@burdenoff/be-sdk 2026.510.79

package/dist/chunk-J26YGR2U.js

@@ -0,0 +1,1484 @@
+import { ValidationError, PermissionDeniedError } from './chunk-SAG6ZYWQ.js';
+import { DEFAULT_GATEWAY_ROUTING } from './chunk-NGMEI42S.js';
+import { logger } from './chunk-CBZNP6RF.js';
+import { __name } from './chunk-XE4OXN2W.js';
+import { GraphQLError } from 'graphql';
+import { GraphQLClient } from 'graphql-request';
+
+var LRUCache = class LRUCache2 {
+  static {
+    __name(this, "LRUCache");
+  }
+  cache = /* @__PURE__ */ new Map();
+  maxSize;
+  ttl;
+  constructor(maxSize, ttl) {
+    this.maxSize = maxSize;
+    this.ttl = ttl;
+  }
+  get(key) {
+    const entry = this.cache.get(key);
+    if (!entry) return void 0;
+    if (Date.now() > entry.expiry) {
+      this.cache.delete(key);
+      return void 0;
+    }
+    this.cache.delete(key);
+    this.cache.set(key, entry);
+    return entry.value;
+  }
+  set(key, value) {
+    if (this.cache.size >= this.maxSize) {
+      const firstKey = this.cache.keys().next().value;
+      if (firstKey !== void 0) {
+        this.cache.delete(firstKey);
+      }
+    }
+    this.cache.set(key, {
+      value,
+      expiry: Date.now() + this.ttl
+    });
+  }
+  clear() {
+    this.cache.clear();
+  }
+  /**
+  * Invalidate all entries whose key starts with the given prefix.
+  * Used to evict all cached permissions for a specific actor.
+  */
+  invalidateByPrefix(prefix) {
+    let count = 0;
+    for (const key of [
+      ...this.cache.keys()
+    ]) {
+      if (typeof key === "string" && key.startsWith(prefix)) {
+        this.cache.delete(key);
+        count++;
+      }
+    }
+    return count;
+  }
+};
+var RBACClient = class RBACClient2 {
+  static {
+    __name(this, "RBACClient");
+  }
+  client;
+  cache;
+  config;
+  constructor(config) {
+    this.client = new GraphQLClient(config.rbacServiceUrl);
+    this.config = {
+      failClosed: config.failClosed !== false,
+      layer: config.layer || "wspace"
+    };
+    if (config.enableCaching !== false) {
+      this.cache = new LRUCache(
+        config.cacheMaxSize || 1e4,
+        config.cacheTTL || 6e4
+        // 1 minute
+      );
+    }
+  }
+  /**
+  * Parse permission string into resourceType and action
+  * @example "project:read" => { resourceType: "project", action: "read" }
+  * @example "rbac:role:create" => { resourceType: "rbac", action: "role:create" }
+  */
+  parsePermission(permission) {
+    const colonIndex = permission.indexOf(":");
+    if (colonIndex === -1) {
+      return {
+        resourceType: permission,
+        action: "read"
+      };
+    }
+    return {
+      resourceType: permission.substring(0, colonIndex),
+      action: permission.substring(colonIndex + 1)
+    };
+  }
+  /**
+  * Check if actor has permission using the new PBAC checkPermission query
+  */
+  async checkPermission(actorId, actorType, scopeId, permission, resourceId) {
+    const { resourceType, action } = this.parsePermission(permission);
+    const cacheKey = `${actorId}:${actorType}:${scopeId}:${resourceType}:${action}:${resourceId || ""}`;
+    if (this.cache) {
+      const cached = this.cache.get(cacheKey);
+      if (cached !== void 0) {
+        logger.debug("[RBAC Directive] Cache hit", {
+          actorId,
+          actorType,
+          scopeId,
+          resourceType,
+          action,
+          resourceId,
+          hasPermission: cached
+        });
+        return {
+          hasPermission: cached,
+          reason: cached ? "Cached: Permission granted" : "Cached: Permission denied"
+        };
+      }
+    }
+    const CHECK_PERMISSION_QUERY = `
+      query CheckPermission($input: PermissionCheckInput!) {
+        checkPermission(input: $input) {
+          allowed
+          decisionPath
+          roleName
+          roleLevel
+          overrideType
+        }
+      }
+    `;
+    const input = {
+      actorId,
+      actorType,
+      scopeId,
+      resourceType,
+      action,
+      resourceId
+    };
+    try {
+      logger.debug("[RBAC Directive] Checking permission via RBAC service (PBAC)", {
+        input,
+        layer: this.config.layer
+      });
+      const result = await this.client.request(CHECK_PERMISSION_QUERY, {
+        input
+      });
+      const hasPermission = result.checkPermission.allowed;
+      const decisionPath = result.checkPermission.decisionPath;
+      if (this.cache) {
+        this.cache.set(cacheKey, hasPermission);
+      }
+      logger.debug("[RBAC Directive] Permission check result", {
+        actorId,
+        resourceType,
+        action,
+        hasPermission,
+        decisionPath
+      });
+      return {
+        hasPermission,
+        reason: decisionPath
+      };
+    } catch (error) {
+      logger.error("[RBAC Directive] RBAC service error", {
+        error,
+        input,
+        layer: this.config.layer
+      });
+      if (this.config.failClosed) {
+        return {
+          hasPermission: false,
+          reason: "RBAC service unavailable - access denied (fail-closed)"
+        };
+      } else {
+        logger.warn("[RBAC Directive] Fail-open mode: allowing access despite RBAC error");
+        return {
+          hasPermission: true,
+          reason: "RBAC service unavailable - access allowed (fail-open)"
+        };
+      }
+    }
+  }
+  /**
+  * Clear permission cache (useful for testing or when permissions change)
+  */
+  clearCache() {
+    this.cache?.clear();
+  }
+  /**
+  * Invalidate cached permissions for a specific actor.
+  * Call this when an actor's roles or permissions change to avoid stale cache hits.
+  *
+  * @param actorId - The actor whose cached permissions should be evicted
+  * @returns Number of cache entries invalidated
+  */
+  invalidateForActor(actorId) {
+    if (!this.cache) return 0;
+    const count = this.cache.invalidateByPrefix(`${actorId}:`);
+    if (count > 0) {
+      logger.info("[RBAC Directive] Invalidated cached permissions for actor", {
+        actorId,
+        entriesRemoved: count
+      });
+    }
+    return count;
+  }
+  /**
+  * Get the configured layer
+  */
+  getLayer() {
+    return this.config.layer;
+  }
+};
+function getValueAtPath(obj, path) {
+  const parts = path.split(".");
+  let current = obj;
+  for (const part of parts) {
+    if (current === null || current === void 0) {
+      return void 0;
+    }
+    if (typeof current !== "object") {
+      return void 0;
+    }
+    current = current[part];
+  }
+  return typeof current === "string" ? current : void 0;
+}
+__name(getValueAtPath, "getValueAtPath");
+function getDirectiveArgument(directive, name) {
+  const arg = directive.arguments?.find((a) => a.name.value === name);
+  if (arg && arg.value.kind === "StringValue") {
+    return arg.value.value;
+  }
+  return void 0;
+}
+__name(getDirectiveArgument, "getDirectiveArgument");
+function parseFieldArguments(field, variableValues) {
+  const args = {};
+  for (const arg of field.arguments || []) {
+    const argName = arg.name.value;
+    const argValue = arg.value;
+    if (argValue.kind === "Variable") {
+      args[argName] = variableValues[argValue.name.value];
+    } else if (argValue.kind === "ObjectValue") {
+      args[argName] = parseObjectValue(argValue, variableValues);
+    } else if ("value" in argValue) {
+      args[argName] = argValue.value;
+    }
+  }
+  return args;
+}
+__name(parseFieldArguments, "parseFieldArguments");
+function parseObjectValue(obj, variableValues) {
+  const result = {};
+  for (const field of obj.fields || []) {
+    const fieldName = field.name.value;
+    const fieldValue = field.value;
+    if (fieldValue.kind === "Variable") {
+      result[fieldName] = variableValues[fieldValue.name.value];
+    } else if (fieldValue.kind === "ObjectValue") {
+      result[fieldName] = parseObjectValue(fieldValue, variableValues);
+    } else if ("value" in fieldValue) {
+      result[fieldName] = fieldValue.value;
+    }
+  }
+  return result;
+}
+__name(parseObjectValue, "parseObjectValue");
+function toActorId(userId) {
+  return userId;
+}
+__name(toActorId, "toActorId");
+function sanitizeHeadersForLogging(headers) {
+  const sanitized = {};
+  for (const [key, value] of Object.entries(headers)) {
+    const lowerKey = key.toLowerCase();
+    if (lowerKey.includes("auth") || lowerKey.includes("token") || lowerKey.includes("password") || lowerKey.includes("secret") || lowerKey.includes("key") || lowerKey.includes("credential")) {
+      sanitized[key] = "***REDACTED***";
+    } else {
+      sanitized[key] = value;
+    }
+  }
+  return sanitized;
+}
+__name(sanitizeHeadersForLogging, "sanitizeHeadersForLogging");
+function getHeader(context, key) {
+  if (context.request?.headers) {
+    if (typeof context.request.headers.get === "function") {
+      const value2 = context.request.headers.get(key);
+      if (value2) return value2;
+    }
+    const requestHeaders = context.request.headers;
+    const value = requestHeaders[key];
+    if (value) return value;
+  }
+  if (context.headers) {
+    const contextHeaders = context.headers;
+    const value = contextHeaders[key];
+    if (value) return value;
+  }
+  return void 0;
+}
+__name(getHeader, "getHeader");
+function validateBypassTimestamp(timestamp) {
+  try {
+    const timestampMs = parseInt(timestamp, 10);
+    if (isNaN(timestampMs)) {
+      return false;
+    }
+    const now = Date.now();
+    const age = now - timestampMs;
+    const MAX_AGE = 60 * 1e3;
+    if (age > MAX_AGE || age < 0) {
+      logger.warn("[RBAC Directive] Stale bypass timestamp", {
+        age,
+        timestamp: timestampMs,
+        now
+      });
+      return false;
+    }
+    return true;
+  } catch (error) {
+    const errorMessage = error instanceof Error ? error.message : "Unknown error";
+    logger.warn("[RBAC Directive] Invalid bypass timestamp format", {
+      timestamp,
+      error: errorMessage
+    });
+    return false;
+  }
+}
+__name(validateBypassTimestamp, "validateBypassTimestamp");
+function checkBypassHeaders(context) {
+  const actorType = getHeader(context, "x-actor-type");
+  const actorId = getHeader(context, "x-actor-id");
+  if (actorType === "service" || actorType === "super_admin") {
+    logger.debug("[RBAC Directive] Actor type bypass - service/super_admin", {
+      actorType,
+      actorId
+    });
+    return {
+      shouldBypass: true
+    };
+  }
+  logger.debug("[RBAC Directive] Checking bypass headers - context structure", {
+    hasRequest: !!context.request,
+    hasRequestHeaders: !!context.request?.headers,
+    hasContextHeaders: !!context.headers,
+    requestHeadersType: context.request?.headers ? typeof context.request.headers : "undefined",
+    contextHeadersType: context.headers ? typeof context.headers : "undefined",
+    actorType,
+    actorId
+  });
+  const allHeaders = {};
+  if (context.request?.headers) {
+    if (typeof context.request.headers.get === "function") {
+      logger.debug("[RBAC Directive] Headers object has get method");
+    } else {
+      const headers = context.request.headers;
+      Object.keys(headers).forEach((key) => {
+        const value = headers[key];
+        if (value) allHeaders[key] = value;
+      });
+      const sanitizedHeaders = sanitizeHeadersForLogging(allHeaders);
+      logger.debug("[RBAC Directive] Request headers (plain object)", {
+        headers: sanitizedHeaders
+      });
+    }
+  }
+  if (context.headers) {
+    const headers = context.headers;
+    const contextHeadersObj = {};
+    Object.keys(headers).forEach((key) => {
+      const value = headers[key];
+      if (value) contextHeadersObj[key] = value;
+    });
+    const sanitizedHeaders = sanitizeHeadersForLogging(contextHeadersObj);
+    logger.debug("[RBAC Directive] Context headers", {
+      headers: sanitizedHeaders
+    });
+  }
+  const bypassHeader = getHeader(context, "x-rbac-bypass");
+  const bypassSource = getHeader(context, "x-bypass-source");
+  const bypassTimestamp = getHeader(context, "x-bypass-timestamp");
+  logger.debug("[RBAC Directive] Extracted bypass headers", {
+    bypassHeader,
+    bypassSource,
+    bypassTimestamp
+  });
+  const bypassAttempted = !!(bypassHeader || bypassSource || bypassTimestamp);
+  if (!bypassHeader || !bypassSource || !bypassTimestamp) {
+    logger.debug("[RBAC Directive] Missing bypass headers - bypass NOT granted", {
+      hasRbacBypass: !!bypassHeader,
+      hasBypassSource: !!bypassSource,
+      hasBypassTimestamp: !!bypassTimestamp
+    });
+    if (bypassAttempted) {
+      return {
+        shouldBypass: false,
+        bypassContext: {
+          bypassAttempted: true,
+          bypassSource,
+          bypassTimestamp,
+          bypassFailureReason: "Missing required bypass headers"
+        }
+      };
+    }
+    return {
+      shouldBypass: false
+    };
+  }
+  if (bypassHeader !== "true") {
+    logger.warn("[RBAC Directive] Invalid bypass header value", {
+      value: bypassHeader
+    });
+    return {
+      shouldBypass: false,
+      bypassContext: {
+        bypassAttempted: true,
+        bypassSource,
+        bypassTimestamp,
+        bypassFailureReason: `Invalid bypass header value: ${bypassHeader}`
+      }
+    };
+  }
+  if (!validateBypassTimestamp(bypassTimestamp)) {
+    logger.warn("[RBAC Directive] Bypass rejected: stale timestamp", {
+      source: bypassSource,
+      timestamp: bypassTimestamp
+    });
+    return {
+      shouldBypass: false,
+      bypassContext: {
+        bypassAttempted: true,
+        bypassSource,
+        bypassTimestamp,
+        bypassFailureReason: "Stale or invalid timestamp (replay attack prevention)"
+      }
+    };
+  }
+  logger.debug("[RBAC Directive] Valid bypass headers detected", {
+    source: bypassSource,
+    timestamp: bypassTimestamp
+  });
+  return {
+    shouldBypass: true
+  };
+}
+__name(checkBypassHeaders, "checkBypassHeaders");
+function verifyAuthentication(contextValue, fieldName, permission) {
+  const ctx = contextValue;
+  const user = ctx.user ?? (ctx.actor?.id ? {
+    id: ctx.actor.id,
+    email: ctx.actor.email,
+    workspace_id: ctx.workspace?.id
+  } : ctx.actorId ? {
+    id: ctx.actorId,
+    workspace_id: ctx.workspace?.id
+  } : void 0);
+  logger.debug("[RBAC Directive] Checking authentication", {
+    hasUser: !!user,
+    userId: user?.id,
+    fieldName
+  });
+  if (!user?.id) {
+    logger.warn("[RBAC Directive] Authentication required but user not found", {
+      fieldName,
+      permission
+    });
+    throw new GraphQLError("Authentication required", {
+      extensions: {
+        code: "UNAUTHENTICATED",
+        field: fieldName,
+        permission
+      }
+    });
+  }
+  return user;
+}
+__name(verifyAuthentication, "verifyAuthentication");
+async function resolveResourceId(resourceIdField, selection, variableValues, config, _rbacClient, _ctx, permission, fieldName) {
+  let resourceId;
+  const fieldArgs = parseFieldArguments(selection, variableValues || {});
+  if (resourceIdField) {
+    resourceId = getValueAtPath(fieldArgs, resourceIdField);
+    if (!resourceId) {
+      logger.error("[RBAC Directive] Resource ID not found at specified path", {
+        resourceIdField,
+        fieldName,
+        permission,
+        availableArgs: Object.keys(fieldArgs)
+      });
+      throw new GraphQLError(`Resource ID not found at specified path "${resourceIdField}" for permission "${permission}"`, {
+        extensions: {
+          code: "INVALID_RESOURCE_CONFIGURATION",
+          field: fieldName,
+          permission,
+          resourceIdField,
+          hint: `Check that the field path "${resourceIdField}" exists in your arguments`
+        }
+      });
+    }
+    logger.debug("[RBAC Directive] Using explicit resourceIdField", {
+      resourceIdField,
+      resourceId,
+      fieldName
+    });
+  } else {
+    const defaultPaths = [
+      "id",
+      "input.id"
+    ];
+    for (const path of defaultPaths) {
+      resourceId = getValueAtPath(fieldArgs, path);
+      if (resourceId) {
+        logger.debug("[RBAC Directive] Auto-resolved resource ID from convention", {
+          path,
+          resourceId,
+          fieldName,
+          permission
+        });
+        break;
+      }
+    }
+    if (!resourceId) {
+      const contextWorkspaceId = _ctx.workspace?.id;
+      if (contextWorkspaceId) {
+        resourceId = contextWorkspaceId;
+        logger.debug("[RBAC Directive] Using workspace ID from context headers", {
+          resourceId,
+          fieldName,
+          permission
+        });
+      } else {
+        logger.error("[RBAC Directive] No resource ID available for permission check", {
+          permission,
+          fieldName,
+          triedPaths: defaultPaths,
+          availableArgs: Object.keys(fieldArgs)
+        });
+        throw new GraphQLError(`Cannot check permission "${permission}": No resource ID available. Tried default paths: ${defaultPaths.join(", ")}. Either provide one of these fields in your arguments, specify resourceIdField in the directive, or pass x-workspace-id header.`, {
+          extensions: {
+            code: "INVALID_RESOURCE_CONFIGURATION",
+            field: fieldName,
+            permission,
+            triedPaths: defaultPaths,
+            hint: 'Add resourceIdField parameter to @requiresPermission directive (e.g., resourceIdField: "input.workspaceId") or pass x-workspace-id header'
+          }
+        });
+      }
+    }
+  }
+  if (resourceId && config.resourceResolver) {
+    const resolved = await config.resourceResolver(resourceId, permission.split(":")[0]);
+    if (!resolved) {
+      logger.warn("[RBAC Directive] Custom resource resolver returned null", {
+        originalResourceId: resourceId,
+        permission,
+        fieldName
+      });
+      throw new GraphQLError("Resource not found or invalid", {
+        extensions: {
+          code: "FORBIDDEN",
+          field: fieldName,
+          permission,
+          resourceId,
+          hint: "Resource resolver could not resolve the resource ID"
+        }
+      });
+    }
+    logger.debug("[RBAC Directive] Custom resource resolver applied", {
+      originalResourceId: resourceId,
+      resolvedResourceId: resolved,
+      fieldName
+    });
+    return resolved;
+  }
+  return resourceId;
+}
+__name(resolveResourceId, "resolveResourceId");
+function extractScopeId(ctx, layer) {
+  if (layer === "wspace") {
+    const workspaceId = getHeader(ctx, "x-workspace-id") || ctx.workspace?.id;
+    if (!workspaceId) {
+      throw new GraphQLError("Workspace ID required for workspace-layer RBAC", {
+        extensions: {
+          code: "BAD_REQUEST",
+          hint: "Pass x-workspace-id header or ensure workspace context is set"
+        }
+      });
+    }
+    return workspaceId;
+  } else {
+    const tenantId = getHeader(ctx, "x-tenant-id") || ctx.tenant?.id || "global";
+    return tenantId;
+  }
+}
+__name(extractScopeId, "extractScopeId");
+function extractActorType(ctx) {
+  const actorTypeHeader = getHeader(ctx, "x-actor-type");
+  if (actorTypeHeader) {
+    const upperType = actorTypeHeader.toUpperCase();
+    if ([
+      "USER",
+      "BOT",
+      "INTEGRATION",
+      "DELEGATED_AGENT"
+    ].includes(upperType)) {
+      return upperType;
+    }
+  }
+  return "USER";
+}
+__name(extractActorType, "extractActorType");
+async function checkAndEnforcePermission(rbacClient, ctx, actorId, permission, resolvedResourceId, userId, fieldName, bypassContext) {
+  const layer = rbacClient.getLayer();
+  const actorType = extractActorType(ctx);
+  const scopeId = extractScopeId(ctx, layer);
+  logger.info("[RBAC Directive] Checking permission", {
+    userId,
+    actorId,
+    actorType,
+    scopeId,
+    permission,
+    resourceId: resolvedResourceId,
+    fieldName,
+    layer,
+    bypassAttempted: bypassContext?.bypassAttempted ?? false
+  });
+  const { hasPermission, reason } = await rbacClient.checkPermission(actorId, actorType, scopeId, permission, resolvedResourceId);
+  if (!hasPermission) {
+    logger.warn("[RBAC Directive] Permission denied", {
+      userId,
+      actorType,
+      scopeId,
+      permission,
+      reason,
+      fieldName,
+      bypassContext
+    });
+    const reasonSuffix = reason ? ` - ${reason}` : "";
+    const errorMessage = `Forbidden: Missing permission "${permission}"${reasonSuffix}`;
+    const extensions = {
+      code: "FORBIDDEN",
+      permission,
+      reason,
+      field: fieldName,
+      resourceId: resolvedResourceId,
+      scopeId,
+      layer
+    };
+    if (bypassContext?.bypassAttempted) {
+      extensions["bypassAttempted"] = true;
+      extensions["bypassSource"] = bypassContext.bypassSource;
+      extensions["bypassTimestamp"] = bypassContext.bypassTimestamp;
+      extensions["bypassFailureReason"] = bypassContext.bypassFailureReason;
+    }
+    throw new GraphQLError(errorMessage, {
+      extensions
+    });
+  }
+  logger.info("[RBAC Directive] Permission granted", {
+    userId,
+    permission,
+    fieldName,
+    reason
+  });
+}
+__name(checkAndEnforcePermission, "checkAndEnforcePermission");
+function createRBACDirective(config) {
+  const skipRbac = process.env["SKIP_RBAC"] === "true" || config.skipRbac === true;
+  if (skipRbac) {
+    const isProduction = process.env["NODE_ENV"] === "production";
+    if (isProduction) {
+      throw new Error("[RBAC Directive] FATAL: SKIP_RBAC cannot be enabled in production environments. This would bypass all authorization checks and is a critical security vulnerability. Remove SKIP_RBAC=true from your environment configuration.");
+    }
+    logger.warn("[RBAC Directive] \u26A0\uFE0F RBAC CHECKS ARE DISABLED (SKIP_RBAC=true) - DO NOT USE IN PRODUCTION!");
+    return {
+      async onExecute({ args }) {
+        const { document } = args;
+        const operation = document.definitions.find((def) => def.kind === "OperationDefinition");
+        const operationName = operation?.name?.value || "anonymous";
+        logger.warn("[RBAC Directive] RBAC check skipped for operation", {
+          operationName
+        });
+      }
+    };
+  }
+  const rbacClient = new RBACClient(config);
+  return {
+    // 🔒 CRITICAL: Use onExecute (not onExecuteDone) to block BEFORE execution
+    async onExecute({ args }) {
+      logger.debug("[RBAC Directive] onExecute called");
+      const { schema, document, contextValue, variableValues } = args;
+      const operation = document.definitions.find((def) => def.kind === "OperationDefinition");
+      if (!operation) {
+        logger.debug("[RBAC Directive] No operation definition found, skipping");
+        return;
+      }
+      const typeName = operation.operation === "mutation" ? "Mutation" : "Query";
+      const type = schema.getType(typeName);
+      if (!type || !("getFields" in type)) {
+        logger.debug(`[RBAC Directive] Type ${typeName} not found, skipping`);
+        return;
+      }
+      const fields = type.getFields();
+      for (const selection of operation.selectionSet.selections) {
+        if (selection.kind !== "Field") {
+          continue;
+        }
+        const fieldName = selection.name.value;
+        const fieldDef = fields[fieldName];
+        if (!fieldDef?.astNode) {
+          continue;
+        }
+        const directive = fieldDef.astNode.directives?.find((d) => d.name.value === "requiresPermission");
+        if (!directive) {
+          continue;
+        }
+        const permission = getDirectiveArgument(directive, "permission");
+        const resourceIdField = getDirectiveArgument(directive, "resourceIdField");
+        if (!permission) {
+          throw new GraphQLError("Invalid @requiresPermission directive: permission argument is required and must be a string", {
+            extensions: {
+              code: "INTERNAL_SERVER_ERROR",
+              field: fieldName
+            }
+          });
+        }
+        const ctx = contextValue;
+        const bypassCheckResult = checkBypassHeaders(ctx);
+        if (bypassCheckResult.shouldBypass) {
+          const bypassSource = getHeader(ctx, "x-bypass-source");
+          const bypassTimestamp = getHeader(ctx, "x-bypass-timestamp");
+          logger.info("[RBAC Directive] RBAC bypassed for internal service call", {
+            field: fieldName,
+            permission,
+            resource: resourceIdField,
+            bypassSource,
+            bypassTimestamp,
+            operationType: operation.operation
+          });
+          continue;
+        }
+        const user = verifyAuthentication(contextValue, fieldName, permission);
+        let resolvedResourceId;
+        try {
+          resolvedResourceId = await resolveResourceId(resourceIdField, selection, variableValues, config, rbacClient, ctx, permission, fieldName);
+        } catch (error) {
+          if (!resourceIdField) {
+            logger.debug("[RBAC Directive] No resource ID resolved, checking permission at scope level", {
+              fieldName,
+              permission
+            });
+          } else {
+            throw error;
+          }
+        }
+        const actorId = toActorId(user.id);
+        await checkAndEnforcePermission(rbacClient, ctx, actorId, permission, resolvedResourceId, user.id, fieldName, bypassCheckResult.bypassContext);
+      }
+    }
+  };
+}
+__name(createRBACDirective, "createRBACDirective");
+function buildRBACServiceUrl(layer) {
+  const routing = DEFAULT_GATEWAY_ROUTING[layer];
+  const gateway = layer === "wspace" ? routing.internalGateway : routing.crossLayerGateway;
+  return `http://${gateway.host}:${gateway.port}${gateway.graphqlPath}`;
+}
+__name(buildRBACServiceUrl, "buildRBACServiceUrl");
+function createRBACDirectiveForLayer(layer, config) {
+  const envPrefix = layer.toUpperCase();
+  const rbacServiceUrl = config?.rbacServiceUrl || process.env[`${envPrefix}_RBAC_GATEWAY_URL`] || process.env["RBAC_GATEWAY_URL"] || buildRBACServiceUrl(layer);
+  const rbacLayer = layer;
+  logger.info("[RBAC Directive] Creating layer-aware RBAC directive", {
+    layer: rbacLayer,
+    rbacServiceUrl,
+    enableCaching: config?.enableCaching ?? true
+  });
+  return createRBACDirective({
+    rbacServiceUrl,
+    layer: rbacLayer,
+    enableCaching: config?.enableCaching ?? true,
+    cacheTTL: config?.cacheTTL,
+    cacheMaxSize: config?.cacheMaxSize,
+    timeout: config?.timeout,
+    failClosed: config?.failClosed,
+    resourceResolver: config?.resourceResolver,
+    skipRbac: config?.skipRbac
+  });
+}
+__name(createRBACDirectiveForLayer, "createRBACDirectiveForLayer");
+function createRBACDirectiveFromEnv(serviceName, config) {
+  const layer = process.env["SERVICE_LAYER"] || (serviceName.startsWith("global-") ? "global" : "wspace");
+  return createRBACDirectiveForLayer(layer, config);
+}
+__name(createRBACDirectiveFromEnv, "createRBACDirectiveFromEnv");
+
+// src/rbac/index.ts
+var RBACModule = class {
+  static {
+    __name(this, "RBACModule");
+  }
+  client;
+  context;
+  constructor(client, context) {
+    this.client = client;
+    this.context = context;
+  }
+  /**
+  * Check if user has permission (returns boolean)
+  */
+  async checkPermission(options) {
+    try {
+      await this.requirePermission(options);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  /**
+  * Require permission (throws if denied)
+  */
+  async requirePermission(options) {
+    if (!options.userId) {
+      throw new ValidationError("User ID is required");
+    }
+    if (!options.action) {
+      throw new ValidationError("Action is required");
+    }
+    if (!options.resourceType) {
+      throw new ValidationError("Resource type is required");
+    }
+    logger.debug("[RBAC] Checking permission", options);
+    const query = `
+      query CheckPermission($input: PermissionCheckInput!) {
+        checkPermission(input: $input) {
+          allowed
+          decisionPath
+        }
+      }
+    `;
+    const variables = {
+      input: {
+        actorId: options.userId,
+        actorType: options.actorType || "USER",
+        scopeId: options.workspaceId || this.context.workspaceId || this.context.tenantId || "",
+        resourceType: options.resourceType,
+        action: options.action,
+        resourceId: options.resourceId
+      }
+    };
+    const response = options.workspaceId || this.context.workspaceId ? await this.client.query(query, variables, this.context) : await this.client.tenantQuery(query, variables, this.context);
+    if (!response.checkPermission.allowed) {
+      throw new PermissionDeniedError(`Permission denied: ${response.checkPermission.decisionPath}`, {
+        action: options.action,
+        resourceType: options.resourceType,
+        resourceId: options.resourceId,
+        userId: options.userId
+      });
+    }
+    logger.debug("[RBAC] Permission granted", {
+      ...options,
+      decisionPath: response.checkPermission.decisionPath
+    });
+  }
+  /**
+  * Get user roles in workspace
+  * Uses the new PBAC actorRoleAssignments query
+  */
+  async getUserRoles(userId, workspaceId) {
+    logger.debug("[RBAC] Getting user roles", {
+      userId,
+      workspaceId
+    });
+    const query = `
+      query GetActorRoleAssignments($actorId: String!, $scopeId: String!) {
+        actorRoleAssignments(actorId: $actorId, scopeId: $scopeId) {
+          id
+          role {
+            id
+            name
+            description
+            defaultPermissions {
+              resourceType
+              level
+            }
+          }
+        }
+      }
+    `;
+    const variables = {
+      actorId: userId,
+      scopeId: workspaceId
+    };
+    const contextWithWorkspace = {
+      ...this.context,
+      workspaceId
+    };
+    const response = await this.client.query(query, variables, contextWithWorkspace);
+    return response.actorRoleAssignments.map((assignment) => ({
+      id: assignment.role.id,
+      name: assignment.role.name,
+      description: assignment.role.description,
+      defaultPermissions: assignment.role.defaultPermissions
+    }));
+  }
+  /**
+  * Assign role to user
+  * Uses the new PBAC assignRoleToActor mutation
+  */
+  async assignRoleToUser(userId, roleId, workspaceId, actorType = "USER") {
+    logger.debug("[RBAC] Assigning role to user", {
+      userId,
+      roleId,
+      workspaceId,
+      actorType
+    });
+    const mutation = `
+      mutation AssignRoleToActor($input: AssignRoleInput!) {
+        assignRoleToActor(input: $input) {
+          id
+          actorId
+          roleId
+          scopeId
+        }
+      }
+    `;
+    const variables = {
+      input: {
+        actorId: userId,
+        actorType,
+        roleId,
+        scopeId: workspaceId
+      }
+    };
+    const contextWithWorkspace = {
+      ...this.context,
+      workspaceId
+    };
+    await this.client.query(mutation, variables, contextWithWorkspace);
+    logger.info("[RBAC] Role assigned to actor", {
+      userId,
+      roleId,
+      workspaceId
+    });
+    return true;
+  }
+  /**
+  * Remove role from user
+  * Uses the new PBAC removeRoleFromActor mutation
+  * Note: This first finds the assignment ID, then removes it
+  */
+  async removeRoleFromUser(userId, roleId, workspaceId) {
+    logger.debug("[RBAC] Removing role from user", {
+      userId,
+      roleId,
+      workspaceId
+    });
+    const contextWithWorkspace = {
+      ...this.context,
+      workspaceId
+    };
+    const findQuery = `
+      query FindAssignment($actorId: String!, $scopeId: String!) {
+        actorRoleAssignments(actorId: $actorId, scopeId: $scopeId) {
+          id
+          roleId
+        }
+      }
+    `;
+    const findResponse = await this.client.query(findQuery, {
+      actorId: userId,
+      scopeId: workspaceId
+    }, contextWithWorkspace);
+    const assignment = findResponse.actorRoleAssignments.find((a) => a.roleId === roleId);
+    if (!assignment) {
+      logger.warn("[RBAC] No role assignment found to remove", {
+        userId,
+        roleId,
+        workspaceId
+      });
+      return false;
+    }
+    const mutation = `
+      mutation RemoveRoleFromActor($assignmentId: ID!) {
+        removeRoleFromActor(assignmentId: $assignmentId)
+      }
+    `;
+    await this.client.query(mutation, {
+      assignmentId: assignment.id
+    }, contextWithWorkspace);
+    logger.info("[RBAC] Role removed from actor", {
+      userId,
+      roleId,
+      workspaceId,
+      assignmentId: assignment.id
+    });
+    return true;
+  }
+  /**
+  * Create custom role with default permissions
+  *
+  * Uses the new PBAC createRole mutation and setRoleDefaultPermission for permissions.
+  *
+  * @param name - Role name
+  * @param description - Role description
+  * @param defaultPermissions - Array of default permission configurations
+  *                            (e.g., [{ resourceType: 'project', level: 'ADMIN' }])
+  *                            OR legacy permission strings (converted to ADMIN level)
+  * @param workspaceId - Workspace ID (scopeId)
+  */
+  async createRole(name, description, defaultPermissions, workspaceId) {
+    logger.debug("[RBAC] Creating role", {
+      name,
+      workspaceId,
+      permissionCount: defaultPermissions.length
+    });
+    const contextWithWorkspace = {
+      ...this.context,
+      workspaceId
+    };
+    const createRoleMutation = `
+      mutation CreateRole($input: CreateRoleInput!) {
+        createRole(input: $input) {
+          id
+          name
+          description
+          defaultPermissions {
+            resourceType
+            level
+          }
+        }
+      }
+    `;
+    const createRoleVariables = {
+      input: {
+        name,
+        description,
+        scopeId: workspaceId,
+        scopeType: "workspace"
+      }
+    };
+    const createResponse = await this.client.query(createRoleMutation, createRoleVariables, contextWithWorkspace);
+    const roleId = createResponse.createRole.id;
+    logger.info("[RBAC] Role created", {
+      name,
+      roleId
+    });
+    if (defaultPermissions.length > 0) {
+      logger.debug("[RBAC] Setting default permissions for role", {
+        roleId,
+        count: defaultPermissions.length
+      });
+      const normalizedPermissions = defaultPermissions.map((perm) => {
+        if (typeof perm === "string") {
+          const resourceType = perm.split(":")[0] || perm;
+          return {
+            resourceType,
+            level: "ADMIN"
+          };
+        }
+        return perm;
+      });
+      const permMap = /* @__PURE__ */ new Map();
+      const levelPriority = {
+        ADMIN: 4,
+        EDITOR: 3,
+        VIEWER: 2,
+        NONE: 1
+      };
+      for (const perm of normalizedPermissions) {
+        const existing = permMap.get(perm.resourceType);
+        if (!existing || levelPriority[perm.level] > levelPriority[existing]) {
+          permMap.set(perm.resourceType, perm.level);
+        }
+      }
+      const setPermissionMutation = `
+        mutation SetRoleDefaultPermission($input: SetRoleDefaultPermissionInput!) {
+          setRoleDefaultPermission(input: $input) {
+            id
+            defaultPermissions {
+              resourceType
+              level
+            }
+          }
+        }
+      `;
+      const failedPermissions = [];
+      for (const [resourceType, level] of permMap) {
+        try {
+          await this.client.query(setPermissionMutation, {
+            input: {
+              roleId,
+              resourceType,
+              level
+            }
+          }, contextWithWorkspace);
+          logger.debug("[RBAC] Set default permission", {
+            roleId,
+            resourceType,
+            level
+          });
+        } catch (error) {
+          const errorMsg = error instanceof Error ? error.message : String(error);
+          logger.error("[RBAC] Failed to set default permission", {
+            roleId,
+            resourceType,
+            level,
+            error: errorMsg
+          });
+          failedPermissions.push({
+            resourceType,
+            level,
+            error: errorMsg
+          });
+        }
+      }
+      if (failedPermissions.length > 0) {
+        const failedTypes = failedPermissions.map((p) => p.resourceType).join(", ");
+        throw new ValidationError(`Role created but failed to set ${failedPermissions.length} default permission(s): ${failedTypes}. Role ID: ${roleId}. Check logs for details.`);
+      }
+      logger.info("[RBAC] Default permissions set for role", {
+        roleId,
+        count: permMap.size
+      });
+    }
+    const roleQuery = `
+      query GetRole($id: ID!) {
+        role(id: $id) {
+          id
+          name
+          description
+          defaultPermissions {
+            resourceType
+            level
+          }
+        }
+      }
+    `;
+    const roleResponse = await this.client.query(roleQuery, {
+      id: roleId
+    }, contextWithWorkspace);
+    const role = roleResponse.role || createResponse.createRole;
+    return {
+      id: role.id,
+      name: role.name,
+      description: role.description,
+      defaultPermissions: role.defaultPermissions
+    };
+  }
+  /**
+  * Get all available action definitions (replaces getAvailablePermissions)
+  * Returns actions organized by resource type
+  */
+  async getAvailablePermissions() {
+    logger.debug("[RBAC] Getting available action definitions");
+    const resourceTypesQuery = `
+      query GetResourceTypes {
+        resourceTypes
+      }
+    `;
+    const hasWorkspace = !!this.context.workspaceId;
+    const resourceTypesResponse = hasWorkspace ? await this.client.query(resourceTypesQuery, {}, this.context) : await this.client.tenantQuery(resourceTypesQuery, {}, this.context);
+    const permissions = [];
+    const actionsQuery = `
+      query GetActionDefinitions($resourceType: String!) {
+        actionDefinitions(resourceType: $resourceType) {
+          id
+          action
+          resourceType
+          description
+        }
+      }
+    `;
+    for (const resourceType of resourceTypesResponse.resourceTypes) {
+      const actionsResponse = hasWorkspace ? await this.client.query(actionsQuery, {
+        resourceType
+      }, this.context) : await this.client.tenantQuery(actionsQuery, {
+        resourceType
+      }, this.context);
+      for (const action of actionsResponse.actionDefinitions) {
+        permissions.push({
+          id: action.id,
+          action: action.action,
+          resourceType: action.resourceType,
+          description: action.description
+        });
+      }
+    }
+    return permissions;
+  }
+  /**
+  * Check multiple permissions at once
+  * Uses the new PBAC checkPermissions query
+  */
+  async checkMultiplePermissions(checks) {
+    logger.debug("[RBAC] Checking multiple permissions", {
+      count: checks.length
+    });
+    const query = `
+      query CheckPermissions($inputs: [PermissionCheckInput!]!) {
+        checkPermissions(inputs: $inputs) {
+          allowed
+          decisionPath
+        }
+      }
+    `;
+    const inputs = checks.map((check) => ({
+      actorId: check.userId,
+      actorType: check.actorType || "USER",
+      scopeId: check.workspaceId || this.context.workspaceId || this.context.tenantId || "",
+      resourceType: check.resourceType,
+      action: check.action,
+      resourceId: check.resourceId
+    }));
+    const hasWorkspace = checks.some((c) => c.workspaceId) || !!this.context.workspaceId;
+    const response = hasWorkspace ? await this.client.query(query, {
+      inputs
+    }, this.context) : await this.client.tenantQuery(query, {
+      inputs
+    }, this.context);
+    return response.checkPermissions.map((result) => ({
+      allowed: result.allowed,
+      reason: result.decisionPath
+    }));
+  }
+  /**
+  * Get effective permissions for a user in a workspace
+  * New method that uses the PBAC effectivePermissions query
+  */
+  async getEffectivePermissions(userId, workspaceId, actorType = "USER") {
+    logger.debug("[RBAC] Getting effective permissions", {
+      userId,
+      workspaceId,
+      actorType
+    });
+    const query = `
+      query EffectivePermissions($actorId: String!, $actorType: ActorType!, $scopeId: String!) {
+        effectivePermissions(actorId: $actorId, actorType: $actorType, scopeId: $scopeId) {
+          actorId
+          scopeId
+          permissions {
+            resourceType
+            level
+            allowedActions
+            source
+          }
+        }
+      }
+    `;
+    const variables = {
+      actorId: userId,
+      actorType,
+      scopeId: workspaceId
+    };
+    const contextWithWorkspace = {
+      ...this.context,
+      workspaceId
+    };
+    const response = await this.client.query(query, variables, contextWithWorkspace);
+    return response.effectivePermissions;
+  }
+  /**
+  * Initialize workspace roles by cloning system roles
+  * New method for workspace initialization
+  */
+  async initializeWorkspaceRoles(workspaceId, ownerId) {
+    logger.debug("[RBAC] Initializing workspace roles", {
+      workspaceId,
+      ownerId
+    });
+    const mutation = `
+      mutation InitializeWorkspaceRoles($workspaceId: String!, $ownerId: String!) {
+        initializeWorkspaceRoles(workspaceId: $workspaceId, ownerId: $ownerId) {
+          success
+          rolesCreated
+          roleNames
+          ownerAssigned
+          message
+        }
+      }
+    `;
+    const contextWithWorkspace = {
+      ...this.context,
+      workspaceId
+    };
+    const response = await this.client.query(mutation, {
+      workspaceId,
+      ownerId
+    }, contextWithWorkspace);
+    logger.info("[RBAC] Workspace roles initialized", response.initializeWorkspaceRoles);
+    return response.initializeWorkspaceRoles;
+  }
+  /**
+  * Update an existing role
+  * Uses the new PBAC updateRole mutation
+  *
+  * @param roleId - Role ID to update
+  * @param updates - Fields to update (name, description, priority)
+  * @param workspaceId - Workspace ID (scopeId)
+  */
+  async updateRole(roleId, updates, workspaceId) {
+    logger.debug("[RBAC] Updating role", {
+      roleId,
+      updates,
+      workspaceId
+    });
+    const contextWithWorkspace = {
+      ...this.context,
+      workspaceId
+    };
+    const mutation = `
+      mutation UpdateRole($id: ID!, $input: UpdateRoleInput!) {
+        updateRole(id: $id, input: $input) {
+          id
+          name
+          description
+          priority
+          defaultPermissions {
+            resourceType
+            level
+          }
+        }
+      }
+    `;
+    const response = await this.client.query(mutation, {
+      id: roleId,
+      input: updates
+    }, contextWithWorkspace);
+    logger.info("[RBAC] Role updated", {
+      roleId,
+      name: response.updateRole.name
+    });
+    return {
+      id: response.updateRole.id,
+      name: response.updateRole.name,
+      description: response.updateRole.description,
+      defaultPermissions: response.updateRole.defaultPermissions
+    };
+  }
+  /**
+  * Delete a role
+  * Uses the new PBAC deleteRole mutation
+  *
+  * @param roleId - Role ID to delete
+  * @param workspaceId - Workspace ID (scopeId)
+  * @param reassignToRoleId - Optional role ID to reassign existing actors to
+  */
+  async deleteRole(roleId, workspaceId, reassignToRoleId) {
+    logger.debug("[RBAC] Deleting role", {
+      roleId,
+      workspaceId,
+      reassignToRoleId
+    });
+    const contextWithWorkspace = {
+      ...this.context,
+      workspaceId
+    };
+    const mutation = `
+      mutation DeleteRole($id: ID!, $reassignToRoleId: ID) {
+        deleteRole(id: $id, reassignToRoleId: $reassignToRoleId)
+      }
+    `;
+    const response = await this.client.query(mutation, {
+      id: roleId,
+      reassignToRoleId
+    }, contextWithWorkspace);
+    logger.info("[RBAC] Role deleted", {
+      roleId,
+      success: response.deleteRole
+    });
+    return response.deleteRole;
+  }
+  /**
+  * List roles in a workspace
+  * Uses the new PBAC roles query
+  *
+  * @param workspaceId - Workspace ID (scopeId)
+  * @param options - Filter and pagination options
+  */
+  async listRoles(workspaceId, options) {
+    logger.debug("[RBAC] Listing roles", {
+      workspaceId,
+      options
+    });
+    const contextWithWorkspace = {
+      ...this.context,
+      workspaceId
+    };
+    const query = `
+      query ListRoles($scopeId: String!, $filter: RoleFilterInput, $pagination: PaginationInput) {
+        roles(scopeId: $scopeId, filter: $filter, pagination: $pagination) {
+          id
+          name
+          description
+          isSystem
+          priority
+          defaultPermissions {
+            resourceType
+            level
+          }
+        }
+      }
+    `;
+    const variables = {
+      scopeId: workspaceId,
+      filter: options?.includeSystem !== void 0 ? {
+        includeSystem: options.includeSystem
+      } : void 0,
+      pagination: {
+        limit: options?.limit ?? 50,
+        offset: options?.offset ?? 0
+      }
+    };
+    const response = await this.client.query(query, variables, contextWithWorkspace);
+    logger.debug("[RBAC] Roles listed", {
+      workspaceId,
+      count: response.roles.length
+    });
+    return response.roles.map((role) => ({
+      id: role.id,
+      name: role.name,
+      description: role.description,
+      defaultPermissions: role.defaultPermissions
+    }));
+  }
+  /**
+  * Get a specific role by ID
+  * Uses the new PBAC role query
+  *
+  * @param roleId - Role ID
+  * @param workspaceId - Workspace ID (scopeId)
+  */
+  async getRole(roleId, workspaceId) {
+    logger.debug("[RBAC] Getting role", {
+      roleId,
+      workspaceId
+    });
+    const contextWithWorkspace = {
+      ...this.context,
+      workspaceId
+    };
+    const query = `
+      query GetRole($id: ID!) {
+        role(id: $id) {
+          id
+          name
+          description
+          isSystem
+          priority
+          defaultPermissions {
+            resourceType
+            level
+          }
+        }
+      }
+    `;
+    const response = await this.client.query(query, {
+      id: roleId
+    }, contextWithWorkspace);
+    if (!response.role) {
+      logger.debug("[RBAC] Role not found", {
+        roleId
+      });
+      return null;
+    }
+    return {
+      id: response.role.id,
+      name: response.role.name,
+      description: response.role.description,
+      defaultPermissions: response.role.defaultPermissions
+    };
+  }
+};
+
+export { RBACClient, RBACModule, createRBACDirective, createRBACDirectiveForLayer, createRBACDirectiveFromEnv };
+//# sourceMappingURL=chunk-J26YGR2U.js.map
+//# sourceMappingURL=chunk-J26YGR2U.js.map