@awsmbiz/inbis-access-control 0.0.0-stage → 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,25 @@
+import { _ as SystemRoleDefinition, a as createAccessControl, c as DeleteRoleInput, d as UserRole, f as RoleFields, g as RoleDeclaration, h as PermissionDefinition, i as RoleAssignmentInput, l as Role, m as AccessControlInput, n as AccessControlOptions, o as SeedResult, p as AccessControlDefinition, r as AuthorizeInput, s as CreateRoleInput, t as AccessControl, u as UpdateRoleInput, v as defineAccessControl } from "./access-control-eE6LZrpn.js";
+/**
+ * Audit actions recorded by `@awsmbiz/inbis-access-control`; register them with the
+ * app's audit trail (`createAuditActions({ platform: [ACCESS_CONTROL_AUDIT_ACTIONS] })`).
+ * - `access.role.assigned` / `access.role.unassigned`: subject `user:<id>`, metadata `roleId`.
+ * - `access.role.created`: subject `role:<id>`, metadata `name`, `description`, `permissions`, `inherits`.
+ * - `access.role.updated`: subject `role:<id>`, metadata `changes` (`name`/`description` as
+ *   `{ from, to }`, `permissions`/`inherits` as `{ added, removed }`; changed fields only).
+ * - `access.role.deleted`: subject `role:<id>`, metadata `name`, `permissions`, `inherits`,
+ *   `unassignedUserIds` (the assignments deleted with it).
+ */
+export declare const ACCESS_CONTROL_AUDIT_ACTIONS: {
+  readonly roleAssigned: "access.role.assigned";
+  readonly roleUnassigned: "access.role.unassigned";
+  readonly roleCreated: "access.role.created";
+  readonly roleUpdated: "access.role.updated";
+  readonly roleDeleted: "access.role.deleted";
+};
+/**
+ * The `migrations_table` of the app's access-control D1 binding (ADR-4).
+ * Declare that binding after auth's and before audit's.
+ */
+export declare const ACCESS_CONTROL_MIGRATIONS_TABLE = "_inbis_access_control_migrations";
+export { type AccessControl, type AccessControlDefinition, type AccessControlInput, type AccessControlOptions, type AuthorizeInput, type CreateRoleInput, type DeleteRoleInput, type PermissionDefinition, type Role, type RoleAssignmentInput, type RoleDeclaration, type RoleFields, type SeedResult, type SystemRoleDefinition, type UpdateRoleInput, type UserRole, createAccessControl, defineAccessControl };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -0,0 +1,438 @@
+import { n as cleanList, r as cleanName, t as cleanDescription } from "./role-fields-ClqODoYn.js";
+import { AppError, createLogger, systemClock } from "@awsmbiz/inbis-core";
+// src/actions.ts
+/**
+* Audit actions recorded by `@awsmbiz/inbis-access-control`; register them with the
+* app's audit trail (`createAuditActions({ platform: [ACCESS_CONTROL_AUDIT_ACTIONS] })`).
+* - `access.role.assigned` / `access.role.unassigned`: subject `user:<id>`, metadata `roleId`.
+* - `access.role.created`: subject `role:<id>`, metadata `name`, `description`, `permissions`, `inherits`.
+* - `access.role.updated`: subject `role:<id>`, metadata `changes` (`name`/`description` as
+*   `{ from, to }`, `permissions`/`inherits` as `{ added, removed }`; changed fields only).
+* - `access.role.deleted`: subject `role:<id>`, metadata `name`, `permissions`, `inherits`,
+*   `unassignedUserIds` (the assignments deleted with it).
+*/
+const ACCESS_CONTROL_AUDIT_ACTIONS = {
+	roleAssigned: "access.role.assigned",
+	roleUnassigned: "access.role.unassigned",
+	roleCreated: "access.role.created",
+	roleUpdated: "access.role.updated",
+	roleDeleted: "access.role.deleted"
+};
+// src/roles.ts
+const ROLES = `
+SELECT r.id, r.name, r.description, r.system, r.created_at, r.updated_at,
+  (SELECT json_group_array(permission) FROM (SELECT permission FROM role_permission WHERE role_id = r.id ORDER BY permission)) AS permissions,
+  (SELECT json_group_array(inherits_role_id) FROM (SELECT inherits_role_id FROM role_inheritance WHERE role_id = r.id ORDER BY inherits_role_id)) AS inherits,
+  (SELECT count(*) FROM user_role WHERE role_id = r.id) AS user_count
+FROM role r`;
+const roleNotFound = () => new AppError({
+	code: "ROLE_NOT_FOUND",
+	status: 404,
+	message: "No such role."
+});
+const userNotFound = () => new AppError({
+	code: "USER_NOT_FOUND",
+	status: 404,
+	message: "No such user."
+});
+/** Lists `added` and `removed` between two sorted lists. */
+function listDiff(from, to) {
+	return {
+		added: to.filter((item) => !from.includes(item)),
+		removed: from.filter((item) => !to.includes(item))
+	};
+}
+/** Role administration over the access-control tables (plan Q40: custom roles; system roles read-only). */
+function roleAdmin(db, definition, record, now) {
+	const toRole = (row) => ({
+		id: row.id,
+		name: row.name,
+		description: row.description,
+		system: row.system === 1,
+		permissions: JSON.parse(row.permissions).filter((name) => definition.hasPermission(name)),
+		inherits: JSON.parse(row.inherits),
+		userCount: row.user_count,
+		createdAt: new Date(row.created_at),
+		updatedAt: new Date(row.updated_at)
+	});
+	async function findRole(roleId) {
+		const row = await db.prepare(`${ROLES} WHERE r.id = ?`).bind(roleId).first();
+		return row === null ? null : toRole(row);
+	}
+	async function getRole(roleId) {
+		const role = await findRole(roleId);
+		if (role === null) throw roleNotFound();
+		return role;
+	}
+	async function assertNameFree(name, roleId) {
+		if (await db.prepare("SELECT id FROM role WHERE lower(name) = lower(?) AND id <> ?").bind(name, roleId).first("id") !== null) throw nameTaken(name);
+	}
+	function assertPermissions(permissions) {
+		const unknown = permissions.filter((name) => !definition.hasPermission(name));
+		if (unknown.length > 0) throw new AppError({
+			code: "UNKNOWN_PERMISSION",
+			status: 422,
+			message: "Some permissions are not declared.",
+			details: { permissions: unknown }
+		});
+	}
+	/** Unknown roles are `422 UNKNOWN_ROLE`; an edge that would close a loop is `422 ROLE_INHERITANCE_CYCLE` (`details.cycle`). */
+	async function assertInheritance(roleId, inherits) {
+		const { results: edges } = await db.prepare("SELECT id AS role_id, NULL AS inherits_role_id FROM role UNION ALL SELECT role_id, inherits_role_id FROM role_inheritance").all();
+		const parents = /* @__PURE__ */ new Map();
+		for (const edge of edges) {
+			const list = parents.get(edge.role_id) ?? [];
+			if (edge.inherits_role_id !== null) list.push(edge.inherits_role_id);
+			parents.set(edge.role_id, list);
+		}
+		const unknown = inherits.filter((id) => !parents.has(id) && id !== roleId);
+		if (unknown.length > 0) throw new AppError({
+			code: "UNKNOWN_ROLE",
+			status: 422,
+			message: "Some inherited roles do not exist.",
+			details: { roleIds: unknown }
+		});
+		parents.set(roleId, [...inherits]);
+		const seen = /* @__PURE__ */ new Set();
+		const find = (id, path) => {
+			for (const parent of parents.get(id) ?? []) {
+				if (parent === roleId) return [...path, parent];
+				if (seen.has(parent)) continue;
+				seen.add(parent);
+				const found = find(parent, [...path, parent]);
+				if (found !== null) return found;
+			}
+			return null;
+		};
+		const cycle = find(roleId, [roleId]);
+		if (cycle !== null) throw new AppError({
+			code: "ROLE_INHERITANCE_CYCLE",
+			status: 422,
+			message: "A role cannot inherit itself, directly or through other roles.",
+			details: { cycle }
+		});
+	}
+	function assertCustom(role) {
+		if (role.system) throw new AppError({
+			code: "SYSTEM_ROLE_IMMUTABLE",
+			status: 409,
+			message: "System roles are declared in code and cannot be changed."
+		});
+	}
+	const replaceGrants = (roleId, permissions) => [db.prepare("DELETE FROM role_permission WHERE role_id = ?").bind(roleId), db.prepare("INSERT INTO role_permission (role_id, permission) SELECT ?, value FROM json_each(?)").bind(roleId, JSON.stringify(permissions))];
+	const replaceInheritance = (roleId, inherits) => [db.prepare("DELETE FROM role_inheritance WHERE role_id = ?").bind(roleId), db.prepare("INSERT INTO role_inheritance (role_id, inherits_role_id) SELECT ?, value FROM json_each(?)").bind(roleId, JSON.stringify(inherits))];
+	/** Runs the batch, turning the unique-name index's refusal (a concurrent create) into `409 ROLE_NAME_TAKEN`. */
+	async function write(statements, name) {
+		try {
+			await db.batch(statements);
+		} catch (error) {
+			if (String(error).includes("UNIQUE constraint failed: role.name")) throw nameTaken(name);
+			throw error;
+		}
+	}
+	return {
+		listPermissions: () => definition.permissions.map(({ name, description }) => ({
+			name,
+			description
+		})),
+		async listRoles() {
+			const { results } = await db.prepare(`${ROLES} ORDER BY r.system DESC, r.name COLLATE NOCASE, r.id`).all();
+			return results.map(toRole);
+		},
+		getRole,
+		async createRole(input) {
+			const id = crypto.randomUUID();
+			const name = cleanName(input.name);
+			const description = cleanDescription(input.description);
+			const permissions = cleanList(input.permissions);
+			const inherits = cleanList(input.inherits);
+			assertPermissions(permissions);
+			await assertInheritance(id, inherits);
+			await assertNameFree(name, id);
+			const at = now().getTime();
+			await write([
+				db.prepare("INSERT INTO role (id, name, description, system, created_at, updated_at) VALUES (?, ?, ?, 0, ?, ?)").bind(id, name, description, at, at),
+				...replaceGrants(id, permissions),
+				...replaceInheritance(id, inherits)
+			], name);
+			await record(ACCESS_CONTROL_AUDIT_ACTIONS.roleCreated, `role:${id}`, input.actorId, {
+				name,
+				description,
+				permissions,
+				inherits
+			});
+			return getRole(id);
+		},
+		async updateRole({ roleId, changes, actorId }) {
+			const role = await getRole(roleId);
+			assertCustom(role);
+			const name = changes.name === void 0 ? role.name : cleanName(changes.name);
+			const description = changes.description === void 0 ? role.description : cleanDescription(changes.description);
+			const permissions = changes.permissions === void 0 ? role.permissions : cleanList(changes.permissions);
+			const inherits = changes.inherits === void 0 ? role.inherits : cleanList(changes.inherits);
+			assertPermissions(permissions);
+			await assertInheritance(roleId, inherits);
+			if (name !== role.name) await assertNameFree(name, roleId);
+			const diff = {};
+			if (name !== role.name) diff["name"] = {
+				from: role.name,
+				to: name
+			};
+			if (description !== role.description) diff["description"] = {
+				from: role.description,
+				to: description
+			};
+			const permissionDiff = listDiff(role.permissions, permissions);
+			if (permissionDiff.added.length + permissionDiff.removed.length > 0) diff["permissions"] = permissionDiff;
+			const inheritsDiff = listDiff(role.inherits, inherits);
+			if (inheritsDiff.added.length + inheritsDiff.removed.length > 0) diff["inherits"] = inheritsDiff;
+			if (Object.keys(diff).length === 0) return role;
+			await write([
+				db.prepare("UPDATE role SET name = ?, description = ?, updated_at = ? WHERE id = ?").bind(name, description, now().getTime(), roleId),
+				..."permissions" in diff ? replaceGrants(roleId, permissions) : [],
+				..."inherits" in diff ? replaceInheritance(roleId, inherits) : []
+			], name);
+			await record(ACCESS_CONTROL_AUDIT_ACTIONS.roleUpdated, `role:${roleId}`, actorId, { changes: diff });
+			return getRole(roleId);
+		},
+		async deleteRole({ roleId, actorId }) {
+			const role = await getRole(roleId);
+			assertCustom(role);
+			const { results: heirs } = await db.prepare("SELECT role_id FROM role_inheritance WHERE inherits_role_id = ? ORDER BY role_id").bind(roleId).all();
+			if (heirs.length > 0) throw new AppError({
+				code: "ROLE_INHERITED",
+				status: 409,
+				message: "Other roles inherit this role; remove it from them first.",
+				details: { roleIds: heirs.map((row) => row.role_id) }
+			});
+			const [users] = await db.batch([db.prepare("SELECT user_id FROM user_role WHERE role_id = ? ORDER BY user_id").bind(roleId), db.prepare("DELETE FROM role WHERE id = ? AND system = 0").bind(roleId)]);
+			await record(ACCESS_CONTROL_AUDIT_ACTIONS.roleDeleted, `role:${roleId}`, actorId, {
+				name: role.name,
+				permissions: role.permissions,
+				inherits: role.inherits,
+				unassignedUserIds: (users?.results ?? []).map((row) => row.user_id)
+			});
+		},
+		async userRoles(userId) {
+			if (await db.prepare("SELECT id FROM user WHERE id = ?").bind(userId).first("id") === null) throw userNotFound();
+			const { results } = await db.prepare(`SELECT r.id, r.name, r.system, ur.assigned_at, ur.assigned_by FROM user_role ur JOIN role r ON r.id = ur.role_id
+           WHERE ur.user_id = ? ORDER BY r.system DESC, r.name COLLATE NOCASE, r.id`).bind(userId).all();
+			return results.map((row) => ({
+				id: row.id,
+				name: row.name,
+				system: row.system === 1,
+				assignedAt: new Date(row.assigned_at),
+				assignedBy: row.assigned_by
+			}));
+		}
+	};
+}
+function nameTaken(name) {
+	return new AppError({
+		code: "ROLE_NAME_TAKEN",
+		status: 409,
+		message: `A role named "${name}" already exists.`,
+		details: { name }
+	});
+}
+// src/seed.ts
+async function fingerprintOf(definition) {
+	const canonical = JSON.stringify({
+		permissions: definition.permissions,
+		roles: definition.roles
+	});
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(canonical));
+	return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+/**
+* Makes the database hold exactly the declared catalogue: upserts permissions
+* and system roles, replaces system roles' grants and inheritance, and removes
+* permissions and system roles no longer declared (with their grants and
+* assignments). Custom roles keep their rows; grants of a removed permission go.
+* One D1 batch (a transaction). Idempotent; skipped when the stored
+* fingerprint matches, so running it per isolate costs one read.
+*/
+async function seedCatalogue(db, definition, now) {
+	const fingerprint = await fingerprintOf(definition);
+	if (await db.prepare("SELECT fingerprint FROM access_control_seed WHERE id = 1").first("fingerprint") === fingerprint) return { changed: false };
+	const at = now.getTime();
+	const permissionNames = JSON.stringify(definition.permissions.map((permission) => permission.name));
+	const roleIds = JSON.stringify(definition.roles.map((role) => role.id));
+	const statements = [
+		...definition.permissions.map((permission) => db.prepare("INSERT INTO permission (name, description) VALUES (?, ?) ON CONFLICT (name) DO UPDATE SET description = excluded.description").bind(permission.name, permission.description)),
+		db.prepare("DELETE FROM permission WHERE name NOT IN (SELECT value FROM json_each(?))").bind(permissionNames),
+		db.prepare("DELETE FROM role WHERE system = 1 AND id NOT IN (SELECT value FROM json_each(?))").bind(roleIds),
+		...definition.roles.map((role) => db.prepare(`INSERT INTO role (id, name, description, system, created_at, updated_at) VALUES (?, ?, ?, 1, ?, ?)
+           ON CONFLICT (id) DO UPDATE SET name = excluded.name, description = excluded.description, system = 1, updated_at = excluded.updated_at`).bind(role.id, role.name, role.description, at, at)),
+		...definition.roles.flatMap((role) => [
+			db.prepare("DELETE FROM role_permission WHERE role_id = ?").bind(role.id),
+			db.prepare("INSERT INTO role_permission (role_id, permission) SELECT ?, value FROM json_each(?)").bind(role.id, JSON.stringify(role.permissions)),
+			db.prepare("DELETE FROM role_inheritance WHERE role_id = ?").bind(role.id),
+			db.prepare("INSERT INTO role_inheritance (role_id, inherits_role_id) SELECT ?, value FROM json_each(?)").bind(role.id, JSON.stringify(role.inherits))
+		]),
+		db.prepare("INSERT INTO access_control_seed (id, fingerprint, seeded_at) VALUES (1, ?, ?) ON CONFLICT (id) DO UPDATE SET fingerprint = excluded.fingerprint, seeded_at = excluded.seeded_at").bind(fingerprint, at)
+	];
+	await db.batch(statements);
+	return { changed: true };
+}
+// src/access-control.ts
+/** Every permission the user holds through their roles and the roles those explicitly inherit. */
+const PERMISSIONS_OF_USER = `
+WITH RECURSIVE granted(role_id) AS (
+  SELECT role_id FROM user_role WHERE user_id = ?
+  UNION
+  SELECT ri.inherits_role_id FROM role_inheritance ri JOIN granted g ON ri.role_id = g.role_id
+)
+SELECT DISTINCT rp.permission AS permission FROM role_permission rp JOIN granted g ON rp.role_id = g.role_id`;
+/**
+* Access control over the database holding the access-control tables (the
+* app's access-control binding), for one request.
+*/
+function createAccessControl(db, definition, options = {}) {
+	const clock = options.clock ?? systemClock;
+	const memo = /* @__PURE__ */ new Map();
+	function permissionsOf(userId) {
+		let pending = memo.get(userId);
+		if (pending === void 0) {
+			pending = db.prepare(PERMISSIONS_OF_USER).bind(userId).all().then(({ results }) => new Set(results.map((row) => row.permission)));
+			pending.catch(() => memo.delete(userId));
+			memo.set(userId, pending);
+		}
+		return pending;
+	}
+	/**
+	* Runs a change, then forgets every memoised answer (even if it failed part
+	* way): later checks on this instance read the new state from D1.
+	*/
+	async function changing(change) {
+		try {
+			return await change();
+		} finally {
+			memo.clear();
+		}
+	}
+	const admin = roleAdmin(db, definition, record, () => clock.now());
+	const recordAssignment = (action, { userId, roleId, actorId }) => record(action, `user:${userId}`, actorId, { roleId });
+	async function record(action, subjectId, actorId, metadata) {
+		if (options.audit === void 0) return;
+		try {
+			await options.audit.record({
+				action,
+				occurredAt: clock.now(),
+				actorId,
+				subjectId,
+				...options.requestId === void 0 ? {} : { requestId: options.requestId },
+				metadata
+			});
+		} catch (error) {
+			(options.logger ?? createLogger()).error("access.audit.record_failed", {
+				action,
+				error
+			});
+		}
+	}
+	return {
+		async authorize({ userId, permission }) {
+			if (!definition.hasPermission(permission)) return false;
+			return (await permissionsOf(userId)).has(permission);
+		},
+		async rolesOf(userId) {
+			const { results } = await db.prepare("SELECT role_id FROM user_role WHERE user_id = ? ORDER BY role_id").bind(userId).all();
+			return results.map((row) => row.role_id);
+		},
+		assignRole: (input) => changing(async () => {
+			if (await db.prepare("SELECT id FROM role WHERE id = ?").bind(input.roleId).first("id") === null) throw new AppError({
+				code: "ROLE_NOT_FOUND",
+				status: 404,
+				message: "No such role."
+			});
+			if (await db.prepare("SELECT id FROM user WHERE id = ?").bind(input.userId).first("id") === null) throw new AppError({
+				code: "USER_NOT_FOUND",
+				status: 404,
+				message: "No such user."
+			});
+			const { meta } = await db.prepare("INSERT INTO user_role (user_id, role_id, assigned_at, assigned_by) VALUES (?, ?, ?, ?) ON CONFLICT DO NOTHING").bind(input.userId, input.roleId, clock.now().getTime(), input.actorId).run();
+			if (meta.changes > 0) await recordAssignment(ACCESS_CONTROL_AUDIT_ACTIONS.roleAssigned, input);
+		}),
+		unassignRole: (input) => changing(async () => {
+			const { meta } = await db.prepare("DELETE FROM user_role WHERE user_id = ? AND role_id = ?").bind(input.userId, input.roleId).run();
+			if (meta.changes > 0) await recordAssignment(ACCESS_CONTROL_AUDIT_ACTIONS.roleUnassigned, input);
+		}),
+		seed: () => seedCatalogue(db, definition, clock.now()),
+		...admin,
+		updateRole: (input) => changing(() => admin.updateRole(input)),
+		deleteRole: (input) => changing(() => admin.deleteRole(input))
+	};
+}
+// src/define.ts
+/** `namespace.thing[.more]`: lowercase segments of letters, digits and `_`, at least two. */
+const PERMISSION_NAME = /^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)+$/;
+/** System role IDs: lowercase letters, digits, `_` and `-`. */
+const ROLE_ID = /^[a-z][a-z0-9_-]*$/;
+function assertNoCycle(roles) {
+	const byId = new Map(roles.map((role) => [role.id, role]));
+	const done = /* @__PURE__ */ new Set();
+	const visit = (id, path) => {
+		if (path.includes(id)) throw new Error(`Role inheritance cycle: ${[...path, id].join(" -> ")}.`);
+		if (done.has(id)) return;
+		for (const parent of byId.get(id)?.inherits ?? []) visit(parent, [...path, id]);
+		done.add(id);
+	};
+	for (const role of roles) visit(role.id, []);
+}
+/**
+* Declares the app's permissions and system roles. Throws on a malformed name,
+* an undeclared permission or role, a duplicate role name or an inheritance
+* cycle: all programming errors, found at startup.
+*
+* ```ts
+* export const access = defineAccessControl({
+*   permissions: { "notes.read": "Read notes", "notes.write": "Write notes" },
+*   roles: {
+*     reader: { name: "Reader", permissions: ["notes.read"] },
+*     editor: { name: "Editor", permissions: ["notes.write"], inherits: ["reader"] },
+*   },
+* });
+* ```
+*/
+function defineAccessControl(input) {
+	const permissions = Object.entries(input.permissions).map(([name, description]) => ({
+		name,
+		description
+	})).sort((a, b) => a.name.localeCompare(b.name));
+	const names = new Set(permissions.map((permission) => permission.name));
+	for (const { name } of permissions) if (!PERMISSION_NAME.test(name)) throw new Error(`Permission "${name}" is not a dotted lowercase name such as "notes.read".`);
+	const declared = input.roles;
+	const roles = Object.entries(declared).map(([id, role]) => ({
+		id,
+		name: role.name,
+		description: role.description ?? null,
+		permissions: [...new Set(role.permissions)].sort(),
+		inherits: [...new Set(role.inherits ?? [])].sort()
+	})).sort((a, b) => a.id.localeCompare(b.id));
+	const roleIds = new Set(roles.map((role) => role.id));
+	const roleNames = /* @__PURE__ */ new Set();
+	for (const role of roles) {
+		if (!ROLE_ID.test(role.id)) throw new Error(`Role ID "${role.id}" must be lowercase letters, digits, "_" or "-".`);
+		if (role.name.trim() === "") throw new Error(`Role "${role.id}" needs a name.`);
+		if (roleNames.has(role.name)) throw new Error(`Two roles are named "${role.name}".`);
+		roleNames.add(role.name);
+		for (const permission of role.permissions) if (!names.has(permission)) throw new Error(`Role "${role.id}" grants undeclared permission "${permission}".`);
+		for (const parent of role.inherits) if (!roleIds.has(parent)) throw new Error(`Role "${role.id}" inherits undeclared role "${parent}".`);
+	}
+	assertNoCycle(roles);
+	return {
+		permissions,
+		roles,
+		hasPermission: (name) => names.has(name)
+	};
+}
+// src/index.ts
+/**
+* The `migrations_table` of the app's access-control D1 binding (ADR-4).
+* Declare that binding after auth's and before audit's.
+*/
+const ACCESS_CONTROL_MIGRATIONS_TABLE = "_inbis_access_control_migrations";
+export { ACCESS_CONTROL_AUDIT_ACTIONS, ACCESS_CONTROL_MIGRATIONS_TABLE, createAccessControl, defineAccessControl };
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../src/actions.ts","../src/roles.ts","../src/seed.ts","../src/access-control.ts","../src/define.ts","../src/index.ts"],"sourcesContent":["/**\n * Audit actions recorded by `@awsmbiz/inbis-access-control`; register them with the\n * app's audit trail (`createAuditActions({ platform: [ACCESS_CONTROL_AUDIT_ACTIONS] })`).\n * - `access.role.assigned` / `access.role.unassigned`: subject `user:<id>`, metadata `roleId`.\n * - `access.role.created`: subject `role:<id>`, metadata `name`, `description`, `permissions`, `inherits`.\n * - `access.role.updated`: subject `role:<id>`, metadata `changes` (`name`/`description` as\n *   `{ from, to }`, `permissions`/`inherits` as `{ added, removed }`; changed fields only).\n * - `access.role.deleted`: subject `role:<id>`, metadata `name`, `permissions`, `inherits`,\n *   `unassignedUserIds` (the assignments deleted with it).\n */\nexport const ACCESS_CONTROL_AUDIT_ACTIONS = {\n  roleAssigned: \"access.role.assigned\",\n  roleUnassigned: \"access.role.unassigned\",\n  roleCreated: \"access.role.created\",\n  roleUpdated: \"access.role.updated\",\n  roleDeleted: \"access.role.deleted\",\n} as const;\n","import { AppError } from \"@awsmbiz/inbis-core\";\nimport { ACCESS_CONTROL_AUDIT_ACTIONS } from \"./actions.js\";\nimport type { AccessControlDefinition, PermissionDefinition } from \"./define.js\";\nimport { cleanDescription, cleanList, cleanName, type RoleFields } from \"./role-fields.js\";\n\n/** A role as the admin API shows it. */\nexport interface Role {\n  id: string;\n  name: string;\n  description: string | null;\n  /** Declared in code: read-only through the API. */\n  system: boolean;\n  /** Permissions the role grants itself (declared ones only), sorted. */\n  permissions: string[];\n  /** IDs of the roles it inherits directly, sorted. */\n  inherits: string[];\n  /** Users the role is assigned to directly. */\n  userCount: number;\n  createdAt: Date;\n  updatedAt: Date;\n}\n\n/** A role assigned to a user directly. */\nexport interface UserRole {\n  /** The role's ID. */\n  id: string;\n  name: string;\n  system: boolean;\n  assignedAt: Date;\n  /** The admin who assigned it; `null` for the system. */\n  assignedBy: string | null;\n}\n\nexport interface CreateRoleInput extends RoleFields {\n  actorId: string | null;\n}\n\nexport interface UpdateRoleInput {\n  roleId: string;\n  /** The fields to change; others keep their value. */\n  changes: Partial<RoleFields>;\n  actorId: string | null;\n}\n\nexport interface DeleteRoleInput {\n  roleId: string;\n  actorId: string | null;\n}\n\n/** Records an audit event (failures are the recorder's to handle). */\nexport type Recorder = (action: string, subjectId: string, actorId: string | null, metadata: Record<string, unknown>) => Promise<void>;\n\ninterface RoleRow {\n  id: string;\n  name: string;\n  description: string | null;\n  system: number;\n  created_at: number;\n  updated_at: number;\n  permissions: string;\n  inherits: string;\n  user_count: number;\n}\n\nconst ROLES = `\nSELECT r.id, r.name, r.description, r.system, r.created_at, r.updated_at,\n  (SELECT json_group_array(permission) FROM (SELECT permission FROM role_permission WHERE role_id = r.id ORDER BY permission)) AS permissions,\n  (SELECT json_group_array(inherits_role_id) FROM (SELECT inherits_role_id FROM role_inheritance WHERE role_id = r.id ORDER BY inherits_role_id)) AS inherits,\n  (SELECT count(*) FROM user_role WHERE role_id = r.id) AS user_count\nFROM role r`;\n\nconst roleNotFound = () => new AppError({ code: \"ROLE_NOT_FOUND\", status: 404, message: \"No such role.\" });\nconst userNotFound = () => new AppError({ code: \"USER_NOT_FOUND\", status: 404, message: \"No such user.\" });\n\n/** Lists `added` and `removed` between two sorted lists. */\nfunction listDiff(from: readonly string[], to: readonly string[]) {\n  return { added: to.filter((item) => !from.includes(item)), removed: from.filter((item) => !to.includes(item)) };\n}\n\n/** Role administration over the access-control tables (plan Q40: custom roles; system roles read-only). */\nexport function roleAdmin<P extends string>(db: D1Database, definition: AccessControlDefinition<P>, record: Recorder, now: () => Date) {\n  const toRole = (row: RoleRow): Role => ({\n    id: row.id,\n    name: row.name,\n    description: row.description,\n    system: row.system === 1,\n    permissions: (JSON.parse(row.permissions) as string[]).filter((name) => definition.hasPermission(name)),\n    inherits: JSON.parse(row.inherits) as string[],\n    userCount: row.user_count,\n    createdAt: new Date(row.created_at),\n    updatedAt: new Date(row.updated_at),\n  });\n\n  async function findRole(roleId: string): Promise<Role | null> {\n    const row = await db.prepare(`${ROLES} WHERE r.id = ?`).bind(roleId).first<RoleRow>();\n    return row === null ? null : toRole(row);\n  }\n\n  async function getRole(roleId: string): Promise<Role> {\n    const role = await findRole(roleId);\n    if (role === null) throw roleNotFound();\n    return role;\n  }\n\n  async function assertNameFree(name: string, roleId: string): Promise<void> {\n    const other = await db.prepare(\"SELECT id FROM role WHERE lower(name) = lower(?) AND id <> ?\").bind(name, roleId).first(\"id\");\n    if (other !== null) throw nameTaken(name);\n  }\n\n  function assertPermissions(permissions: readonly string[]): void {\n    const unknown = permissions.filter((name) => !definition.hasPermission(name));\n    if (unknown.length > 0) {\n      throw new AppError({ code: \"UNKNOWN_PERMISSION\", status: 422, message: \"Some permissions are not declared.\", details: { permissions: unknown } });\n    }\n  }\n\n  /** Unknown roles are `422 UNKNOWN_ROLE`; an edge that would close a loop is `422 ROLE_INHERITANCE_CYCLE` (`details.cycle`). */\n  async function assertInheritance(roleId: string, inherits: readonly string[]): Promise<void> {\n    const { results: edges } = await db\n      .prepare(\"SELECT id AS role_id, NULL AS inherits_role_id FROM role UNION ALL SELECT role_id, inherits_role_id FROM role_inheritance\")\n      .all<{ role_id: string; inherits_role_id: string | null }>();\n    const parents = new Map<string, string[]>();\n    for (const edge of edges) {\n      const list = parents.get(edge.role_id) ?? [];\n      if (edge.inherits_role_id !== null) list.push(edge.inherits_role_id);\n      parents.set(edge.role_id, list);\n    }\n    const unknown = inherits.filter((id) => !parents.has(id) && id !== roleId);\n    if (unknown.length > 0) {\n      throw new AppError({ code: \"UNKNOWN_ROLE\", status: 422, message: \"Some inherited roles do not exist.\", details: { roleIds: unknown } });\n    }\n    parents.set(roleId, [...inherits]);\n    // A cycle through this role: a path from it back to itself.\n    const seen = new Set<string>();\n    const find = (id: string, path: string[]): string[] | null => {\n      for (const parent of parents.get(id) ?? []) {\n        if (parent === roleId) return [...path, parent];\n        if (seen.has(parent)) continue;\n        seen.add(parent);\n        const found = find(parent, [...path, parent]);\n        if (found !== null) return found;\n      }\n      return null;\n    };\n    const cycle = find(roleId, [roleId]);\n    if (cycle !== null) {\n      throw new AppError({\n        code: \"ROLE_INHERITANCE_CYCLE\",\n        status: 422,\n        message: \"A role cannot inherit itself, directly or through other roles.\",\n        details: { cycle },\n      });\n    }\n  }\n\n  function assertCustom(role: Role): void {\n    if (role.system) {\n      throw new AppError({ code: \"SYSTEM_ROLE_IMMUTABLE\", status: 409, message: \"System roles are declared in code and cannot be changed.\" });\n    }\n  }\n\n  const replaceGrants = (roleId: string, permissions: readonly string[]) => [\n    db.prepare(\"DELETE FROM role_permission WHERE role_id = ?\").bind(roleId),\n    db.prepare(\"INSERT INTO role_permission (role_id, permission) SELECT ?, value FROM json_each(?)\").bind(roleId, JSON.stringify(permissions)),\n  ];\n  const replaceInheritance = (roleId: string, inherits: readonly string[]) => [\n    db.prepare(\"DELETE FROM role_inheritance WHERE role_id = ?\").bind(roleId),\n    db.prepare(\"INSERT INTO role_inheritance (role_id, inherits_role_id) SELECT ?, value FROM json_each(?)\").bind(roleId, JSON.stringify(inherits)),\n  ];\n\n  /** Runs the batch, turning the unique-name index's refusal (a concurrent create) into `409 ROLE_NAME_TAKEN`. */\n  async function write(statements: D1PreparedStatement[], name: string): Promise<void> {\n    try {\n      await db.batch(statements);\n    } catch (error) {\n      if (String(error).includes(\"UNIQUE constraint failed: role.name\")) throw nameTaken(name);\n      throw error;\n    }\n  }\n\n  return {\n    listPermissions: (): PermissionDefinition<P>[] => definition.permissions.map(({ name, description }) => ({ name, description })),\n\n    async listRoles(): Promise<Role[]> {\n      const { results } = await db.prepare(`${ROLES} ORDER BY r.system DESC, r.name COLLATE NOCASE, r.id`).all<RoleRow>();\n      return results.map(toRole);\n    },\n\n    getRole,\n\n    async createRole(input: CreateRoleInput): Promise<Role> {\n      const id = crypto.randomUUID();\n      const name = cleanName(input.name);\n      const description = cleanDescription(input.description);\n      const permissions = cleanList(input.permissions);\n      const inherits = cleanList(input.inherits);\n      assertPermissions(permissions);\n      await assertInheritance(id, inherits);\n      await assertNameFree(name, id);\n      const at = now().getTime();\n      await write(\n        [\n          db\n            .prepare(\"INSERT INTO role (id, name, description, system, created_at, updated_at) VALUES (?, ?, ?, 0, ?, ?)\")\n            .bind(id, name, description, at, at),\n          ...replaceGrants(id, permissions),\n          ...replaceInheritance(id, inherits),\n        ],\n        name,\n      );\n      await record(ACCESS_CONTROL_AUDIT_ACTIONS.roleCreated, `role:${id}`, input.actorId, { name, description, permissions, inherits });\n      return getRole(id);\n    },\n\n    async updateRole({ roleId, changes, actorId }: UpdateRoleInput): Promise<Role> {\n      const role = await getRole(roleId);\n      assertCustom(role);\n      const name = changes.name === undefined ? role.name : cleanName(changes.name);\n      const description = changes.description === undefined ? role.description : cleanDescription(changes.description);\n      const permissions = changes.permissions === undefined ? role.permissions : cleanList(changes.permissions);\n      const inherits = changes.inherits === undefined ? role.inherits : cleanList(changes.inherits);\n      assertPermissions(permissions);\n      await assertInheritance(roleId, inherits);\n      if (name !== role.name) await assertNameFree(name, roleId);\n\n      // A secret-free diff: changed scalars as { from, to }, lists as { added, removed }.\n      const diff: Record<string, unknown> = {};\n      if (name !== role.name) diff[\"name\"] = { from: role.name, to: name };\n      if (description !== role.description) diff[\"description\"] = { from: role.description, to: description };\n      const permissionDiff = listDiff(role.permissions, permissions);\n      if (permissionDiff.added.length + permissionDiff.removed.length > 0) diff[\"permissions\"] = permissionDiff;\n      const inheritsDiff = listDiff(role.inherits, inherits);\n      if (inheritsDiff.added.length + inheritsDiff.removed.length > 0) diff[\"inherits\"] = inheritsDiff;\n      if (Object.keys(diff).length === 0) return role;\n\n      await write(\n        [\n          db.prepare(\"UPDATE role SET name = ?, description = ?, updated_at = ? WHERE id = ?\").bind(name, description, now().getTime(), roleId),\n          ...(\"permissions\" in diff ? replaceGrants(roleId, permissions) : []),\n          ...(\"inherits\" in diff ? replaceInheritance(roleId, inherits) : []),\n        ],\n        name,\n      );\n      await record(ACCESS_CONTROL_AUDIT_ACTIONS.roleUpdated, `role:${roleId}`, actorId, { changes: diff });\n      return getRole(roleId);\n    },\n\n    async deleteRole({ roleId, actorId }: DeleteRoleInput): Promise<void> {\n      const role = await getRole(roleId);\n      assertCustom(role);\n      const { results: heirs } = await db\n        .prepare(\"SELECT role_id FROM role_inheritance WHERE inherits_role_id = ? ORDER BY role_id\")\n        .bind(roleId)\n        .all<{ role_id: string }>();\n      if (heirs.length > 0) {\n        throw new AppError({\n          code: \"ROLE_INHERITED\",\n          status: 409,\n          message: \"Other roles inherit this role; remove it from them first.\",\n          details: { roleIds: heirs.map((row) => row.role_id) },\n        });\n      }\n      const [users] = await db.batch<{ user_id: string }>([\n        db.prepare(\"SELECT user_id FROM user_role WHERE role_id = ? ORDER BY user_id\").bind(roleId),\n        // Assignments and grants go with it (ON DELETE CASCADE).\n        db.prepare(\"DELETE FROM role WHERE id = ? AND system = 0\").bind(roleId),\n      ]);\n      await record(ACCESS_CONTROL_AUDIT_ACTIONS.roleDeleted, `role:${roleId}`, actorId, {\n        name: role.name,\n        permissions: role.permissions,\n        inherits: role.inherits,\n        unassignedUserIds: (users?.results ?? []).map((row) => row.user_id),\n      });\n    },\n\n    async userRoles(userId: string): Promise<UserRole[]> {\n      const user = await db.prepare(\"SELECT id FROM user WHERE id = ?\").bind(userId).first(\"id\");\n      if (user === null) throw userNotFound();\n      const { results } = await db\n        .prepare(\n          `SELECT r.id, r.name, r.system, ur.assigned_at, ur.assigned_by FROM user_role ur JOIN role r ON r.id = ur.role_id\n           WHERE ur.user_id = ? ORDER BY r.system DESC, r.name COLLATE NOCASE, r.id`,\n        )\n        .bind(userId)\n        .all<{ id: string; name: string; system: number; assigned_at: number; assigned_by: string | null }>();\n      return results.map((row) => ({\n        id: row.id,\n        name: row.name,\n        system: row.system === 1,\n        assignedAt: new Date(row.assigned_at),\n        assignedBy: row.assigned_by,\n      }));\n    },\n  };\n}\n\nfunction nameTaken(name: string): AppError {\n  return new AppError({ code: \"ROLE_NAME_TAKEN\", status: 409, message: `A role named \"${name}\" already exists.`, details: { name } });\n}\n\n\n","import type { AccessControlDefinition } from \"./define.js\";\n\n/** What {@link seedCatalogue} did. */\nexport interface SeedResult {\n  /** `false` when the database already held this exact catalogue (nothing written). */\n  changed: boolean;\n}\n\nasync function fingerprintOf(definition: AccessControlDefinition): Promise<string> {\n  const canonical = JSON.stringify({ permissions: definition.permissions, roles: definition.roles });\n  const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(canonical));\n  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/**\n * Makes the database hold exactly the declared catalogue: upserts permissions\n * and system roles, replaces system roles' grants and inheritance, and removes\n * permissions and system roles no longer declared (with their grants and\n * assignments). Custom roles keep their rows; grants of a removed permission go.\n * One D1 batch (a transaction). Idempotent; skipped when the stored\n * fingerprint matches, so running it per isolate costs one read.\n */\nexport async function seedCatalogue(db: D1Database, definition: AccessControlDefinition, now: Date): Promise<SeedResult> {\n  const fingerprint = await fingerprintOf(definition);\n  const stored = await db.prepare(\"SELECT fingerprint FROM access_control_seed WHERE id = 1\").first<string>(\"fingerprint\");\n  if (stored === fingerprint) return { changed: false };\n\n  const at = now.getTime();\n  const permissionNames = JSON.stringify(definition.permissions.map((permission) => permission.name));\n  const roleIds = JSON.stringify(definition.roles.map((role) => role.id));\n  const statements: D1PreparedStatement[] = [\n    ...definition.permissions.map((permission) =>\n      db\n        .prepare(\n          \"INSERT INTO permission (name, description) VALUES (?, ?) ON CONFLICT (name) DO UPDATE SET description = excluded.description\",\n        )\n        .bind(permission.name, permission.description),\n    ),\n    db.prepare(\"DELETE FROM permission WHERE name NOT IN (SELECT value FROM json_each(?))\").bind(permissionNames),\n    db.prepare(\"DELETE FROM role WHERE system = 1 AND id NOT IN (SELECT value FROM json_each(?))\").bind(roleIds),\n    ...definition.roles.map((role) =>\n      db\n        .prepare(\n          `INSERT INTO role (id, name, description, system, created_at, updated_at) VALUES (?, ?, ?, 1, ?, ?)\n           ON CONFLICT (id) DO UPDATE SET name = excluded.name, description = excluded.description, system = 1, updated_at = excluded.updated_at`,\n        )\n        .bind(role.id, role.name, role.description, at, at),\n    ),\n    ...definition.roles.flatMap((role) => [\n      db.prepare(\"DELETE FROM role_permission WHERE role_id = ?\").bind(role.id),\n      db\n        .prepare(\"INSERT INTO role_permission (role_id, permission) SELECT ?, value FROM json_each(?)\")\n        .bind(role.id, JSON.stringify(role.permissions)),\n      db.prepare(\"DELETE FROM role_inheritance WHERE role_id = ?\").bind(role.id),\n      db\n        .prepare(\"INSERT INTO role_inheritance (role_id, inherits_role_id) SELECT ?, value FROM json_each(?)\")\n        .bind(role.id, JSON.stringify(role.inherits)),\n    ]),\n    db\n      .prepare(\n        \"INSERT INTO access_control_seed (id, fingerprint, seeded_at) VALUES (1, ?, ?) ON CONFLICT (id) DO UPDATE SET fingerprint = excluded.fingerprint, seeded_at = excluded.seeded_at\",\n      )\n      .bind(fingerprint, at),\n  ];\n  await db.batch(statements);\n  return { changed: true };\n}\n","import { AppError, createLogger, systemClock, type AuditSink, type Clock, type Logger } from \"@awsmbiz/inbis-core\";\nimport { ACCESS_CONTROL_AUDIT_ACTIONS } from \"./actions.js\";\nimport type { AccessControlDefinition, PermissionDefinition } from \"./define.js\";\nimport { roleAdmin, type CreateRoleInput, type DeleteRoleInput, type Role, type UpdateRoleInput, type UserRole } from \"./roles.js\";\nimport { seedCatalogue, type SeedResult } from \"./seed.js\";\n\nexport interface AuthorizeInput<P extends string = string> {\n  userId: string;\n  permission: P;\n  /**\n   * The record the action applies to, e.g. `note:<id>`. Reserved: ignored\n   * today, so apps can add resource scoping later without a breaking change.\n   */\n  resource?: string;\n}\n\nexport interface RoleAssignmentInput {\n  userId: string;\n  roleId: string;\n  /** Who made the change (audited); `null` for the system. */\n  actorId: string | null;\n}\n\n/**\n * Access control for one request (create one per request: answers are\n * memoised for its life only, and forgotten when it changes roles or assignments).\n */\nexport interface AccessControl<P extends string = string> {\n  /**\n   * `true` when one of the user's roles, or a role they explicitly inherit,\n   * grants the permission. Reads D1 (once per user per instance, never a\n   * cache), so revocation applies on the next request. Unknown permissions\n   * deny. A platform admin (`role` `admin`) gets nothing implicitly.\n   */\n  authorize(input: AuthorizeInput<P>): Promise<boolean>;\n  /** IDs of the roles assigned to the user directly (not inherited), sorted. */\n  rolesOf(userId: string): Promise<string[]>;\n  /**\n   * Assigns a role (idempotent). Audited as `access.role.assigned` when it\n   * changes anything. `404 ROLE_NOT_FOUND` / `404 USER_NOT_FOUND`.\n   */\n  assignRole(input: RoleAssignmentInput): Promise<void>;\n  /** Removes a role assignment (idempotent). Audited as `access.role.unassigned` when it changes anything. */\n  unassignRole(input: RoleAssignmentInput): Promise<void>;\n  /** Seeds the catalogue and system roles into D1 (see `seedCatalogue`); run once per isolate before use. */\n  seed(): Promise<SeedResult>;\n\n  // Role administration (the admin API, `mountRoleAdmin`). Refusals are `AppError`s.\n\n  /** The declared permission catalogue, sorted by name. */\n  listPermissions(): PermissionDefinition<P>[];\n  /** Every role: system roles first, then by name. */\n  listRoles(): Promise<Role[]>;\n  /** `404 ROLE_NOT_FOUND` for an unknown ID. */\n  getRole(roleId: string): Promise<Role>;\n  /**\n   * Creates a custom role. Audited as `access.role.created`. `422 VALIDATION_FAILED`\n   * (name, description), `422 UNKNOWN_PERMISSION` (`details.permissions`),\n   * `422 UNKNOWN_ROLE` (`details.roleIds`), `409 ROLE_NAME_TAKEN`.\n   */\n  createRole(input: CreateRoleInput): Promise<Role>;\n  /**\n   * Changes a custom role's fields. Audited as `access.role.updated` with a diff\n   * (nothing is written or audited when nothing changes). As {@link createRole},\n   * plus `404 ROLE_NOT_FOUND`, `409 SYSTEM_ROLE_IMMUTABLE` and\n   * `422 ROLE_INHERITANCE_CYCLE` (`details.cycle`, role IDs from this role back to it).\n   */\n  updateRole(input: UpdateRoleInput): Promise<Role>;\n  /**\n   * Deletes a custom role and its assignments. Audited as `access.role.deleted`.\n   * `404 ROLE_NOT_FOUND`, `409 SYSTEM_ROLE_IMMUTABLE`, `409 ROLE_INHERITED`\n   * (`details.roleIds`: roles that inherit it).\n   */\n  deleteRole(input: DeleteRoleInput): Promise<void>;\n  /** The user's directly assigned roles. `404 USER_NOT_FOUND`. */\n  userRoles(userId: string): Promise<UserRole[]>;\n}\n\nexport interface AccessControlOptions {\n  /** Receives role-assignment events (e.g. `@awsmbiz/inbis-audit`'s sink). Without it, nothing is audited. */\n  audit?: AuditSink;\n  /** Stamped on audit events. */\n  requestId?: string;\n  /** Receives `access.audit.record_failed`. Defaults to a console JSON logger. */\n  logger?: Logger;\n  clock?: Clock;\n}\n\n/** Every permission the user holds through their roles and the roles those explicitly inherit. */\nconst PERMISSIONS_OF_USER = `\nWITH RECURSIVE granted(role_id) AS (\n  SELECT role_id FROM user_role WHERE user_id = ?\n  UNION\n  SELECT ri.inherits_role_id FROM role_inheritance ri JOIN granted g ON ri.role_id = g.role_id\n)\nSELECT DISTINCT rp.permission AS permission FROM role_permission rp JOIN granted g ON rp.role_id = g.role_id`;\n\n/**\n * Access control over the database holding the access-control tables (the\n * app's access-control binding), for one request.\n */\nexport function createAccessControl<P extends string>(\n  db: D1Database,\n  definition: AccessControlDefinition<P>,\n  options: AccessControlOptions = {},\n): AccessControl<P> {\n  const clock = options.clock ?? systemClock;\n  const memo = new Map<string, Promise<ReadonlySet<string>>>();\n\n  function permissionsOf(userId: string): Promise<ReadonlySet<string>> {\n    let pending = memo.get(userId);\n    if (pending === undefined) {\n      pending = db\n        .prepare(PERMISSIONS_OF_USER)\n        .bind(userId)\n        .all<{ permission: string }>()\n        .then(({ results }) => new Set(results.map((row) => row.permission)));\n      // A failed read is not remembered: the next call tries again.\n      pending.catch(() => memo.delete(userId));\n      memo.set(userId, pending);\n    }\n    return pending;\n  }\n\n  /**\n   * Runs a change, then forgets every memoised answer (even if it failed part\n   * way): later checks on this instance read the new state from D1.\n   */\n  async function changing<T>(change: () => Promise<T>): Promise<T> {\n    try {\n      return await change();\n    } finally {\n      memo.clear();\n    }\n  }\n\n  const admin = roleAdmin(db, definition, record, () => clock.now());\n\n  const recordAssignment = (action: string, { userId, roleId, actorId }: RoleAssignmentInput) =>\n    record(action, `user:${userId}`, actorId, { roleId });\n\n  async function record(action: string, subjectId: string, actorId: string | null, metadata: Record<string, unknown>): Promise<void> {\n    if (options.audit === undefined) return;\n    try {\n      await options.audit.record({\n        action,\n        occurredAt: clock.now(),\n        actorId,\n        subjectId,\n        ...(options.requestId === undefined ? {} : { requestId: options.requestId }),\n        metadata,\n      });\n    } catch (error) {\n      // The change is made; a failing sink is logged, never the request's failure.\n      (options.logger ?? createLogger()).error(\"access.audit.record_failed\", { action, error });\n    }\n  }\n\n  return {\n    async authorize({ userId, permission }) {\n      if (!definition.hasPermission(permission)) return false;\n      return (await permissionsOf(userId)).has(permission);\n    },\n    async rolesOf(userId) {\n      const { results } = await db\n        .prepare(\"SELECT role_id FROM user_role WHERE user_id = ? ORDER BY role_id\")\n        .bind(userId)\n        .all<{ role_id: string }>();\n      return results.map((row) => row.role_id);\n    },\n    assignRole: (input) => changing(async () => {\n      const role = await db.prepare(\"SELECT id FROM role WHERE id = ?\").bind(input.roleId).first(\"id\");\n      if (role === null) throw new AppError({ code: \"ROLE_NOT_FOUND\", status: 404, message: \"No such role.\" });\n      const user = await db.prepare(\"SELECT id FROM user WHERE id = ?\").bind(input.userId).first(\"id\");\n      if (user === null) throw new AppError({ code: \"USER_NOT_FOUND\", status: 404, message: \"No such user.\" });\n      const { meta } = await db\n        .prepare(\"INSERT INTO user_role (user_id, role_id, assigned_at, assigned_by) VALUES (?, ?, ?, ?) ON CONFLICT DO NOTHING\")\n        .bind(input.userId, input.roleId, clock.now().getTime(), input.actorId)\n        .run();\n      if (meta.changes > 0) await recordAssignment(ACCESS_CONTROL_AUDIT_ACTIONS.roleAssigned, input);\n    }),\n    unassignRole: (input) => changing(async () => {\n      const { meta } = await db\n        .prepare(\"DELETE FROM user_role WHERE user_id = ? AND role_id = ?\")\n        .bind(input.userId, input.roleId)\n        .run();\n      if (meta.changes > 0) await recordAssignment(ACCESS_CONTROL_AUDIT_ACTIONS.roleUnassigned, input);\n    }),\n    seed: () => seedCatalogue(db, definition, clock.now()),\n    ...admin,\n    updateRole: (input) => changing(() => admin.updateRole(input)),\n    deleteRole: (input) => changing(() => admin.deleteRole(input)),\n  };\n}\n","/**\n * The permission catalogue and system roles, declared in the app's code\n * (plan Q40). Permission names are typed: a typo is a compile error.\n */\n\n/** A system role as the app declares it. */\nexport interface RoleDeclaration<P extends string, R extends string> {\n  /** Display name, unique among all roles (custom ones included). */\n  name: string;\n  description?: string;\n  /** Permissions the role grants itself. */\n  permissions: readonly P[];\n  /**\n   * Roles whose permissions this role also grants (transitively). Explicit\n   * inheritance is the only inheritance: nothing is implied by names or order.\n   */\n  inherits?: readonly R[];\n}\n\nexport interface AccessControlInput<P extends string, R extends string> {\n  /** Every permission the app checks, with a description for the admin UI: `{ \"notes.read\": \"Read notes\" }`. */\n  permissions: Readonly<Record<P, string>>;\n  /** System roles by ID: seeded into D1 and immutable through the API. */\n  roles: Readonly<Record<R, RoleDeclaration<NoInfer<P>, NoInfer<R>>>>;\n}\n\nexport interface PermissionDefinition<P extends string = string> {\n  name: P;\n  description: string;\n}\n\nexport interface SystemRoleDefinition<P extends string = string, R extends string = string> {\n  id: R;\n  name: string;\n  description: string | null;\n  permissions: readonly P[];\n  inherits: readonly R[];\n}\n\n/** A validated catalogue, from {@link defineAccessControl}. */\nexport interface AccessControlDefinition<P extends string = string, R extends string = string> {\n  /** Sorted by name. */\n  readonly permissions: readonly PermissionDefinition<P>[];\n  /** Sorted by ID. */\n  readonly roles: readonly SystemRoleDefinition<P, R>[];\n  /** True for a declared permission name. */\n  hasPermission(name: string): name is P;\n}\n\n/** `namespace.thing[.more]`: lowercase segments of letters, digits and `_`, at least two. */\nconst PERMISSION_NAME = /^[a-z][a-z0-9_]*(\\.[a-z][a-z0-9_]*)+$/;\n/** System role IDs: lowercase letters, digits, `_` and `-`. */\nconst ROLE_ID = /^[a-z][a-z0-9_-]*$/;\n\nfunction assertNoCycle(roles: readonly SystemRoleDefinition[]): void {\n  const byId = new Map(roles.map((role) => [role.id, role]));\n  const done = new Set<string>();\n  const visit = (id: string, path: readonly string[]) => {\n    if (path.includes(id)) throw new Error(`Role inheritance cycle: ${[...path, id].join(\" -> \")}.`);\n    if (done.has(id)) return;\n    for (const parent of byId.get(id)?.inherits ?? []) visit(parent, [...path, id]);\n    done.add(id);\n  };\n  for (const role of roles) visit(role.id, []);\n}\n\n/**\n * Declares the app's permissions and system roles. Throws on a malformed name,\n * an undeclared permission or role, a duplicate role name or an inheritance\n * cycle: all programming errors, found at startup.\n *\n * ```ts\n * export const access = defineAccessControl({\n *   permissions: { \"notes.read\": \"Read notes\", \"notes.write\": \"Write notes\" },\n *   roles: {\n *     reader: { name: \"Reader\", permissions: [\"notes.read\"] },\n *     editor: { name: \"Editor\", permissions: [\"notes.write\"], inherits: [\"reader\"] },\n *   },\n * });\n * ```\n */\nexport function defineAccessControl<const P extends string, const R extends string>(\n  input: AccessControlInput<P, R>,\n): AccessControlDefinition<P, R> {\n  const permissions = (Object.entries(input.permissions) as [P, string][])\n    .map(([name, description]) => ({ name, description }))\n    .sort((a, b) => a.name.localeCompare(b.name));\n  const names = new Set<string>(permissions.map((permission) => permission.name));\n  for (const { name } of permissions) {\n    if (!PERMISSION_NAME.test(name)) throw new Error(`Permission \"${name}\" is not a dotted lowercase name such as \"notes.read\".`);\n  }\n\n  const declared = input.roles as Readonly<Record<R, RoleDeclaration<P, R>>>;\n  const roles = (Object.entries(declared) as [R, RoleDeclaration<P, R>][])\n    .map(([id, role]) => ({\n      id,\n      name: role.name,\n      description: role.description ?? null,\n      permissions: [...new Set(role.permissions)].sort(),\n      inherits: [...new Set(role.inherits ?? [])].sort(),\n    }))\n    .sort((a, b) => a.id.localeCompare(b.id));\n  const roleIds = new Set<string>(roles.map((role) => role.id));\n  const roleNames = new Set<string>();\n  for (const role of roles) {\n    if (!ROLE_ID.test(role.id)) throw new Error(`Role ID \"${role.id}\" must be lowercase letters, digits, \"_\" or \"-\".`);\n    if (role.name.trim() === \"\") throw new Error(`Role \"${role.id}\" needs a name.`);\n    if (roleNames.has(role.name)) throw new Error(`Two roles are named \"${role.name}\".`);\n    roleNames.add(role.name);\n    for (const permission of role.permissions) {\n      if (!names.has(permission)) throw new Error(`Role \"${role.id}\" grants undeclared permission \"${permission}\".`);\n    }\n    for (const parent of role.inherits) {\n      if (!roleIds.has(parent)) throw new Error(`Role \"${role.id}\" inherits undeclared role \"${parent}\".`);\n    }\n  }\n  assertNoCycle(roles);\n\n  return {\n    permissions,\n    roles,\n    hasPermission: (name): name is P => names.has(name),\n  };\n}\n","export {\n  createAccessControl,\n  type AccessControl,\n  type AccessControlOptions,\n  type AuthorizeInput,\n  type RoleAssignmentInput,\n} from \"./access-control.js\";\nexport { ACCESS_CONTROL_AUDIT_ACTIONS } from \"./actions.js\";\nexport {\n  defineAccessControl,\n  type AccessControlDefinition,\n  type AccessControlInput,\n  type PermissionDefinition,\n  type RoleDeclaration,\n  type SystemRoleDefinition,\n} from \"./define.js\";\nexport type { RoleFields } from \"./role-fields.js\";\nexport type { CreateRoleInput, DeleteRoleInput, Role, UpdateRoleInput, UserRole } from \"./roles.js\";\nexport type { SeedResult } from \"./seed.js\";\n\n/**\n * The `migrations_table` of the app's access-control D1 binding (ADR-4).\n * Declare that binding after auth's and before audit's.\n */\nexport const ACCESS_CONTROL_MIGRATIONS_TABLE = \"_inbis_access_control_migrations\";\n"],"mappings":";;;;;;;;;;;;;AAUA,MAAa,+BAA+B;CAC1C,cAAc;CACd,gBAAgB;CAChB,aAAa;CACb,aAAa;CACb,aAAa;AACf;;ACgDA,MAAM,QAAQ;;;;;;AAOd,MAAM,qBAAqB,IAAI,SAAS;CAAE,MAAM;CAAkB,QAAQ;CAAK,SAAS;AAAgB,CAAC;AACzG,MAAM,qBAAqB,IAAI,SAAS;CAAE,MAAM;CAAkB,QAAQ;CAAK,SAAS;AAAgB,CAAC;;AAGzG,SAAS,SAAS,MAAyB,IAAuB;CAChE,OAAO;EAAE,OAAO,GAAG,QAAQ,SAAS,CAAC,KAAK,SAAS,IAAI,CAAC;EAAG,SAAS,KAAK,QAAQ,SAAS,CAAC,GAAG,SAAS,IAAI,CAAC;CAAE;AAChH;;AAGA,SAAgB,UAA4B,IAAgB,YAAwC,QAAkB,KAAiB;CACrI,MAAM,UAAU,SAAwB;EACtC,IAAI,IAAI;EACR,MAAM,IAAI;EACV,aAAa,IAAI;EACjB,QAAQ,IAAI,WAAW;EACvB,aAAc,KAAK,MAAM,IAAI,WAAW,CAAC,CAAc,QAAQ,SAAS,WAAW,cAAc,IAAI,CAAC;EACtG,UAAU,KAAK,MAAM,IAAI,QAAQ;EACjC,WAAW,IAAI;EACf,WAAW,IAAI,KAAK,IAAI,UAAU;EAClC,WAAW,IAAI,KAAK,IAAI,UAAU;CACpC;CAEA,eAAe,SAAS,QAAsC;EAC5D,MAAM,MAAM,MAAM,GAAG,QAAQ,GAAG,MAAM,gBAAgB,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,MAAe;EACpF,OAAO,QAAQ,OAAO,OAAO,OAAO,GAAG;CACzC;CAEA,eAAe,QAAQ,QAA+B;EACpD,MAAM,OAAO,MAAM,SAAS,MAAM;EAClC,IAAI,SAAS,MAAM,MAAM,aAAa;EACtC,OAAO;CACT;CAEA,eAAe,eAAe,MAAc,QAA+B;EAEzE,IAAI,MADgB,GAAG,QAAQ,8DAA8D,CAAC,CAAC,KAAK,MAAM,MAAM,CAAC,CAAC,MAAM,IAAI,MAC9G,MAAM,MAAM,UAAU,IAAI;CAC1C;CAEA,SAAS,kBAAkB,aAAsC;EAC/D,MAAM,UAAU,YAAY,QAAQ,SAAS,CAAC,WAAW,cAAc,IAAI,CAAC;EAC5E,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,SAAS;GAAE,MAAM;GAAsB,QAAQ;GAAK,SAAS;GAAsC,SAAS,EAAE,aAAa,QAAQ;EAAE,CAAC;CAEpJ;;CAGA,eAAe,kBAAkB,QAAgB,UAA4C;EAC3F,MAAM,EAAE,SAAS,UAAU,MAAM,GAC9B,QAAQ,2HAA2H,CAAC,CACpI,IAA0D;EAC7D,MAAM,0BAAU,IAAI,IAAsB;EAC1C,KAAK,MAAM,QAAQ,OAAO;GACxB,MAAM,OAAO,QAAQ,IAAI,KAAK,OAAO,KAAK,CAAC;GAC3C,IAAI,KAAK,qBAAqB,MAAM,KAAK,KAAK,KAAK,gBAAgB;GACnE,QAAQ,IAAI,KAAK,SAAS,IAAI;EAChC;EACA,MAAM,UAAU,SAAS,QAAQ,OAAO,CAAC,QAAQ,IAAI,EAAE,KAAK,OAAO,MAAM;EACzE,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,SAAS;GAAE,MAAM;GAAgB,QAAQ;GAAK,SAAS;GAAsC,SAAS,EAAE,SAAS,QAAQ;EAAE,CAAC;EAExI,QAAQ,IAAI,QAAQ,CAAC,GAAG,QAAQ,CAAC;EAEjC,MAAM,uBAAO,IAAI,IAAY;EAC7B,MAAM,QAAQ,IAAY,SAAoC;GAC5D,KAAK,MAAM,UAAU,QAAQ,IAAI,EAAE,KAAK,CAAC,GAAG;IAC1C,IAAI,WAAW,QAAQ,OAAO,CAAC,GAAG,MAAM,MAAM;IAC9C,IAAI,KAAK,IAAI,MAAM,GAAG;IACtB,KAAK,IAAI,MAAM;IACf,MAAM,QAAQ,KAAK,QAAQ,CAAC,GAAG,MAAM,MAAM,CAAC;IAC5C,IAAI,UAAU,MAAM,OAAO;GAC7B;GACA,OAAO;EACT;EACA,MAAM,QAAQ,KAAK,QAAQ,CAAC,MAAM,CAAC;EACnC,IAAI,UAAU,MACZ,MAAM,IAAI,SAAS;GACjB,MAAM;GACN,QAAQ;GACR,SAAS;GACT,SAAS,EAAE,MAAM;EACnB,CAAC;CAEL;CAEA,SAAS,aAAa,MAAkB;EACtC,IAAI,KAAK,QACP,MAAM,IAAI,SAAS;GAAE,MAAM;GAAyB,QAAQ;GAAK,SAAS;EAA2D,CAAC;CAE1I;CAEA,MAAM,iBAAiB,QAAgB,gBAAmC,CACxE,GAAG,QAAQ,+CAA+C,CAAC,CAAC,KAAK,MAAM,GACvE,GAAG,QAAQ,qFAAqF,CAAC,CAAC,KAAK,QAAQ,KAAK,UAAU,WAAW,CAAC,CAC5I;CACA,MAAM,sBAAsB,QAAgB,aAAgC,CAC1E,GAAG,QAAQ,gDAAgD,CAAC,CAAC,KAAK,MAAM,GACxE,GAAG,QAAQ,4FAA4F,CAAC,CAAC,KAAK,QAAQ,KAAK,UAAU,QAAQ,CAAC,CAChJ;;CAGA,eAAe,MAAM,YAAmC,MAA6B;EACnF,IAAI;GACF,MAAM,GAAG,MAAM,UAAU;EAC3B,SAAS,OAAO;GACd,IAAI,OAAO,KAAK,CAAC,CAAC,SAAS,qCAAqC,GAAG,MAAM,UAAU,IAAI;GACvF,MAAM;EACR;CACF;CAEA,OAAO;EACL,uBAAkD,WAAW,YAAY,KAAK,EAAE,MAAM,mBAAmB;GAAE;GAAM;EAAY,EAAE;EAE/H,MAAM,YAA6B;GACjC,MAAM,EAAE,YAAY,MAAM,GAAG,QAAQ,GAAG,MAAM,qDAAqD,CAAC,CAAC,IAAa;GAClH,OAAO,QAAQ,IAAI,MAAM;EAC3B;EAEA;EAEA,MAAM,WAAW,OAAuC;GACtD,MAAM,KAAK,OAAO,WAAW;GAC7B,MAAM,OAAO,UAAU,MAAM,IAAI;GACjC,MAAM,cAAc,iBAAiB,MAAM,WAAW;GACtD,MAAM,cAAc,UAAU,MAAM,WAAW;GAC/C,MAAM,WAAW,UAAU,MAAM,QAAQ;GACzC,kBAAkB,WAAW;GAC7B,MAAM,kBAAkB,IAAI,QAAQ;GACpC,MAAM,eAAe,MAAM,EAAE;GAC7B,MAAM,KAAK,IAAI,CAAC,CAAC,QAAQ;GACzB,MAAM,MACJ;IACE,GACG,QAAQ,oGAAoG,CAAC,CAC7G,KAAK,IAAI,MAAM,aAAa,IAAI,EAAE;IACrC,GAAG,cAAc,IAAI,WAAW;IAChC,GAAG,mBAAmB,IAAI,QAAQ;GACpC,GACA,IACF;GACA,MAAM,OAAO,6BAA6B,aAAa,QAAQ,MAAM,MAAM,SAAS;IAAE;IAAM;IAAa;IAAa;GAAS,CAAC;GAChI,OAAO,QAAQ,EAAE;EACnB;EAEA,MAAM,WAAW,EAAE,QAAQ,SAAS,WAA2C;GAC7E,MAAM,OAAO,MAAM,QAAQ,MAAM;GACjC,aAAa,IAAI;GACjB,MAAM,OAAO,QAAQ,SAAS,KAAA,IAAY,KAAK,OAAO,UAAU,QAAQ,IAAI;GAC5E,MAAM,cAAc,QAAQ,gBAAgB,KAAA,IAAY,KAAK,cAAc,iBAAiB,QAAQ,WAAW;GAC/G,MAAM,cAAc,QAAQ,gBAAgB,KAAA,IAAY,KAAK,cAAc,UAAU,QAAQ,WAAW;GACxG,MAAM,WAAW,QAAQ,aAAa,KAAA,IAAY,KAAK,WAAW,UAAU,QAAQ,QAAQ;GAC5F,kBAAkB,WAAW;GAC7B,MAAM,kBAAkB,QAAQ,QAAQ;GACxC,IAAI,SAAS,KAAK,MAAM,MAAM,eAAe,MAAM,MAAM;GAGzD,MAAM,OAAgC,CAAC;GACvC,IAAI,SAAS,KAAK,MAAM,KAAK,UAAU;IAAE,MAAM,KAAK;IAAM,IAAI;GAAK;GACnE,IAAI,gBAAgB,KAAK,aAAa,KAAK,iBAAiB;IAAE,MAAM,KAAK;IAAa,IAAI;GAAY;GACtG,MAAM,iBAAiB,SAAS,KAAK,aAAa,WAAW;GAC7D,IAAI,eAAe,MAAM,SAAS,eAAe,QAAQ,SAAS,GAAG,KAAK,iBAAiB;GAC3F,MAAM,eAAe,SAAS,KAAK,UAAU,QAAQ;GACrD,IAAI,aAAa,MAAM,SAAS,aAAa,QAAQ,SAAS,GAAG,KAAK,cAAc;GACpF,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,WAAW,GAAG,OAAO;GAE3C,MAAM,MACJ;IACE,GAAG,QAAQ,wEAAwE,CAAC,CAAC,KAAK,MAAM,aAAa,IAAI,CAAC,CAAC,QAAQ,GAAG,MAAM;IACpI,GAAI,iBAAiB,OAAO,cAAc,QAAQ,WAAW,IAAI,CAAC;IAClE,GAAI,cAAc,OAAO,mBAAmB,QAAQ,QAAQ,IAAI,CAAC;GACnE,GACA,IACF;GACA,MAAM,OAAO,6BAA6B,aAAa,QAAQ,UAAU,SAAS,EAAE,SAAS,KAAK,CAAC;GACnG,OAAO,QAAQ,MAAM;EACvB;EAEA,MAAM,WAAW,EAAE,QAAQ,WAA2C;GACpE,MAAM,OAAO,MAAM,QAAQ,MAAM;GACjC,aAAa,IAAI;GACjB,MAAM,EAAE,SAAS,UAAU,MAAM,GAC9B,QAAQ,kFAAkF,CAAC,CAC3F,KAAK,MAAM,CAAC,CACZ,IAAyB;GAC5B,IAAI,MAAM,SAAS,GACjB,MAAM,IAAI,SAAS;IACjB,MAAM;IACN,QAAQ;IACR,SAAS;IACT,SAAS,EAAE,SAAS,MAAM,KAAK,QAAQ,IAAI,OAAO,EAAE;GACtD,CAAC;GAEH,MAAM,CAAC,SAAS,MAAM,GAAG,MAA2B,CAClD,GAAG,QAAQ,kEAAkE,CAAC,CAAC,KAAK,MAAM,GAE1F,GAAG,QAAQ,8CAA8C,CAAC,CAAC,KAAK,MAAM,CACxE,CAAC;GACD,MAAM,OAAO,6BAA6B,aAAa,QAAQ,UAAU,SAAS;IAChF,MAAM,KAAK;IACX,aAAa,KAAK;IAClB,UAAU,KAAK;IACf,oBAAoB,OAAO,WAAW,CAAC,EAAA,CAAG,KAAK,QAAQ,IAAI,OAAO;GACpE,CAAC;EACH;EAEA,MAAM,UAAU,QAAqC;GAEnD,IAAI,MADe,GAAG,QAAQ,kCAAkC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,MAAM,IAAI,MAC5E,MAAM,MAAM,aAAa;GACtC,MAAM,EAAE,YAAY,MAAM,GACvB,QACC;oFAEF,CAAC,CACA,KAAK,MAAM,CAAC,CACZ,IAAmG;GACtG,OAAO,QAAQ,KAAK,SAAS;IAC3B,IAAI,IAAI;IACR,MAAM,IAAI;IACV,QAAQ,IAAI,WAAW;IACvB,YAAY,IAAI,KAAK,IAAI,WAAW;IACpC,YAAY,IAAI;GAClB,EAAE;EACJ;CACF;AACF;AAEA,SAAS,UAAU,MAAwB;CACzC,OAAO,IAAI,SAAS;EAAE,MAAM;EAAmB,QAAQ;EAAK,SAAS,iBAAiB,KAAK;EAAoB,SAAS,EAAE,KAAK;CAAE,CAAC;AACpI;;AClSA,eAAe,cAAc,YAAsD;CACjF,MAAM,YAAY,KAAK,UAAU;EAAE,aAAa,WAAW;EAAa,OAAO,WAAW;CAAM,CAAC;CACjG,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,SAAS,CAAC;CACxF,OAAO,CAAC,GAAG,IAAI,WAAW,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AAC9F;;;;;;;;;AAUA,eAAsB,cAAc,IAAgB,YAAqC,KAAgC;CACvH,MAAM,cAAc,MAAM,cAAc,UAAU;CAElD,IAAI,MADiB,GAAG,QAAQ,0DAA0D,CAAC,CAAC,MAAc,aAAa,MACxG,aAAa,OAAO,EAAE,SAAS,MAAM;CAEpD,MAAM,KAAK,IAAI,QAAQ;CACvB,MAAM,kBAAkB,KAAK,UAAU,WAAW,YAAY,KAAK,eAAe,WAAW,IAAI,CAAC;CAClG,MAAM,UAAU,KAAK,UAAU,WAAW,MAAM,KAAK,SAAS,KAAK,EAAE,CAAC;CACtE,MAAM,aAAoC;EACxC,GAAG,WAAW,YAAY,KAAK,eAC7B,GACG,QACC,8HACF,CAAC,CACA,KAAK,WAAW,MAAM,WAAW,WAAW,CACjD;EACA,GAAG,QAAQ,2EAA2E,CAAC,CAAC,KAAK,eAAe;EAC5G,GAAG,QAAQ,kFAAkF,CAAC,CAAC,KAAK,OAAO;EAC3G,GAAG,WAAW,MAAM,KAAK,SACvB,GACG,QACC;iJAEF,CAAC,CACA,KAAK,KAAK,IAAI,KAAK,MAAM,KAAK,aAAa,IAAI,EAAE,CACtD;EACA,GAAG,WAAW,MAAM,SAAS,SAAS;GACpC,GAAG,QAAQ,+CAA+C,CAAC,CAAC,KAAK,KAAK,EAAE;GACxE,GACG,QAAQ,qFAAqF,CAAC,CAC9F,KAAK,KAAK,IAAI,KAAK,UAAU,KAAK,WAAW,CAAC;GACjD,GAAG,QAAQ,gDAAgD,CAAC,CAAC,KAAK,KAAK,EAAE;GACzE,GACG,QAAQ,4FAA4F,CAAC,CACrG,KAAK,KAAK,IAAI,KAAK,UAAU,KAAK,QAAQ,CAAC;EAChD,CAAC;EACD,GACG,QACC,iLACF,CAAC,CACA,KAAK,aAAa,EAAE;CACzB;CACA,MAAM,GAAG,MAAM,UAAU;CACzB,OAAO,EAAE,SAAS,KAAK;AACzB;;;ACuBA,MAAM,sBAAsB;;;;;;;;;;;AAY5B,SAAgB,oBACd,IACA,YACA,UAAgC,CAAC,GACf;CAClB,MAAM,QAAQ,QAAQ,SAAS;CAC/B,MAAM,uBAAO,IAAI,IAA0C;CAE3D,SAAS,cAAc,QAA8C;EACnE,IAAI,UAAU,KAAK,IAAI,MAAM;EAC7B,IAAI,YAAY,KAAA,GAAW;GACzB,UAAU,GACP,QAAQ,mBAAmB,CAAC,CAC5B,KAAK,MAAM,CAAC,CACZ,IAA4B,CAAC,CAC7B,MAAM,EAAE,cAAc,IAAI,IAAI,QAAQ,KAAK,QAAQ,IAAI,UAAU,CAAC,CAAC;GAEtE,QAAQ,YAAY,KAAK,OAAO,MAAM,CAAC;GACvC,KAAK,IAAI,QAAQ,OAAO;EAC1B;EACA,OAAO;CACT;;;;;CAMA,eAAe,SAAY,QAAsC;EAC/D,IAAI;GACF,OAAO,MAAM,OAAO;EACtB,UAAU;GACR,KAAK,MAAM;EACb;CACF;CAEA,MAAM,QAAQ,UAAU,IAAI,YAAY,cAAc,MAAM,IAAI,CAAC;CAEjE,MAAM,oBAAoB,QAAgB,EAAE,QAAQ,QAAQ,cAC1D,OAAO,QAAQ,QAAQ,UAAU,SAAS,EAAE,OAAO,CAAC;CAEtD,eAAe,OAAO,QAAgB,WAAmB,SAAwB,UAAkD;EACjI,IAAI,QAAQ,UAAU,KAAA,GAAW;EACjC,IAAI;GACF,MAAM,QAAQ,MAAM,OAAO;IACzB;IACA,YAAY,MAAM,IAAI;IACtB;IACA;IACA,GAAI,QAAQ,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,QAAQ,UAAU;IAC1E;GACF,CAAC;EACH,SAAS,OAAO;GAEd,CAAC,QAAQ,UAAU,aAAa,EAAA,CAAG,MAAM,8BAA8B;IAAE;IAAQ;GAAM,CAAC;EAC1F;CACF;CAEA,OAAO;EACL,MAAM,UAAU,EAAE,QAAQ,cAAc;GACtC,IAAI,CAAC,WAAW,cAAc,UAAU,GAAG,OAAO;GAClD,QAAQ,MAAM,cAAc,MAAM,EAAA,CAAG,IAAI,UAAU;EACrD;EACA,MAAM,QAAQ,QAAQ;GACpB,MAAM,EAAE,YAAY,MAAM,GACvB,QAAQ,kEAAkE,CAAC,CAC3E,KAAK,MAAM,CAAC,CACZ,IAAyB;GAC5B,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO;EACzC;EACA,aAAa,UAAU,SAAS,YAAY;GAE1C,IAAI,MADe,GAAG,QAAQ,kCAAkC,CAAC,CAAC,KAAK,MAAM,MAAM,CAAC,CAAC,MAAM,IAAI,MAClF,MAAM,MAAM,IAAI,SAAS;IAAE,MAAM;IAAkB,QAAQ;IAAK,SAAS;GAAgB,CAAC;GAEvG,IAAI,MADe,GAAG,QAAQ,kCAAkC,CAAC,CAAC,KAAK,MAAM,MAAM,CAAC,CAAC,MAAM,IAAI,MAClF,MAAM,MAAM,IAAI,SAAS;IAAE,MAAM;IAAkB,QAAQ;IAAK,SAAS;GAAgB,CAAC;GACvG,MAAM,EAAE,SAAS,MAAM,GACpB,QAAQ,+GAA+G,CAAC,CACxH,KAAK,MAAM,QAAQ,MAAM,QAAQ,MAAM,IAAI,CAAC,CAAC,QAAQ,GAAG,MAAM,OAAO,CAAC,CACtE,IAAI;GACP,IAAI,KAAK,UAAU,GAAG,MAAM,iBAAiB,6BAA6B,cAAc,KAAK;EAC/F,CAAC;EACD,eAAe,UAAU,SAAS,YAAY;GAC5C,MAAM,EAAE,SAAS,MAAM,GACpB,QAAQ,yDAAyD,CAAC,CAClE,KAAK,MAAM,QAAQ,MAAM,MAAM,CAAC,CAChC,IAAI;GACP,IAAI,KAAK,UAAU,GAAG,MAAM,iBAAiB,6BAA6B,gBAAgB,KAAK;EACjG,CAAC;EACD,YAAY,cAAc,IAAI,YAAY,MAAM,IAAI,CAAC;EACrD,GAAG;EACH,aAAa,UAAU,eAAe,MAAM,WAAW,KAAK,CAAC;EAC7D,aAAa,UAAU,eAAe,MAAM,WAAW,KAAK,CAAC;CAC/D;AACF;;;AC/IA,MAAM,kBAAkB;;AAExB,MAAM,UAAU;AAEhB,SAAS,cAAc,OAA8C;CACnE,MAAM,OAAO,IAAI,IAAI,MAAM,KAAK,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;CACzD,MAAM,uBAAO,IAAI,IAAY;CAC7B,MAAM,SAAS,IAAY,SAA4B;EACrD,IAAI,KAAK,SAAS,EAAE,GAAG,MAAM,IAAI,MAAM,2BAA2B,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,KAAK,MAAM,EAAE,EAAE;EAC/F,IAAI,KAAK,IAAI,EAAE,GAAG;EAClB,KAAK,MAAM,UAAU,KAAK,IAAI,EAAE,CAAC,EAAE,YAAY,CAAC,GAAG,MAAM,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC;EAC9E,KAAK,IAAI,EAAE;CACb;CACA,KAAK,MAAM,QAAQ,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC;AAC7C;;;;;;;;;;;;;;;;AAiBA,SAAgB,oBACd,OAC+B;CAC/B,MAAM,cAAe,OAAO,QAAQ,MAAM,WAAW,CAAC,CACnD,KAAK,CAAC,MAAM,kBAAkB;EAAE;EAAM;CAAY,EAAE,CAAC,CACrD,MAAM,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;CAC9C,MAAM,QAAQ,IAAI,IAAY,YAAY,KAAK,eAAe,WAAW,IAAI,CAAC;CAC9E,KAAK,MAAM,EAAE,UAAU,aACrB,IAAI,CAAC,gBAAgB,KAAK,IAAI,GAAG,MAAM,IAAI,MAAM,eAAe,KAAK,uDAAuD;CAG9H,MAAM,WAAW,MAAM;CACvB,MAAM,QAAS,OAAO,QAAQ,QAAQ,CAAC,CACpC,KAAK,CAAC,IAAI,WAAW;EACpB;EACA,MAAM,KAAK;EACX,aAAa,KAAK,eAAe;EACjC,aAAa,CAAC,GAAG,IAAI,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK;EACjD,UAAU,CAAC,GAAG,IAAI,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK;CACnD,EAAE,CAAC,CACF,MAAM,GAAG,MAAM,EAAE,GAAG,cAAc,EAAE,EAAE,CAAC;CAC1C,MAAM,UAAU,IAAI,IAAY,MAAM,KAAK,SAAS,KAAK,EAAE,CAAC;CAC5D,MAAM,4BAAY,IAAI,IAAY;CAClC,KAAK,MAAM,QAAQ,OAAO;EACxB,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,GAAG,MAAM,IAAI,MAAM,YAAY,KAAK,GAAG,iDAAiD;EACjH,IAAI,KAAK,KAAK,KAAK,MAAM,IAAI,MAAM,IAAI,MAAM,SAAS,KAAK,GAAG,gBAAgB;EAC9E,IAAI,UAAU,IAAI,KAAK,IAAI,GAAG,MAAM,IAAI,MAAM,wBAAwB,KAAK,KAAK,GAAG;EACnF,UAAU,IAAI,KAAK,IAAI;EACvB,KAAK,MAAM,cAAc,KAAK,aAC5B,IAAI,CAAC,MAAM,IAAI,UAAU,GAAG,MAAM,IAAI,MAAM,SAAS,KAAK,GAAG,kCAAkC,WAAW,GAAG;EAE/G,KAAK,MAAM,UAAU,KAAK,UACxB,IAAI,CAAC,QAAQ,IAAI,MAAM,GAAG,MAAM,IAAI,MAAM,SAAS,KAAK,GAAG,8BAA8B,OAAO,GAAG;CAEvG;CACA,cAAc,KAAK;CAEnB,OAAO;EACL;EACA;EACA,gBAAgB,SAAoB,MAAM,IAAI,IAAI;CACpD;AACF;;;;;;ACnGA,MAAa,kCAAkC"}

package/dist/role-fields-ClqODoYn.js

@@ -0,0 +1,72 @@
+import { validationFailed } from "@awsmbiz/inbis-core";
+function stringList(value, field, issues) {
+	if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) {
+		issues.push({
+			path: [field],
+			message: "Must be an array of strings."
+		});
+		return;
+	}
+	return value;
+}
+function parseRoleFields(body, options = {}) {
+	const issues = [];
+	const fields = {};
+	if (typeof body !== "object" || body === null || Array.isArray(body)) issues.push({
+		path: [],
+		message: "Must be a JSON object."
+	});
+	else {
+		const input = body;
+		const partial = options.partial === true;
+		if (input["name"] !== void 0 || !partial) {
+			if (typeof input["name"] === "string") fields.name = input["name"];
+			else issues.push({
+				path: ["name"],
+				message: "Must be a string."
+			});
+		}
+		if (input["description"] !== void 0) {
+			if (typeof input["description"] === "string" || input["description"] === null) fields.description = input["description"];
+			else issues.push({
+				path: ["description"],
+				message: "Must be a string or null."
+			});
+		}
+		if (input["permissions"] !== void 0 || !partial) {
+			const permissions = stringList(input["permissions"], "permissions", issues);
+			if (permissions !== void 0) fields.permissions = permissions;
+		}
+		if (input["inherits"] !== void 0) {
+			const inherits = stringList(input["inherits"], "inherits", issues);
+			if (inherits !== void 0) fields.inherits = inherits;
+		}
+	}
+	if (issues.length > 0) throw validationFailed(issues);
+	return fields;
+}
+/** The trimmed name, or `422 VALIDATION_FAILED`. */
+function cleanName(name) {
+	const trimmed = name.trim();
+	if (trimmed === "" || trimmed.length > 64) throw validationFailed([{
+		path: ["name"],
+		message: `Must be 1 to ${String(64)} characters.`
+	}]);
+	return trimmed;
+}
+/** The trimmed description (`null` when empty), or `422 VALIDATION_FAILED`. */
+function cleanDescription(description) {
+	const trimmed = description?.trim() ?? "";
+	if (trimmed.length > 500) throw validationFailed([{
+		path: ["description"],
+		message: `Must be at most ${String(500)} characters.`
+	}]);
+	return trimmed === "" ? null : trimmed;
+}
+/** Deduplicated and sorted. */
+function cleanList(values) {
+	return [...new Set(values ?? [])].sort();
+}
+export { parseRoleFields as i, cleanList as n, cleanName as r, cleanDescription as t };
+
+//# sourceMappingURL=role-fields-ClqODoYn.js.map

package/dist/role-fields-ClqODoYn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-fields-ClqODoYn.js","names":[],"sources":["../src/role-fields.ts"],"sourcesContent":["import { validationFailed, type ValidationIssue } from \"@awsmbiz/inbis-core\";\n\n/** A custom role's editable fields. */\nexport interface RoleFields {\n  /** Display name, 1–64 characters, unique among all roles (case-insensitive). */\n  name: string;\n  /** Up to 500 characters; `null` or `\"\"` for none. */\n  description?: string | null;\n  /** Declared permission names the role grants itself. */\n  permissions: readonly string[];\n  /** IDs of roles (system or custom) whose permissions this role also grants. */\n  inherits?: readonly string[];\n}\n\nexport const NAME_MAX = 64;\nexport const DESCRIPTION_MAX = 500;\n\nfunction stringList(value: unknown, field: string, issues: ValidationIssue[]): string[] | undefined {\n  if (!Array.isArray(value) || value.some((item) => typeof item !== \"string\")) {\n    issues.push({ path: [field], message: \"Must be an array of strings.\" });\n    return undefined;\n  }\n  return value as string[];\n}\n\n/**\n * Reads a request body into {@link RoleFields}: all fields for a new role,\n * any subset (`partial`) for a change. Fields it does not know are ignored.\n * A malformed field is `422 VALIDATION_FAILED` (`details.issues[{ path, message }]`).\n */\nexport function parseRoleFields(body: unknown, options: { partial: true }): Partial<RoleFields>;\nexport function parseRoleFields(body: unknown, options?: { partial?: false }): RoleFields;\nexport function parseRoleFields(body: unknown, options: { partial?: boolean } = {}): Partial<RoleFields> {\n  const issues: ValidationIssue[] = [];\n  const fields: Partial<RoleFields> = {};\n  if (typeof body !== \"object\" || body === null || Array.isArray(body)) {\n    issues.push({ path: [], message: \"Must be a JSON object.\" });\n  } else {\n    const input = body as Record<string, unknown>;\n    const partial = options.partial === true;\n    if (input[\"name\"] !== undefined || !partial) {\n      if (typeof input[\"name\"] === \"string\") fields.name = input[\"name\"];\n      else issues.push({ path: [\"name\"], message: \"Must be a string.\" });\n    }\n    if (input[\"description\"] !== undefined) {\n      if (typeof input[\"description\"] === \"string\" || input[\"description\"] === null) fields.description = input[\"description\"];\n      else issues.push({ path: [\"description\"], message: \"Must be a string or null.\" });\n    }\n    if (input[\"permissions\"] !== undefined || !partial) {\n      const permissions = stringList(input[\"permissions\"], \"permissions\", issues);\n      if (permissions !== undefined) fields.permissions = permissions;\n    }\n    if (input[\"inherits\"] !== undefined) {\n      const inherits = stringList(input[\"inherits\"], \"inherits\", issues);\n      if (inherits !== undefined) fields.inherits = inherits;\n    }\n  }\n  if (issues.length > 0) throw validationFailed(issues);\n  return fields;\n}\n\n/** The trimmed name, or `422 VALIDATION_FAILED`. */\nexport function cleanName(name: string): string {\n  const trimmed = name.trim();\n  if (trimmed === \"\" || trimmed.length > NAME_MAX) {\n    throw validationFailed([{ path: [\"name\"], message: `Must be 1 to ${String(NAME_MAX)} characters.` }]);\n  }\n  return trimmed;\n}\n\n/** The trimmed description (`null` when empty), or `422 VALIDATION_FAILED`. */\nexport function cleanDescription(description: string | null | undefined): string | null {\n  const trimmed = description?.trim() ?? \"\";\n  if (trimmed.length > DESCRIPTION_MAX) {\n    throw validationFailed([{ path: [\"description\"], message: `Must be at most ${String(DESCRIPTION_MAX)} characters.` }]);\n  }\n  return trimmed === \"\" ? null : trimmed;\n}\n\n/** Deduplicated and sorted. */\nexport function cleanList(values: readonly string[] | undefined): string[] {\n  return [...new Set(values ?? [])].sort();\n}\n"],"mappings":";AAiBA,SAAS,WAAW,OAAgB,OAAe,QAAiD;CAClG,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,MAAM,SAAS,OAAO,SAAS,QAAQ,GAAG;EAC3E,OAAO,KAAK;GAAE,MAAM,CAAC,KAAK;GAAG,SAAS;EAA+B,CAAC;EACtE;CACF;CACA,OAAO;AACT;AASA,SAAgB,gBAAgB,MAAe,UAAiC,CAAC,GAAwB;CACvG,MAAM,SAA4B,CAAC;CACnC,MAAM,SAA8B,CAAC;CACrC,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,GACjE,OAAO,KAAK;EAAE,MAAM,CAAC;EAAG,SAAS;CAAyB,CAAC;MACtD;EACL,MAAM,QAAQ;EACd,MAAM,UAAU,QAAQ,YAAY;EACpC,IAAI,MAAM,YAAY,KAAA,KAAa,CAAC,SAAS;GAC3C,IAAI,OAAO,MAAM,YAAY,UAAU,OAAO,OAAO,MAAM;QACtD,OAAO,KAAK;IAAE,MAAM,CAAC,MAAM;IAAG,SAAS;GAAoB,CAAC;EACnE;EACA,IAAI,MAAM,mBAAmB,KAAA,GAAW;GACtC,IAAI,OAAO,MAAM,mBAAmB,YAAY,MAAM,mBAAmB,MAAM,OAAO,cAAc,MAAM;QACrG,OAAO,KAAK;IAAE,MAAM,CAAC,aAAa;IAAG,SAAS;GAA4B,CAAC;EAClF;EACA,IAAI,MAAM,mBAAmB,KAAA,KAAa,CAAC,SAAS;GAClD,MAAM,cAAc,WAAW,MAAM,gBAAgB,eAAe,MAAM;GAC1E,IAAI,gBAAgB,KAAA,GAAW,OAAO,cAAc;EACtD;EACA,IAAI,MAAM,gBAAgB,KAAA,GAAW;GACnC,MAAM,WAAW,WAAW,MAAM,aAAa,YAAY,MAAM;GACjE,IAAI,aAAa,KAAA,GAAW,OAAO,WAAW;EAChD;CACF;CACA,IAAI,OAAO,SAAS,GAAG,MAAM,iBAAiB,MAAM;CACpD,OAAO;AACT;;AAGA,SAAgB,UAAU,MAAsB;CAC9C,MAAM,UAAU,KAAK,KAAK;CAC1B,IAAI,YAAY,MAAM,QAAQ,SAAA,IAC5B,MAAM,iBAAiB,CAAC;EAAE,MAAM,CAAC,MAAM;EAAG,SAAS,gBAAgB,OAAA,EAAe,EAAE;CAAc,CAAC,CAAC;CAEtG,OAAO;AACT;;AAGA,SAAgB,iBAAiB,aAAuD;CACtF,MAAM,UAAU,aAAa,KAAK,KAAK;CACvC,IAAI,QAAQ,SAAA,KACV,MAAM,iBAAiB,CAAC;EAAE,MAAM,CAAC,aAAa;EAAG,SAAS,mBAAmB,OAAA,GAAsB,EAAE;CAAc,CAAC,CAAC;CAEvH,OAAO,YAAY,KAAK,OAAO;AACjC;;AAGA,SAAgB,UAAU,QAAiD;CACzE,OAAO,CAAC,GAAG,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK;AACzC"}