@bevel-software/platform-core-backend 0.1.0

package/dist/modules/access/access-splice.js

@@ -0,0 +1,346 @@
+/**
+ * Surgical text-splice editor for `access.md` frontmatter and node-frontmatter
+ * access verbs.
+ *
+ * WHY a splice and not parse→model→emit: the resolver's parser
+ * (`parseYamlSubset` / `extractFrontmatter` / `stripComment`) deliberately
+ * throws away comments, blank lines, key order, AND the markdown body below the
+ * closing `---`. Re-serialising from the parsed model would silently DELETE the
+ * prose bodies the real `access.md` files carry (the repo-root one is a whole
+ * README) — and a `parse(emit(x))` round-trip test would PASS anyway because
+ * parse ignores the body. So every mutation here edits the RAW text: we locate
+ * the verb's block, splice exactly one list line in or out, and leave every
+ * other byte — comments, ordering, blank lines, the body — untouched.
+ *
+ *   ---
+ *   write:                 (verb key line, indent 0)
+ *     - Admin              (list item, indent 2)  <- splice point
+ *     - Felix <f@x.eu>     (list item)
+ *   # a comment            (preserved verbatim)
+ *   owner: []              (inline-empty list)
+ *   ---
+ *   # Body prose           (preserved verbatim)
+ *
+ * The same engine serves node-frontmatter, which additionally accepts a scalar
+ * form (`owner: Felix <f@x.eu>`). Adding a second principal to a scalar verb
+ * normalises it to the block-list form.
+ */
+import { parseAccessEntry, canonicalEmail, canonicalRoleName, } from './access-control.service.js';
+/** Thrown when the input can't be spliced safely (malformed frontmatter, etc.). */
+export class AccessSpliceError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'AccessSpliceError';
+    }
+}
+/** Control chars (NUL..US) — newlines, tabs, etc. Never allowed in a principal. */
+// eslint-disable-next-line no-control-regex -- intentional control-char injection guard
+const CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
+/**
+ * Render a principal as the canonical access-entry line value the parser reads
+ * back (`Name <email>` or a bare role display name). The caller is responsible
+ * for having validated the principal first (see `validatePrincipal`).
+ *
+ * `deny` prefixes the entry with `deny ` so the resolver reads it as a denial
+ * (the `deny-here` per-item override) — same line shape, opposite verdict.
+ */
+export function renderEntry(p, deny = false) {
+    const body = p.kind === 'user' ? `${p.displayName} <${p.email}>` : p.role;
+    return deny ? `deny ${body}` : body;
+}
+/**
+ * Validate a principal before it is spliced into a file. Rejects anything that
+ * could break frontmatter or smuggle in extra YAML — newlines, control chars,
+ * and emails / names that don't match the resolver's own regexes. This is the
+ * injection guard: a principal that survives this is safe to render verbatim
+ * into a `  - ` list line.
+ *
+ * Returns the canonical principal (lowercased email / canonical role) on
+ * success, or throws `AccessSpliceError`.
+ */
+export function validatePrincipal(p) {
+    if (p.kind === 'user') {
+        const displayName = p.displayName.trim();
+        const email = canonicalEmail(p.email);
+        if (!displayName)
+            throw new AccessSpliceError('person grant needs a display name');
+        // `#` is rejected because `uncomment()` truncates a whitespace-preceded `#`
+        // on read-back, so a name containing it would not round-trip through blockEntries.
+        if (CONTROL_CHARS.test(displayName) ||
+            displayName.includes('<') ||
+            displayName.includes('>') ||
+            displayName.includes('#')) {
+            throw new AccessSpliceError(`invalid display name: ${JSON.stringify(p.displayName)}`);
+        }
+        // Reuse the resolver's own email shape so a granted entry always parses back.
+        if (!/^[^<>\s@]+@[^<>\s@]+\.[^<>\s@]+$/.test(email)) {
+            throw new AccessSpliceError(`invalid email: ${JSON.stringify(p.email)}`);
+        }
+        // The rendered `Name <email>` line must round-trip through parseAccessEntry.
+        const round = parseAccessEntry(`${displayName} <${email}>`);
+        if (!round.ok || round.entry.kind !== 'user' || round.entry.deny) {
+            throw new AccessSpliceError(`person grant does not round-trip: ${JSON.stringify(p)}`);
+        }
+        return { kind: 'user', email, displayName };
+    }
+    const role = p.role.trim();
+    const canonical = canonicalRoleName(role);
+    if (!canonical)
+        throw new AccessSpliceError('group grant needs a name');
+    if (CONTROL_CHARS.test(role) ||
+        role.includes('<') ||
+        role.includes('>') ||
+        role.includes(':') ||
+        role.includes('#')) {
+        throw new AccessSpliceError(`invalid group name: ${JSON.stringify(p.role)}`);
+    }
+    // `deny` is never a grantee — it's the denial prefix. `everyone` IS grantable
+    // (the built-in public role); the access route restricts it to the read verb.
+    if (canonical === 'deny') {
+        throw new AccessSpliceError(`'${role}' is a reserved name and cannot be granted as a group`);
+    }
+    const round = parseAccessEntry(role);
+    if (!round.ok || round.entry.kind !== 'role' || round.entry.deny) {
+        throw new AccessSpliceError(`group grant does not round-trip: ${JSON.stringify(p)}`);
+    }
+    return { kind: 'role', role };
+}
+/** True when a parsed entry names the given principal (ignoring deny prefix). */
+function entryMatches(entry, p) {
+    if (p.kind === 'user')
+        return entry.kind === 'user' && entry.email === canonicalEmail(p.email);
+    return entry.kind === 'role' && entry.role === canonicalRoleName(p.role);
+}
+/**
+ * Split a file into [pre, frontmatter-lines, post] without losing a byte.
+ * `hasFrontmatter` is false when the file has no `---` fence yet — callers that
+ * grant into a fresh file synthesise one.
+ */
+function splitFrontmatter(text) {
+    const eol = text.includes('\r\n') ? '\r\n' : '\n';
+    const lines = text.split(/\r?\n/);
+    // Opening fence must be the very first line.
+    if (lines[0]?.trim() !== '---') {
+        return { pre: [], fm: [], post: lines, eol, hasFrontmatter: false };
+    }
+    for (let i = 1; i < lines.length; i++) {
+        if (lines[i].trim() === '---') {
+            return {
+                pre: lines.slice(0, 1), // the opening ---
+                fm: lines.slice(1, i),
+                post: lines.slice(i), // closing --- onward (body preserved)
+                eol,
+                hasFrontmatter: true,
+            };
+        }
+    }
+    throw new AccessSpliceError('unterminated frontmatter — no closing `---`');
+}
+function joinFrontmatter(f) {
+    return [...f.pre, ...f.fm, ...f.post].join(f.eol);
+}
+/** Leading-space count of a line. */
+function indentOf(line) {
+    const m = line.match(/^( *)/);
+    return m ? m[1].length : 0;
+}
+/** Strip a trailing `# comment` the way the resolver's tokeniser does. */
+function uncomment(line) {
+    let inWs = true;
+    for (let i = 0; i < line.length; i++) {
+        const ch = line[i];
+        if (ch === '#' && (inWs || (i > 0 && /\s/.test(line[i - 1]))))
+            return line.slice(0, i);
+        if (!/\s/.test(ch))
+            inWs = false;
+    }
+    return line;
+}
+/**
+ * Locate a verb's block within the frontmatter lines. Walks the raw lines (not
+ * the parsed model) so we can address them for splicing. Recognises the three
+ * shapes the resolver accepts: a block list, an inline `verb: []`, and (node
+ * frontmatter only) an inline scalar `verb: value`.
+ */
+function findVerbBlock(fm, verb) {
+    const block = {
+        keyLine: -1,
+        keyIndent: 0,
+        itemLines: [],
+        itemIndent: -1,
+        inlineEmpty: false,
+        inlineScalarValue: null,
+    };
+    for (let i = 0; i < fm.length; i++) {
+        const content = uncomment(fm[i]);
+        if (!content.trim())
+            continue;
+        const indent = indentOf(content);
+        const body = content.slice(indent);
+        // A list item belonging to the current verb block.
+        if ((body.startsWith('- ') || body === '-') &&
+            block.keyLine !== -1 &&
+            indent > block.keyIndent) {
+            block.itemLines.push(i);
+            if (block.itemIndent === -1)
+                block.itemIndent = indent;
+            continue;
+        }
+        const colon = body.indexOf(':');
+        if (colon < 0)
+            continue; // not a key line; ignore (the parser would too)
+        const key = body.slice(0, colon).trim();
+        const value = body.slice(colon + 1).trim();
+        if (block.keyLine !== -1) {
+            // We already found our verb; a new key at <= our indent ends the block.
+            if (indent <= block.keyIndent)
+                break;
+            continue;
+        }
+        if (key === verb && indent === 0) {
+            block.keyLine = i;
+            block.keyIndent = indent;
+            if (value === '[]')
+                block.inlineEmpty = true;
+            else if (value !== '')
+                block.inlineScalarValue = value;
+        }
+    }
+    if (block.itemIndent === -1)
+        block.itemIndent = block.keyIndent + 2;
+    return block;
+}
+/**
+ * Parse the items currently under a verb block into ParsedEntry form, for
+ * matching. Handles list items and the inline-scalar form.
+ */
+function blockEntries(fm, block) {
+    const out = [];
+    if (block.inlineScalarValue !== null) {
+        const r = parseAccessEntry(block.inlineScalarValue);
+        if (r.ok)
+            out.push({ entry: r.entry, line: block.keyLine });
+        return out;
+    }
+    for (const li of block.itemLines) {
+        const content = uncomment(fm[li]).trim();
+        const value = content === '-' ? '' : content.slice(2).trim();
+        if (!value)
+            continue;
+        const r = parseAccessEntry(value);
+        if (r.ok)
+            out.push({ entry: r.entry, line: li });
+    }
+    return out;
+}
+// ---------------------------------------------------------------------------
+// Public splice operations
+// ---------------------------------------------------------------------------
+/**
+ * Add `principal` under `verb`. Idempotent: if an equivalent entry already
+ * exists with the SAME deny-ness (a grant when granting, a deny when denying),
+ * returns `changed: false`. Creates the verb key (and the frontmatter fence,
+ * for a fresh file) as needed. Preserves everything else byte-for-byte.
+ *
+ * `allowScalar` controls whether a fresh single-entry verb may be written in
+ * the node-frontmatter scalar form (`owner: Name <email>`). access.md always
+ * uses the block-list form; node frontmatter prefers scalar for a lone entry.
+ *
+ * `deny` writes the entry as a `deny <principal>` denial instead of a grant
+ * (the `deny-here` per-item override). The block/scalar/empty-list handling is
+ * identical — only the rendered line and the idempotency check differ — so the
+ * deny path reuses this engine rather than a parallel `spliceDeny`. NOTE: the
+ * resolver lets a same-scope grant override a same-scope deny of the same
+ * principal, so a caller adding a deny where a grant already exists must strip
+ * that grant first (see `AccessMutationService`); this function only writes the
+ * one entry it's asked to.
+ */
+export function spliceGrant(text, verb, rawPrincipal, opts = {}) {
+    const principal = validatePrincipal(rawPrincipal);
+    const deny = opts.deny ?? false;
+    const f = splitFrontmatter(text);
+    if (!f.hasFrontmatter) {
+        // Fresh file — synthesise a minimal frontmatter block, keep any body lines
+        // the caller passed (usually none for a new access.md).
+        const itemLine = opts.allowScalar
+            ? `${verb}: ${renderEntry(principal, deny)}`
+            : `${verb}:${f.eol}  - ${renderEntry(principal, deny)}`;
+        const fenced = ['---', itemLine, '---'].join(f.eol);
+        const bodyText = f.post.length ? f.post.join(f.eol) : '';
+        const text2 = bodyText ? `${fenced}${f.eol}${bodyText}` : `${fenced}${f.eol}`;
+        return { text: text2, changed: true };
+    }
+    const block = findVerbBlock(f.fm, verb);
+    const existing = blockEntries(f.fm, block);
+    // Idempotency: an entry for this principal with the same deny-ness is already
+    // present (a grant when granting, a deny when denying).
+    if (existing.some((e) => entryMatches(e.entry, principal) && e.entry.deny === deny)) {
+        return { text, changed: false };
+    }
+    const itemValue = renderEntry(principal, deny);
+    if (block.keyLine === -1) {
+        // Verb key absent — append a new block at the end of the frontmatter.
+        const lines = opts.allowScalar ? [`${verb}: ${itemValue}`] : [`${verb}:`, `  - ${itemValue}`];
+        f.fm.push(...lines);
+        return { text: joinFrontmatter(f), changed: true };
+    }
+    if (block.inlineScalarValue !== null) {
+        // Scalar form — promote to a block list with both the old and new entry.
+        const old = block.inlineScalarValue;
+        f.fm.splice(block.keyLine, 1, `${verb}:`, `  - ${old}`, `  - ${itemValue}`);
+        return { text: joinFrontmatter(f), changed: true };
+    }
+    // Block-list (possibly inline `[]`). Insert after the last existing item, or
+    // right after the key line when the list is currently empty.
+    const indent = ' '.repeat(block.itemIndent);
+    const newLine = `${indent}- ${itemValue}`;
+    if (block.inlineEmpty) {
+        // `verb: []` -> `verb:` + one item.
+        f.fm[block.keyLine] = `${' '.repeat(block.keyIndent)}${verb}:`;
+        f.fm.splice(block.keyLine + 1, 0, newLine);
+        return { text: joinFrontmatter(f), changed: true };
+    }
+    const insertAt = block.itemLines.length > 0 ? block.itemLines[block.itemLines.length - 1] + 1 : block.keyLine + 1;
+    f.fm.splice(insertAt, 0, newLine);
+    return { text: joinFrontmatter(f), changed: true };
+}
+/**
+ * Remove every entry naming `principal` under `verb` (grant or deny). Idempotent:
+ * returns `changed: false` when the principal isn't present. If removing the
+ * last item empties the verb, the `verb:` key is collapsed to `verb: []` so the
+ * file still parses cleanly (the resolver reads `[]` as an empty list).
+ * Preserves everything else.
+ */
+export function spliceRevoke(text, verb, rawPrincipal) {
+    const principal = validatePrincipal(rawPrincipal);
+    const f = splitFrontmatter(text);
+    if (!f.hasFrontmatter)
+        return { text, changed: false };
+    const block = findVerbBlock(f.fm, verb);
+    if (block.keyLine === -1)
+        return { text, changed: false };
+    if (block.inlineScalarValue !== null) {
+        const r = parseAccessEntry(block.inlineScalarValue);
+        if (r.ok && entryMatches(r.entry, principal)) {
+            // Lone scalar entry removed -> collapse to empty list.
+            f.fm[block.keyLine] = `${' '.repeat(block.keyIndent)}${verb}: []`;
+            return { text: joinFrontmatter(f), changed: true };
+        }
+        return { text, changed: false };
+    }
+    const entries = blockEntries(f.fm, block);
+    const victims = entries.filter((e) => entryMatches(e.entry, principal)).map((e) => e.line);
+    if (victims.length === 0)
+        return { text, changed: false };
+    // Delete from the bottom up so earlier indices stay valid.
+    const remaining = block.itemLines.filter((l) => !victims.includes(l));
+    for (const line of [...victims].sort((a, b) => b - a))
+        f.fm.splice(line, 1);
+    if (remaining.length === 0) {
+        // Verb block is now empty — collapse `verb:` to `verb: []`. The key line
+        // index is unchanged because we only removed lines that came after it.
+        f.fm[block.keyLine] = `${' '.repeat(block.keyIndent)}${verb}: []`;
+    }
+    return { text: joinFrontmatter(f), changed: true };
+}
+//# sourceMappingURL=access-splice.js.map

package/dist/modules/access/access-splice.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-splice.js","sourceRoot":"","sources":["../../../src/modules/access/access-splice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAGL,gBAAgB,EAChB,cAAc,EACd,iBAAiB,GAClB,MAAM,6BAA6B,CAAC;AAarC,mFAAmF;AACnF,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,mFAAmF;AACnF,wFAAwF;AACxF,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,CAAY,EAAE,IAAI,GAAG,KAAK;IACpD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAY;IAC5C,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,iBAAiB,CAAC,mCAAmC,CAAC,CAAC;QACnF,4EAA4E;QAC5E,mFAAmF;QACnF,IACE,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC;YAC/B,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;YACzB,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;YACzB,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EACzB,CAAC;YACD,MAAM,IAAI,iBAAiB,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,8EAA8E;QAC9E,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,6EAA6E;QAC7E,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,WAAW,KAAK,KAAK,GAAG,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACjE,MAAM,IAAI,iBAAiB,CAAC,qCAAqC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;IACxE,IACE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAClB,CAAC;QACD,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,8EAA8E;IAC9E,8EAA8E;IAC9E,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,iBAAiB,CAAC,IAAI,IAAI,uDAAuD,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACjE,MAAM,IAAI,iBAAiB,CAAC,oCAAoC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,iFAAiF;AACjF,SAAS,YAAY,CAAC,KAAkB,EAAE,CAAY;IACpD,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC/F,OAAO,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAC3E,CAAC;AAiBD;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,6CAA6C;IAC7C,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IACtE,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;YAC9B,OAAO;gBACL,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB;gBAC1C,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBACrB,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,sCAAsC;gBAC5D,GAAG;gBACH,cAAc,EAAE,IAAI;aACrB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,iBAAiB,CAAC,6CAA6C,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,eAAe,CAAC,CAAc;IACrC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACpD,CAAC;AAED,qCAAqC;AACrC,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9B,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,0EAA0E;AAC1E,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,IAAI,GAAG,KAAK,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAiBD;;;;;GAKG;AACH,SAAS,aAAa,CAAC,EAAY,EAAE,IAAU;IAC7C,MAAM,KAAK,GAAc;QACvB,OAAO,EAAE,CAAC,CAAC;QACX,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,CAAC,CAAC;QACd,WAAW,EAAE,KAAK;QAClB,iBAAiB,EAAE,IAAI;KACxB,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;YAAE,SAAS;QAC9B,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnC,mDAAmD;QACnD,IACE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC;YACvC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;YACpB,MAAM,GAAG,KAAK,CAAC,SAAS,EACxB,CAAC;YACD,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC,CAAC;gBAAE,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC;YACvD,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC;YAAE,SAAS,CAAC,gDAAgD;QACzE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;YACzB,wEAAwE;YACxE,IAAI,MAAM,IAAI,KAAK,CAAC,SAAS;gBAAE,MAAM;YACrC,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;YAClB,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC;YACzB,IAAI,KAAK,KAAK,IAAI;gBAAE,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;iBACxC,IAAI,KAAK,KAAK,EAAE;gBAAE,KAAK,CAAC,iBAAiB,GAAG,KAAK,CAAC;QACzD,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC,CAAC;QAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,EAAY,EAAE,KAAgB;IAClD,MAAM,GAAG,GAA2C,EAAE,CAAC;IACvD,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACpD,IAAI,CAAC,CAAC,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,OAAO,GAAG,CAAC;IACb,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,WAAW,CACzB,IAAY,EACZ,IAAU,EACV,YAAuB,EACvB,OAAkD,EAAE;IAEpD,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC;IAChC,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAEjC,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;QACtB,2EAA2E;QAC3E,wDAAwD;QACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW;YAC/B,CAAC,CAAC,GAAG,IAAI,KAAK,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE;YAC5C,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,OAAO,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC9E,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAE3C,8EAA8E;IAC9E,wDAAwD;IACxD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACpF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAE/C,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;QACzB,sEAAsE;QACtE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,SAAS,EAAE,CAAC,CAAC;QAC9F,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QACpB,OAAO,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACrC,yEAAyE;QACzE,MAAM,GAAG,GAAG,KAAK,CAAC,iBAAiB,CAAC;QACpC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,IAAI,GAAG,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,SAAS,EAAE,CAAC,CAAC;QAC5E,OAAO,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACrD,CAAC;IAED,6EAA6E;IAC7E,6DAA6D;IAC7D,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,MAAM,KAAK,SAAS,EAAE,CAAC;IAC1C,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,oCAAoC;QACpC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,GAAG,CAAC;QAC/D,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QAC3C,OAAO,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,QAAQ,GACZ,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;IACnG,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IAClC,OAAO,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,IAAU,EAAE,YAAuB;IAC5E,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC,CAAC,cAAc;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAEvD,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE1D,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACpD,IAAI,CAAC,CAAC,EAAE,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;YAC7C,uDAAuD;YACvD,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,MAAM,CAAC;YAClE,OAAO,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACrD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE1D,2DAA2D;IAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAE5E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,yEAAyE;QACzE,uEAAuE;QACvE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,MAAM,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACrD,CAAC"}

package/dist/modules/access/access.routes.d.ts

@@ -0,0 +1,10 @@
+import express from 'express';
+import type { IAccessControl } from './access-control.interface.js';
+import type { WorkspaceService } from '../workspace/workspace.service.js';
+import type { AuthService } from '../auth/auth.service.js';
+import type { WorkflowService } from '../workflow/workflow.service.js';
+import type { WorkflowEventBus } from '../workflow/event-bus.js';
+import type { Database } from '../database/connection.js';
+import '../auth/auth.middleware.js';
+export declare function createAccessRoutes(accessControl: IAccessControl, workspaceService: WorkspaceService, authService: AuthService, workflowService: WorkflowService, eventBus: WorkflowEventBus, db: Database, kbDirName: string): express.Router;
+//# sourceMappingURL=access.routes.d.ts.map

package/dist/modules/access/access.routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/access/access.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAE1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAYjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAE1D,OAAO,4BAA4B,CAAC;AA4BpC,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,cAAc,EAC7B,gBAAgB,EAAE,gBAAgB,EAClC,WAAW,EAAE,WAAW,EACxB,eAAe,EAAE,eAAe,EAChC,QAAQ,EAAE,gBAAgB,EAC1B,EAAE,EAAE,QAAQ,EACZ,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CA6yBhB"}