@authyon/auth 0.2.0-beta.0 → 0.2.0-beta.2

package/dist/chunk-EHZEUM47.js

@@ -0,0 +1,323 @@
+// src/session/sessionController.ts
+var SERVER_SNAPSHOT = {
+  // The server cannot inspect browser storage. Reporting unauthenticated here
+  // makes guards redirect during hydration before a persisted session can be
+  // restored and validated on the client.
+  status: "validating",
+  session: null,
+  user: null,
+  error: null
+};
+var AuthyonSessionController = class {
+  constructor(client, options = {}) {
+    this.client = client;
+    this.listeners = /* @__PURE__ */ new Set();
+    this.getSnapshot = () => this.snapshot;
+    this.getServerSnapshot = () => SERVER_SNAPSHOT;
+    this.subscribe = (listener) => {
+      this.listeners.add(listener);
+      return () => this.listeners.delete(listener);
+    };
+    this.refreshAheadMs = options.refreshAheadMs ?? 3e4;
+    if (!Number.isFinite(this.refreshAheadMs) || this.refreshAheadMs < 0) {
+      throw new Error("Authyon: `refreshAheadMs` must be a non-negative finite number");
+    }
+    const session = client.getSession();
+    this.snapshot = {
+      status: session ? "validating" : "unauthenticated",
+      session,
+      user: session?.user ?? null,
+      error: null
+    };
+  }
+  start() {
+    if (!this.unsubscribeAuth) {
+      this.unsubscribeAuth = this.client.onAuthStateChange((event) => {
+        if (event.type === "signed_out") {
+          this.cancelRefresh();
+          this.setSnapshot({
+            status: "unauthenticated",
+            session: null,
+            user: null,
+            error: null
+          });
+          return;
+        }
+        if (event.type === "session_validated") {
+          this.acceptSession(event.session);
+          return;
+        }
+        this.setSnapshot({
+          status: "validating",
+          session: event.session,
+          user: event.session.user ?? null,
+          error: null
+        });
+        void this.validate();
+      });
+    }
+    void this.validate();
+    return () => this.stop();
+  }
+  stop() {
+    this.unsubscribeAuth?.();
+    this.unsubscribeAuth = void 0;
+    this.cancelRefresh();
+  }
+  validate() {
+    if (this.validation) return this.validation;
+    const localSession = this.client.getSession();
+    if (!localSession) {
+      this.setSnapshot({
+        status: "unauthenticated",
+        session: null,
+        user: null,
+        error: null
+      });
+      return Promise.resolve(this.snapshot);
+    }
+    this.setSnapshot({ ...this.snapshot, status: "validating", error: null });
+    this.validation = this.client.validateSession().then((session) => {
+      if (session) this.acceptSession(session);
+      else {
+        this.setSnapshot({
+          status: "unauthenticated",
+          session: null,
+          user: null,
+          error: null
+        });
+      }
+      return this.snapshot;
+    }).catch((error) => {
+      this.setSnapshot({ ...this.snapshot, status: "error", error });
+      return this.snapshot;
+    }).finally(() => {
+      this.validation = void 0;
+    });
+    return this.validation;
+  }
+  async refreshNow() {
+    if (!this.client.getSession()) return this.validate();
+    try {
+      await this.client.refresh();
+    } catch (error) {
+      if (!this.client.getSession()) return this.validate();
+      this.setSnapshot({ ...this.snapshot, status: "error", error });
+      return this.snapshot;
+    }
+    return this.validate();
+  }
+  acceptSession(session) {
+    this.setSnapshot({
+      status: "authenticated",
+      session,
+      user: session.user ?? null,
+      error: null
+    });
+    this.scheduleRefresh(session);
+  }
+  scheduleRefresh(session) {
+    this.cancelRefresh();
+    const delay = Math.max(1e3, session.expiresAt - Date.now() - this.refreshAheadMs);
+    this.refreshTimer = setTimeout(() => void this.refreshNow(), delay);
+  }
+  cancelRefresh() {
+    if (this.refreshTimer !== void 0) clearTimeout(this.refreshTimer);
+    this.refreshTimer = void 0;
+  }
+  setSnapshot(snapshot) {
+    this.snapshot = snapshot;
+    for (const listener of this.listeners) listener();
+  }
+};
+
+// ../../internal/core/authorization/ability.ts
+var AuthyonAbility = class {
+  constructor(rules = [], detectSubjectType = defaultSubjectType) {
+    this.detectSubjectType = detectSubjectType;
+    this.listeners = /* @__PURE__ */ new Set();
+    this.currentRules = rules.map(cloneRule);
+  }
+  get rules() {
+    return this.currentRules;
+  }
+  can(action, subject, field) {
+    const subjectType = typeof subject === "string" ? subject : this.detectSubjectType(subject);
+    for (let index = this.currentRules.length - 1; index >= 0; index -= 1) {
+      const rule = this.currentRules[index];
+      if (!matchesToken(rule.action, action, "manage")) continue;
+      if (!matchesToken(rule.subject, subjectType, "all")) continue;
+      if (field && rule.fields && !rule.fields.some((value) => matchesField(value, field)))
+        continue;
+      if (rule.conditions) {
+        if (typeof subject === "string" || !matchesConditions(subject, rule.conditions)) continue;
+      }
+      return !rule.inverted;
+    }
+    return false;
+  }
+  cannot(action, subject, field) {
+    return !this.can(action, subject, field);
+  }
+  rulesFor(action, subject) {
+    return this.currentRules.filter(
+      (rule) => matchesToken(rule.action, action, "manage") && matchesToken(rule.subject, subject, "all")
+    );
+  }
+  update(rules) {
+    this.currentRules = rules.map(cloneRule);
+    for (const listener of this.listeners) listener(this.rules);
+  }
+  on(event, listener) {
+    if (event !== "updated") return () => void 0;
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+};
+var AuthyonAbilityBuilder = class {
+  constructor() {
+    this.rules = [];
+  }
+  can(action, subject, conditions, fields) {
+    this.rules.push({ action, subject, conditions, fields });
+    return this;
+  }
+  cannot(action, subject, conditions, fields, reason) {
+    this.rules.push({ action, subject, conditions, fields, reason, inverted: true });
+    return this;
+  }
+  build(options = {}) {
+    return new AuthyonAbility(this.rules, options.detectSubjectType);
+  }
+};
+function createAuthyonAbility(source = {}, options = {}) {
+  return new AuthyonAbility(createAuthyonRules(source, options), options.detectSubjectType);
+}
+function hasPermission(source, requiredPermission) {
+  const requirement = permissionToRule(requiredPermission);
+  if (!requirement || typeof requirement.action !== "string" || typeof requirement.subject !== "string") {
+    return false;
+  }
+  const permissionSource = isPermissionList(source) ? { permissions: source } : source;
+  return createAuthyonAbility(permissionSource).can(requirement.action, requirement.subject);
+}
+function isPermissionList(source) {
+  return Array.isArray(source);
+}
+function createAuthyonRules(source = {}, options = {}) {
+  const permissions = /* @__PURE__ */ new Set([
+    ...source.permissions ?? [],
+    ...source.scope?.split(/\s+/).filter(Boolean) ?? []
+  ]);
+  const rules = [...permissions].map(permissionToRule).filter(isAbilityRule);
+  for (const role of /* @__PURE__ */ new Set([...source.roles ?? [], ...options.roles ?? []])) {
+    rules.push(...(options.roleRules?.[role] ?? []).map(cloneRule));
+  }
+  rules.push(...(options.rules ?? []).map(cloneRule));
+  return rules;
+}
+function permissionToRule(permission) {
+  const normalized = permission.trim();
+  if (!normalized) return null;
+  if (normalized === "*" || normalized === "*:*" || normalized === "all:manage") {
+    return { action: "manage", subject: "all" };
+  }
+  const separator = normalized.lastIndexOf(":");
+  if (separator <= 0 || separator === normalized.length - 1) return null;
+  const subject = normalized.slice(0, separator);
+  const action = normalized.slice(separator + 1);
+  return {
+    action: action === "*" ? "manage" : action,
+    subject: subject === "*" ? "all" : subject
+  };
+}
+function matchesToken(value, expected, wildcard) {
+  return (Array.isArray(value) ? value : [value]).some(
+    (candidate) => candidate === expected || candidate === wildcard || candidate === "*" || matchesSegments(candidate, expected)
+  );
+}
+function matchesSegments(pattern, value) {
+  const patternSegments = pattern.split(":");
+  const valueSegments = value.split(":");
+  return patternSegments.length === valueSegments.length && patternSegments.every((segment, index) => segment === "*" || segment === valueSegments[index]);
+}
+function matchesField(pattern, field) {
+  if (pattern === "*" || pattern === field) return true;
+  return pattern.endsWith(".*") && field.startsWith(pattern.slice(0, -1));
+}
+function matchesConditions(subject, conditions) {
+  return Object.entries(conditions).every(([path, expected]) => {
+    if (path === "$and" && Array.isArray(expected)) {
+      return expected.every(
+        (condition) => matchesConditions(subject, condition)
+      );
+    }
+    if (path === "$or" && Array.isArray(expected)) {
+      return expected.some(
+        (condition) => matchesConditions(subject, condition)
+      );
+    }
+    return matchesValue(readPath(subject, path), expected);
+  });
+}
+function matchesValue(actual, expected) {
+  if (!isRecord(expected) || !Object.keys(expected).some((key) => key.startsWith("$"))) {
+    return isRecord(expected) && isRecord(actual) ? matchesConditions(actual, expected) : Object.is(actual, expected);
+  }
+  return Object.entries(expected).every(([operator, operand]) => {
+    switch (operator) {
+      case "$eq":
+        return Object.is(actual, operand);
+      case "$ne":
+        return !Object.is(actual, operand);
+      case "$in":
+        return Array.isArray(operand) && operand.some((value) => Object.is(actual, value));
+      case "$nin":
+        return Array.isArray(operand) && !operand.some((value) => Object.is(actual, value));
+      case "$gt":
+        return typeof actual === "number" && typeof operand === "number" && actual > operand;
+      case "$gte":
+        return typeof actual === "number" && typeof operand === "number" && actual >= operand;
+      case "$lt":
+        return typeof actual === "number" && typeof operand === "number" && actual < operand;
+      case "$lte":
+        return typeof actual === "number" && typeof operand === "number" && actual <= operand;
+      case "$exists":
+        return operand ? actual !== void 0 : actual === void 0;
+      default:
+        return false;
+    }
+  });
+}
+function readPath(value, path) {
+  return path.split(".").reduce((current, part) => isRecord(current) ? current[part] : void 0, value);
+}
+function defaultSubjectType(subject) {
+  const explicit = subject.__type ?? subject.type ?? subject.kind;
+  if (typeof explicit === "string") return explicit;
+  const constructorName = subject.constructor?.name;
+  return typeof constructorName === "string" ? constructorName : "Object";
+}
+function cloneRule(rule) {
+  return {
+    ...rule,
+    action: Array.isArray(rule.action) ? [...rule.action] : rule.action,
+    subject: Array.isArray(rule.subject) ? [...rule.subject] : rule.subject,
+    fields: rule.fields ? [...rule.fields] : void 0
+  };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isAbilityRule(value) {
+  return value !== null;
+}
+
+export {
+  AuthyonSessionController,
+  AuthyonAbility,
+  AuthyonAbilityBuilder,
+  createAuthyonAbility,
+  hasPermission,
+  createAuthyonRules
+};