@authup/access 1.0.0-beta.68 → 1.0.0-beta.69
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.mts +65 -55
- package/dist/index.d.mts.map +1 -1
- package/dist/index.mjs +34 -7
- package/dist/index.mjs.map +1 -1
- package/dist/permission/authorization/module.d.ts.map +1 -1
- package/dist/policy/built-in/identity/data/validator.d.ts.map +1 -1
- package/dist/policy/built-in/identity/types.d.ts +9 -0
- package/dist/policy/built-in/identity/types.d.ts.map +1 -1
- package/dist/policy/built-in/permission-binding/identity-evaluator.d.ts +7 -7
- package/dist/policy/built-in/permission-binding/identity-evaluator.d.ts.map +1 -1
- package/package.json +5 -5
package/dist/index.d.mts
CHANGED
|
@@ -319,56 +319,6 @@ export declare class DatePolicyEvaluator implements IPolicyEvaluator {
|
|
|
319
319
|
evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult>;
|
|
320
320
|
}
|
|
321
321
|
//#endregion
|
|
322
|
-
//#region src/policy/built-in/identity/types.d.ts
|
|
323
|
-
export interface IdentityPolicy extends BasePolicy {
|
|
324
|
-
/**
|
|
325
|
-
* Set of allowed identity types.
|
|
326
|
-
*/
|
|
327
|
-
types?: string[];
|
|
328
|
-
}
|
|
329
|
-
export type IdentityPolicyData = {
|
|
330
|
-
/**
|
|
331
|
-
* user, client
|
|
332
|
-
*/
|
|
333
|
-
type: string;
|
|
334
|
-
/**
|
|
335
|
-
* UUID
|
|
336
|
-
*/
|
|
337
|
-
id: string;
|
|
338
|
-
/**
|
|
339
|
-
* Client associated with identity.
|
|
340
|
-
*/
|
|
341
|
-
clientId?: string | null;
|
|
342
|
-
/**
|
|
343
|
-
* Realm id associated with identity.
|
|
344
|
-
*/
|
|
345
|
-
realmId?: string | null;
|
|
346
|
-
/**
|
|
347
|
-
* Realm name associated with identity.
|
|
348
|
-
*/
|
|
349
|
-
realmName?: string | null;
|
|
350
|
-
};
|
|
351
|
-
//#endregion
|
|
352
|
-
//#region src/policy/built-in/identity/data/validator.d.ts
|
|
353
|
-
declare class PolicyIdentityDataValidator extends Container<IdentityPolicyData> {
|
|
354
|
-
initialize(): void;
|
|
355
|
-
}
|
|
356
|
-
//#endregion
|
|
357
|
-
//#region src/policy/built-in/identity/validator.d.ts
|
|
358
|
-
export declare class IdentityPolicyValidator extends Container<IdentityPolicy> {
|
|
359
|
-
initialize(): void;
|
|
360
|
-
}
|
|
361
|
-
//#endregion
|
|
362
|
-
//#region src/policy/built-in/identity/evaluator.d.ts
|
|
363
|
-
export declare class IdentityPolicyEvaluator implements IPolicyEvaluator {
|
|
364
|
-
protected validator: IdentityPolicyValidator;
|
|
365
|
-
protected dataValidator: PolicyIdentityDataValidator;
|
|
366
|
-
constructor();
|
|
367
|
-
requires(): string[];
|
|
368
|
-
accessData(ctx: PolicyEvaluationContext): Promise<IdentityPolicyData | null>;
|
|
369
|
-
evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult>;
|
|
370
|
-
}
|
|
371
|
-
//#endregion
|
|
372
322
|
//#region src/permission/realm-scope/constants.d.ts
|
|
373
323
|
/**
|
|
374
324
|
* Actor-relative realm reach of a permission grant.
|
|
@@ -461,6 +411,64 @@ export type PermissionPolicyBindingAggregated = {
|
|
|
461
411
|
grants: PermissionGrant[];
|
|
462
412
|
};
|
|
463
413
|
//#endregion
|
|
414
|
+
//#region src/policy/built-in/identity/types.d.ts
|
|
415
|
+
export interface IdentityPolicy extends BasePolicy {
|
|
416
|
+
/**
|
|
417
|
+
* Set of allowed identity types.
|
|
418
|
+
*/
|
|
419
|
+
types?: string[];
|
|
420
|
+
}
|
|
421
|
+
export type IdentityPolicyData = {
|
|
422
|
+
/**
|
|
423
|
+
* user, client
|
|
424
|
+
*/
|
|
425
|
+
type: string;
|
|
426
|
+
/**
|
|
427
|
+
* UUID
|
|
428
|
+
*/
|
|
429
|
+
id: string;
|
|
430
|
+
/**
|
|
431
|
+
* Client associated with identity.
|
|
432
|
+
*/
|
|
433
|
+
clientId?: string | null;
|
|
434
|
+
/**
|
|
435
|
+
* Realm id associated with identity.
|
|
436
|
+
*/
|
|
437
|
+
realmId?: string | null;
|
|
438
|
+
/**
|
|
439
|
+
* Realm name associated with identity.
|
|
440
|
+
*/
|
|
441
|
+
realmName?: string | null;
|
|
442
|
+
/**
|
|
443
|
+
* The grants the identity holds. The permission binding evaluator reads
|
|
444
|
+
* them from here rather than loading them, so evaluation is a function of
|
|
445
|
+
* the data alone. Whoever places an identity in the policy data places
|
|
446
|
+
* its grants with it, and an identity without them holds none we could
|
|
447
|
+
* prove.
|
|
448
|
+
*/
|
|
449
|
+
grants?: PermissionPolicyBinding[];
|
|
450
|
+
};
|
|
451
|
+
//#endregion
|
|
452
|
+
//#region src/policy/built-in/identity/data/validator.d.ts
|
|
453
|
+
declare class PolicyIdentityDataValidator extends Container<IdentityPolicyData> {
|
|
454
|
+
initialize(): void;
|
|
455
|
+
}
|
|
456
|
+
//#endregion
|
|
457
|
+
//#region src/policy/built-in/identity/validator.d.ts
|
|
458
|
+
export declare class IdentityPolicyValidator extends Container<IdentityPolicy> {
|
|
459
|
+
initialize(): void;
|
|
460
|
+
}
|
|
461
|
+
//#endregion
|
|
462
|
+
//#region src/policy/built-in/identity/evaluator.d.ts
|
|
463
|
+
export declare class IdentityPolicyEvaluator implements IPolicyEvaluator {
|
|
464
|
+
protected validator: IdentityPolicyValidator;
|
|
465
|
+
protected dataValidator: PolicyIdentityDataValidator;
|
|
466
|
+
constructor();
|
|
467
|
+
requires(): string[];
|
|
468
|
+
accessData(ctx: PolicyEvaluationContext): Promise<IdentityPolicyData | null>;
|
|
469
|
+
evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult>;
|
|
470
|
+
}
|
|
471
|
+
//#endregion
|
|
464
472
|
//#region src/policy/built-in/realm-match/types.d.ts
|
|
465
473
|
export interface RealmMatchPolicy extends BasePolicy {
|
|
466
474
|
/**
|
|
@@ -526,17 +534,18 @@ export declare class PermissionBindingPolicyValidator extends Container<Permissi
|
|
|
526
534
|
}
|
|
527
535
|
//#endregion
|
|
528
536
|
//#region src/policy/built-in/permission-binding/identity-evaluator.d.ts
|
|
529
|
-
type IdentityPermissionProvider = {
|
|
530
|
-
getFor(identity: IdentityPolicyData): Promise<PermissionPolicyBinding[]>;
|
|
531
|
-
};
|
|
532
537
|
export declare class IdentityPermissionBindingPolicyEvaluator implements IPolicyEvaluator {
|
|
533
538
|
protected validator: PermissionBindingPolicyValidator;
|
|
534
539
|
protected identityEvaluator: IdentityPolicyEvaluator;
|
|
535
540
|
protected realmMatchEvaluator: RealmMatchPolicyEvaluator;
|
|
536
|
-
|
|
537
|
-
constructor(identityPermissionProvider: IdentityPermissionProvider);
|
|
541
|
+
constructor();
|
|
538
542
|
requires(): string[];
|
|
539
543
|
accessData(ctx: PolicyEvaluationContext): Promise<PermissionPolicyBindingAggregated | null>;
|
|
544
|
+
/**
|
|
545
|
+
* The grants the identity holds. An identity carrying none is missing
|
|
546
|
+
* data, which throws a PolicyError carrying the refusing issue.
|
|
547
|
+
*/
|
|
548
|
+
accessGrants(ctx: PolicyEvaluationContext, identity: IdentityPolicyData): PermissionPolicyBinding[];
|
|
540
549
|
evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult>;
|
|
541
550
|
}
|
|
542
551
|
//#endregion
|
|
@@ -1291,4 +1300,5 @@ export declare const authorizationCheckPermissionsSchema: z.ZodArray<z.ZodObject
|
|
|
1291
1300
|
realms: z.ZodArray<z.ZodNullable<z.ZodString>>;
|
|
1292
1301
|
}, z.core.$strip>>;
|
|
1293
1302
|
//#endregion
|
|
1303
|
+
export {};
|
|
1294
1304
|
//# sourceMappingURL=index.d.mts.map
|
package/dist/index.d.mts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.mts","names":[],"sources":["../src/policy/data.ts","../src/policy/evaluation/context/types.ts","../src/policy/evaluation/context/define.ts","../src/policy/evaluation/context/transition.ts","../src/policy/evaluation/types.ts","../src/policy/types.ts","../src/policy/engine/types.ts","../src/policy/engine/module.ts","../src/policy/issue/constants.ts","../src/policy/issue/types.ts","../src/policy/issue/define.ts","../src/policy/error/module.ts","../src/policy/error/check.ts","../src/policy/helpers/invert.ts","../src/policy/built-in/attribute-names/types.ts","../src/policy/built-in/attribute-names/validator.ts","../src/policy/built-in/attributes/types.ts","../src/policy/built-in/attributes/define.ts","../src/policy/built-in/attributes/validator.ts","../src/policy/built-in/attributes/evaluator.ts","../src/policy/built-in/attribute-names/evaluator.ts","../src/policy/built-in/composite/types.ts","../src/policy/built-in/composite/validator.ts","../src/policy/built-in/composite/evaluator.ts","../src/policy/built-in/composite/helper.ts","../src/policy/built-in/date/types.ts","../src/policy/built-in/date/validator.ts","../src/policy/built-in/date/evaluator.ts","../src/
|
|
1
|
+
{"version":3,"file":"index.d.mts","names":[],"sources":["../src/policy/data.ts","../src/policy/evaluation/context/types.ts","../src/policy/evaluation/context/define.ts","../src/policy/evaluation/context/transition.ts","../src/policy/evaluation/types.ts","../src/policy/types.ts","../src/policy/engine/types.ts","../src/policy/engine/module.ts","../src/policy/issue/constants.ts","../src/policy/issue/types.ts","../src/policy/issue/define.ts","../src/policy/error/module.ts","../src/policy/error/check.ts","../src/policy/helpers/invert.ts","../src/policy/built-in/attribute-names/types.ts","../src/policy/built-in/attribute-names/validator.ts","../src/policy/built-in/attributes/types.ts","../src/policy/built-in/attributes/define.ts","../src/policy/built-in/attributes/validator.ts","../src/policy/built-in/attributes/evaluator.ts","../src/policy/built-in/attribute-names/evaluator.ts","../src/policy/built-in/composite/types.ts","../src/policy/built-in/composite/validator.ts","../src/policy/built-in/composite/evaluator.ts","../src/policy/built-in/composite/helper.ts","../src/policy/built-in/date/types.ts","../src/policy/built-in/date/validator.ts","../src/policy/built-in/date/evaluator.ts","../src/permission/realm-scope/constants.ts","../src/permission/realm-scope/helpers.ts","../src/permission/types.ts","../src/policy/built-in/identity/types.ts","../src/policy/built-in/identity/data/validator.ts","../src/policy/built-in/identity/validator.ts","../src/policy/built-in/identity/evaluator.ts","../src/policy/built-in/realm-match/types.ts","../src/policy/built-in/realm-match/validator.ts","../src/policy/built-in/realm-match/evaluator.ts","../src/policy/built-in/permission-binding/types.ts","../src/policy/built-in/permission-binding/validator.ts","../src/policy/built-in/permission-binding/identity-evaluator.ts","../src/policy/built-in/permission-binding/module.ts","../src/policy/built-in/time/constants.ts","../src/policy/built-in/time/types.ts","../src/policy/built-in/time/validator.ts","../src/policy/built-in/time/evaluator.ts","../src/policy/built-in/time/helpers.ts","../src/policy/built-in/constants.ts","../src/policy/built-in/types.ts","../src/policy/built-in/define.ts","../src/policy/constants.ts","../src/policy/input.ts","../src/permission/error/module.ts","../src/permission/error/check.ts","../src/permission/helpers/aggregate.ts","../src/permission/helpers/equal.ts","../src/permission/helpers/grant.ts","../src/permission/helpers/key.ts","../src/permission/provider/types.ts","../src/permission/provider/memory.ts","../src/permission/evaluator/types.ts","../src/permission/evaluator/module.ts","../src/permission/authorization/error.ts","../src/permission/authorization/check.ts","../src/permission/authorization/types.ts","../src/permission/authorization/check-schema.ts","../src/permission/authorization/constants.ts","../src/permission/authorization/module.ts","../src/permission/authorization/policy.ts","../src/permission/authorization/schema.ts"],"mappings":";;;;;;;;iBAOiB;EACb,IAAI,aAAa;EACjB,IAAI;EACJ,IAAI,aAAa,cAAe;EAChC,OAAO;EAEP,YAAY;EACZ,aAAa;EAEb,SAAU;;qBAGD,sBAAsB;YACrB,MAAM;YAEN,WAAY;EAGlB,YAAA,OAAM,qBACN,YAAW;EAMf,IAAI,aAAa,aAAa,OAAO;EAKrC,IAAI,aAAa,cAAe;EAQhC,IAAI;EAIJ,OAAO;EAKP,aAAa;EAIb,YAAY;EAIZ,SAAK;;;;;;;;;;;;;YC5CG;EACR,OAAO,IAAI;;YAGH;WACC,YAAY,eAAe;WAC3B;WACA;WACA;WACA,MAAM;;;;;;;WAON;;;;;;;;;WASA;;;;;;WAMA,cAAc;;YAGf,+BAA+B,QAAQ;;;wBC1CnC,8BACZ,QAAO,+BACP;;;YCHQ,4BAA4B;;;;WAI3B,MAAM;;;;;;wBAOH,mCAAoC;;;YCTxC,mBAAmB,eAAe;YAElC;EACR;;;;;;;;;EASA;;;;;;;;;;EAUA,YAAY;EACZ,SAAS;;iBAGI;;;;;;;;;;EAUb,UAAU,OAAO;;;;;;;;;;;;EAajB,aAAa,OAAO,qBAAqB,SAAS,0BAA0B,QAAQ;;;;EAKpF,SAAS,OAAO,qBAAqB,SAAS,0BAA0B,QAAQ;;;;;;;YCrDxE,mBAAmB,eAAe,UAAU;YAE5C,WAAW;;;;EAInB,OAAO;;;;EAKP;;YAGQ,eACR,UAAU,sBAAsB,qBAChC,6BACA,IAAI,WAAW;;;iBCnBF;EACb,SAAS,QAAQ,YAAY,SAAS,0BAA2B,QAAQ;EAEzE,eAAe,QAAQ,YAAY,SAAS,0BAA2B;;;;;;;;qBC2B9D,wBAAwB;YACvB,YAAa,eAAe;EAE1B,YAAA,aAAY;EAWjB,kBACH,cACA,WAAW;EAKR,mBAAmB,YAAY;;;;;EAWhC,SAAS,QAAQ,YAAY,KAAK,0BAA2B,QAAQ;EAoHrE,eAAe,QAAQ,YAAY,KAAK,0BAA2B;;;;oBCrLjE;EACR;EACA;;oBAGQ;EAER;EACA;EAGA;EACA;EACA;EACA;EAGA;EACA;EAGA;EACA;EACA;EAGA;EACA;EAGA;;;;YC5BQ,kBAAkB;YAClB,mBAAmB;YAEnB,cAAc,kBAAkB;;;wBCF5B,sBAAsB,OAAO,KAAK,2BAA4B;wBAI9D,uBAAuB,OAAO,KAAK,4BAA6B;;;qBCJnE;qBAEA,oBAAoB;EACjB,YAAA,kBAAkB,sBAAsB,SAAS;SAStD,kBAAkB,eAAY;SAO9B,2BAAuB;SAOvB,2BAAuB;;;;wBC1BlB,cAAc,iBAAiB,SAAS;;;KCHnD,YAAY;wBAED,yBACZ,kBACA,mBAAmB;;;iBCFN,6BAA6B;EAC1C;;;;qBCES,sCAAsC,UAAU;EAChD;;;;YCHD,sBACR,UAAU,sBAAsB,uBAChC,wBAAwB;iBAEX,iBACb,UAAU,sBAAsB,6BAC1B;EACN,OAAO,sBAAsB;;;;wBCRjB,uBACZ,UAAU,sBAAsB,qBAEhC,MAAM,iBAAiB,KACvB,iBAAiB;;;qBCDR,0BACT,UAAU,sBAAsB,6BAC1B,UAAU,iBAAiB;EACxB;;;;qBCKA,0BACT,UAAU,sBAAsB,gCACvB;YACC,WAAY,0BAA0B;YAEtC,QAAS;;EAOnB;EAIM,YAAY,OAAO,sBAAuB,QAAQ;EAiBlD,WAAW,KAAK,0BAA2B,QAAQ;EAkBnD,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;YA6CxE,SACN;;;;qBCtGK,yCAAyC;YACxC,WAAY;YAEZ,qBAAsB;;EAO1B,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;iBCfrE,wBAAwB;;;;EAIrC,sBAAsB;;;;EAItB,UAAU;;;;qBCLD,iCAAiC,UAAU;EAC3C;;;;qBCIA,oCAAoC;YACnC,WAAY;;EAMhB,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;wBCdtE,kBACZ,OAAO,iBACP,SAAS,eAAe;;;iBCJX,mBAAmB;EAChC,iBAAiB;EAEjB,eAAe;;;;qBCAN,4BAA4B,UAAU;EACtC;;;;qBCwCA,+BAA+B;YAC9B,WAAY;;EAMhB,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;;;;;;;;oBC9C1E;;EAER;;EAEA;;EAEA;;EAEA;;;qBAIS,mBAAmB,UAAU;;;;;;;wBCb1B,oBAAoB,WAAW,yBAAyB;;;;;wBAYxD,kBACZ,OAAO,qBACP,OAAO;;wBAMK,cAAc,QAAQ,SAAS,sCAAsC;;wBAerE,cAAc,QAAQ,SAAS,sCAAsC;;;;;;;wBAyCrE,kBACZ,UAAU,iCACV,0BAA0B,yCAC1B,4CACA;;;YClFQ;EACR;EACA;EACA;EACA,sBAAsB;;;;;;;YAQd;EACR,YAAY;EACZ,WAAW;;;;;;EAMX,gBAAgB;;;;;;;YAQR;;EAER,eAAe;;;;;;EAMf,SAAS;;;;;;;;YASD;EACR,YAAY;EACZ,QAAQ;;;;iBChDK,uBAAuB;;;;EAIpC;;YAGQ;;;;EAIR;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAIA;;;;;;;;EAQA,SAAS;;;;cCnBA,oCAAoC,UAAU;EAC9C;;;;qBCfA,gCAAgC,UAAU;EAC1C;;;;qBCEA,mCAAmC;YAClC,WAAY;YAEZ,eAAgB;;EAO1B;EAIM,WAAW,KAAK,0BAA2B,QAAQ;EAiBnD,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;iBCnCrE,yBAAyB;;;;EAItC,sBAAsB;;;;;EAMtB;;;;EAKA;;;;;EAMA;;;;;;;EAQA,WAAW;;;;qBC1BF,kCAAkC,UAAU;EAC5C;;;;qBCUA,qCAAqC;YACpC,WAAY;YAEZ,mBAAmB;YAEnB,qBAAsB;;EAQhC,SAAS,OAAO;;;;;;;;;;;;EAsBV,YAAY,OAAO,qBAAqB,KAAK,0BAA2B,QAAQ;EAuFhF,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;iBC1IrE,gCAAgC;;;qBCGpC,yCAAyC,UAAU;EACnD;;;;qBC6BA,oDAAoD;YACnD,WAAY;YAEZ,mBAAmB;YAEnB,qBAAsB;;EAQhC;EASM,WAAW,KAAK,0BAA2B,QAAQ;;;;;EAqBzD,aACI,KAAK,yBACL,UAAU,qBACV;EAcE,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;qBC1FzE,4CAA4C;YAC3C,WAAW;;EAMrB;EAMM,SAAS,OAAO,sBAAsB,QAAQ;;;;oBClB5C;EACR;EACA;EACA;EACA;;;;iBCDa,mBAAmB;;;;EAIhC,0BAA0B;;;;EAK1B,wBAAwB;;;;EAKxB,cAAc;;;;EAKd;;;;EAKA;;;;EAKA;;;;qBC1BS,4BAA4B,UAAU;EACtC;;;;qBCgGA,+BAA+B;YAC9B,WAAY;;EAMhB,SAAS,OAAO,qBAAqB,KAAK,0BAA0B,QAAQ;;;;wBC5GtE,uBACZ,mBAAgB,YAAA,mBAAA,SAAA,mBAAA,UAAA,mBAAA;wBAOJ,wBACZ,mBAAgB,YAAA,mBAAA,UAAA,mBAAA;wBAMJ,uBACZ,mBAAgB,YAAA,mBAAA;;;oBClBR;;;;EAIR;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAIA;;;;EAKA;;;;EAKA;;qBAMS;;;;;;;;;;KC9BR,wBAAwB,UAAU,sBAAsB;GACxD,kBAAkB,aAAa,iBAAiB;GAChD,kBAAkB,kBAAkB;GACpC,kBAAkB,OAAO;GACzB,kBAAkB,YAAY;GAC9B,kBAAkB,OAAO;GACzB,kBAAkB,WAAW;GAC7B,kBAAkB,qBAAqB;GACvC,kBAAkB,cAAc;;YAGzB,qBAAqB,UAAU,sBAAsB,0BAC5D,WAAW,wBAAwB,SAAS,MAAM,wBAAwB,GAAG;YAGtE,gBAAgB,UAAU,sBAAsB,0BACvD,WAAW,qBAAqB,KAAK,qBAAqB,GAAG;EAC1D,MAAM;WAEN;;;wBC1BQ,qBACZ,gBAAgB,sBAChB,UAAU,0BAA0B,IAEpC,MAAM,GACN,MAAM,IACN,eAAe,GAAG;;;qBCYT;;;;;;;;;;;;;;;;;;;qBAoBA,yBAA0B,SAAS;;;;;;;;;;;iBC7B/B;GACZ,kBAAkB,YAAY;GAC9B,kBAAkB,cAAc;GAChC,kBAAkB;GAClB;;;;;;;;;wBAUW,iBAAiB,QAAO,cAAmB;;;qBCtB9C;qBAEA,wBAAwB;EACrB,YAAA,UAAS;SASd,SAAS,eAAY;SAOrB,OAAO,eAAY;SAOnB,UAAU,kBAAe;SAOzB,iBAAiB,yBAAyB,SAAS,gBAAa;;;;wBClC3D,kBAAkB,iBAAiB,SAAS;;;;;;;;;;wBC4C5C,kCACZ,OAAO,4BACR;;;wBC/Ca,+BACZ;EAAK,YAAY;GACjB;EAAK,YAAY;;;;;;;;;;wBC+GL,eAAe,QAAQ,iBAAiB,OAAO;;;wBC5G/C,mBACZ,OAAO;;;YCNC;EACR;EACA;EACA;;iBAGa;EACb,QAAQ,UAAU,uBAAwB,QAAQ;;;;qBCLzC,oCAAoC;YACnC,OAAQ,eAAe;EAErB,YAAA,QAAO;EAIb,QACF,SAAS,uBACV,QAAQ;EAeX,QAAQ,OAAO;;;;iBCvBF;EACb,SAAS,KAAK,8BAA8B;EAE5C,cAAc,KAAK,8BAA8B;EAEjD,YAAY,KAAK,8BAA8B;EAE/C,iBAAiB,KAAK,8BAA8B;EAEpD,QAAQ,KAAK,2BAA2B,QAAQ;;YAGxC;EACR,UAAU;EACV,eAAe;EACf;EACA;;YAGQ;EACR,sBAAsB;EACtB;EACA;;;;;;;;;;EAUA;;;;;;;EAOA,cAAc;;YAGN;EACR;EACA;EACA;EACA,OAAO;EACP,UAAU;;YAGF;;;;;EAKR;EACA;EACA;;;;;;EAMA,OAAO;;;;;;;;EAQP;;;;;;;;;;;;;YAcQ;EAA4B;;EAClC;;EACA;EAAwB,WAAW;;EACnC;;;;qBClEO,+BAA+B;YAC9B,UAAW;YAEX,cAAe;YAEf;YAEA;EAIE,YAAA,SAAS;YAeL,QACZ,eACA;IACI;IACA;MAEJ,QAAQ;EAUN,SAAS,KAAK,8BAA+B;EAsH7C,cAAc,KAAK,8BAA+B;EAYlD,YAAY,KAAK,8BAA+B;EAehD,iBAAiB,KAAK,8BAA+B;;;;;;;;;;;EAsBrD,QAAQ,KAAK,2BAA4B,QAAQ;;;;qBC1O9C;;;;;;;;;;;;;qBAcA,uCAAuC;EACpC,YAAA;;;;;;;;wBCTA,iCAAiC,iBAAkB,SAAS;;;;;;;YCAhE;EACR;EACA;EACA,WAAW;GACV;;YAGO;EACR;EACA;EACA;EACA,sBAAsB;;;;;;;;;EAStB;;;;;YAMQ;;;;;EAKR,UAAU,eAAe;EACzB,aAAa;;;;;;;;YASL;EACR;EACA;EACA;;;;EAIA,iBAAiB;;;;EAIjB;;YAGQ;;;;EAIR;;;;;EAKA;;;;;;EAMA,WAAW;;YAGH;;;;;EAKR,aAAa;;;;;;;EAOb,aAAa;;;;;;;;;;;;;;;YAgBL,8BAA8B,WAAW,WAClD,WAAW,gBACd;;;;;;YAOY;EACR;EACA,QAAQ;;;;;;;;;;;YAYA,gCAAgC;YAEhC;;;;EAIR;;;;;;;EAOA,WAAW;;;;;;;;;;qBCrIF,kDAAkD,UAAU;EAC5D;;YAUD;EACR,aAAa;EACb,UAAU;;;;;;;;wBASQ,sCAClB,OAAO,mCACP,QAAQ;;;;;;;;;;;;;;;qBCxBC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBC8GS,6BAClB,OAAO,6BACP,UAAS,gCACT,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA6NU,kCAClB,OAAO,mCACP,QAAQ;;;;;;;;;;;;;;;;;;;;;wBC9SU,2BAClB,gBACA,aAAY,mBACZ,QAAQ;;;;;;;;;wBAyDI,qBAAqB,QAAQ;;;;;;;;;;qBCpFhC,2BAAyB,EAAA;;GAA6C,EAAA,KAAA;;;;;qBAMtE,+BAA6B,EAAA;;;;;;GAMxC,EAAA,KAAA;qBAEW,4BAA0B,EAAA;;;;;;;;;;;GAGrC,EAAA,KAAA;;;;;;qBAOW,0BAAwB,EAAA;;;;;;GAMnC,EAAA,KAAA;qBAEW,6BAA2B,EAAA;;;;;;;;;GAMtC,EAAA,KAAA;;;;;;;;qBASW,6CAA6C,UAAU;EACvD;;YAWD;EACR,SAAS;EACT,QAAQ;EACR,UAAU;;;;;;;;;;;;;;;;;;;wBAoBQ,iCAClB,OAAO,8BACP,QAAQ;;;;;;qBA4DC,oCAAkC,EAAA;;;GAG7C,EAAA,KAAA;qBAEW,qCAAmC,EAAA,SAAA,EAAA;;;GAA8C,EAAA,KAAA"}
|
package/dist/index.mjs
CHANGED
|
@@ -969,6 +969,11 @@ var DatePolicyEvaluator = class {
|
|
|
969
969
|
};
|
|
970
970
|
//#endregion
|
|
971
971
|
//#region src/policy/built-in/identity/data/validator.ts
|
|
972
|
+
function isPermissionPolicyBinding(input) {
|
|
973
|
+
if (!input || typeof input !== "object") return false;
|
|
974
|
+
const { permission } = input;
|
|
975
|
+
return !!permission && typeof permission === "object" && typeof permission.name === "string";
|
|
976
|
+
}
|
|
972
977
|
var PolicyIdentityDataValidator = class extends Container {
|
|
973
978
|
initialize() {
|
|
974
979
|
super.initialize();
|
|
@@ -976,6 +981,7 @@ var PolicyIdentityDataValidator = class extends Container {
|
|
|
976
981
|
this.mount("id", createValidator(z.uuid()));
|
|
977
982
|
this.mount("clientId", createValidator(z.uuid().or(z.null()).or(z.undefined()).optional()));
|
|
978
983
|
this.mount("realmId", createValidator(z.uuid().or(z.null()).or(z.undefined()).optional()));
|
|
984
|
+
this.mount("grants", createValidator(z.array(z.custom((input) => isPermissionPolicyBinding(input))).optional()));
|
|
979
985
|
this.mount("realmName", createValidator(z.string().min(3).max(128).or(z.null()).or(z.undefined()).optional()));
|
|
980
986
|
}
|
|
981
987
|
};
|
|
@@ -1205,12 +1211,10 @@ var IdentityPermissionBindingPolicyEvaluator = class {
|
|
|
1205
1211
|
validator;
|
|
1206
1212
|
identityEvaluator;
|
|
1207
1213
|
realmMatchEvaluator;
|
|
1208
|
-
|
|
1209
|
-
constructor(identityPermissionProvider) {
|
|
1214
|
+
constructor() {
|
|
1210
1215
|
this.validator = new PermissionBindingPolicyValidator();
|
|
1211
1216
|
this.identityEvaluator = new IdentityPolicyEvaluator();
|
|
1212
1217
|
this.realmMatchEvaluator = new RealmMatchPolicyEvaluator();
|
|
1213
|
-
this.identityPermissionProvider = identityPermissionProvider;
|
|
1214
1218
|
}
|
|
1215
1219
|
requires() {
|
|
1216
1220
|
return ["permissionBinding"];
|
|
@@ -1223,6 +1227,18 @@ var IdentityPermissionBindingPolicyEvaluator = class {
|
|
|
1223
1227
|
ctx.data.setValidated("permissionBinding");
|
|
1224
1228
|
return data;
|
|
1225
1229
|
}
|
|
1230
|
+
/**
|
|
1231
|
+
* The grants the identity holds. An identity carrying none is missing
|
|
1232
|
+
* data, which throws a PolicyError carrying the refusing issue.
|
|
1233
|
+
*/
|
|
1234
|
+
accessGrants(ctx, identity) {
|
|
1235
|
+
if (!identity.grants) throw new PolicyError("The identity grants are missing", void 0, [definePolicyIssueItem({
|
|
1236
|
+
code: "DATA_MISSING",
|
|
1237
|
+
message: "The identity grants are missing",
|
|
1238
|
+
path: ctx.path
|
|
1239
|
+
})]);
|
|
1240
|
+
return identity.grants;
|
|
1241
|
+
}
|
|
1226
1242
|
async evaluate(value, ctx) {
|
|
1227
1243
|
const policy = await this.validator.run(value);
|
|
1228
1244
|
const identity = await this.identityEvaluator.accessData(ctx);
|
|
@@ -1243,10 +1259,20 @@ var IdentityPermissionBindingPolicyEvaluator = class {
|
|
|
1243
1259
|
path: ctx.path
|
|
1244
1260
|
})]
|
|
1245
1261
|
};
|
|
1246
|
-
|
|
1262
|
+
let grants;
|
|
1263
|
+
try {
|
|
1264
|
+
grants = this.accessGrants(ctx, identity);
|
|
1265
|
+
} catch (e) {
|
|
1266
|
+
if (isPolicyError(e)) return {
|
|
1267
|
+
success: false,
|
|
1268
|
+
issues: [...e.issues]
|
|
1269
|
+
};
|
|
1270
|
+
throw e;
|
|
1271
|
+
}
|
|
1272
|
+
const identityBindings = grants.filter((item) => {
|
|
1247
1273
|
if (item.permission.name !== binding.permission.name) return false;
|
|
1248
1274
|
return (binding.permission.realmId ?? null) === (item.permission.realmId ?? null) && (binding.permission.clientId ?? null) === (item.permission.clientId ?? null);
|
|
1249
|
-
})
|
|
1275
|
+
});
|
|
1250
1276
|
if (identityBindings.length === 0) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
|
|
1251
1277
|
const [aggr] = aggregatePermissionPolicyBindings(identityBindings);
|
|
1252
1278
|
if (!aggr) return { success: maybeInvertPolicyOutcome(false, policy.invert) };
|
|
@@ -2132,7 +2158,7 @@ async function createAuthorizationEvaluator(input, options = {}) {
|
|
|
2132
2158
|
});
|
|
2133
2159
|
}
|
|
2134
2160
|
const engine = new PolicyEngine(options.evaluators ?? PolicyDefaultEvaluators);
|
|
2135
|
-
engine.registerEvaluator("permissionBinding", new IdentityPermissionBindingPolicyEvaluator(
|
|
2161
|
+
engine.registerEvaluator("permissionBinding", new IdentityPermissionBindingPolicyEvaluator());
|
|
2136
2162
|
const evaluator = new PermissionEvaluator({
|
|
2137
2163
|
provider: new PermissionMemoryProvider(definitions),
|
|
2138
2164
|
policyEngine: engine
|
|
@@ -2148,7 +2174,8 @@ async function createAuthorizationEvaluator(input, options = {}) {
|
|
|
2148
2174
|
type: identity.type,
|
|
2149
2175
|
realmId: identity.realmId ?? void 0,
|
|
2150
2176
|
realmName: identity.realmName ?? void 0,
|
|
2151
|
-
clientId: identity.clientId ?? null
|
|
2177
|
+
clientId: identity.clientId ?? null,
|
|
2178
|
+
grants: bindings
|
|
2152
2179
|
});
|
|
2153
2180
|
return data;
|
|
2154
2181
|
};
|