a, b) {
+    if (a.name !== b.name) {
+        return false;
+    }
+    if (typeof a.realmId === 'string' || typeof b.realmId === 'string') {
+        return a.realmId === b.realmId;
+    }
+    if (typeof a.clientId === 'string' || typeof b.clientId === 'string') {
+        return a.clientId === b.clientId;
+    }
+    return !!a.realmId === !!b.realmId && !!a.clientId === !!b.clientId;
+}
+
+/*
+ * Copyright (c) 2024-2024.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */ var DecisionStrategy = /*#__PURE__*/ function(DecisionStrategy) {
+    /**
+     * One or more positive
+     */ DecisionStrategy["AFFIRMATIVE"] = "affirmative";
+    /**
+     * All positive
+     */ DecisionStrategy["UNANIMOUS"] = "unanimous";
+    /**
+     * More positive than negative
+     */ DecisionStrategy["CONSENSUS"] = "consensus";
+    return DecisionStrategy;
+}({});
+
 /*
  * Copyright (c) 2024-2024.
  * Author Peter Placzek (tada5hi)
@@ -41,6 +114,226 @@ class PolicyError extends AuthupError {
     return !outcome;
 }
 
+class PolicyError extends AuthupError {
+    constructor(message, code){
+        super({
+            message,
+            code
+        });
+    }
+    addIssue(data) {
+        this.issues.push(data);
+    }
+    addIssues(data) {
+        this.issues.push(...data);
+    }
+    static evaluatorNotFound(type) {
+        return new PolicyError(`No evaluator is registered to handle the policy: ${type}`, ErrorCode.POLICY_EVALUATOR_NOT_FOUND);
+    }
+    static evaluatorNotProcessable() {
+        return new PolicyError('The evaluator can not process the policy.', ErrorCode.POLICY_EVALUATOR_NOT_PROCESSABLE);
+    }
+    static evaluatorContextInvalid() {
+        return new PolicyError('The evaluator context is not valid.', ErrorCode.POLICY_EVALUATOR_CONTEXT_INVALID);
+    }
+}
+
+/**
+ * The policy engine is a component that interprets defined policies and makes decisions
+ * on whether to allow or deny a particular access.
+ */ class PolicyEngine {
+    evaluators;
+    constructor(evaluators = {}){
+        this.evaluators = evaluators;
+    }
+    registerEvaluator(type, evaluator) {
+        this.evaluators[type] = evaluator;
+    }
+    registerEvaluators(evaluators) {
+        const keys = Object.keys(evaluators);
+        for(let i = 0; i < keys.length; i++){
+            this.registerEvaluator(keys[i], evaluators[keys[i]]);
+        }
+    }
+    /**
+     * @param policy
+     * @param ctx
+     */ async evaluate(policy, ctx) {
+        if (ctx.exclude && ctx.exclude.length > 0 && ctx.exclude.indexOf(policy.type) !== -1) {
+            return {
+                success: maybeInvertPolicyOutcome(true, policy.invert)
+            };
+        }
+        if (ctx.include && ctx.include.length > 0 && ctx.include.indexOf(policy.type) === -1) {
+            return {
+                success: maybeInvertPolicyOutcome(true, policy.invert)
+            };
+        }
+        const issues = [];
+        const evaluator = this.evaluators[policy.type];
+        if (!evaluator) {
+            // todo: add issue here instead + return false ?
+            issues.push(defineIssueItem({
+                path: [
+                    policy.type
+                ],
+                message: `The policy ${policy.type} can not be handled by any evaluator.`,
+                code: ErrorCode.POLICY_EVALUATOR_NOT_FOUND
+            }));
+            return {
+                success: maybeInvertPolicyOutcome(false, policy.invert),
+                issues
+            };
+        }
+        try {
+            return await evaluator.evaluate(policy, {
+                ...ctx,
+                evaluators: {
+                    ...this.evaluators,
+                    ...ctx.evaluators || {}
+                }
+            });
+        } catch (e) {
+            issues.push(defineIssueItem({
+                path: [
+                    policy.type
+                ],
+                message: `The ${policy.type} evaluator can not process the policy specification.`,
+                code: ErrorCode.POLICY_EVALUATOR_NOT_PROCESSABLE
+            }));
+            return {
+                success: maybeInvertPolicyOutcome(false, policy.invert),
+                issues
+            };
+        }
+    }
+    async evaluateOrFail(policy, ctx) {
+        const issues = [];
+        try {
+            const outcome = await this.evaluate(policy, ctx);
+            if (outcome.success) {
+                return;
+            }
+            if (outcome.issues) {
+                issues.push(...outcome.issues);
+            }
+        } catch (e) {
+            if (e instanceof PolicyError) {
+                throw e;
+            }
+        }
+        const error = new PolicyError(`The policy ${policy.type} evaluation failed.`);
+        error.addIssues(issues);
+        throw error;
+    }
+}
+
+/*
+ * Copyright (c) 2026.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */ class PolicyData {
+    data;
+    validated;
+    constructor(data = {}, validated = new Set()){
+        this.data = data;
+        this.validated = validated;
+    }
+    set(key, value) {
+        this.data[key] = value;
+        this.validated.delete(key);
+    }
+    get(key) {
+        if (key in this.data) {
+            return this.data[key];
+        }
+        throw new Error(`Policy data item ${key} does not exist.`);
+    }
+    has(key) {
+        return key in this.data;
+    }
+    setValidated(key) {
+        this.validated.add(key);
+    }
+    isValidated(key) {
+        return this.validated.has(key);
+    }
+    clone() {
+        return new PolicyData({
+            ...this.data
+        }, new Set(this.validated));
+    }
+}
+
+function definePolicyEvaluationContext(input = {}) {
+    return {
+        evaluators: input.evaluators || {},
+        path: input.path || [],
+        data: input.data || new PolicyData(),
+        include: input.include || [],
+        exclude: input.exclude || []
+    };
+}
+
+/*
+ * Copyright (c) 2026-2026.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */ var PolicyIssueSeverity = /*#__PURE__*/ function(PolicyIssueSeverity) {
+    PolicyIssueSeverity["WARNING"] = "warning";
+    PolicyIssueSeverity["ERROR"] = "error";
+    return PolicyIssueSeverity;
+}({});
+var PolicyIssueCode = /*#__PURE__*/ function(PolicyIssueCode) {
+    // Data/Input
+    PolicyIssueCode["DATA_MISSING"] = "DATA_MISSING";
+    PolicyIssueCode["DATA_INVALID"] = "DATA_INVALID";
+    // Policy Spec / Config
+    PolicyIssueCode["INVALID"] = "INVALID";
+    PolicyIssueCode["TYPE_UNKNOWN"] = "TYPE_UNKNOWN";
+    PolicyIssueCode["FIELD_MISSING"] = "FIELD_MISSING";
+    PolicyIssueCode["FIELD_INVALID"] = "FIELD_INVALID";
+    // Composite / Tree evaluation
+    PolicyIssueCode["CHILD_INVALID"] = "CHILD_INVALID";
+    PolicyIssueCode["CHILD_EVALUATION_FAILED"] = "CHILD_EVALUATION_FAILED";
+    // Engine / Evaluator registry
+    PolicyIssueCode["EVALUATION_DENIED"] = "EVALUATION_DENIED";
+    PolicyIssueCode["EVALUATOR_NOT_FOUND"] = "EVALUATOR_NOT_FOUND";
+    PolicyIssueCode["EVALUATOR_ERROR"] = "EVALUATOR_ERROR";
+    // Execution control
+    PolicyIssueCode["SKIPPED_EXCLUDED"] = "SKIPPED_EXCLUDED";
+    PolicyIssueCode["SKIPPED_NOT_INCLUDED"] = "SKIPPED_NOT_INCLUDED";
+    // Internal / unexpected
+    PolicyIssueCode["INTERNAL_ERROR"] = "INTERNAL_ERROR";
+    return PolicyIssueCode;
+}({});
+
+function definePolicyIssueItem(input) {
+    return defineIssueItem(input);
+}
+function definePolicyIssueGroup(input) {
+    return defineIssueGroup(input);
+}
+
+class AttributeNamesPolicyValidator extends Container {
+    initialize() {
+        super.initialize();
+        this.mount('names', createValidator(z.array(z.string().min(3).max(128))));
+        this.mount('invert', createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
+    }
+}
+
+/*
+ * Copyright (c) 2025.
+ * Author Peter Placzek (tada5hi)
+ * For the full copyright and license information,
+ * view the LICENSE file that was distributed with this source code.
+ */ function defineAttributesPolicy(data) {
+    return data;
+}
+
 /*
  * Copyright (c) 2024-2024.
  * Author Peter Placzek (tada5hi)
@@ -74,277 +367,218 @@ class PolicyError extends AuthupError {
     return BuiltInPolicyType;
 }({});
 
-class AttributeNamesPolicyValidator extends Container {
-    initialize() {
-        super.initialize();
-        this.mount('names', createValidator(z.array(z.string().min(3).max(128))));
-        this.mount('invert', createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
-    }
-}
-
-class AttributeNamesPolicyEvaluator {
-    async can(ctx) {
-        return ctx.config.type === BuiltInPolicyType.ATTRIBUTE_NAMES;
-    }
-    async validateConfig(ctx) {
-        return this.validator.run(ctx.config);
-    }
-    async validateInput(ctx) {
-        if (!isObject(ctx.input.attributes)) {
-            throw PolicyError.evaluatorContextInvalid();
-        }
-        return ctx.input;
-    }
-    async evaluate(ctx) {
-        if (!ctx.input.attributes) {
-            throw PolicyError.evaluatorContextInvalid();
-        }
-        const attributes = flattenObject(ctx.input.attributes);
-        const keys = Object.keys(attributes);
-        for(let i = 0; i < keys.length; i++){
-            const index = ctx.config.names.indexOf(keys[i]);
-            if (index === -1) {
-                return maybeInvertPolicyOutcome(false, ctx.config.invert);
-            }
-        }
-        return maybeInvertPolicyOutcome(true, ctx.config.invert);
-    }
-    constructor(){
-        this.validator = new AttributeNamesPolicyValidator();
-    }
-}
-
-/*
- * Copyright (c) 2025.
- * Author Peter Placzek (tada5hi)
- * For the full copyright and license information,
- * view the LICENSE file that was distributed with this source code.
- */ function defineAttributesPolicy(data) {
-    return data;
-}
-
 class AttributesPolicyValidator extends Container {
     initialize() {
         super.initialize();
-        this.mount('query', createValidator(z.object({}).passthrough()));
+        this.mount('query', createValidator(z.looseObject({})));
         this.mount('invert', createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
     }
 }
 
 class AttributesPolicyEvaluator {
-    async can(ctx) {
-        return ctx.config.type === BuiltInPolicyType.ATTRIBUTES;
-    }
-    async validateConfig(ctx) {
-        return this.validator.run(ctx.config);
+    validator;
+    constructor(){
+        this.validator = new AttributesPolicyValidator();
     }
-    async validateInput(ctx) {
-        if (!isObject(ctx.input.attributes)) {
-            throw PolicyError.evaluatorContextInvalid();
+    async accessData(ctx) {
+        if (!ctx.data.has(BuiltInPolicyType.ATTRIBUTES)) {
+            return null;
         }
-        return ctx.input;
-    }
-    async evaluate(ctx) {
-        if (!ctx.input.attributes) {
-            throw PolicyError.evaluatorContextInvalid();
+        if (ctx.data.isValidated(BuiltInPolicyType.ATTRIBUTES)) {
+            return ctx.data.get(BuiltInPolicyType.ATTRIBUTES);
+        }
+        // todo: run validator on attributes (isObject ...)
+        const data = ctx.data.get(BuiltInPolicyType.ATTRIBUTES);
+        ctx.data.set(BuiltInPolicyType.ATTRIBUTES, data);
+        ctx.data.setValidated(BuiltInPolicyType.ATTRIBUTES);
+        return data;
+    }
+    async evaluate(value, ctx) {
+        // todo: catch errors + transform to issue(s)
+        const policy = await this.validator.run(value);
+        const data = await this.accessData(ctx);
+        if (!data) {
+            return {
+                success: false,
+                issues: [
+                    definePolicyIssueItem({
+                        code: PolicyIssueCode.DATA_MISSING,
+                        message: 'The data property attributes is missing',
+                        path: ctx.path
+                    })
+                ]
+            };
         }
-        this.fixQuery(ctx.config.query);
-        const testIt = guard(ctx.config.query);
-        return maybeInvertPolicyOutcome(testIt(ctx.input.attributes), ctx.config.invert);
+        this.fixQuery(policy.query);
+        const testIt = guard(policy.query);
+        return {
+            success: maybeInvertPolicyOutcome(testIt(data), policy.invert)
+        };
     }
     fixQuery(query) {
-        const keys = Object.keys(query);
-        for(let i = 0; i < keys.length; i++){
-            const key = keys[i];
-            const value = query[key];
-            if (isObject(value) || Array.isArray(value)) {
-                this.fixQuery(value);
-                continue;
+        if (Array.isArray(query)) {
+            for(let i = 0; i < query.length; i++){
+                this.fixQuery(query[i]);
             }
-            if (key === '$regex' && typeof value === 'string') {
-                const fragments = value.match(/\/(.*?)\/([a-z]*)?$/i);
-                if (fragments) {
-                    query[key] = new RegExp(fragments[1], fragments[2]);
+            return;
+        }
+        if (isObject(query)) {
+            const keys = Object.keys(query);
+            for(let i = 0; i < keys.length; i++){
+                const key = keys[i];
+                const value = query[key];
+                if (isObject(value) || Array.isArray(value)) {
+                    this.fixQuery(value);
+                    continue;
+                }
+                if (key === '$regex' && typeof value === 'string') {
+                    const fragments = value.match(/\/(.*?)\/([a-z]*)?$/i);
+                    if (fragments) {
+                        query[key] = new RegExp(fragments[1], fragments[2]);
+                    }
                 }
             }
         }
     }
-    constructor(){
-        this.validator = new AttributesPolicyValidator();
-    }
 }
 
-/*
- * Copyright (c) 2024-2024.
- * Author Peter Placzek (tada5hi)
- * For the full copyright and license information,
- * view the LICENSE file that was distributed with this source code.
- */ var DecisionStrategy = /*#__PURE__*/ function(DecisionStrategy) {
-    /**
-     * One or more positive
-     */ DecisionStrategy["AFFIRMATIVE"] = "affirmative";
-    /**
-     * All positive
-     */ DecisionStrategy["UNANIMOUS"] = "unanimous";
-    /**
-     * More positive than negative
-     */ DecisionStrategy["CONSENSUS"] = "consensus";
-    return DecisionStrategy;
-}({});
-
-class PolicyDataIdentityValidator extends Container {
-    initialize() {
-        super.initialize();
-        this.mount('type', createValidator(z.string().min(3).max(128)));
-        this.mount('id', createValidator(z.string().uuid()));
-        this.mount('clientId', createValidator(z.string().uuid().or(z.null()).or(z.undefined()).optional()));
-        this.mount('realmId', createValidator(z.string().uuid().or(z.null()).or(z.undefined()).optional()));
-        this.mount('realmName', createValidator(z.string().min(3).max(128).or(z.null()).or(z.undefined()).optional()));
-    }
-}
-
-class PolicyDataPermissionValidator extends Container {
-    initialize() {
-        super.initialize();
-        this.mount('name', createValidator(z.string().min(3).max(256)));
-        this.mount('clientId', createValidator(z.string().uuid().or(z.null()).or(z.undefined()).optional()));
-        this.mount('realmId', createValidator(z.string().uuid().or(z.null()).or(z.undefined()).optional()));
-        this.mount('policy', createValidator(z.object({
-            type: z.string()
-        }).optional()));
-    }
-}
-
-class PolicyDataValidator extends Container {
-    initialize() {
-        super.initialize();
-        // todo: optionalValue should be null
-        const identity = new PolicyDataIdentityValidator();
-        this.mount('identity', {
-            optional: true,
-            optionalValue: 'undefined',
-            optionalInclude: true
-        }, identity);
-        // todo: optionalValue should be null
-        const permission = new PolicyDataPermissionValidator();
-        this.mount('permission', {
-            optional: true,
-            optionalValue: 'undefined',
-            optionalInclude: true
-        }, permission);
-        this.mount('attributes', createValidator(z.object({}).optional()));
-        this.mount('dateTime', createValidator(z.date().or(z.string()).or(z.number()).optional()));
-    }
-}
-
-async function evaluatePolicy(ctx) {
-    if (ctx.options.exclude && ctx.options.exclude.length > 0 && ctx.options.exclude.indexOf(ctx.config.type) !== -1) {
-        if (typeof ctx.config.invert === 'boolean') {
-            return maybeInvertPolicyOutcome(true, ctx.config.invert);
-        }
-        return true;
-    }
-    if (ctx.options.include && ctx.options.include.length > 0 && ctx.options.include.indexOf(ctx.config.type) === -1) {
-        if (typeof ctx.config.invert === 'boolean') {
-            return maybeInvertPolicyOutcome(true, ctx.config.invert);
-        }
-        return true;
-    }
-    const evaluator = ctx.evaluators[ctx.config.type];
-    if (!evaluator) {
-        throw PolicyError.evaluatorNotFound(ctx.config.type);
-    }
-    try {
-        const canEvaluate = await evaluator.can(ctx);
-        if (canEvaluate) {
-            const config = await evaluator.validateConfig(ctx);
-            const input = await evaluator.validateInput(ctx);
-            return await evaluator.evaluate({
-                ...ctx,
-                input,
-                config
-            });
-        }
-    } catch (e) {
-        if (e instanceof PolicyError) {
-            throw e;
+class AttributeNamesPolicyEvaluator {
+    validator;
+    attributesEvaluator;
+    constructor(){
+        this.validator = new AttributeNamesPolicyValidator();
+        this.attributesEvaluator = new AttributesPolicyEvaluator();
+    }
+    async evaluate(value, ctx) {
+        // todo: catch errors + transform to issue(s)
+        const policy = await this.validator.run(value);
+        const data = await this.attributesEvaluator.accessData(ctx);
+        if (!data) {
+            return {
+                success: false,
+                issues: [
+                    definePolicyIssueItem({
+                        code: PolicyIssueCode.DATA_MISSING,
+                        message: 'The data property attributes is missing',
+                        path: ctx.path
+                    })
+                ]
+            };
         }
-        if (e instanceof Error) {
-            const error = new PolicyError(e.message);
-            error.stack = e.stack;
-            throw error;
+        const attributes = flattenObject(data);
+        const keys = Object.keys(attributes);
+        const issues = [];
+        for(let i = 0; i < keys.length; i++){
+            const index = policy.names.indexOf(keys[i]);
+            if (index === -1) {
+                issues.push(definePolicyIssueItem({
+                    code: PolicyIssueCode.EVALUATION_DENIED,
+                    message: `The attribute ${keys[i]} is not included`,
+                    path: [
+                        ...ctx.path,
+                        keys[i]
+                    ]
+                }));
+            }
         }
-        throw new PolicyError();
+        return {
+            success: maybeInvertPolicyOutcome(issues.length === 0, policy.invert),
+            issues
+        };
     }
-    throw PolicyError.evaluatorNotProcessable();
-}
-
-function isCompositePolicy(input) {
-    return input.type === BuiltInPolicyType.COMPOSITE;
 }
 
 class CompositePolicyValidator extends Container {
     initialize() {
         super.initialize();
-        this.mount('decisionStrategy', createValidator(z.nativeEnum(DecisionStrategy).or(z.null()).or(z.undefined()).optional()));
-        this.mount('children', createValidator(z.array(z.object({
+        this.mount('decisionStrategy', createValidator(z.enum(DecisionStrategy).or(z.null()).or(z.undefined()).optional()));
+        this.mount('children', createValidator(z.array(z.looseObject({
             type: z.string().min(3)
-        }).passthrough())));
+        }))));
         this.mount('invert', createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
     }
 }
 
 class CompositePolicyEvaluator {
-    async can(ctx) {
-        return isCompositePolicy(ctx.config);
-    }
-    async validateConfig(ctx) {
-        return this.validator.run(ctx.config);
-    }
-    async validateInput(ctx) {
-        return ctx.input;
+    validator;
+    constructor(){
+        this.validator = new CompositePolicyValidator();
     }
-    async evaluate(ctx) {
+    async evaluate(value, ctx) {
+        // todo: catch errors + transform to issue(s)
+        const policy = await this.validator.run(value);
         let count = 0;
-        const decisionStrategy = ctx.config.decisionStrategy ?? DecisionStrategy.UNANIMOUS;
-        for(let i = 0; i < ctx.config.children.length; i++){
-            const childPolicy = ctx.config.children[i];
-            let outcome;
-            if (isCompositePolicy(childPolicy)) {
-                outcome = await this.evaluate({
-                    ...ctx,
-                    config: childPolicy
-                });
-            } else {
-                outcome = await evaluatePolicy({
-                    ...ctx,
-                    config: childPolicy
-                });
-            }
-            if (outcome) {
+        const decisionStrategy = policy.decisionStrategy ?? DecisionStrategy.UNANIMOUS;
+        const engine = new PolicyEngine(ctx.evaluators);
+        const issues = [];
+        for(let i = 0; i < policy.children.length; i++){
+            const childPolicy = policy.children[i];
+            const path = [
+                ...ctx.path || [],
+                childPolicy.type
+            ];
+            const outcome = await engine.evaluate(childPolicy, {
+                ...ctx,
+                path
+            });
+            if (outcome.success) {
                 if (decisionStrategy === DecisionStrategy.AFFIRMATIVE) {
-                    return maybeInvertPolicyOutcome(true, ctx.config.invert);
+                    return {
+                        success: maybeInvertPolicyOutcome(true, policy.invert),
+                        issues: []
+                    };
                 }
                 count++;
             } else {
+                if (outcome.issues) {
+                    issues.push(defineIssueGroup({
+                        message: `The evaluation of child policy ${childPolicy.type} failed`,
+                        issues: outcome.issues || [],
+                        path
+                    }));
+                }
                 if (decisionStrategy === DecisionStrategy.UNANIMOUS) {
-                    return maybeInvertPolicyOutcome(false, ctx.config.invert);
+                    return {
+                        success: maybeInvertPolicyOutcome(false, policy.invert),
+                        issues: [
+                            defineIssueGroup({
+                                message: `The evaluation of composite policy failed (${DecisionStrategy.UNANIMOUS})`,
+                                issues,
+                                path: ctx.path
+                            })
+                        ]
+                    };
                 }
                 count--;
             }
         }
-        return maybeInvertPolicyOutcome(count > 0, ctx.config.invert);
-    }
-    constructor(){
-        this.validator = new CompositePolicyValidator();
+        if (count > 0) {
+            return {
+                success: maybeInvertPolicyOutcome(true, policy.invert)
+            };
+        }
+        return {
+            success: maybeInvertPolicyOutcome(false, policy.invert),
+            issues: [
+                defineIssueGroup({
+                    message: `The evaluation of composite policy failed (${DecisionStrategy.CONSENSUS})`,
+                    issues: issues || [],
+                    path: ctx.path
+                })
+            ]
+        };
     }
 }
 
+function isCompositePolicy(input) {
+    return input.type === BuiltInPolicyType.COMPOSITE;
+}
+
 class DatePolicyValidator extends Container {
     initialize() {
         super.initialize();
-        this.mount('start', createValidator(z.date().or(z.string().date()).or(z.number()).or(z.null()).or(z.undefined()).optional()));
-        this.mount('end', createValidator(z.date().or(z.string().date()).or(z.number()).or(z.null()).or(z.undefined()).optional()));
+        this.mount('start', createValidator(z.date().or(z.iso.date()).or(z.number()).or(z.null()).or(z.undefined()).optional()));
+        this.mount('end', createValidator(z.date().or(z.iso.date()).or(z.number()).or(z.null()).or(z.undefined()).optional()));
         this.mount('invert', createValidator(z.boolean().or(z.undefined()).or(z.null()).optional()));
     }
 }
@@ -362,38 +596,56 @@ function toDate$1(input) {
     return input;
 }
 class DatePolicyEvaluator {
-    async can(ctx) {
-        return ctx.config.type === BuiltInPolicyType.DATE;
-    }
-    async validateConfig(ctx) {
-        return this.validator.run(ctx.config);
-    }
-    async validateInput(ctx) {
-        return ctx.input;
+    validator;
+    constructor(){
+        this.validator = new DatePolicyValidator();
     }
-    async evaluate(ctx) {
+    async evaluate(value, ctx) {
+        // todo: catch errors + transform to issue(s)
+        const policy = await this.validator.run(value);
         let now;
-        if (ctx.input.dateTime) {
-            now = normalizeDate$1(toDate$1(ctx.input.dateTime));
+        if (ctx.data.has(BuiltInPolicyType.DATE)) {
+            if (ctx.data.isValidated(BuiltInPolicyType.DATE)) {
+                now = ctx.data.get(BuiltInPolicyType.DATE);
+            } else {
+                // todo: run validator on attributes (isObject ...)
+                now = normalizeDate$1(toDate$1(ctx.data.get(BuiltInPolicyType.DATE)));
+                ctx.data.set(BuiltInPolicyType.DATE, now);
+                ctx.data.setValidated(BuiltInPolicyType.DATE);
+            }
         } else {
             now = normalizeDate$1(new Date());
         }
-        if (ctx.config.start) {
-            const start = normalizeDate$1(toDate$1(ctx.config.start));
+        if (policy.start) {
+            const start = normalizeDate$1(toDate$1(policy.start));
             if (now < start) {
-                return maybeInvertPolicyOutcome(false, ctx.config.invert);
+                return {
+                    success: maybeInvertPolicyOutcome(false, policy.invert)
+                };
             }
         }
-        if (ctx.config.end) {
-            const end = normalizeDate$1(toDate$1(ctx.config.end));
+        if (policy.end) {
+            const end = normalizeDate$1(toDate$1(policy.end));
             if (now > end) {
-                return maybeInvertPolicyOutcome(false, ctx.config.invert);
+                return {
+                    success: maybeInvertPolicyOutcome(false, policy.invert)
+                };
             }
         }
-        return maybeInvertPolicyOutcome(true, ctx.config.invert);
+        return {
+            success: maybeInvertPolicyOutcome(true, policy.invert)
+        };
     }
-    constructor(){
-        this.validator = new DatePolicyValidator();
+}
+
+class PolicyIdentityDataValidator extends Container {
+    initialize() {
+        super.initialize();
+        this.mount('type', createValidator(z.string().min(3).max(128)));
+        this.mount('id', createValidator(z.uuid()));
+        this.mount('clientId', createValidator(z.uuid().or(z.null()).or(z.undefined()).optional()));
+        this.mount('realmId', createValidator(z.uuid().or(z.null()).or(z.undefined()).optional()));
+        this.mount('realmName', createValidator(z.string().min(3).max(128).or(z.null()).or(z.undefined()).optional()));
     }
 }
 
@@ -405,28 +657,61 @@ class IdentityPolicyValidator extends Container {
 }
 
 class IdentityPolicyEvaluator {
-    async can(ctx) {
-        return ctx.config.type === BuiltInPolicyType.IDENTITY;
-    }
-    async validateConfig(ctx) {
-        return this.validator.run(ctx.config);
-    }
-    async validateInput(ctx) {
-        return ctx.input;
+    validator;
+    dataValidator;
+    constructor(){
+        this.validator = new IdentityPolicyValidator();
+        this.dataValidator = new PolicyIdentityDataValidator();
     }
-    async evaluate(ctx) {
-        if (!isObject(ctx.input.identity)) {
-            return maybeInvertPolicyOutcome(false, ctx.config.invert);
+    async accessData(ctx) {
+        if (!ctx.data.has('identity')) {
+            return null;
         }
-        const types = ctx.config.types || [];
-        if (types.length === 0) {
-            return maybeInvertPolicyOutcome(true, ctx.config.invert);
+        if (ctx.data.isValidated('identity')) {
+            return ctx.data.get('identity');
         }
-        const typeAllowed = types.indexOf(ctx.input.identity.type) !== -1;
-        return maybeInvertPolicyOutcome(typeAllowed, ctx.config.invert);
-    }
-    constructor(){
-        this.validator = new IdentityPolicyValidator();
+        const data = await this.dataValidator.run(ctx.data.get('identity'));
+        ctx.data.set('identity', data);
+        ctx.data.setValidated('identity');
+        return data;
+    }
+    async evaluate(value, ctx) {
+        // todo: catch errors + transform to issue(s)
+        const policy = await this.validator.run(value);
+        const data = await this.accessData(ctx);
+        if (!data) {
+            return {
+                success: false,
+                issues: [
+                    definePolicyIssueItem({
+                        code: PolicyIssueCode.DATA_MISSING,
+                        message: 'The data property identity is missing',
+                        path: ctx.path
+                    })
+                ]
+            };
+        }
+        if (!policy.types || policy.types.length === 0) {
+            return {
+                success: maybeInvertPolicyOutcome(true, policy.invert)
+            };
+        }
+        const typeAllowed = policy.types.indexOf(data.type) !== -1;
+        if (typeAllowed) {
+            return {
+                success: maybeInvertPolicyOutcome(typeAllowed, policy.invert)
+            };
+        }
+        return {
+            success: maybeInvertPolicyOutcome(typeAllowed, policy.invert),
+            issues: [
+                definePolicyIssueItem({
+                    code: PolicyIssueCode.EVALUATION_DENIED,
+                    message: `The type ${data.type} is not covered by the policy configuration`,
+                    path: ctx.path
+                })
+            ]
+        };
     }
 }
 
@@ -435,31 +720,23 @@ class PermissionBindingPolicyValidator extends Container {
 }
 
 class PermissionBindingPolicyEvaluator {
-    async can(ctx) {
-        return ctx.config.type === BuiltInPolicyType.PERMISSION_BINDING;
-    }
-    async validateConfig(ctx) {
-        return this.validator.run(ctx.config);
-    }
-    async validateInput(ctx) {
-        if (!isObject(ctx.input.identity) && !isObject(ctx.input.permission)) {
-            throw PolicyError.evaluatorContextInvalid();
-        }
-        return ctx.input;
-    }
-    async evaluate(ctx) {
-        // todo: this must be changed when the permission-checker not only checks owned permissions.
-        return maybeInvertPolicyOutcome(true, ctx.config.invert);
-    }
+    validator;
     constructor(){
         this.validator = new PermissionBindingPolicyValidator();
     }
+    async evaluate(value) {
+        const policy = await this.validator.run(value);
+        // todo: this must be changed when the permission-checker not only checks owned permissions.
+        return {
+            success: maybeInvertPolicyOutcome(true, policy.invert)
+        };
+    }
 }
 
 class RealmMatchPolicyValidator extends Container {
     initialize() {
         super.initialize();
-        this.mount('decisionStrategy', createValidator(z.nativeEnum(DecisionStrategy).or(z.null()).or(z.undefined()).optional()));
+        this.mount('decisionStrategy', createValidator(z.enum(DecisionStrategy).or(z.null()).or(z.undefined()).optional()));
         this.mount('attributeName', createValidator(z.string().min(3).or(z.array(z.string().min(3))).or(z.null()).or(z.undefined()).optional()));
         this.mount('attributeNameStrict', createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
         this.mount('attributeNullMatchAll', createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
@@ -469,33 +746,56 @@ class RealmMatchPolicyValidator extends Container {
 }
 
 class RealmMatchPolicyEvaluator {
-    async can(ctx) {
-        return ctx.config.type === BuiltInPolicyType.REALM_MATCH;
-    }
-    async validateConfig(ctx) {
-        return this.validator.run(ctx.config);
-    }
-    async validateInput(ctx) {
-        if (!isObject(ctx.input.attributes) || !isObject(ctx.input.identity)) {
-            throw PolicyError.evaluatorContextInvalid();
+    validator;
+    identityEvaluator;
+    attributesEvaluator;
+    constructor(){
+        this.validator = new RealmMatchPolicyValidator();
+        this.identityEvaluator = new IdentityPolicyEvaluator();
+        this.attributesEvaluator = new AttributesPolicyEvaluator();
+    }
+    async evaluate(value, ctx) {
+        // todo: catch errors + transform to issue(s)
+        const policy = await this.validator.run(value);
+        const identity = await this.identityEvaluator.accessData(ctx);
+        if (!identity) {
+            return {
+                success: false,
+                issues: [
+                    definePolicyIssueItem({
+                        code: PolicyIssueCode.DATA_MISSING,
+                        message: 'The data property identity is missing',
+                        path: ctx.path
+                    })
+                ]
+            };
         }
-        return ctx.input;
-    }
-    async evaluate(ctx) {
-        if (!ctx.input.attributes || !ctx.input.identity) {
-            throw PolicyError.evaluatorContextInvalid();
+        const attributes = await this.attributesEvaluator.accessData(ctx);
+        if (!attributes) {
+            return {
+                success: false,
+                issues: [
+                    definePolicyIssueItem({
+                        code: PolicyIssueCode.DATA_MISSING,
+                        message: 'The data property attributes is missing',
+                        path: ctx.path
+                    })
+                ]
+            };
         }
-        const identityMasterMatchAll = ctx.config.identityMasterMatchAll ?? true;
-        if (identityMasterMatchAll && ctx.input.identity.realmName && ctx.input.identity.realmName === 'master') {
-            return maybeInvertPolicyOutcome(true, ctx.config.invert);
+        const identityMasterMatchAll = policy.identityMasterMatchAll ?? true;
+        if (identityMasterMatchAll && identity.realmName && identity.realmName === 'master') {
+            return {
+                success: maybeInvertPolicyOutcome(true, policy.invert)
+            };
         }
         let keys;
-        if (ctx.config.attributeName) {
-            if (Array.isArray(ctx.config.attributeName)) {
-                keys = ctx.config.attributeName;
+        if (policy.attributeName) {
+            if (Array.isArray(policy.attributeName)) {
+                keys = policy.attributeName;
             } else {
                 keys = [
-                    ctx.config.attributeName
+                    policy.attributeName
                 ];
             }
         } else {
@@ -505,11 +805,11 @@ class RealmMatchPolicyEvaluator {
                 'realmId',
                 'realmName'
             ];
-            ctx.config.decisionStrategy = DecisionStrategy.CONSENSUS;
+            policy.decisionStrategy = DecisionStrategy.CONSENSUS;
         }
-        const attributeNameStrict = ctx.config.attributeNameStrict ?? true;
+        const attributeNameStrict = policy.attributeNameStrict ?? true;
         if (!attributeNameStrict) {
-            const resourceKeys = Object.keys(ctx.input.attributes);
+            const resourceKeys = Object.keys(attributes);
             const keysToAdd = [];
             for(let i = 0; i < resourceKeys.length; i++){
                 let contains = false;
@@ -529,32 +829,35 @@ class RealmMatchPolicyEvaluator {
         }
         let count = 0;
         for(let i = 0; i < keys.length; i++){
-            if (!hasOwnProperty(ctx.input.attributes, keys[i])) {
+            if (!hasOwnProperty(attributes, keys[i])) {
                 continue;
             }
             let outcome = false;
-            const attributeValue = ctx.input.attributes[keys[i]];
-            if (attributeValue === null && ctx.config.attributeNullMatchAll) {
+            const attributeValue = attributes[keys[i]];
+            if (attributeValue === null && policy.attributeNullMatchAll) {
                 outcome = true;
-            } else if (attributeValue === ctx.input.identity.realmId || attributeValue === ctx.input.identity.realmName) {
+            } else if (attributeValue === identity.realmId || attributeValue === identity.realmName) {
                 outcome = true;
             }
             if (outcome) {
-                if (ctx.config.decisionStrategy === DecisionStrategy.AFFIRMATIVE) {
-                    return maybeInvertPolicyOutcome(true, ctx.config.invert);
+                if (policy.decisionStrategy === DecisionStrategy.AFFIRMATIVE) {
+                    return {
+                        success: maybeInvertPolicyOutcome(true, policy.invert)
+                    };
                 }
                 count++;
             } else {
-                if (ctx.config.decisionStrategy === DecisionStrategy.UNANIMOUS) {
-                    return maybeInvertPolicyOutcome(false, ctx.config.invert);
+                if (policy.decisionStrategy === DecisionStrategy.UNANIMOUS) {
+                    return {
+                        success: maybeInvertPolicyOutcome(false, policy.invert)
+                    };
                 }
                 count--;
             }
         }
-        return maybeInvertPolicyOutcome(count > 0, ctx.config.invert);
-    }
-    constructor(){
-        this.validator = new RealmMatchPolicyValidator();
+        return {
+            success: maybeInvertPolicyOutcome(count > 0, policy.invert)
+        };
     }
 }
 
@@ -586,10 +889,10 @@ class TimePolicyValidator extends Container {
         super.initialize();
         this.mount('dayOfWeek', createValidator(z.number().min(0).max(6).or(z.null()).or(z.undefined()).optional()));
         this.mount('dayOfMonth', createValidator(z.number().min(1).max(31).or(z.null()).or(z.undefined()).optional()));
-        this.mount('dayOfYear', createValidator(z.number().min(1).max(366).or(z.null()).or(z.undefined()).optional()));
-        this.mount('start', createValidator(z.date().or(z.string().datetime()).or(z.string().time()).or(z.number()).or(z.null()).or(z.undefined()).optional()));
-        this.mount('end', createValidator(z.date().or(z.string().datetime()).or(z.string().time()).or(z.number()).or(z.null()).or(z.undefined()).optional()));
-        this.mount('interval', createValidator(z.nativeEnum(TimePolicyInterval).or(z.null()).or(z.undefined()).optional()));
+        this.mount('dayOfYear', createValidator(z.number().min(1).max(365).or(z.null()).or(z.undefined()).optional()));
+        this.mount('start', createValidator(z.date().or(z.iso.datetime()).or(z.iso.time()).or(z.number()).or(z.null()).or(z.undefined()).optional()));
+        this.mount('end', createValidator(z.date().or(z.iso.datetime()).or(z.iso.time()).or(z.number()).or(z.null()).or(z.undefined()).optional()));
+        this.mount('interval', createValidator(z.enum(TimePolicyInterval).or(z.null()).or(z.undefined()).optional()));
         this.mount('invert', createValidator(z.boolean().or(z.undefined()).or(z.null()).optional()));
     }
 }
@@ -616,59 +919,72 @@ function toDate(input, dateRef) {
     return input;
 }
 class TimePolicyEvaluator {
-    async can(ctx) {
-        return ctx.config.type === BuiltInPolicyType.TIME;
-    }
-    async validateConfig(ctx) {
-        return this.validator.run(ctx.config);
-    }
-    async validateInput(ctx) {
-        return ctx.input;
+    validator;
+    constructor(){
+        this.validator = new TimePolicyValidator();
     }
-    async evaluate(ctx) {
+    async evaluate(value, ctx) {
+        // todo: catch errors + transform to issue(s)
+        const policy = await this.validator.run(value);
         let now;
-        if (ctx.input.dateTime) {
-            now = toDate(ctx.input.dateTime);
+        if (ctx.data.has(BuiltInPolicyType.TIME)) {
+            if (ctx.data.isValidated(BuiltInPolicyType.TIME)) {
+                now = ctx.data.get(BuiltInPolicyType.TIME);
+            } else {
+                // todo: run validator on attributes (isObject ...)
+                now = toDate(ctx.data.get(BuiltInPolicyType.TIME));
+                ctx.data.set(BuiltInPolicyType.TIME, now);
+                ctx.data.setValidated(BuiltInPolicyType.TIME);
+            }
         } else {
             now = new Date();
         }
-        if (ctx.config.start) {
-            const start = normalizeDate(toDate(ctx.config.start, now), now);
+        if (policy.start) {
+            const start = normalizeDate(toDate(policy.start, now), now);
             if (now < start) {
-                return maybeInvertPolicyOutcome(false, ctx.config.invert);
+                return {
+                    success: maybeInvertPolicyOutcome(false, policy.invert)
+                };
             }
         }
-        if (ctx.config.end) {
-            const end = normalizeDate(toDate(ctx.config.end, now), now);
+        if (policy.end) {
+            const end = normalizeDate(toDate(policy.end, now), now);
             if (now > end) {
-                return maybeInvertPolicyOutcome(false, ctx.config.invert);
+                return {
+                    success: maybeInvertPolicyOutcome(false, policy.invert)
+                };
             }
         }
-        if (ctx.config.interval) {
-            if (isIntervalForDayOfWeek(ctx.config.interval) && ctx.config.dayOfWeek) {
-                if (now.getDay() !== ctx.config.dayOfWeek) {
-                    return maybeInvertPolicyOutcome(false, ctx.config.invert);
+        if (policy.interval) {
+            if (isIntervalForDayOfWeek(policy.interval) && policy.dayOfWeek) {
+                if (now.getDay() !== policy.dayOfWeek) {
+                    return {
+                        success: maybeInvertPolicyOutcome(false, policy.invert)
+                    };
                 }
             }
-            if (isIntervalForDayOfMonth(ctx.config.interval) && ctx.config.dayOfMonth) {
-                if (now.getDate() !== ctx.config.dayOfMonth) {
-                    return maybeInvertPolicyOutcome(false, ctx.config.invert);
+            if (isIntervalForDayOfMonth(policy.interval) && policy.dayOfMonth) {
+                if (now.getDate() !== policy.dayOfMonth) {
+                    return {
+                        success: maybeInvertPolicyOutcome(false, policy.invert)
+                    };
                 }
             }
-            if (isIntervalForDayOfYear(ctx.config.interval) && ctx.config.dayOfYear) {
+            if (isIntervalForDayOfYear(policy.interval) && policy.dayOfYear) {
                 const start = new Date(now.getFullYear(), 0, 0);
                 const diff = now.getTime() - start.getTime() + (start.getTimezoneOffset() - now.getTimezoneOffset()) * 60 * 1000;
                 const oneDay = 1000 * 60 * 60 * 24;
                 const dayOfYear = Math.floor(diff / oneDay);
-                if (dayOfYear !== ctx.config.dayOfYear) {
-                    return maybeInvertPolicyOutcome(false, ctx.config.invert);
+                if (dayOfYear !== policy.dayOfYear) {
+                    return {
+                        success: maybeInvertPolicyOutcome(false, policy.invert)
+                    };
                 }
             }
         }
-        return maybeInvertPolicyOutcome(true, ctx.config.invert);
-    }
-    constructor(){
-        this.validator = new TimePolicyValidator();
+        return {
+            success: maybeInvertPolicyOutcome(true, policy.invert)
+        };
     }
 }
 
@@ -684,117 +1000,16 @@ class TimePolicyEvaluator {
     };
 }
 
-/**
- * The policy engine is a component that interprets defined policies and makes decisions
- * on whether to allow or deny a particular access.
- */ class PolicyEngine {
-    registerEvaluator(type, evaluator) {
-        this.evaluators[type] = evaluator;
-    }
-    registerEvaluators(evaluators) {
-        const keys = Object.keys(evaluators);
-        for(let i = 0; i < keys.length; i++){
-            this.registerEvaluator(keys[i], evaluators[keys[i]]);
-        }
-    }
-    registerDefaultEvaluators() {
-        this.registerEvaluator(BuiltInPolicyType.COMPOSITE, new CompositePolicyEvaluator());
-        this.registerEvaluator(BuiltInPolicyType.ATTRIBUTES, new AttributesPolicyEvaluator());
-        this.registerEvaluator(BuiltInPolicyType.ATTRIBUTE_NAMES, new AttributeNamesPolicyEvaluator());
-        this.registerEvaluator(BuiltInPolicyType.DATE, new DatePolicyEvaluator());
-        this.registerEvaluator(BuiltInPolicyType.IDENTITY, new IdentityPolicyEvaluator());
-        this.registerEvaluator(BuiltInPolicyType.PERMISSION_BINDING, new PermissionBindingPolicyEvaluator());
-        this.registerEvaluator(BuiltInPolicyType.REALM_MATCH, new RealmMatchPolicyEvaluator());
-        this.registerEvaluator(BuiltInPolicyType.TIME, new TimePolicyEvaluator());
-    }
-    /**
-     * @throws PolicyError
-     *
-     * @param ctx
-     */ async evaluate(ctx) {
-        return evaluatePolicy({
-            ...ctx,
-            options: ctx.options || {},
-            evaluators: this.evaluators
-        });
-    }
-    constructor(evaluators = {}){
-        this.evaluators = {};
-        this.registerDefaultEvaluators();
-        this.registerEvaluators(evaluators);
-    }
-}
-
-class PermissionError extends AuthupError {
-    static notFound(name) {
-        return new PermissionError({
-            message: `The permission ${name} was not found.`,
-            code: ErrorCode.PERMISSION_NOT_FOUND
-        });
-    }
-    static denied(name) {
-        return new PermissionError({
-            message: `The permission ${name} has not been granted.`,
-            code: ErrorCode.PERMISSION_DENIED
-        });
-    }
-    static deniedAll(names) {
-        return new PermissionError({
-            message: `None of the permissions ${names.join(', ')} has been granted.`,
-            code: ErrorCode.PERMISSION_DENIED
-        });
-    }
-    static evaluationFailed(options) {
-        const error = new PermissionError({
-            message: `The evaluation of permission ${options.name} failed.`,
-            code: ErrorCode.PERMISSION_EVALUATION_FAILED
-        });
-        if (options.policy) {
-            error.policy = options.policy;
-            if (options.policy.type === BuiltInPolicyType.IDENTITY) {
-                error.statusCode = 401;
-            }
-        }
-        if (options.policyError) {
-            error.policyError = options.policyError;
-        }
-        return error;
-    }
-    constructor(options = {}){
-        super({
-            ...options,
-            message: options.message || 'A permission error occurred.',
-            statusCode: options.statusCode || 403
-        });
-    }
-}
-
-/*
- * Copyright (c) 2025.
- * Author Peter Placzek (tada5hi)
- * For the full copyright and license information,
- * view the LICENSE file that was distributed with this source code.
- */ function buildPermissionItemKey(input) {
-    return `${input.realmId || '_'}/${input.clientId || '_'}/${input.name}`;
-}
-
-/*
- * Copyright (c) 2024-2024.
- * Author Peter Placzek (tada5hi)
- * For the full copyright and license information,
- * view the LICENSE file that was distributed with this source code.
- */ function isPermissionItemEqual(a, b) {
-    if (a.name !== b.name) {
-        return false;
-    }
-    if (typeof a.realmId === 'string' || typeof b.realmId === 'string') {
-        return a.realmId === b.realmId;
-    }
-    if (typeof a.clientId === 'string' || typeof b.clientId === 'string') {
-        return a.clientId === b.clientId;
-    }
-    return !!a.realmId === !!b.realmId && !!a.clientId === !!b.clientId;
-}
+const PolicyDefaultEvaluators = {
+    [BuiltInPolicyType.COMPOSITE]: new CompositePolicyEvaluator(),
+    [BuiltInPolicyType.ATTRIBUTES]: new AttributesPolicyEvaluator(),
+    [BuiltInPolicyType.ATTRIBUTE_NAMES]: new AttributeNamesPolicyEvaluator(),
+    [BuiltInPolicyType.DATE]: new DatePolicyEvaluator(),
+    [BuiltInPolicyType.IDENTITY]: new IdentityPolicyEvaluator(),
+    [BuiltInPolicyType.PERMISSION_BINDING]: new PermissionBindingPolicyEvaluator(),
+    [BuiltInPolicyType.REALM_MATCH]: new RealmMatchPolicyEvaluator(),
+    [BuiltInPolicyType.TIME]: new TimePolicyEvaluator()
+};
 
 function mergePermissionItems(input) {
     const grouped = input.reduce((previous, current)=>{
@@ -827,9 +1042,17 @@ function mergePermissionItems(input) {
     return output;
 }
 
-class PermissionMemoryProvider {
-    async get(options) {
-        return this.items[buildPermissionItemKey(options)];
+class PermissionMemoryRepository {
+    items = {};
+    constructor(items = []){
+        this.setMany(items);
+    }
+    async findOne(options) {
+        const entry = this.items[buildPermissionItemKey(options)];
+        if (entry) {
+            return entry;
+        }
+        return null;
     }
     setMany(input) {
         this.items = mergePermissionItems(input).reduce((prev, current)=>{
@@ -837,19 +1060,38 @@ class PermissionMemoryProvider {
             return prev;
         }, {});
     }
-    constructor(items = []){
-        this.items = {};
-        this.setMany(items);
-    }
 }
 
 class PermissionChecker {
+    provider;
+    policyEngine;
+    clientId;
+    realmId;
+    // ----------------------------------------------
+    constructor(options = {}){
+        if (options.repository) {
+            this.provider = options.repository;
+        } else {
+            this.provider = new PermissionMemoryRepository();
+        }
+        if (options.clientId) {
+            this.clientId = options.clientId;
+        }
+        if (options.realmId) {
+            this.realmId = options.realmId;
+        }
+        if (options.policyEngine) {
+            this.policyEngine = options.policyEngine;
+        } else {
+            this.policyEngine = new PolicyEngine(PolicyDefaultEvaluators);
+        }
+    }
     // ----------------------------------------------
     /**
      * Get a permission.
      *
      * @param input
-     */ async get(input) {
+     */ async findOne(input) {
         const options = {
             name: input
         };
@@ -859,7 +1101,7 @@ class PermissionChecker {
         if (this.realmId) {
             options.realmId = this.realmId;
         }
-        return this.provider.get(options);
+        return this.provider.findOne(options);
     }
     // ----------------------------------------------
     /**
@@ -880,14 +1122,23 @@ class PermissionChecker {
         }
         const { options = {} } = ctx;
         const decisionStrategy = options.decisionStrategy ?? DecisionStrategy.UNANIMOUS;
-        let lastError;
+        const issues = [];
         let count = 0;
+        const dataBase = ctx.input || new PolicyData();
         for(let i = 0; i < ctx.name.length; i++){
-            const entity = await this.get(ctx.name[i]);
+            const entity = await this.findOne(ctx.name[i]);
             if (!entity) {
-                lastError = PermissionError.notFound(ctx.name[i]);
+                issues.push(defineIssueItem({
+                    code: ErrorCode.PERMISSION_NOT_FOUND,
+                    message: `The ${ctx.name[i]} permission could not be resolved`,
+                    path: [
+                        ctx.name[i]
+                    ]
+                }));
                 if (decisionStrategy === DecisionStrategy.UNANIMOUS) {
-                    throw lastError;
+                    const error = PermissionError.evaluationFailed(ctx.name);
+                    error.addIssues(issues);
+                    throw error;
                 }
                 continue;
             }
@@ -898,48 +1149,31 @@ class PermissionChecker {
                 count++;
                 continue;
             }
-            let outcome;
-            try {
-                outcome = await this.policyEngine.evaluate({
-                    input: {
-                        ...ctx.input || {},
-                        permission: entity
-                    },
-                    config: entity.policy,
-                    options: {
-                        include: options.policiesIncluded,
-                        exclude: options.policiesExcluded
-                    }
-                });
-            } catch (e) {
-                if (e instanceof PolicyError) {
-                    lastError = PermissionError.evaluationFailed({
-                        name: entity.name,
-                        policy: entity.policy,
-                        policyError: e
-                    });
-                } else {
-                    lastError = PermissionError.evaluationFailed({
-                        name: entity.name,
-                        policy: entity.policy
-                    });
-                }
-                outcome = false;
-            }
-            if (outcome) {
+            const data = dataBase.clone();
+            data.set(BuiltInPolicyType.PERMISSION_BINDING, entity);
+            const evaluationResult = await this.policyEngine.evaluate(entity.policy, definePolicyEvaluationContext({
+                include: options.policiesIncluded,
+                exclude: options.policiesExcluded,
+                data
+            }));
+            if (evaluationResult.success) {
                 if (decisionStrategy === DecisionStrategy.AFFIRMATIVE) {
                     return;
                 }
                 count++;
             } else {
-                if (!lastError) {
-                    lastError = PermissionError.evaluationFailed({
-                        name: entity.name,
-                        policy: entity.policy
-                    });
-                }
+                issues.push(definePolicyIssueGroup({
+                    code: ErrorCode.PERMISSION_EVALUATION_FAILED,
+                    issues: evaluationResult.issues || [],
+                    message: `The ${entity.name} permissions policy evaluation failed`,
+                    path: [
+                        entity.name
+                    ]
+                }));
                 if (decisionStrategy === DecisionStrategy.UNANIMOUS) {
-                    throw lastError;
+                    const error = PermissionError.evaluationFailed(entity.name);
+                    error.addIssues(issues);
+                    throw error;
                 }
                 count--;
             }
@@ -947,10 +1181,12 @@ class PermissionChecker {
         if (count > 0) {
             return;
         }
-        if (count > 1 || !lastError) {
+        if (issues.length === 0) {
             throw PermissionError.deniedAll(ctx.name);
         } else {
-            throw lastError;
+            const error = PermissionError.evaluationFailed(ctx.name);
+            error.addIssues(issues);
+            throw error;
         }
     }
     /**
@@ -991,26 +1227,7 @@ class PermissionChecker {
             }
         });
     }
-    // ----------------------------------------------
-    constructor(options = {}){
-        if (options.provider) {
-            this.provider = options.provider;
-        } else {
-            this.provider = new PermissionMemoryProvider();
-        }
-        if (options.clientId) {
-            this.clientId = options.clientId;
-        }
-        if (options.realmId) {
-            this.realmId = options.realmId;
-        }
-        if (options.policyEngine) {
-            this.policyEngine = options.policyEngine;
-        } else {
-            this.policyEngine = new PolicyEngine();
-        }
-    }
 }
 
-export { AttributeNamesPolicyEvaluator, AttributeNamesPolicyValidator, AttributesPolicyEvaluator, AttributesPolicyValidator, BuiltInPolicyType, CompositePolicyEvaluator, CompositePolicyValidator, DatePolicyEvaluator, DatePolicyValidator, DecisionStrategy, IdentityPolicyEvaluator, IdentityPolicyValidator, PermissionBindingPolicyEvaluator, PermissionBindingPolicyValidator, PermissionChecker, PermissionError, PermissionMemoryProvider, PolicyDataIdentityValidator, PolicyDataPermissionValidator, PolicyDataValidator, PolicyEngine, PolicyError, RealmMatchPolicyEvaluator, RealmMatchPolicyValidator, TimePolicyEvaluator, TimePolicyInterval, TimePolicyValidator, buildPermissionItemKey, defineAttributesPolicy, definePolicyWithType, evaluatePolicy, isCompositePolicy, isIntervalForDayOfMonth, isIntervalForDayOfWeek, isIntervalForDayOfYear, isPermissionItemEqual, maybeInvertPolicyOutcome, mergePermissionItems };
+export { AttributeNamesPolicyEvaluator, AttributeNamesPolicyValidator, AttributesPolicyEvaluator, AttributesPolicyValidator, BuiltInPolicyType, CompositePolicyEvaluator, CompositePolicyValidator, DatePolicyEvaluator, DatePolicyValidator, DecisionStrategy, IdentityPolicyEvaluator, IdentityPolicyValidator, PermissionBindingPolicyEvaluator, PermissionBindingPolicyValidator, PermissionChecker, PermissionError, PermissionMemoryRepository, PolicyData, PolicyDefaultEvaluators, PolicyEngine, PolicyError, PolicyIssueCode, PolicyIssueSeverity, RealmMatchPolicyEvaluator, RealmMatchPolicyValidator, TimePolicyEvaluator, TimePolicyInterval, TimePolicyValidator, buildPermissionItemKey, defineAttributesPolicy, definePolicyEvaluationContext, definePolicyIssueGroup, definePolicyIssueItem, definePolicyWithType, isCompositePolicy, isIntervalForDayOfMonth, isIntervalForDayOfWeek, isIntervalForDayOfYear, isPermissionItemEqual, maybeInvertPolicyOutcome, mergePermissionItems };
 //# sourceMappingURL=index.mjs.map