@authup/access 1.0.0-beta.68 → 1.0.0-beta.70

package/dist/permission/authorization/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/permission/authorization/module.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACR,oBAAoB,EAIvB,MAAM,cAAc,CAAC;AAWtB,OAAO,KAAK,EACR,gCAAgC,EAChC,2BAA2B,EAC3B,6BAA6B,EAEhC,MAAM,SAAS,CAAC;AA0CjB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAsB,4BAA4B,CAC9C,KAAK,EAAE,2BAA2B,EAClC,OAAO,GAAE,6BAAkC,GAC3C,OAAO,CAAC,oBAAoB,CAAC,CAgMhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,iCAAiC,CACnD,KAAK,EAAE,gCAAgC,GACvC,OAAO,CAAC,oBAAoB,CAAC,CA0GhC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/permission/authorization/module.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACR,oBAAoB,EAIvB,MAAM,cAAc,CAAC;AAWtB,OAAO,KAAK,EACR,gCAAgC,EAChC,2BAA2B,EAC3B,6BAA6B,EAEhC,MAAM,SAAS,CAAC;AA0CjB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAsB,4BAA4B,CAC9C,KAAK,EAAE,2BAA2B,EAClC,OAAO,GAAE,6BAAkC,GAC3C,OAAO,CAAC,oBAAoB,CAAC,CAiMhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,iCAAiC,CACnD,KAAK,EAAE,gCAAgC,GACvC,OAAO,CAAC,oBAAoB,CAAC,CA0GhC"}

package/dist/permission/index.d.ts

@@ -3,6 +3,7 @@ export * from './helpers';
 export * from './provider';
 export * from './evaluator';
 export * from './realm-scope';
+export * from './record';
 export * from './types';
 export * from './authorization';
 //# sourceMappingURL=index.d.ts.map

package/dist/permission/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/permission/index.ts"],"names":[],"mappings":"AAOA,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,SAAS,CAAC;AACxB,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/permission/index.ts"],"names":[],"mappings":"AAOA,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC;AACxB,cAAc,iBAAiB,CAAC"}

package/dist/permission/record/index.d.ts

@@ -0,0 +1,3 @@
+export * from './module';
+export * from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/permission/record/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/permission/record/index.ts"],"names":[],"mappings":"AAOA,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC"}

package/dist/permission/record/module.d.ts

@@ -0,0 +1,36 @@
+import type { IPermissionEvaluator } from '../evaluator';
+import type { RecordEvaluationContext, RecordUpdateEvaluationContext } from './types';
+/**
+ * Throws a permission error unless `name` passes for the record: each grant's
+ * `realm_scope` is matched against the record's realm and its policies are
+ * evaluated against the record. An array of names must ALL pass, like
+ * `evaluate()`.
+ */
+export declare function evaluateRecord(evaluator: IPermissionEvaluator, ctx: RecordEvaluationContext): Promise<void>;
+/** {@link evaluateRecord} where ANY of the names suffices, like `evaluateOneOf()`. */
+export declare function evaluateRecordOneOf(evaluator: IPermissionEvaluator, ctx: RecordEvaluationContext): Promise<void>;
+/**
+ * {@link evaluateRecord} as a predicate. Only a permission error reads as
+ * `false`; anything else propagates, so a failure on the authorization path
+ * never turns into a quiet "not authorized".
+ */
+export declare function reachesRecord(evaluator: IPermissionEvaluator, ctx: RecordEvaluationContext): Promise<boolean>;
+/** {@link evaluateRecordOneOf} as a predicate, like {@link reachesRecord}. */
+export declare function reachesRecordOneOf(evaluator: IPermissionEvaluator, ctx: RecordEvaluationContext): Promise<boolean>;
+/**
+ * An update passes only when `name` passes for BOTH the stored row (the actor
+ * may only change a row it can already reach) and the updated row (the row
+ * must stay in reach afterwards). Evaluating the updated row alone lets an
+ * update move a row INTO reach.
+ */
+export declare function evaluateRecordUpdate(evaluator: IPermissionEvaluator, ctx: RecordUpdateEvaluationContext): Promise<void>;
+/**
+ * Whether a grant of `name` (any of, for an array) reaches every realm with
+ * no narrowing policy, i.e. `realm_scope: any`. Reads the `compile()`
+ * verdict, so it relies on the binding policy (`system.default`) being bound
+ * to the permission: without it a grant's reach is never evaluated and any
+ * grant compiles to `allow`. Fail-closed: a policy-bearing `any` grant
+ * compiles to `conditional` and reads as `false`.
+ */
+export declare function hasUnboundedReach(evaluator: IPermissionEvaluator, name: string | string[]): Promise<boolean>;
+//# sourceMappingURL=module.d.ts.map

package/dist/permission/record/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/permission/record/module.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,oBAAoB,EAA+B,MAAM,cAAc,CAAC;AACtF,OAAO,KAAK,EACR,uBAAuB,EAEvB,6BAA6B,EAChC,MAAM,SAAS,CAAC;AAuDjB;;;;;GAKG;AACH,wBAAsB,cAAc,CAChC,SAAS,EAAE,oBAAoB,EAC/B,GAAG,EAAE,uBAAuB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,sFAAsF;AACtF,wBAAsB,mBAAmB,CACrC,SAAS,EAAE,oBAAoB,EAC/B,GAAG,EAAE,uBAAuB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAEf;AAeD;;;;GAIG;AACH,wBAAsB,aAAa,CAC/B,SAAS,EAAE,oBAAoB,EAC/B,GAAG,EAAE,uBAAuB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,8EAA8E;AAC9E,wBAAsB,kBAAkB,CACpC,SAAS,EAAE,oBAAoB,EAC/B,GAAG,EAAE,uBAAuB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAElB;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACtC,SAAS,EAAE,oBAAoB,EAC/B,GAAG,EAAE,6BAA6B,GACnC,OAAO,CAAC,IAAI,CAAC,CAaf;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACnC,SAAS,EAAE,oBAAoB,EAC/B,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,GACxB,OAAO,CAAC,OAAO,CAAC,CAGlB"}

package/dist/permission/record/types.d.ts

@@ -0,0 +1,41 @@
+import type { PolicyData, PolicyInput } from '../../policy';
+import type { PermissionEvaluationOptions } from '../evaluator';
+/**
+ * The realm of the record a check is evaluated against: a realm id, `null`
+ * for a global row, or a list of either when every listed realm must be
+ * reached.
+ */
+export type RecordRealm = string | null | (string | null)[];
+/** One record a single-record check is evaluated against. */
+export type RecordTarget = {
+    /**
+     * The RECORD's realm (`null` = global row), or the target realm on
+     * create. This is what each grant's `realm_scope` is matched against.
+     * It is distinct from `PermissionEvaluationContext.realmId`, which is the
+     * realm the PERMISSION is bound to. Required: `undefined` throws, so a
+     * caller cannot drop the realm by omission and neutral-pass every grant's
+     * `realm_scope`.
+     */
+    realm: RecordRealm;
+    /**
+     * The policy data the record is evaluated with: the row under
+     * `attributes` (for attribute policies on the grant; never synthesized,
+     * so without it an attribute policy stays pending), an identity, a custom
+     * key. Never mutated; must not carry `realmMatch`, which is set from
+     * `realm`.
+     */
+    data?: PolicyData | PolicyInput;
+};
+export type RecordEvaluationContext = RecordTarget & {
+    name: string | string[];
+    options?: PermissionEvaluationOptions;
+};
+export type RecordUpdateEvaluationContext = {
+    name: string | string[];
+    options?: PermissionEvaluationOptions;
+    /** The stored row: the actor must reach it to change it at all. */
+    current: RecordTarget;
+    /** The updated row: it must stay in reach afterwards. */
+    next: RecordTarget;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/permission/record/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/permission/record/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAEhE;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;AAE5D,6DAA6D;AAC7D,MAAM,MAAM,YAAY,GAAG;IACvB;;;;;;;OAOG;IACH,KAAK,EAAE,WAAW,CAAC;IACnB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,UAAU,GAAG,WAAW,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,YAAY,GAAG;IACjD,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,OAAO,CAAC,EAAE,2BAA2B,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IACxC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,OAAO,CAAC,EAAE,2BAA2B,CAAC;IACtC,mEAAmE;IACnE,OAAO,EAAE,YAAY,CAAC;IACtB,yDAAyD;IACzD,IAAI,EAAE,YAAY,CAAC;CACtB,CAAC"}

package/dist/policy/built-in/identity/data/validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../../src/policy/built-in/identity/data/validator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAGpC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEtD,qBAAa,2BAA4B,SAAQ,SAAS,CAAC,kBAAkB,CAAC;IACjE,UAAU;CA+CtB"}
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../../../src/policy/built-in/identity/data/validator.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAIpC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AActD,qBAAa,2BAA4B,SAAQ,SAAS,CAAC,kBAAkB,CAAC;IACjE,UAAU;CAuDtB"}

package/dist/policy/built-in/identity/types.d.ts

@@ -1,3 +1,4 @@
+import type { PermissionPolicyBinding } from '../../../permission/types';
 import type { BasePolicy } from '../../types';
 export interface IdentityPolicy extends BasePolicy {
     /**
@@ -26,5 +27,13 @@ export type IdentityPolicyData = {
      * Realm name associated with identity.
      */
     realmName?: string | null;
+    /**
+     * The grants the identity holds. The permission binding evaluator reads
+     * them from here rather than loading them, so evaluation is a function of
+     * the data alone. Whoever places an identity in the policy data places
+     * its grants with it, and an identity without them holds none we could
+     * prove.
+     */
+    grants?: PermissionPolicyBinding[];
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/policy/built-in/identity/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/identity/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,WAAW,cAAe,SAAQ,UAAU;IAC9C;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC7B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,EAAE,EAAE,MAAM,CAAC;IACX;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/identity/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,WAAW,cAAe,SAAQ,UAAU;IAC9C;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC7B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,EAAE,EAAE,MAAM,CAAC;IACX;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,uBAAuB,EAAE,CAAA;CACrC,CAAC"}

package/dist/policy/built-in/permission-binding/identity-evaluator.d.ts

@@ -1,21 +1,21 @@
 import type { PermissionPolicyBinding, PermissionPolicyBindingAggregated } from '../../../permission/types';
 import type { IPolicyEvaluator, PolicyEvaluationContext, PolicyEvaluationResult } from '../../evaluation';
-import type { IdentityPolicyData } from '../identity';
 import { IdentityPolicyEvaluator } from '../identity';
+import type { IdentityPolicyData } from '../identity';
 import { RealmMatchPolicyEvaluator } from '../realm-match';
 import { PermissionBindingPolicyValidator } from './validator';
-type IdentityPermissionProvider = {
-    getFor(identity: IdentityPolicyData): Promise<PermissionPolicyBinding[]>;
-};
 export declare class IdentityPermissionBindingPolicyEvaluator implements IPolicyEvaluator {
     protected validator: PermissionBindingPolicyValidator;
     protected identityEvaluator: IdentityPolicyEvaluator;
     protected realmMatchEvaluator: RealmMatchPolicyEvaluator;
-    protected identityPermissionProvider: IdentityPermissionProvider;
-    constructor(identityPermissionProvider: IdentityPermissionProvider);
+    constructor();
     requires(): string[];
     accessData(ctx: PolicyEvaluationContext): Promise<PermissionPolicyBindingAggregated | null>;
+    /**
+     * The grants the identity holds. An identity carrying none is missing
+     * data, which throws a PolicyError carrying the refusing issue.
+     */
+    accessGrants(ctx: PolicyEvaluationContext, identity: IdentityPolicyData): PermissionPolicyBinding[];
     evaluate(value: Record<string, any>, ctx: PolicyEvaluationContext): Promise<PolicyEvaluationResult>;
 }
-export {};
 //# sourceMappingURL=identity-evaluator.d.ts.map

package/dist/policy/built-in/permission-binding/identity-evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-evaluator.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/permission-binding/identity-evaluator.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,uBAAuB,EAAE,iCAAiC,EAAE,MAAM,2BAA2B,CAAC;AAG5G,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAM1G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAC;AAE/D,KAAK,0BAA0B,GAAG;IAC9B,MAAM,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;CAC5E,CAAC;AAmBF,qBAAa,wCAAyC,YAAW,gBAAgB;IAC7E,SAAS,CAAC,SAAS,EAAG,gCAAgC,CAAC;IAEvD,SAAS,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;IAErD,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;IAE1D,SAAS,CAAC,0BAA0B,EAAE,0BAA0B,CAAC;gBAErD,0BAA0B,EAAE,0BAA0B;IAOlE,QAAQ,IAAK,MAAM,EAAE;IAQf,UAAU,CAAC,GAAG,EAAE,uBAAuB,GAAI,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC;IAiB5F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CA6N5G"}
+{"version":3,"file":"identity-evaluator.d.ts","sourceRoot":"","sources":["../../../../src/policy/built-in/permission-binding/identity-evaluator.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,uBAAuB,EAAE,iCAAiC,EAAE,MAAM,2BAA2B,CAAC;AAG5G,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAO1G,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAC;AAmB/D,qBAAa,wCAAyC,YAAW,gBAAgB;IAC7E,SAAS,CAAC,SAAS,EAAG,gCAAgC,CAAC;IAEvD,SAAS,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;IAErD,SAAS,CAAC,mBAAmB,EAAG,yBAAyB,CAAC;;IAQ1D,QAAQ,IAAK,MAAM,EAAE;IASf,UAAU,CAAC,GAAG,EAAE,uBAAuB,GAAI,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC;IAiBlG;;;OAGG;IACH,YAAY,CACR,GAAG,EAAE,uBAAuB,EAC5B,QAAQ,EAAE,kBAAkB,GAC5B,uBAAuB,EAAE;IAcvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAuO5G"}

package/package.json

@@ -1,8 +1,8 @@
 {
     "name": "@authup/access",
     "type": "module",
-    "version": "1.0.0-beta.68",
-    "description": "A library for evaluating permissions and policies.",
+    "version": "1.0.0-beta.70",
+    "description": "Evaluate Authup permissions and policies in your own process, with the same engine the server uses.",
     "license": "Apache-2.0",
     "exports": {
         "./package.json": "./package.json",
@@ -54,8 +54,8 @@
     },
     "homepage": "https://github.com/authup/authup#readme",
     "dependencies": {
-        "@authup/errors": "^1.0.0-beta.68",
-        "@authup/kit": "^1.0.0-beta.68",
+        "@authup/errors": "^1.0.0-beta.70",
+        "@authup/kit": "^1.0.0-beta.70",
         "@ebec/core": "^1.3.2",
         "@rapiq/adapter-memory": "^2.4.0",
         "@rapiq/core": "^2.4.0",
@@ -63,11 +63,11 @@
         "@validup/zod": "^2.0.1",
         "smob": "^1.6.1",
         "validup": "^2.0.1",
-        "zod": "^4.6.5"
+        "zod": "^4.6.7"
     },
     "devDependencies": {
-        "unplugin-swc": "^1.6.0",
-        "vitest": "^4.0.14"
+        "unplugin-swc": "^2.0.0",
+        "vitest": "^5.0.3"
     },
     "publishConfig": {
         "access": "public"