@autorix/express 0.1.1 → 0.1.2

package/README.md

@@ -46,7 +46,7 @@ const policyProvider = new MemoryPolicyProvider();
 
 // Create enforcer
 const enforcer = {
-  can: async (input: { action: string; context: any; resource?: unknown }) => {
+  can: async (input: { action: string; resource: string; context: any }) => {
     // ✅ IMPORTANT: If your app allows unauthenticated requests, guard here
     // to avoid storage/providers crashing when principal is null.
     if (!input.context?.principal) {
@@ -62,8 +62,8 @@ const enforcer = {
     const result = evaluateAll({
       policies: policies.map(p => p.document),
       action: input.action,
-      resource: input.resource,
-      context: input.context,
+      resource: input.resource,  // ← String for matching (e.g., 'post/123')
+      ctx: input.context,        // ← Contains resource object in ctx.resource
     });
 
     return { allowed: result.allowed, reason: result.reason };
@@ -209,6 +209,49 @@ authorize({
 })
 ```
 
+## 🔑 Understanding Resources
+
+Autorix uses **two separate concepts** for resources:
+
+1. **Resource String** (for pattern matching in policies)
+   - Format: `type/id` or `type/*`
+   - Used in policy `Resource` field
+   - Example: `'post/123'`, `'document/*'`
+
+2. **Resource Object** (for attribute-based conditions)
+   - Contains resource properties/attributes
+   - Used in policy `Condition` blocks
+   - Example: `{ type: 'post', id: '123', authorId: 'u1' }`
+
+**How they work together:**
+
+```typescript
+// Policy matches by string pattern
+Statement: [{
+  Effect: 'Allow',
+  Action: ['post:delete'],
+  Resource: 'post/*',  // ← Matches 'post/123'
+  Condition: {
+    StringEquals: {
+      'resource.authorId': '${principal.id}'  // ← Uses resource object
+    }
+  }
+}]
+
+// Middleware automatically handles both
+authorize({
+  action: 'post:delete',
+  resource: {
+    type: 'post',
+    idFrom: (req) => req.params.id,  // → Builds string: 'post/123'
+    loader: async (id) => {
+      const post = await db.posts.findById(id);
+      return { authorId: post.authorId };  // → Object for conditions
+    }
+  }
+})
+```
+
 ## 🎯 Usage Examples
 
 ### Role-Based Access Control (RBAC)
@@ -253,16 +296,16 @@ app.get('/admin/settings',
 ### Attribute-Based Access Control (ABAC)
 
 ```typescript
-// Policy with conditions
+// Policy with conditions - checks resource attributes
 await provider.setPolicy('owner-only', {
   Version: '2024-01-01',
   Statement: [{
     Effect: 'Allow',
     Action: ['post:update', 'post:delete'],
-    Resource: ['post/*'],
+    Resource: ['post/*'],  // ← Matches 'post/123' string pattern
     Condition: {
       StringEquals: {
-        'principal.id': '${resource.ownerId}'
+        'resource.authorId': '${principal.id}'  // ← Checks resource object property
       }
     }
   }]
@@ -277,12 +320,16 @@ app.put('/posts/:id',
       idFrom: (req) => req.params.id,
       loader: async (id) => {
         const post = await db.posts.findById(id);
-        return { ...post, ownerId: post.userId };
+        // Return object with properties for conditions
+        return { 
+          authorId: post.authorId,  // ← This becomes resource.authorId in conditions
+          status: post.status 
+        };
       }
     }
   }),
   (req, res) => {
-    // Only post owner can update
+    // Only post author can update
     res.json({ message: 'Post updated!' });
   }
 );

package/dist/index.cjs

@@ -125,17 +125,31 @@ function autorixExpress(opts) {
       const context = await buildRequestContext(req, opts);
       req.autorix = {
         context,
-        can: /* @__PURE__ */ __name(async (action, resource, ctxExtra) => {
+        can: /* @__PURE__ */ __name(async (action, resourceObj, ctxExtra) => {
+          let resourceString = "*";
+          if (typeof resourceObj === "object" && resourceObj && "type" in resourceObj) {
+            const resType = resourceObj.type;
+            const resId = resourceObj.id;
+            resourceString = resId ? `${resType}/${resId}` : `${resType}/*`;
+          } else if (typeof resourceObj === "string") {
+            resourceString = resourceObj;
+          } else if (resourceObj === void 0) {
+            const parts = action.split(":");
+            if (parts.length > 1) {
+              resourceString = `${parts[0]}/*`;
+            }
+          }
           const decision = await opts.enforcer.can({
             action,
+            resource: resourceString,
             context: {
               ...context,
+              resource: resourceObj,
               attributes: {
                 ...context.attributes ?? {},
                 ...ctxExtra ?? {}
               }
-            },
-            resource
+            }
           });
           opts.onDecision?.({
             ...decision,
@@ -161,9 +175,16 @@ async function resolveResource(spec, req) {
   if (typeof spec === "string") return {
     type: spec
   };
-  if ("loader" in spec) {
+  if ("loader" in spec && typeof spec.loader === "function" && typeof spec.idFrom === "function") {
     const id = spec.idFrom(req);
     const data = await spec.loader(id, req);
+    if (data && typeof data === "object" && !Array.isArray(data)) {
+      return {
+        type: spec.type,
+        id,
+        ...data
+      };
+    }
     return {
       type: spec.type,
       id,

package/dist/index.d.cts

@@ -17,19 +17,19 @@ type AutorixRequestContext = {
 type ResourceSpec = string | {
     type: string;
     id?: string;
-    data?: unknown;
+    [key: string]: unknown;
 } | {
     type: string;
     idFrom: (req: Request) => string;
-    loader: (id: string, req: Request) => Promise<unknown>;
+    loader: (id: string, req: Request) => Promise<Record<string, unknown>>;
 };
 type GetContextFn = (req: Request) => Partial<AutorixRequestContext> | Promise<Partial<AutorixRequestContext>>;
 type AutorixExpressOptions = {
     enforcer: {
         can: (input: {
             action: string;
+            resource: string;
             context: AutorixRequestContext;
-            resource?: unknown;
         }) => Promise<{
             allowed: boolean;
             reason?: string;

package/dist/index.d.ts

@@ -17,19 +17,19 @@ type AutorixRequestContext = {
 type ResourceSpec = string | {
     type: string;
     id?: string;
-    data?: unknown;
+    [key: string]: unknown;
 } | {
     type: string;
     idFrom: (req: Request) => string;
-    loader: (id: string, req: Request) => Promise<unknown>;
+    loader: (id: string, req: Request) => Promise<Record<string, unknown>>;
 };
 type GetContextFn = (req: Request) => Partial<AutorixRequestContext> | Promise<Partial<AutorixRequestContext>>;
 type AutorixExpressOptions = {
     enforcer: {
         can: (input: {
             action: string;
+            resource: string;
             context: AutorixRequestContext;
-            resource?: unknown;
         }) => Promise<{
             allowed: boolean;
             reason?: string;

package/dist/index.js

@@ -92,17 +92,31 @@ function autorixExpress(opts) {
       const context = await buildRequestContext(req, opts);
       req.autorix = {
         context,
-        can: /* @__PURE__ */ __name(async (action, resource, ctxExtra) => {
+        can: /* @__PURE__ */ __name(async (action, resourceObj, ctxExtra) => {
+          let resourceString = "*";
+          if (typeof resourceObj === "object" && resourceObj && "type" in resourceObj) {
+            const resType = resourceObj.type;
+            const resId = resourceObj.id;
+            resourceString = resId ? `${resType}/${resId}` : `${resType}/*`;
+          } else if (typeof resourceObj === "string") {
+            resourceString = resourceObj;
+          } else if (resourceObj === void 0) {
+            const parts = action.split(":");
+            if (parts.length > 1) {
+              resourceString = `${parts[0]}/*`;
+            }
+          }
           const decision = await opts.enforcer.can({
             action,
+            resource: resourceString,
             context: {
               ...context,
+              resource: resourceObj,
               attributes: {
                 ...context.attributes ?? {},
                 ...ctxExtra ?? {}
               }
-            },
-            resource
+            }
           });
           opts.onDecision?.({
             ...decision,
@@ -128,9 +142,16 @@ async function resolveResource(spec, req) {
   if (typeof spec === "string") return {
     type: spec
   };
-  if ("loader" in spec) {
+  if ("loader" in spec && typeof spec.loader === "function" && typeof spec.idFrom === "function") {
     const id = spec.idFrom(req);
     const data = await spec.loader(id, req);
+    if (data && typeof data === "object" && !Array.isArray(data)) {
+      return {
+        type: spec.type,
+        id,
+        ...data
+      };
+    }
     return {
       type: spec.type,
       id,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autorix/express",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Express.js integration for Autorix policy-based authorization (RBAC + ABAC)",
   "keywords": [
     "authorization",
@@ -55,7 +55,8 @@
     "@types/express": "^5.0.6",
     "@types/supertest": "^6.0.3",
     "express": "^5.2.1",
-    "supertest": "^7.2.2"
+    "supertest": "^7.2.2",
+    "@autorix/storage": "^0.1.0"
   },
   "engines": {
     "node": ">=18"