@authup/access 1.0.0-beta.65 → 1.0.0-beta.66

package/dist/index.mjs

@@ -1,10 +1,10 @@
-import { AuthupError, ErrorCode, isAuthupError, markInstanceof, matchesInstanceof } from "@authup/errors";
+import { AuthupError, ErrorCode, InternalError, isAuthupError, markInstanceof, matchesInstanceof } from "@authup/errors";
 import { DecisionStrategy, flattenObject, hasOwnProperty, isObject } from "@authup/kit";
 import { isEqual } from "smob";
 import { and, eq, inArray, nin, not, or } from "@rapiq/core";
-import { defineIssueGroup, defineIssueItem } from "@ebec/core";
-import { createValidator } from "@validup/zod";
-import { Container } from "validup";
+import { defineIssueGroup, defineIssueItem, prefixIssuePath } from "@ebec/core";
+import { buildIssuesForZodError, createValidator } from "@validup/zod";
+import { Container, ValidupError, isValidupError } from "validup";
 import { z } from "zod";
 import { compileFilters } from "@rapiq/adapter-memory";
 import { MongoFiltersParser } from "@rapiq/parser-mongo";
@@ -515,6 +515,10 @@ var PolicyData = class PolicyData {
 	has(key) {
 		return key in this.data;
 	}
+	delete(key) {
+		delete this.data[key];
+		this.validated.delete(key);
+	}
 	setValidated(key) {
 		this.validated.add(key);
 	}
@@ -534,7 +538,8 @@ function definePolicyEvaluationContext(input = {}) {
 		data: input.data || new PolicyData(),
 		include: input.include || [],
 		exclude: input.exclude || [],
-		withConditions: input.withConditions ?? false
+		withConditions: input.withConditions ?? false,
+		realmAttributeName: input.realmAttributeName
 	};
 }
 //#endregion
@@ -987,25 +992,6 @@ var IdentityPolicyEvaluator = class {
 	}
 };
 //#endregion
-//#region src/policy/built-in/permission-binding/validator.ts
-var PermissionBindingPolicyValidator = class extends Container {
-	initialize() {}
-};
-//#endregion
-//#region src/policy/built-in/permission-binding/module.ts
-var PermissionBindingPolicyEvaluator = class {
-	validator;
-	constructor() {
-		this.validator = new PermissionBindingPolicyValidator();
-	}
-	requires() {
-		return ["permissionBinding"];
-	}
-	async evaluate(value) {
-		return { success: maybeInvertPolicyOutcome(true, (await this.validator.run(value)).invert) };
-	}
-};
-//#endregion
 //#region src/policy/built-in/realm-match/validator.ts
 var RealmMatchPolicyValidator = class extends Container {
 	initialize() {
@@ -1062,7 +1048,7 @@ var RealmMatchPolicyEvaluator = class {
 			else {
 				const terms = [];
 				if (realmId !== null && scope !== "none") terms.push(eq(field, realmId));
-				if (scope === "ownOrNull") terms.push(eq(field, null));
+				if (scope === "ownOrNull" && (realmId !== null || identity.realmName != null)) terms.push(eq(field, null));
 				if (terms.length === 0) condition = inArray(field, []);
 				else if (terms.length === 1) condition = terms[0];
 				else condition = or(...terms);
@@ -1161,6 +1147,145 @@ var RealmMatchPolicyEvaluator = class {
 	}
 };
 //#endregion
+//#region src/policy/built-in/permission-binding/validator.ts
+var PermissionBindingPolicyValidator = class extends Container {
+	initialize() {
+		this.mount("invert", createValidator(z.boolean().or(z.null()).or(z.undefined()).optional()));
+	}
+};
+//#endregion
+//#region src/policy/built-in/permission-binding/identity-evaluator.ts
+var IdentityPermissionBindingPolicyEvaluator = class {
+	validator;
+	identityEvaluator;
+	realmMatchEvaluator;
+	identityPermissionProvider;
+	constructor(identityPermissionProvider) {
+		this.validator = new PermissionBindingPolicyValidator();
+		this.identityEvaluator = new IdentityPolicyEvaluator();
+		this.realmMatchEvaluator = new RealmMatchPolicyEvaluator();
+		this.identityPermissionProvider = identityPermissionProvider;
+	}
+	requires() {
+		return ["permissionBinding"];
+	}
+	async accessData(ctx) {
+		if (!ctx.data.has("permissionBinding")) return null;
+		if (ctx.data.isValidated("permissionBinding")) return ctx.data.get("permissionBinding");
+		const data = ctx.data.get("permissionBinding");
+		ctx.data.set("permissionBinding", data);
+		ctx.data.setValidated("permissionBinding");
+		return data;
+	}
+	async evaluate(value, ctx) {
+		const policy = await this.validator.run(value);
+		const identity = await this.identityEvaluator.accessData(ctx);
+		if (!identity) return {
+			success: false,
+			issues: [definePolicyIssueItem({
+				code: "DATA_MISSING",
+				message: "The data property identity is missing",
+				path: ctx.path
+			})]
+		};
+		const binding = await this.accessData(ctx);
+		if (!binding) return {
+			success: false,
+			issues: [definePolicyIssueItem({
+				code: "DATA_MISSING",
+				message: "The data property permission is missing",
+				path: ctx.path
+			})]
+		};
+		const identityBindings = await this.identityPermissionProvider.getFor(identity).then((bindings) => bindings.filter((item) => {
+			if (item.permission.name !== binding.permission.name) return false;
+			return (binding.permission.realmId ?? null) === (item.permission.realmId ?? null) && (binding.permission.clientId ?? null) === (item.permission.clientId ?? null);
+		}));
+		if (identityBindings.length === 0) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
+		const [aggr] = aggregatePermissionPolicyBindings(identityBindings);
+		if (!aggr) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
+		const issues = [];
+		const pendingIssues = [];
+		const conditions = [];
+		let pending = false;
+		let lowerable = true;
+		for (const grant of aggr.grants) {
+			let reachCondition = null;
+			const realmOutcome = await this.realmMatchEvaluator.evaluate({
+				scope: grant.realmScope,
+				attributeName: ctx.realmAttributeName
+			}, ctx);
+			if (realmOutcome.pending) {
+				const scope = normalizeRealmScope(grant.realmScope);
+				if (scope === "none") continue;
+				if (scope !== "any") {
+					if (!realmOutcome.condition) {
+						pending = true;
+						lowerable = false;
+						continue;
+					}
+					reachCondition = realmOutcome.condition;
+				}
+			} else if (!realmOutcome.success) continue;
+			if (!grant.policy) {
+				if (!reachCondition) return { success: maybeInvertPolicyOutcome(true, policy.invert) };
+				conditions.push(reachCondition);
+				pending = true;
+				continue;
+			}
+			const outcome = await new PolicyEngine(ctx.evaluators).evaluate(grant.policy, {
+				...ctx,
+				path: [...ctx.path || []]
+			});
+			if (outcome.success) {
+				if (!reachCondition) return { success: maybeInvertPolicyOutcome(true, policy.invert) };
+				conditions.push(reachCondition);
+				pending = true;
+				continue;
+			}
+			if (outcome.pending) {
+				pending = true;
+				if (ctx.withConditions && outcome.condition && !ctx.realmAttributeName) conditions.push(reachCondition ? and(reachCondition, outcome.condition) : outcome.condition);
+				else lowerable = false;
+				if (outcome.issues) pendingIssues.push(...outcome.issues);
+				continue;
+			}
+			if (outcome.issues) issues.push(...outcome.issues);
+		}
+		if (pending) {
+			const result = {
+				success: false,
+				pending: true,
+				issues: pendingIssues
+			};
+			if (lowerable && ctx.withConditions && conditions.length > 0) {
+				const condition = conditions.length === 1 ? conditions[0] : or(...conditions);
+				result.condition = policy.invert ? not(condition) : condition;
+			}
+			return result;
+		}
+		const success = maybeInvertPolicyOutcome(false, policy.invert);
+		return {
+			success,
+			issues: success ? [] : issues
+		};
+	}
+};
+//#endregion
+//#region src/policy/built-in/permission-binding/module.ts
+var PermissionBindingPolicyEvaluator = class {
+	validator;
+	constructor() {
+		this.validator = new PermissionBindingPolicyValidator();
+	}
+	requires() {
+		return ["permissionBinding"];
+	}
+	async evaluate(value) {
+		return { success: maybeInvertPolicyOutcome(true, (await this.validator.run(value)).invert) };
+	}
+};
+//#endregion
 //#region src/policy/built-in/time/constants.ts
 let TimePolicyInterval = /* @__PURE__ */ function(TimePolicyInterval) {
 	TimePolicyInterval["DAILY"] = "daily";
@@ -1435,7 +1560,8 @@ var PermissionEvaluator = class {
 			};
 			const evaluationResult = await this.policyEngine.evaluate(compositePolicy, definePolicyEvaluationContext({
 				data,
-				withConditions: true
+				withConditions: true,
+				realmAttributeName: ctx.realmAttributeName
 			}));
 			if (evaluationResult.success) return { verdict: "allow" };
 			if (evaluationResult.pending) {
@@ -1459,6 +1585,568 @@ var PermissionEvaluator = class {
 	}
 };
 //#endregion
-export { AttributeNamesPolicyEvaluator, AttributeNamesPolicyValidator, AttributesPolicyEvaluator, AttributesPolicyValidator, BuiltInPolicyType, CompositePolicyEvaluator, CompositePolicyValidator, DatePolicyEvaluator, DatePolicyValidator, IdentityPolicyEvaluator, IdentityPolicyValidator, PERMISSION_ERROR_INSTANCE, POLICY_ERROR_INSTANCE, PermissionBindingPolicyEvaluator, PermissionBindingPolicyValidator, PermissionError, PermissionEvaluator, PermissionMemoryProvider, PolicyData, PolicyDefaultEvaluators, PolicyEngine, PolicyError, PolicyIssueCode, PolicyIssueSeverity, REALM_SCOPE_ORDER, RealmMatchPolicyEvaluator, RealmMatchPolicyValidator, RealmScope, SystemPolicyName, TimePolicyEvaluator, TimePolicyInterval, TimePolicyValidator, aggregatePermissionPolicyBindings, buildPermissionKey, compareRealmScope, defineAttributesPolicy, definePolicyData, definePolicyEvaluationContext, definePolicyIssueGroup, definePolicyIssueItem, definePolicyWithType, grantDominates, isCompositePolicy, isIntervalForDayOfMonth, isIntervalForDayOfWeek, isIntervalForDayOfYear, isPermissionError, isPermissionPolicyBindingEqual, isPolicyError, maxRealmScope, maybeInvertPolicyOutcome, minRealmScope, normalizeRealmScope, realmScopeMatches };
+//#region src/permission/authorization/error.ts
+const AUTHORIZATION_CATALOG_STALE_ERROR_INSTANCE = Symbol.for("@authup/access/AuthorizationCatalogStaleError");
+/**
+* A grant references a definition or a policy the supplied catalog does not
+* carry: the caller's cached catalog predates the definition or the junction
+* row and must be refetched. A definition the catalog carries with
+* `policies: null`, and one whose tree this copy cannot project, are not
+* stale but unevaluable, and a grant of either is dropped.
+*
+* Recognize it with `isAuthorizationCatalogStaleError`, never `instanceof`:
+* this package is a plain caret dependency of several workspaces, so a
+* consumer tree may resolve two copies of it and turn the one recoverable
+* state into an unrecoverable one.
+*/
+var AuthorizationCatalogStaleError = class extends AuthupError {
+	constructor(message) {
+		super({ message });
+		this.name = "AuthorizationCatalogStaleError";
+		markInstanceof(this, AUTHORIZATION_CATALOG_STALE_ERROR_INSTANCE);
+	}
+};
+//#endregion
+//#region src/permission/authorization/check.ts
+/**
+* Marker-only: the error carries no code of its own, and it never crosses a
+* wire boundary, so there is no shape to fall back to.
+*/
+function isAuthorizationCatalogStaleError(input) {
+	return matchesInstanceof(input, AUTHORIZATION_CATALOG_STALE_ERROR_INSTANCE);
+}
+//#endregion
+//#region src/permission/authorization/schema.ts
+const id = z.string().min(1);
+const namespaceId = id.nullable();
+/**
+* A policy node as it travels. Deliberately LOOSE: every key beyond `type` is
+* that type's own configuration, and `projectAuthorizationPolicy` is what
+* validates it, by running the type's own validator. Mounting a node in a
+* validup container would strip every key the container does not mount, and
+* the whole configuration would go with it.
+*/
+const authorizationPolicySchema = z.looseObject({ type: z.string().min(1) });
+/**
+* One permission definition. `policies` carries the ids of its
+* definition-layer trees, or `null` when the server could not project one.
+*/
+const authorizationDefinitionSchema = z.object({
+	name: z.string().min(1),
+	realm_id: namespaceId,
+	client_id: namespaceId,
+	decision_strategy: z.enum(DecisionStrategy).nullable(),
+	policies: z.array(id).nullable()
+});
+const authorizationCatalogSchema = z.object({
+	policies: z.record(id, authorizationPolicySchema),
+	permissions: z.array(authorizationDefinitionSchema)
+});
+/**
+* One grant of the identity, as the introspection endpoints report it.
+* Whether a grant's policy ids are declared is checked against the catalog
+* the consumer holds, since the two travel separately.
+*/
+const authorizationGrantSchema = z.object({
+	name: z.string().min(1),
+	realm_id: namespaceId.optional(),
+	client_id: namespaceId.optional(),
+	realm_scope: z.enum(RealmScope).nullish(),
+	policies: z.array(id).nullish()
+});
+const authorizationIdentitySchema = z.object({
+	id: z.string().min(1),
+	type: z.enum(["user", "client"]),
+	realmId: z.string().nullish(),
+	realmName: z.string().nullish(),
+	clientId: z.string().nullish()
+});
+/**
+* The whole input `createAuthorizationEvaluator` takes: the catalog
+* `GET /authorization` serves, the grants an introspection reports and the
+* identity it names. A validup container over zod mounts, the shape every
+* validator in this package uses, so a consumer can reuse or override one
+* member's rules instead of restating the document.
+*/
+var AuthorizationEvaluatorInputValidator = class extends Container {
+	initialize() {
+		super.initialize();
+		this.mount("catalog", createValidator(authorizationCatalogSchema));
+		this.mount("grants", createValidator(z.array(authorizationGrantSchema).optional()));
+		this.mount("identity", createValidator(authorizationIdentitySchema.optional()));
+	}
+};
+const validator = new AuthorizationEvaluatorInputValidator();
+/**
+* Validate the evaluator's input, plus the two rules per-key validators
+* cannot express.
+*
+* Every id a definition names must be a key of `policies`: a dangling id
+* resolves to `undefined`, which reads as "this layer carries no policy", so
+* a catalog that merely omitted a tree would grant unrestricted access rather
+* than fail. The lookup is own-property only, so an id such as `constructor`
+* cannot be answered by a member of `Object.prototype`.
+*
+* And the identity and its grants travel together: grants without an identity
+* belong to nobody, while an identity without a grant list is the shape an
+* INACTIVE introspection produces (`permissions` is absent unless the
+* credential is active), which read as "holds nothing" would authorize every
+* definition that carries no binding check. An identity holding no grant says
+* so with an empty array.
+*/
+async function parseAuthorizationEvaluatorInput(input) {
+	const identityGiven = typeof input.identity !== "undefined";
+	const grantsGiven = typeof input.grants !== "undefined";
+	if (!identityGiven && grantsGiven) throw new ValidupError([defineIssueItem({
+		message: "Grants require the identity they belong to.",
+		path: ["identity"]
+	})]);
+	if (identityGiven && !grantsGiven) throw new ValidupError([defineIssueItem({
+		message: "An identity requires its grant list; pass an empty array for an identity holding none.",
+		path: ["grants"]
+	})]);
+	const { catalog, grants, identity } = await validator.run(structuredClone(input));
+	for (const [i, definition] of catalog.permissions.entries()) for (const [j, policyId] of (definition.policies ?? []).entries()) {
+		if (Object.hasOwn(catalog.policies, policyId)) continue;
+		throw new ValidupError([defineIssueItem({
+			message: `The policy ${policyId} is not declared by the catalog.`,
+			path: [
+				"catalog",
+				"permissions",
+				i,
+				"policies",
+				j
+			]
+		})]);
+	}
+	return {
+		catalog,
+		grants: grants ?? [],
+		identity
+	};
+}
+/**
+* One verdict: the permission namespace and the requested realms it holds in.
+* A realm value is a realm key the caller itself supplied, or `null` for the
+* global rows, so nothing here is resolved or looked up.
+*/
+const authorizationCheckPermissionSchema = z.object({
+	name: z.string().min(1),
+	realms: z.array(z.string().min(1).nullable()).min(1)
+});
+const authorizationCheckPermissionsSchema = z.array(authorizationCheckPermissionSchema);
+//#endregion
+//#region src/permission/authorization/check-schema.ts
+/**
+* The whole input `createAuthorizationCheckEvaluator` takes: the answer
+* `POST /authorization/check` served and the identity it belongs to. Same
+* validup-over-zod shape as the catalog's input, so a consumer can override
+* one member's rules instead of restating the answer.
+*/
+var AuthorizationCheckEvaluatorInputValidator = class extends Container {
+	initialize() {
+		super.initialize();
+		this.mount("permissions", createValidator(authorizationCheckPermissionsSchema));
+		this.mount("identity", createValidator(authorizationIdentitySchema.optional()));
+	}
+};
+const checkValidator = new AuthorizationCheckEvaluatorInputValidator();
+/**
+* Validate the check evaluator's input, plus the one rule a per-key validator
+* cannot express: a permission namespace appears at most once. Two entries for
+* one name would make the answer depend on which the consumer looked up first,
+* and the server emits one entry per name by construction.
+*/
+async function parseAuthorizationCheckEvaluatorInput(input) {
+	const { permissions, identity } = await checkValidator.run(structuredClone(input));
+	const seen = /* @__PURE__ */ new Set();
+	for (const [i, permission] of permissions.entries()) {
+		if (seen.has(permission.name)) throw new ValidupError([defineIssueItem({
+			message: `The permission ${permission.name} is answered more than once.`,
+			path: [
+				"permissions",
+				i,
+				"name"
+			]
+		})]);
+		seen.add(permission.name);
+	}
+	return {
+		permissions,
+		identity
+	};
+}
+//#endregion
+//#region src/permission/authorization/constants.ts
+/**
+* The node a policy tree travels as when the server withholds it, because the
+* caller's realm reach does not cover the row it was read from.
+*
+* It is deliberately a type no consumer can project: `projectAuthorizationPolicy`
+* refuses it, which is already the state a definition referencing it denies
+* through and a grant naming it is dropped through, so withholding a body needs
+* no rule of its own on the consumer side. That is a contract between the two
+* halves rather than a server detail, which is why it is declared HERE, next to
+* the projection that has to keep refusing it, and pinned by this package's own
+* test.
+*/
+const AUTHORIZATION_POLICY_WITHHELD_TYPE = "withheld";
+//#endregion
+//#region src/permission/authorization/policy.ts
+/**
+* The two keys a node carries whatever its type is. Deliberately NOT the whole
+* node: every other key is that type's own configuration, which the type's own
+* validator reads, and a container strips every key it does not mount.
+*/
+var AuthorizationPolicyHeadValidator = class extends Container {
+	initialize() {
+		super.initialize();
+		this.mount("type", createValidator(z.enum(BuiltInPolicyType)));
+		this.mount("children", createValidator(z.array(z.unknown()).optional()));
+	}
+};
+function createValidators() {
+	return {
+		["attributes"]: new AttributesPolicyValidator(),
+		["attributeNames"]: new AttributeNamesPolicyValidator(),
+		["composite"]: new CompositePolicyValidator(),
+		["date"]: new DatePolicyValidator(),
+		["time"]: new TimePolicyValidator(),
+		["identity"]: new IdentityPolicyValidator(),
+		["permissionBinding"]: new PermissionBindingPolicyValidator(),
+		["realmMatch"]: new RealmMatchPolicyValidator()
+	};
+}
+/**
+* The one definition of what a policy looks like on the wire, used by the server
+* to build a document and by the consumer to validate one. A node is the OUTPUT
+* of its type's validator (validup strips every unmounted key, so entity columns
+* such as `id`, `name`, `builtIn` or `createdAt` never travel), plus its type
+* and, for a composite, its projected children.
+*
+* Every refusal is a `ValidupError`, the node's head and the type's own
+* validator alike, and a child's issues are rebased onto the position it sits
+* at, so one message names the node in the tree that is wrong.
+*/
+async function projectAuthorizationPolicy(input) {
+	const headValidator = new AuthorizationPolicyHeadValidator();
+	const validators = createValidators();
+	const project = async (value) => {
+		const head = await headValidator.run(value);
+		const output = {
+			...await validators[head.type].run(value),
+			type: head.type
+		};
+		for (const key of Object.keys(output)) if (typeof output[key] === "undefined") delete output[key];
+		if (head.type === "composite") output.children = await Promise.all((head.children ?? []).map((child, index) => projectChild(child, index)));
+		else delete output.children;
+		return output;
+	};
+	const projectChild = async (child, index) => {
+		try {
+			return await project(child);
+		} catch (e) {
+			if (isValidupError(e)) throw new ValidupError(e.issues.map((issue) => prefixIssuePath(issue, ["children", index])));
+			throw e;
+		}
+	};
+	return project(input);
+}
+/**
+* Whether a projected tree evaluates the permission binding at any depth. A
+* grant policy carrying one would re-enter its own permission's grants, so
+* `createAuthorizationEvaluator` drops the grant that names it and evaluates
+* the permission from the rest. Its one caller is that consumer: the tree is
+* legal in a definition, where the binding check is what reach is enforced
+* by, so the producer carries it and only the grant side is refused.
+*/
+function containsBindingCheck(policy) {
+	if (policy.type === "permissionBinding") return true;
+	return (policy.children ?? []).some((child) => containsBindingCheck(child));
+}
+//#endregion
+//#region src/permission/authorization/module.ts
+const realmMatchSchema = z.union([
+	z.string().min(1),
+	z.array(z.string().min(1)).min(1),
+	z.null()
+]);
+/**
+* Every refusal of the DOCUMENT is a `ValidupError` carrying the path of the
+* member at fault, the shape `parseAuthorizationEvaluatorInput` raises and the
+* one a consumer can render. A bare `Error` carries neither a code nor a path,
+* so nothing downstream can normalize it.
+*/
+function refuseDocument(message, path) {
+	throw new ValidupError([defineIssueItem({
+		message,
+		path
+	})]);
+}
+function refuseDocumentWithIssues(issues) {
+	throw new ValidupError(issues);
+}
+function toPolicy(tree) {
+	const { invert, children, ...policy } = tree;
+	return {
+		...policy,
+		...typeof invert === "boolean" ? { invert } : {},
+		...children ? { children: children.map((child) => toPolicy(child)) } : {}
+	};
+}
+/**
+* Build a resource-server (or console) evaluator from the catalog
+* `GET /authorization` serves, the identity's grants as the introspection
+* endpoints report them, and the identity itself. Rejects legacy, incomplete
+* and unsupported input. A grant referencing a definition or a policy the
+* catalog lacks throws `AuthorizationCatalogStaleError`, the signal to
+* refetch the catalog: the grants come from a fresh introspection while the
+* catalog may predate the definition or the junction row. A definition the
+* server could not project travels with `policies: null` instead of being
+* left out, so a grant of it is dropped rather than reported stale: the
+* definition layer cannot be evaluated here, a refetch changes nothing, and
+* the permission denies until the policy is fixed.
+*
+* A tree THIS copy cannot project is the same condition read from the other
+* side, and it is per tree: a policy type newer than this package (the
+* built-in type enum is closed while the column is a free string) or a
+* configuration its validator refuses denies the definitions that reference
+* it, exactly as `policies: null` does, and drops a grant that names it,
+* exactly as a binding check does. One such tree never takes the evaluator
+* down for the permissions that do not use it. A malformed catalog still
+* throws: a duplicate permission namespace is not a data condition.
+*
+* Both the identity and the grants are optional. Without an identity no grant
+* is bound and any IDENTITY key the caller supplied is REMOVED, so the
+* binding evaluator answers with missing data exactly as the server does for
+* an anonymous request, only a definition whose policies need no identity can
+* pass, and a caller can never inject an identity the document did not prove.
+* Grants without the identity they belong to are refused.
+*
+* The REALM_MATCH data key follows the server's own three-way rule: a
+* resource that carries a realm passes it (null for a global row, which
+* `own` denies), a resource with no realm dimension passes nothing and reach
+* neutral-passes. `preEvaluate` / `preEvaluateOneOf` are the pre-gate and
+* enforce reach only when that key is present. `compile` returns the
+* allow/deny/conditional/post contract; a `post` collection query must be
+* rejected or evaluated over every candidate before paging. The supplied
+* identity is authoritative; `options.decisionStrategy` is forwarded and the
+* policy include, exclude and pending options are refused.
+*/
+async function createAuthorizationEvaluator(input) {
+	const { catalog, grants, identity } = await parseAuthorizationEvaluatorInput(input);
+	const trees = /* @__PURE__ */ new Map();
+	const unevaluable = /* @__PURE__ */ new Set();
+	for (const [id, raw] of Object.entries(catalog.policies)) try {
+		trees.set(id, await projectAuthorizationPolicy(raw));
+	} catch {
+		unevaluable.add(id);
+	}
+	const definitions = [];
+	const permissions = /* @__PURE__ */ new Map();
+	for (const [index, entry] of catalog.permissions.entries()) {
+		const permission = {
+			name: entry.name,
+			realmId: entry.realm_id,
+			clientId: entry.client_id,
+			decisionStrategy: entry.decision_strategy ?? void 0
+		};
+		const key = buildPermissionKey(permission);
+		if (permissions.has(key)) refuseDocument(`The catalog defines the permission ${key} more than once.`, [
+			"catalog",
+			"permissions",
+			index
+		]);
+		if (entry.policies === null || entry.policies.some((id) => unevaluable.has(id))) {
+			permissions.set(key, null);
+			continue;
+		}
+		permissions.set(key, permission);
+		const policies = [];
+		for (const [i, id] of entry.policies.entries()) {
+			const tree = trees.get(id);
+			if (!tree) refuseDocument(`The catalog does not declare the policy ${id}.`, [
+				"catalog",
+				"permissions",
+				index,
+				"policies",
+				i
+			]);
+			policies.push(toPolicy(tree));
+		}
+		definitions.push({
+			permission,
+			policies: policies.length > 0 ? policies : void 0
+		});
+	}
+	const bindings = [];
+	for (const grant of grants) {
+		const key = buildPermissionKey({
+			name: grant.name,
+			realmId: grant.realm_id ?? null,
+			clientId: grant.client_id ?? null
+		});
+		const permission = permissions.get(key);
+		if (typeof permission === "undefined") throw new AuthorizationCatalogStaleError(`The catalog does not define the permission ${key}.`);
+		if (permission === null) continue;
+		const policies = [];
+		let evaluable = true;
+		for (const id of grant.policies ?? []) {
+			if (unevaluable.has(id)) {
+				evaluable = false;
+				break;
+			}
+			const tree = trees.get(id);
+			if (!tree) throw new AuthorizationCatalogStaleError(`The catalog does not declare the policy ${id}.`);
+			if (containsBindingCheck(tree)) {
+				evaluable = false;
+				break;
+			}
+			policies.push(toPolicy(tree));
+		}
+		if (!evaluable) continue;
+		bindings.push({
+			permission,
+			realmScope: normalizeRealmScope(grant.realm_scope),
+			policies: policies.length > 0 ? policies : void 0
+		});
+	}
+	const engine = new PolicyEngine(PolicyDefaultEvaluators);
+	engine.registerEvaluator("permissionBinding", new IdentityPermissionBindingPolicyEvaluator({ getFor: async () => bindings }));
+	const evaluator = new PermissionEvaluator({
+		provider: new PermissionMemoryProvider(definitions),
+		policyEngine: engine
+	});
+	const withIdentity = (input) => {
+		const data = input?.clone() ?? new PolicyData();
+		if (!identity) {
+			data.delete("identity");
+			return data;
+		}
+		data.set("identity", {
+			id: identity.id,
+			type: identity.type,
+			realmId: identity.realmId ?? void 0,
+			realmName: identity.realmName ?? void 0,
+			clientId: identity.clientId ?? null
+		});
+		return data;
+	};
+	const forGate = (ctx) => {
+		if (ctx.options?.policiesIncluded || ctx.options?.policiesExcluded || ctx.options?.pendingPolicies) throw new InternalError("The authorization evaluator does not accept policy bypass options.");
+		return {
+			name: ctx.name,
+			realmId: ctx.realmId,
+			clientId: ctx.clientId,
+			data: withIdentity(ctx.data),
+			...ctx.options?.decisionStrategy ? { options: { decisionStrategy: ctx.options.decisionStrategy } } : {}
+		};
+	};
+	const forResource = (ctx) => {
+		const next = forGate(ctx);
+		if (next.data.has("realmMatch")) {
+			const value = next.data.get("realmMatch");
+			const outcome = realmMatchSchema.safeParse(value);
+			if (!outcome.success) refuseDocumentWithIssues(buildIssuesForZodError(outcome.error, value).map((issue) => prefixIssuePath(issue, ["data", "realmMatch"])));
+		}
+		return next;
+	};
+	return {
+		async evaluate(ctx) {
+			return evaluator.evaluate(forResource(ctx));
+		},
+		async evaluateOneOf(ctx) {
+			return evaluator.evaluateOneOf(forResource(ctx));
+		},
+		async preEvaluate(ctx) {
+			return evaluator.preEvaluate(forGate(ctx));
+		},
+		async preEvaluateOneOf(ctx) {
+			return evaluator.preEvaluateOneOf(forGate(ctx));
+		},
+		async compile(ctx) {
+			if (ctx.data?.has("realmMatch") || ctx.data?.has("attributes")) throw new InternalError("Compile authorization without resource realm or row attributes.");
+			return evaluator.compile({
+				name: ctx.name,
+				realmId: ctx.realmId,
+				clientId: ctx.clientId,
+				data: withIdentity(ctx.data),
+				realmAttributeName: ctx.realmAttributeName
+			});
+		}
+	};
+}
+/**
+* An `IPermissionEvaluator` over the answer `POST /authorization/check`
+* served: the caller's own verdicts, paired with the realms they hold in.
+*
+* It is what a PUBLIC client gets where the catalog is out of reach. A public
+* client holds no secret, so it can obtain no `client_credentials` token and
+* has no credential of its own for the catalog's gate to be satisfied by;
+* publishing every policy predicate to it instead would be the wrong trade.
+* The verdicts are computed by the server from the same grants and the same
+* evaluators a request runs, so this is authoritative where the name-only
+* fallback it replaces is merely coarse.
+*
+* Two properties follow from the answer being a pre-gate:
+*
+* It is an UPPER BOUND, so `evaluate` and `evaluateOneOf` answer exactly what
+* the pre-gate pair answers. A check that depends on a resource row belongs to
+* whoever holds the row, and the server decides it there; answering such a
+* check here would mean inventing a verdict. That is the same bound the
+* name-only fallback already had, so nothing that gates on it loosens.
+*
+* And a resource realm is matched against what the REQUEST asked about: a
+* `realmMatch` naming a realm the request never carried is in no entry's list
+* and therefore denies. That is fail-closed by construction rather than by a
+* rule, and it is why a caller must ask about the realms its UI will ask
+* about.
+*/
+async function createAuthorizationCheckEvaluator(input) {
+	const { permissions, identity } = await parseAuthorizationCheckEvaluatorInput(input);
+	const verdicts = /* @__PURE__ */ new Map();
+	for (const permission of permissions) verdicts.set(permission.name, new Set(permission.realms));
+	const ownKeys = /* @__PURE__ */ new Set();
+	if (identity?.realmId) ownKeys.add(identity.realmId);
+	if (identity?.realmName) ownKeys.add(identity.realmName);
+	const matchesRealm = (realms, value) => {
+		if (realms.has(value)) return true;
+		if (value === null || !ownKeys.has(value)) return false;
+		for (const key of ownKeys) if (realms.has(key)) return true;
+		return false;
+	};
+	const holds = (name, data) => {
+		const realms = verdicts.get(name);
+		if (!realms) return false;
+		if (!data || !data.has("realmMatch")) return true;
+		const value = data.get("realmMatch");
+		if (Array.isArray(value)) {
+			if (value.length === 0) return false;
+			return value.every((entry) => matchesRealm(realms, entry ?? null));
+		}
+		return matchesRealm(realms, value ?? null);
+	};
+	const names = (ctx) => Array.isArray(ctx.name) ? ctx.name : [ctx.name];
+	const assertEvery = async (ctx) => {
+		for (const name of names(ctx)) if (!holds(name, ctx.data)) throw PermissionError.evaluationFailed(ctx.name);
+	};
+	const assertSome = async (ctx) => {
+		const list = names(ctx);
+		for (const name of list) if (holds(name, ctx.data)) return;
+		throw PermissionError.evaluationFailed(ctx.name);
+	};
+	return {
+		evaluate: assertEvery,
+		evaluateOneOf: assertSome,
+		preEvaluate: assertEvery,
+		preEvaluateOneOf: assertSome,
+		async compile(ctx) {
+			if ((Array.isArray(ctx.name) ? ctx.name : [ctx.name]).some((name) => holds(name, ctx.data))) return { verdict: "post" };
+			return { verdict: "deny" };
+		}
+	};
+}
+//#endregion
+export { AUTHORIZATION_CATALOG_STALE_ERROR_INSTANCE, AUTHORIZATION_POLICY_WITHHELD_TYPE, AttributeNamesPolicyEvaluator, AttributeNamesPolicyValidator, AttributesPolicyEvaluator, AttributesPolicyValidator, AuthorizationCatalogStaleError, AuthorizationCheckEvaluatorInputValidator, AuthorizationEvaluatorInputValidator, BuiltInPolicyType, CompositePolicyEvaluator, CompositePolicyValidator, DatePolicyEvaluator, DatePolicyValidator, IdentityPermissionBindingPolicyEvaluator, IdentityPolicyEvaluator, IdentityPolicyValidator, PERMISSION_ERROR_INSTANCE, POLICY_ERROR_INSTANCE, PermissionBindingPolicyEvaluator, PermissionBindingPolicyValidator, PermissionError, PermissionEvaluator, PermissionMemoryProvider, PolicyData, PolicyDefaultEvaluators, PolicyEngine, PolicyError, PolicyIssueCode, PolicyIssueSeverity, REALM_SCOPE_ORDER, RealmMatchPolicyEvaluator, RealmMatchPolicyValidator, RealmScope, SystemPolicyName, TimePolicyEvaluator, TimePolicyInterval, TimePolicyValidator, aggregatePermissionPolicyBindings, authorizationCatalogSchema, authorizationCheckPermissionSchema, authorizationCheckPermissionsSchema, authorizationDefinitionSchema, authorizationGrantSchema, authorizationIdentitySchema, authorizationPolicySchema, buildPermissionKey, compareRealmScope, containsBindingCheck, createAuthorizationCheckEvaluator, createAuthorizationEvaluator, defineAttributesPolicy, definePolicyData, definePolicyEvaluationContext, definePolicyIssueGroup, definePolicyIssueItem, definePolicyWithType, grantDominates, isAuthorizationCatalogStaleError, isCompositePolicy, isIntervalForDayOfMonth, isIntervalForDayOfWeek, isIntervalForDayOfYear, isPermissionError, isPermissionPolicyBindingEqual, isPolicyError, maxRealmScope, maybeInvertPolicyOutcome, minRealmScope, normalizeRealmScope, parseAuthorizationCheckEvaluatorInput, parseAuthorizationEvaluatorInput, projectAuthorizationPolicy, realmScopeMatches };
 
 //# sourceMappingURL=index.mjs.map